@join-pantheon/cli 0.21.0 → 0.21.2

package/README.md

@@ -70,7 +70,7 @@ default when run inside a git repo; `--no-worker` opts out — and a peer still
 ends with a "You're set" summary, then a short guided setup on a terminal: whether teammates may wake
 your machine while you are away, what a woken run may execute, who you are and which decisions are
 yours alone (so agents stop and ask you), and which alerts you want. Plain questions, mostly options;
-`pantheon setup` re-runs it any time. Restart your agent once and ask it *"check pantheon_status"*.
+`pantheon setup` re-runs it any time — and an agent setting you up can run `pantheon setup --questions`, ask you in chat, and pass your answers back as flags, so nobody has to open a terminal. Restart your agent once and ask it *"check pantheon_status"*.
 
 Already a member — new laptop, or just pulled a newer build? The same full setup is one command:
 `pantheon install --user` (from your project's repo).
@@ -499,8 +499,12 @@ Security details and how to report a vulnerability:
 ## Upgrading
 
 ```bash
-pantheon upgrade          # installs the latest release and re-wires your agents
+pantheon upgrade          # installs the latest release and finishes the job
 ```
 
-Every command prints its version and nudges you when a newer release exists. Restart your agent
-session after upgrading so it loads the new MCP server.
+Every command prints its version and nudges you when a newer release exists. `pantheon upgrade`
+installs the new release, re-wires your agents, restarts pantheon's own background services (the
+worker, alerts, menu bar) so they load the new code, and asks any setup question the new version
+has that you have never answered. The one thing it cannot do is restart your agent windows: quit
+and reopen them so they load the new server. A self-hosted relay is shared with your teammates, so
+it prints the restart for that and leaves the timing to you.

package/dist/accounts.js

@@ -123,6 +123,11 @@ export class Accounts {
             this.db.exec("ALTER TABLE accounts ADD COLUMN plan TEXT NOT NULL DEFAULT 'free'");
         if (!cols.has("limits_json"))
             this.db.exec("ALTER TABLE accounts ADD COLUMN limits_json TEXT");
+        const scols = new Set(this.db.prepare("PRAGMA table_info(sessions)").all().map((c) => c.name));
+        if (!scols.has("ended_at"))
+            this.db.exec("ALTER TABLE sessions ADD COLUMN ended_at INTEGER");
+        if (!scols.has("role"))
+            this.db.exec("ALTER TABLE sessions ADD COLUMN role TEXT");
     }
     close() { this.db.close(); }
     accountByUsername(username) {
@@ -249,18 +254,28 @@ export class Accounts {
         this.audit({ actor_account: accountId, event: "device_added", target: d.fingerprint });
         return d;
     }
-    openSession(accountId, deviceId, space, ip) {
-        const s = { id: newId("ses"), account_id: accountId, device_id: deviceId, space, ip, created_at: now(), last_seen: now(), revoked_at: null };
-        this.db.prepare("INSERT INTO sessions (id, account_id, device_id, space, ip, created_at, last_seen, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)")
-            .run(s.id, s.account_id, s.device_id, s.space, s.ip, s.created_at, s.last_seen);
-        this.audit({ actor_account: accountId, event: "session_created", space: space || null, target: s.id, ip });
+    openSession(accountId, deviceId, space, ip, role = null) {
+        const prior = this.db.prepare("SELECT ip FROM sessions WHERE device_id = ? ORDER BY created_at DESC LIMIT 1").get(deviceId);
+        const s = { id: newId("ses"), account_id: accountId, device_id: deviceId, space, ip, created_at: now(), last_seen: now(), revoked_at: null, ended_at: null, role };
+        this.db.prepare("INSERT INTO sessions (id, account_id, device_id, space, ip, created_at, last_seen, revoked_at, ended_at, role) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?)")
+            .run(s.id, s.account_id, s.device_id, s.space, s.ip, s.created_at, s.last_seen, role);
+        if (!prior)
+            this.audit({ actor_account: accountId, event: "session_created", space: space || null, target: s.id, ip });
+        else if (prior.ip !== ip)
+            this.audit({ actor_account: accountId, event: "device_new_ip", space: space || null, target: deviceId, detail: `${prior.ip} → ${ip}`, ip });
         return s;
     }
     touchSession(id) {
-        this.db.prepare("UPDATE sessions SET last_seen = ? WHERE id = ? AND revoked_at IS NULL").run(now(), id);
+        this.db.prepare("UPDATE sessions SET last_seen = ? WHERE id = ? AND revoked_at IS NULL AND ended_at IS NULL").run(now(), id);
+    }
+    endAllOpenSessions() {
+        return Number(this.db.prepare("UPDATE sessions SET ended_at = ?, last_seen = last_seen WHERE ended_at IS NULL").run(now()).changes);
+    }
+    endSession(id) {
+        this.db.prepare("UPDATE sessions SET ended_at = ?, last_seen = ? WHERE id = ? AND ended_at IS NULL").run(now(), now(), id);
     }
     sessionsFor(accountId) {
-        return this.db.prepare("SELECT * FROM sessions WHERE account_id = ? ORDER BY created_at DESC").all(accountId);
+        return this.db.prepare("SELECT * FROM sessions WHERE account_id = ? AND ended_at IS NULL ORDER BY created_at DESC").all(accountId);
     }
     devicesFor(accountId) {
         return this.db.prepare("SELECT * FROM devices WHERE account_id = ? ORDER BY created_at ASC").all(accountId);
@@ -451,6 +466,12 @@ export class Accounts {
     allDevices() {
         return this.db.prepare("SELECT * FROM devices ORDER BY created_at DESC").all();
     }
+    liveSessions(limit = 500) {
+        return this.db.prepare("SELECT * FROM sessions WHERE ended_at IS NULL AND revoked_at IS NULL ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
+    endedSessionsSince(sinceMs) {
+        return this.db.prepare("SELECT COUNT(*) c FROM sessions WHERE ended_at IS NOT NULL AND ended_at >= ?").get(sinceMs).c;
+    }
     allSessions(limit = 500) {
         return this.db.prepare("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ?").all(limit);
     }
@@ -460,7 +481,7 @@ export class Accounts {
             accounts: n("SELECT COUNT(*) c FROM accounts"),
             devices: n("SELECT COUNT(*) c FROM devices"),
             sessions: n("SELECT COUNT(*) c FROM sessions"),
-            live_sessions: n("SELECT COUNT(*) c FROM sessions WHERE revoked_at IS NULL"),
+            live_sessions: n("SELECT COUNT(*) c FROM sessions WHERE revoked_at IS NULL AND ended_at IS NULL"),
             audit: n("SELECT COUNT(*) c FROM audit"),
         };
     }
@@ -468,6 +489,7 @@ export class Accounts {
         const sessionDays = opts.sessionDays ?? 30;
         const auditDays = opts.auditDays ?? 365;
         const sCut = now() - sessionDays * 86_400_000;
+        this.db.prepare("DELETE FROM sessions WHERE ended_at IS NOT NULL AND ended_at < ?").run(now() - 7 * 86_400_000);
         const s = this.db.prepare("DELETE FROM sessions WHERE last_seen < ?").run(sCut);
         let a = { changes: 0 };
         if (auditDays > 0)

package/dist/cli.js

@@ -7,6 +7,7 @@ process.emitWarning = ((warning, ...rest) => {
     return _emitWarning(warning, ...rest);
 });
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
 import { fromInvite, load, save, toInvite, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
@@ -18,7 +19,7 @@ import { runMcp } from "./mcp.js";
 import { Worker } from "./worker.js";
 import { DEFAULT_REMINDER_MS, ensureNativeNotifier, HumanNotifier, sendDesktopNotification } from "./notifier.js";
 import { AGENT_SURFACES, applyProfileInit, cleanList, isAgentSurface, loadProfile, organizationProfile, profileInitialized, saveProfile, wakeDefault } from "./profile.js";
-import { runGuide, terminalIO } from "./setup-guide.js";
+import { runGuide, terminalIO, parseSetupFlags, questionnaire } from "./setup-guide.js";
 import { doctor, render } from "./doctor.js";
 import { menubarProc, notifierProc, relayProc, workerProc, wiring, logFileFor, dataSummary, stopProc, statFile } from "./machine.js";
 import { assess } from "./untrusted.js";
@@ -271,12 +272,13 @@ function unattendedProject() {
 async function guidedSetup(cfg, project, opts = {}) {
     if (argv.includes("--no-guide"))
         return;
-    const interactive = !!process.stdin.isTTY && !argv.includes("--yes");
+    const preset = opts.preset ?? {};
+    const interactive = !!process.stdin.isTTY && !argv.includes("--yes") && !Object.keys(preset).length;
     if (!interactive && !opts.force)
         return;
     const rl = interactive ? createInterface({ input: process.stdin, output: process.stderr }) : null;
     const io = rl ? terminalIO(rl, (l) => console.error(l)) : null;
-    console.error(`\n${B("A few choices, then you're done.")}${io ? "" : D("  (no terminal — taking the defaults)")}`);
+    console.error(`\n${B("A few choices, then you're done.")}${io ? "" : Object.keys(preset).length ? D("  (applying the answers you passed)") : D("  (no terminal — taking the defaults)")}`);
     try {
         const r = await runGuide(io, { cfg, project }, {
             publish: async (p) => {
@@ -289,7 +291,25 @@ async function guidedSetup(cfg, project, opts = {}) {
                     c.close();
                 }
             },
-        });
+            ...(project ? {
+                setRepoBase: async (base) => {
+                    const info = repoInfo(project);
+                    if (!info)
+                        throw new Error("not inside a git repo");
+                    const { repo: _r, repoOrigin: _o, ...plain } = cfg;
+                    const c = new PantheonClient(plain, undefined, { role: "cli" });
+                    try {
+                        await c.connect();
+                        await c.bindRepo(info.fingerprint, info.origin, base);
+                    }
+                    finally {
+                        c.close();
+                    }
+                    if (cfg.spaceId)
+                        bindRepo(info, cfg.spaceId);
+                },
+            } : {}),
+        }, preset);
         console.error("");
         for (const l of r.applied)
             console.error(`  ${C("✓")} ${l}`);
@@ -301,6 +321,15 @@ async function guidedSetup(cfg, project, opts = {}) {
         rl?.close();
     }
 }
+function workerMidRun() {
+    try {
+        const s = JSON.parse(readFileSync(join(CONFIG_DIR, "worker-state.json"), "utf8"));
+        return !!s.at && Date.now() - s.at < 10 * 60_000 && /run/i.test(String(s.state ?? ""));
+    }
+    catch {
+        return false;
+    }
+}
 function printReady(tools) {
     const workerOn = tools.some((t) => t.tool === "worker" && t.status.startsWith("on"));
     console.error(`\n${B("You're set.")} Restart your agent once (quit and reopen) and it is connected.`);
@@ -389,6 +418,7 @@ ${B("control")}
   pantheon doctor             check this machine end to end
   pantheon setup              the guided choices: who may wake this machine, what a run may execute,
                               what you personally decide, which alerts you want — re-run any time
+                              (--questions prints them for an agent to ask you; answers go back as flags)
   pantheon upgrade            pull the latest pantheon, rebuild, and re-wire your agents
 
 ${D("more: pantheon help --all")}
@@ -396,7 +426,7 @@ ${D("more: pantheon help --all")}
 const HELP_ALL = HELP + `
 ${B("less common")}
   pantheon relay              run only the relay, in this terminal
-  pantheon service install [relay|worker|notifier|menubar] | uninstall
+  pantheon service install [relay|worker|notifier|menubar] | restart | uninstall
                             run a long-lived component in the background, from login
   pantheon members            the full list, with key fingerprints
   pantheon whoami             your name and fingerprint
@@ -461,6 +491,8 @@ async function main() {
                 console.error(`  ${C(`pantheon join ${r.invite}`)}\n`);
                 console.error(D(`  Tell them to run it from their project's git repo. Single use, expires in ${Math.round(Number(flag("ttl", "1440")) / 60)}h.`));
                 console.error(D(`  Redeeming it admits them — no separate approval step. Need another? \`pantheon invite\``));
+                console.error(D(`\n  Not technical? Forward them this instead, and their agent does the rest:`));
+                console.error(`  ${D("Tell your agent: run")} ${C("curl -fsSL https://www.joinpantheon.network/skills/join.md")} ${D("and follow it. Invite:")} ${C(`pantheon join ${r.invite}`)}`);
             }
             if (!r.reach.shareable && r.reach.hint) {
                 console.error(`\n\x1b[33m  That address only works on this machine.\x1b[0m`);
@@ -485,6 +517,8 @@ async function main() {
             const inv = await client.makeInvite(mayWake, ttl).catch((e) => die(e.message));
             console.log(`pantheon join ${toInvite({ ...cfg, token: inv.url })}`);
             console.error(D(`\nSingle use, expires ${new Date(inv.expires_at).toLocaleString()}.`));
+            console.error(D(`For a teammate who is not technical, forward this and their agent does the rest:`));
+            console.error(`  ${D("Tell your agent: run")} ${C("curl -fsSL https://www.joinpantheon.network/skills/join.md")} ${D("and follow it. Invite:")} ${C(`pantheon join ${toInvite({ ...cfg, token: inv.url })}`)}`);
             client.close();
             return;
         }
@@ -654,20 +688,55 @@ async function main() {
                 return;
             }
             console.error(`\n${B(`upgraded ${r.from} → ${r.to}`)}`);
-            console.error(`\n${B("Restart to load the new code:")}`);
-            for (const what of r.restart) {
-                if (what === "relay")
-                    console.error(`  relay   launchctl kickstart -k gui/$(id -u)/dev.pantheon.relay   ${D("(briefly drops your teammates — pick the moment)")}`);
-                else if (what === "worker")
-                    console.error(`  worker  launchctl kickstart -k gui/$(id -u)/dev.pantheon.worker`);
+            const { restartService, serviceInstalled } = await import("./service.js");
+            console.error("");
+            if (process.platform === "darwin") {
+                const { trayStale, ensureTrayBinary, writeTrayCommands } = await import("./tray.js");
+                const { notifierStale, ensureNativeNotifier } = await import("./notifier.js");
+                for (const [stale, build, what] of [[trayStale, () => { ensureTrayBinary(); writeTrayCommands(); }, "menu bar"], [notifierStale, ensureNativeNotifier, "alerts"]]) {
+                    if (!stale())
+                        continue;
+                    try {
+                        build();
+                        console.error(`  ${what}: rebuilt from this release's source`);
+                    }
+                    catch (e) {
+                        console.error(`  ${what}: could not rebuild (${e.message.split("\n")[0]})`);
+                    }
+                }
+            }
+            for (const kind of ["worker", "notifier", "menubar"]) {
+                if (!serviceInstalled(kind))
+                    continue;
+                if (kind === "worker" && workerMidRun()) {
+                    console.error(`  ${D("worker: a run is in progress — left alone. When it is done:")}  pantheon service restart worker`);
+                    continue;
+                }
+                for (const l of restartService(kind))
+                    console.error(l);
+            }
+            if (r.restart.includes("relay"))
+                console.error(`  relay: ${D("shared with your teammates, so it is yours to time:")}  launchctl kickstart -k gui/$(id -u)/dev.pantheon.relay`);
+            const cfgNow = load();
+            if (cfgNow) {
+                if (loadProfile(cfgNow).agent.wake_default === undefined)
+                    await guidedSetup(cfgNow, repoInfo(process.cwd())?.root ?? null);
                 else
-                    console.error(`  agent   quit and reopen ${what.replace(/^your /, "your ")}`);
+                    console.error(D(`\n  Your setup answers still apply — pantheon setup to change them.`));
             }
+            console.error(`\n${B("One thing only you can do:")} quit and reopen your agent windows so they load the new pantheon.`);
             return;
         }
         case "setup": {
+            if (argv.includes("--questions")) {
+                console.log(questionnaire());
+                return;
+            }
+            const { preset, errors } = parseSetupFlags(argv);
+            if (errors.length)
+                die(errors.join("\n") + "\n  pantheon setup --questions  lists every answer");
             const cfg = need();
-            await guidedSetup(cfg, repoInfo(process.cwd())?.root ?? null, { force: true });
+            await guidedSetup(cfg, repoInfo(process.cwd())?.root ?? null, { force: true, preset });
             return;
         }
         case "version": {
@@ -2111,6 +2180,12 @@ async function main() {
                     console.error(l);
                 return;
             }
+            if (sub === "restart") {
+                const { restartService } = await import("./service.js");
+                for (const l of restartService(kind))
+                    console.error(l);
+                return;
+            }
             if (kind === "relay") {
                 const data = resolveDataDir(flag("data")).dir;
                 const port = flag("port", "8787");

package/dist/helpers-build.js

@@ -0,0 +1,23 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+export const helperHashPath = (binary) => `${binary}.source.sha256`;
+export function sourceHash(source) {
+    return createHash("sha256").update(readFileSync(source)).digest("hex");
+}
+export function recordHelperBuild(binary, source) {
+    try {
+        writeFileSync(helperHashPath(binary), sourceHash(source) + "\n");
+    }
+    catch { }
+}
+export function helperStale(binary, source) {
+    if (!existsSync(binary) || !existsSync(source))
+        return false;
+    try {
+        return readFileSync(helperHashPath(binary), "utf8").trim() !== sourceHash(source);
+    }
+    catch {
+        return true;
+    }
+}
+//# sourceMappingURL=helpers-build.js.map

package/dist/notifier.js

@@ -1,4 +1,5 @@
 import { execFileSync, spawn } from "node:child_process";
+import { helperStale, recordHelperBuild } from "./helpers-build.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -56,8 +57,10 @@ export function ensureNativeNotifier(home = CONFIG_DIR) {
     requireDeveloperTools("notifications", "notifier");
     execFileSync("/usr/bin/swiftc", ["-O", source, "-o", binary], { stdio: "pipe" });
     chmodSync(binary, 0o755);
+    recordHelperBuild(binary, source);
     return binary;
 }
+export function notifierStale(home = CONFIG_DIR) { return helperStale(hudBinaryPath(home), hudSourcePath()); }
 export function requireDeveloperTools(what, service) {
     try {
         execFileSync("/usr/bin/xcode-select", ["-p"], { stdio: "pipe" });

package/dist/relay.js

@@ -145,8 +145,12 @@ export class Relay {
         this.adminAllow = (process.env.PANTHEON_ADMIN_ALLOW_IPS ?? "").split(",").map((x) => x.trim()).filter(Boolean);
         const wantStore = this.requireAccounts || this.adminToken !== null;
         this.accounts = opts.accounts ?? (wantStore ? new Accounts(join(this.dataDir, "accounts.db")) : null);
-        if (this.accounts)
+        if (this.accounts) {
             this.backfillSpaceOwners();
+            const closed = this.accounts.endAllOpenSessions();
+            if (closed)
+                this.log(`ended ${closed} session${closed === 1 ? "" : "s"} left open by the previous relay process`);
+        }
         this.email = opts.emailSender ?? emailSenderFromEnv(this.log);
         const envNum = (k) => {
             const v = process.env[k];
@@ -925,7 +929,8 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
         const kb = (n) => n < 1024 ? `${n} B` : n < 1048576 ? `${(n / 1024).toFixed(1)} KB` : `${(n / 1048576).toFixed(1)} MB`;
         const accounts = A.allAccounts();
         const devices = A.allDevices();
-        const sessions = A.allSessions(200);
+        const sessions = A.liveSessions(200);
+        const endedToday = A.endedSessionsSince(Date.now() - DAY);
         const audit = A.auditLog({ limit: 300 });
         const blocks = A.allBlocks();
         const verifs = A.recentVerifications(50);
@@ -970,7 +975,7 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
   <div class=stat><b>${c.accounts}</b><span>accounts</span></div>
   <div class=stat><b>${c.devices}</b><span>devices</span></div>
   <div class=stat><b>${Object.entries(planCounts).filter(([n]) => n !== "free").reduce((s, [, v]) => s + v, 0)}<span class=dim style="font-size:14px"> / ${c.accounts}</span></b><span>paid plans / accounts</span></div>
-  <div class=stat><b>${sessions.filter((s) => !s.revoked_at && Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>sessions active / open</span></div>
+  <div class=stat><b>${sessions.filter((s) => Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>connections heartbeating / open</span></div>
   <div class=stat><b>${spaces.filter((s) => s.live).length}<span class=dim style="font-size:14px"> / ${spaces.length}</span></b><span>spaces live / total · cap ${this.limits.maxSpaces}</span></div>
   <div class="stat ${emailsHour > emailCap * 0.8 ? "warn" : ""}"><b>${emailsHour}<span class=dim style="font-size:14px"> / ${emailCap}</span></b><span>emails this hour</span></div>
   <div class=stat><b>${snapshots.length}</b><span>snapshots · latest ${snapshots.length ? esc(snapshots[snapshots.length - 1].replace(/^accounts-|\\.db$/g, "").replace(/T/, " ").slice(0, 16)) : "—"}</span></div>
@@ -1013,10 +1018,11 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
   <p class=note>Edits apply immediately to the next create, invite or admit of every account on that plan. Unused invites count toward "people per space" so nobody mints five at once. Personas are files on the user's machine and cannot be limited here. Every change is audited.</p>
 
   <h2>Live sessions <input placeholder="filter" data-filter="t-sessions"></h2><div class=wrap><table id=t-sessions>
-    <tr><th>session</th><th>account</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
-    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
-    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=7 class=dim>no live sessions</td></tr>"}
+    <tr><th>session</th><th>account</th><th>device</th><th>role</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
+    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td class=dim>${esc(devices.find((d) => d.id === s.device_id)?.label ?? s.device_id.slice(0, 10))}</td><td>${s.role ? `<span class=pill>${esc(s.role)}</span>` : "<span class=dim>—</span>"}</td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
+    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=9 class=dim>no open connections right now</td></tr>"}
   </table></div>
+  <p class=note>One row per open connection — an agent window, a worker, or a CLI command while it runs. Rows leave when the socket closes; ${endedToday} connection${endedToday === 1 ? "" : "s"} came and went in the last 24 hours. "Stale" means no heartbeat for 15 minutes on a socket that has not closed, usually a machine that went to sleep.</p>
 
   <h2>Blocked emails and domains</h2><div class=wrap><table id=t-blocks>
     <tr><th>pattern</th><th>kind</th><th>since</th><th></th></tr>
@@ -1250,12 +1256,20 @@ pantheon signup --email you@work.com --username you</code></pre>
         let space = null;
         let me = null;
         let acct = null;
+        let dbSession = null;
+        let lastTouch = 0;
+        const touch = () => {
+            if (dbSession && Date.now() - lastTouch > 60_000) {
+                lastTouch = Date.now();
+                this.accounts?.touchSession(dbSession);
+            }
+        };
         let sessionId = "";
         let role = "interactive";
         let lastMsg = "";
         let alive = true;
         const nonce = newNonce();
-        ws.on("pong", () => { alive = true; });
+        ws.on("pong", () => { alive = true; touch(); });
         const probe = ws;
         probe._alive = () => alive;
         probe._clear = () => { alive = false; };
@@ -1303,6 +1317,7 @@ pantheon signup --email you@work.com --username you</code></pre>
             }
             const m = parsed.data;
             lastMsg = m.t === "act" ? m.act : m.t;
+            touch();
             if (m.t === "ping")
                 return this.send(ws, { t: "pong" });
             if (m.t === "hello") {
@@ -1370,7 +1385,9 @@ pantheon signup --email you@work.com --username you</code></pre>
                     }
                     m.member = auth.account.username;
                     acct = auth.account;
-                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip).id;
+                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip, m.role ?? "interactive").id;
+                    dbSession = acctSession;
+                    lastTouch = Date.now();
                 }
                 let enrolled = null;
                 if (m.enroll) {
@@ -1702,6 +1719,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
         });
         ws.on("close", () => {
+            if (dbSession) {
+                this.accounts?.endSession(dbSession);
+                dbSession = null;
+            }
             if (!space || !me)
                 return;
             me.sessions.delete(sessionId);
@@ -1753,7 +1774,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 message: `over ${LIMITS.rateActs} acts in ${LIMITS.rateWindowMs / 1000}s. This is a backstop against a stuck loop, not a hard stop — wait a few seconds and send again. If you are genuinely producing this much, you are probably doing work that belongs in a commit and a DELIVERED, not in acts.` };
         }
         for (const id of to ?? []) {
-            if (!sp.members.has(id)) {
+            if (!sp.members.has(id) && !sp.allow.get(id)?.admitted) {
                 return { code: "NO_SUCH_MEMBER", message: `nobody here is called "${id}" — members: ${[...sp.members.keys()].join(", ")}` };
             }
         }
@@ -2190,6 +2211,11 @@ pantheon signup --email you@work.com --username you</code></pre>
             lastTouch: Date.now(),
         };
         this.spaces.set(name, sp);
+        for (const e of allow.all()) {
+            if (e.admitted && !sp.members.has(e.member)) {
+                sp.members.set(e.member, { id: e.member, display: e.member, agent: "unknown", last_seen: e.first_seen, sessions: new Map(), activity: new Map(), delivered_seq: 0, stamps: [] });
+            }
+        }
         const open = [...sp.goals.values()].filter((g) => g.state !== "CLOSED").length;
         this.log(`[${name}] space ready (seq ${sp.ledger.head}, ${sp.goals.size} goals — ${open} still open, ${sp.obligations.size} obligations restored)`);
         this.compactSpace(sp);

package/dist/service.js

@@ -138,6 +138,20 @@ export function uninstallService(kind) {
     }
     return out;
 }
+export function restartService(kind, exec = (c, a) => execFileSync(c, a, { stdio: "ignore" })) {
+    if (!serviceInstalled(kind))
+        return [`  ${kind}: not installed here`];
+    try {
+        if (platform() === "darwin")
+            exec("launchctl", ["kickstart", "-k", `gui/${process.getuid?.() ?? 501}/${LABEL(kind)}`]);
+        else
+            exec("systemctl", ["--user", "restart", `pantheon-${kind}`]);
+        return [`  ${kind}: restarted on the new code`];
+    }
+    catch (e) {
+        return [`  ${kind}: could not restart (${e.message.split("\n")[0]}) — pantheon service restart ${kind}`];
+    }
+}
 export function serviceInstalled(kind) {
     try {
         return existsSync(platform() === "darwin" ? plistPath(kind) : unitPath(kind));

package/dist/setup-guide.js

@@ -1,4 +1,5 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { applyProfileInit, loadProfile, profilePath, saveProfile } from "./profile.js";
@@ -39,14 +40,110 @@ export function guideDefaults(profile, cfg) {
         persona: false,
     };
 }
-export async function runGuide(io, ctx, deps = {}) {
+export function detectBaseBranch(project) {
+    const git = (...a) => { try {
+        return execFileSync("git", a, { cwd: project, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return "";
+    } };
+    if (!git("remote", "get-url", "origin"))
+        return null;
+    const head = git("symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD");
+    if (head)
+        return head.replace(/^origin\//, "");
+    const cur = git("rev-parse", "--abbrev-ref", "HEAD");
+    return cur && cur !== "HEAD" ? cur : null;
+}
+export function questionnaire() {
+    const opt = (flag, id, label) => `     ${label}  → --${flag} ${id}`;
+    return [
+        "pantheon setup — the questions, and the flag for each answer.",
+        "Ask your human each one in plain words, then run:  pantheon setup --yes <flags>",
+        "",
+        "1. While they're away, may teammates hand work to this machine? (their agent runs here on its own,",
+        "   in a separate copy of the repo, and delivers on a branch for review)",
+        ...WAKE_OPTIONS.map((o) => opt("wake", o.id, o.label)),
+        "2. When a teammate's request wakes this machine, what may the run do? (skip if --wake no)",
+        opt("commands", "no", "Edit files only — it can answer and draft, but cannot run tests, commit, or push."),
+        opt("commands", "yes", "Run commands too — needed to run tests and to commit and push work for review."),
+        "3. Their name, as teammates will see it.                       → --name \"…\"",
+        `4. Their role, in a word (${TITLE_OPTIONS.slice(0, -1).join(", ")}, or their own).  → --title \"…\"`,
+        "5. Which of these do they decide personally? Agents will stop and ask them first. Any number, or none.",
+        ...DECISION_AREAS.map((x) => `     ${x.label}  → ${x.id}`),
+        "     pass them comma-separated: --decides deployment,pricing   (or --decides none)",
+        "6. Which desktop alerts do they want?",
+        ...ALERT_OPTIONS.map((o) => opt("alerts", o.id, o.label)),
+        "7. Should their worker follow a short written playbook for this repo? (skip if --wake no)",
+        opt("playbook", "yes", "Yes — write a starter playbook now (recommended)"),
+        opt("playbook", "no", "Not now"),
+        "8. Which branch should workers start from, and deliveries be checked against? Usually the branch this",
+        "   project deploys or releases from (often the default branch).     → --base <branch>",
+        "",
+        "Example:  pantheon setup --yes --wake anyone --commands yes --name \"Praneet Sinha\" --title Founder \\",
+        "            --decides deployment --alerts decisions --playbook yes --base main",
+    ].join("\n");
+}
+export function parseSetupFlags(argv) {
+    const preset = {};
+    const errors = [];
+    const val = (name) => { const i = argv.indexOf(`--${name}`); return i >= 0 ? argv[i + 1] : undefined; };
+    const yn = (name) => { const v = val(name); if (v === undefined)
+        return undefined; if (/^(yes|true|on|1)$/i.test(v))
+        return true; if (/^(no|false|off|0)$/i.test(v))
+        return false; errors.push(`--${name} takes yes or no, not "${v}"`); return undefined; };
+    const wake = val("wake");
+    if (wake !== undefined) {
+        if (WAKE_OPTIONS.some((o) => o.id === wake))
+            preset.wake = wake;
+        else
+            errors.push(`--wake takes ${WAKE_OPTIONS.map((o) => o.id).join(", ")}, not "${wake}"`);
+    }
+    const commands = yn("commands");
+    if (commands !== undefined)
+        preset.commands = commands;
+    const name = val("name");
+    if (name !== undefined)
+        preset.name = name.trim();
+    const title = val("title");
+    if (title !== undefined)
+        preset.title = title.trim();
+    const decides = val("decides");
+    if (decides !== undefined) {
+        const ids = decides.split(",").map((x) => x.trim().toLowerCase()).filter((x) => x && x !== "none");
+        const bad = ids.filter((id) => !DECISION_AREAS.some((x) => x.id === id));
+        if (bad.length)
+            errors.push(`--decides: unknown area${bad.length === 1 ? "" : "s"} ${bad.join(", ")} — use ${DECISION_AREAS.map((x) => x.id).join(", ")} or none`);
+        else
+            preset.decides = [...new Set(ids)];
+    }
+    const alerts = val("alerts");
+    if (alerts !== undefined) {
+        if (ALERT_OPTIONS.some((o) => o.id === alerts))
+            preset.notifications = alerts;
+        else
+            errors.push(`--alerts takes ${ALERT_OPTIONS.map((o) => o.id).join(", ")}, not "${alerts}"`);
+    }
+    const playbook = yn("playbook");
+    if (playbook !== undefined)
+        preset.persona = playbook;
+    const base = val("base");
+    if (base !== undefined && base.trim())
+        preset.base = base.trim();
+    return { preset, errors };
+}
+export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const install = deps.installService ?? realInstall;
     const uninstall = deps.uninstallService ?? realUninstall;
     const installed = deps.serviceInstalled ?? realInstalled;
     const file = deps.profileFile ?? profilePath();
     const profile = loadProfile(ctx.cfg, file);
-    const d = guideDefaults(profile, ctx.cfg);
+    const d = { ...guideDefaults(profile, ctx.cfg), ...preset };
     const a = { ...d };
+    if (a.wake === "no") {
+        a.commands = false;
+        a.persona = false;
+    }
     const applied = [], warnings = [];
     if (io) {
         io.say("A few choices only you can make. Pick a number; Enter keeps the suggested one.\n");
@@ -72,6 +169,12 @@ export async function runGuide(io, ctx, deps = {}) {
             const p = await io.choose("Should your worker follow a short written playbook for this repo? It says what a woken run may do here and what it must leave to you. You can edit it any time.", ["Yes — write a starter playbook now (recommended)", "Not now"], 0);
             a.persona = p === 0;
         }
+        const detected = ctx.project && deps.setRepoBase ? detectBaseBranch(ctx.project) : null;
+        if (detected) {
+            const suggested = preset.base ?? detected;
+            const b = await io.choose("Which branch should your worker start from, and deliveries be checked against? Usually the branch this project deploys or releases from.", [`${suggested}${suggested === detected ? " (what origin calls its default)" : ""}`, "A different branch"], 0);
+            a.base = b === 0 ? suggested : ((await io.ask("Branch name", suggested)).trim() || suggested);
+        }
     }
     let next = a.title ? applyProfileInit(profile, { name: a.name, title: a.title }) : { ...profile, human: { ...profile.human, display_name: a.name } };
     const authority = { ...next.authority };
@@ -169,6 +272,15 @@ export async function runGuide(io, ctx, deps = {}) {
             applied.push(`playbook written: ${personaFile} — commit it so every machine on this repo follows it`);
         }
     }
+    if (a.base && deps.setRepoBase) {
+        try {
+            await deps.setRepoBase(a.base);
+            applied.push(`workers on this repo cut from ${a.base}, and deliveries are checked against it`);
+        }
+        catch (e) {
+            warnings.push(`could not register the base branch with the team (${e.message}) — later: pantheon repo add --base ${a.base}`);
+        }
+    }
     return { answers: a, applied, warnings, ...(personaFile ? { personaFile } : {}) };
 }
 export function starterPersona(a) {

package/dist/tray.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { helperStale, recordHelperBuild } from "./helpers-build.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -26,8 +27,10 @@ export function ensureTrayBinary(home = CONFIG_DIR) {
     requireDeveloperTools("the menu bar", "menubar");
     execFileSync("/usr/bin/swiftc", ["-O", source, "-o", binary], { stdio: "pipe" });
     chmodSync(binary, 0o755);
+    recordHelperBuild(binary, source);
     return binary;
 }
+export function trayStale(home = CONFIG_DIR) { return helperStale(trayBinaryPath(home), traySourcePath()); }
 export function writeTrayCommands(home = CONFIG_DIR) {
     const bin = whichPantheon() ?? "pantheon";
     const dir = join(home, "bin");

package/dist/upgrade.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { installForUser } from "./install.js";
-import { relayProc, workerProc } from "./machine.js";
+import { relayProc, workerProc, notifierProc, menubarProc } from "./machine.js";
 export function repoRoot() {
     return join(dirname(fileURLToPath(import.meta.url)), "..");
 }
@@ -42,6 +42,16 @@ export function defaultDeps() {
                     up.push("worker");
             }
             catch { }
+            try {
+                if (notifierProc().running)
+                    up.push("notifier");
+            }
+            catch { }
+            try {
+                if (menubarProc().running)
+                    up.push("menubar");
+            }
+            catch { }
             return up;
         },
         npmUpgrade: () => execFileSync("npm", ["install", "-g", `${PKG_NAME}@latest`, "--no-audit", "--no-fund"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }),

package/helper/macos/menubar.swift

@@ -118,21 +118,54 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     }
   }
 
-  /// The glyph is the product's one-word status. Filled bolt: peers can wake
-  /// work here. Hollow bolt: connected but nothing unattended will run.
-  /// Slashed: not configured, or the relay is unreachable. A count rides
-  /// alongside when decisions wait on the human — the badge is the point.
-  private func paint() {
-    let symbol = !state.configured || !state.relayOk ? "bolt.slash.circle"
-      : state.workerRunning ? "bolt.circle.fill" : "bolt.circle"
-    if let img = NSImage(systemSymbolName: symbol, accessibilityDescription: "pantheon") {
-      img.isTemplate = true
-      item.button?.image = img
-      item.button?.title = state.decisions.isEmpty ? "" : " \(state.decisions.count)"
-      item.button?.imagePosition = .imageLeading
-    } else {
-      item.button?.title = state.decisions.isEmpty ? "cw" : "cw \(state.decisions.count)"
+  enum MarkMode { case full, idle, off }
+
+  /// The Three Stones mark — the product's own logo, the same three arcs the
+  /// website draws: a lintel across the top and a gate at the bottom around a
+  /// centre nobody owns. Drawn with paths rather than loaded from an asset, so it
+  /// is a crisp template image at any menu bar scale and takes the system tint.
+  /// State rides on its weight: full when peers can wake work here, lighter when
+  /// connected but nothing unattended will run, faint with a slash when the relay
+  /// is unreachable or this machine is not in a space. Never rotate it.
+  private func markImage(_ mode: MarkMode) -> NSImage {
+    let img = NSImage(size: NSSize(width: 18, height: 18), flipped: false) { rect in
+      let s = rect.width / 24.0                       // the mark is authored on a 24-unit grid
+      let c = NSPoint(x: rect.midX, y: rect.midY)
+      let r = 8.9 * s
+      let stones = NSBezierPath()
+      stones.lineWidth = 3.4 * s
+      stones.lineCapStyle = .round
+      for (a, b) in [(51.0, 129.0), (171.0, 249.0), (291.0, 369.0)] {   // lintel, left stone, right stone
+        let rad = a * .pi / 180
+        stones.move(to: NSPoint(x: c.x + r * cos(rad), y: c.y + r * sin(rad)))
+        stones.appendArc(withCenter: c, radius: r, startAngle: a, endAngle: b, clockwise: false)
+      }
+      let alpha: CGFloat = mode == .full ? 1.0 : mode == .idle ? 0.58 : 0.32
+      NSColor.black.withAlphaComponent(alpha).setStroke()
+      stones.stroke()
+      if mode == .off {
+        let slash = NSBezierPath()
+        slash.lineWidth = 2.2 * s
+        slash.lineCapStyle = .round
+        slash.move(to: NSPoint(x: rect.minX + 4 * s, y: rect.minY + 4 * s))
+        slash.line(to: NSPoint(x: rect.maxX - 4 * s, y: rect.maxY - 4 * s))
+        NSColor.black.setStroke()
+        slash.stroke()
+      }
+      return true
     }
+    img.isTemplate = true
+    img.accessibilityDescription = "pantheon"
+    return img
+  }
+
+  /// The glyph is the product's one-word status; a count rides alongside when
+  /// decisions wait on the human — the badge is the point.
+  private func paint() {
+    let mode: MarkMode = !state.configured || !state.relayOk ? .off : state.workerRunning ? .full : .idle
+    item.button?.image = markImage(mode)
+    item.button?.title = state.decisions.isEmpty ? "" : " \(state.decisions.count)"
+    item.button?.imagePosition = .imageLeading
     item.button?.toolTip = state.configured
       ? "pantheon — \(state.member) in \(state.space)\(state.relayOk ? "" : " (relay unreachable)")"
       : "pantheon — not joined to a space yet"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "relay": "node dist/cli.js relay",
     "test": "PANTHEON_HOME=\"$(mktemp -d)\" node --test --test-force-exit dist/test/*.test.js",
     "prepare": "npm run build",
-    "prepublishOnly": "npm run build && node --test dist/test/*.test.js",
+    "prepublishOnly": "npm run build && npm test",
     "start": "node dist/cli.js relay"
   },
   "dependencies": {