@join-pantheon/cli 0.24.1 → 0.25.0

package/dist/measure.js

@@ -0,0 +1,142 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { resolve, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { claudeGranted, cursorGranted, claudeAllow, cursorAllow } from "./grants.js";
+import { codexApprovalState } from "./install.js";
+import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES } from "./tools.js";
+const ROOT = process.env.PANTHEON_MCP_ROOT ?? resolve(dirname(fileURLToPath(import.meta.url)), "..");
+export const HOST_STARTUP_ALLOWANCE_MS = 10_000;
+export const STARTUP_WARN_MS = 1_500;
+export function measureMcp(opts = {}) {
+    const entry = opts.entry ?? join(ROOT, "dist", "cli.js");
+    const timeoutMs = opts.timeoutMs ?? HOST_STARTUP_ALLOWANCE_MS;
+    if (!existsSync(entry))
+        return Promise.resolve({ error: `${entry} is missing` });
+    return new Promise((done) => {
+        let settled = false;
+        const finish = (m) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                proc.kill("SIGKILL");
+            }
+            catch { }
+            done(m);
+        };
+        const t0 = Date.now();
+        const proc = spawn(process.execPath, [entry, "mcp", "--child"], {
+            cwd: opts.cwd, stdio: ["pipe", "pipe", "pipe"], env: opts.env ?? process.env,
+        });
+        const timer = setTimeout(() => finish({ error: `no answer to initialize within ${timeoutMs}ms` }), timeoutMs);
+        proc.on("error", (e) => finish({ error: `could not start: ${e.message}` }));
+        proc.on("exit", (code) => finish({ error: `exited with ${code ?? "a signal"} before answering` }));
+        proc.stdin.on("error", () => { });
+        const send = (m) => { try {
+            proc.stdin.write(JSON.stringify(m) + "\n");
+        }
+        catch { } };
+        send({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "pantheon doctor", version: "0" } } });
+        let initializeMs = -1;
+        let pending = "";
+        proc.stdout.on("data", (d) => {
+            pending += d.toString("utf8");
+            let nl;
+            while ((nl = pending.indexOf("\n")) >= 0) {
+                const line = pending.slice(0, nl).trim();
+                pending = pending.slice(nl + 1);
+                if (!line)
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (msg.error)
+                    return finish({ error: msg.error.message ?? "the server refused the handshake" });
+                if (msg.id === 1) {
+                    initializeMs = Date.now() - t0;
+                    send({ jsonrpc: "2.0", method: "notifications/initialized" });
+                    send({ jsonrpc: "2.0", id: 2, method: "tools/list" });
+                }
+                else if (msg.id === 2) {
+                    const tools = (msg.result?.tools ?? []).map((t) => t.name).sort();
+                    finish({ initializeMs, toolsMs: Date.now() - t0, tools });
+                }
+            }
+        });
+    });
+}
+function agentLine(name, seen, wanted, strip) {
+    if (seen.state === "absent")
+        return { text: `${name} not set up here`, drift: false };
+    if (seen.state === "invalid")
+        return { text: `${name} settings unreadable`, drift: true };
+    const have = seen.tools.map(strip);
+    const want = wanted.map(strip);
+    const missing = want.filter((t) => !have.includes(t));
+    const extra = have.filter((t) => !want.includes(t));
+    if (!missing.length && !extra.length)
+        return { text: `${name} allows ${have.length}`, drift: false };
+    const parts = [];
+    if (missing.length)
+        parts.push(`${missing.length} would prompt on every call (${missing.map((t) => t.replace(/^pantheon_/, "")).join(", ")})`);
+    if (extra.length)
+        parts.push(`${extra.length} allowed against your choice (${extra.map((t) => t.replace(/^pantheon_/, "")).join(", ")})`);
+    return { text: `${name} allows ${have.length} — ${parts.join("; ")}`, drift: true };
+}
+export function toolsReport(registered, seen, approval) {
+    const problems = [];
+    const expected = [...PANTHEON_TOOL_NAMES].sort();
+    let head;
+    if (registered === null) {
+        head = `${expected.length} tools`;
+    }
+    else if (JSON.stringify(registered) !== JSON.stringify(expected)) {
+        head = `${registered.length} registered, this build expects ${expected.length}`;
+        problems.push("the running server and this install disagree about the tool list — a stale window or a half-finished upgrade");
+    }
+    else {
+        head = `${registered.length} registered`;
+    }
+    const stripClaude = (t) => t.replace(/^mcp__pantheon__/, "");
+    const stripCursor = (t) => t.replace(/^Mcp\(pantheon:(.*)\)$/, "$1");
+    const claude = agentLine("Claude Code", seen.claude, claudeAllow(approval), stripClaude);
+    const cursor = agentLine("Cursor", seen.cursor, cursorAllow(approval), stripCursor);
+    if (claude.drift)
+        problems.push("Claude Code's allow-list does not match");
+    if (cursor.drift)
+        problems.push("Cursor's allow-list does not match");
+    let codex;
+    if (seen.codex === null)
+        codex = "Codex not set up here";
+    else if (!seen.codex.present)
+        codex = "Codex has no pantheon entry";
+    else if (!seen.codex.serverApprove) {
+        codex = "Codex entry without its approval line";
+        problems.push("Codex would prompt on every tool");
+    }
+    else {
+        const wantPrompt = approval === "ask-before-sending" ? [...WRITE_TOOL_NAMES].sort() : [];
+        const havePrompt = [...seen.codex.prompted].sort();
+        if (JSON.stringify(wantPrompt) === JSON.stringify(havePrompt)) {
+            codex = approval === "ask-before-sending" ? "Codex per-server, send/open_goal/claim prompt" : "Codex per-server";
+        }
+        else {
+            codex = `Codex per-server, but ${havePrompt.length} tool${havePrompt.length === 1 ? "" : "s"} set to prompt (chose ${approval === "ask-before-sending" ? "3" : "0"})`;
+            problems.push("Codex's per-tool overrides do not match your choice");
+        }
+    }
+    const detail = `${head}; ${claude.text}, ${cursor.text}, ${codex}`;
+    if (!problems.length)
+        return { level: "pass", detail };
+    return { level: "warn", detail, fix: `${problems.join("; ")} — pantheon install --user rewrites every grant to match this build and your approval choice` };
+}
+export function grantsSeen() {
+    return { claude: claudeGranted(), cursor: cursorGranted(), codex: codexApprovalState() };
+}
+//# sourceMappingURL=measure.js.map

package/dist/notice.js

@@ -135,7 +135,9 @@ export function composeWorker(run, ctx) {
     const asked = plain(run.obligationBody);
     let body;
     if (!run.ok) {
-        body = `Could not finish ${peer}'s request: ${asked}. It needs a live session or your decision.`;
+        body = run.diagnosis
+            ? `${run.diagnosis.says} ${peer}'s request is still open: ${asked}`
+            : `Could not finish ${peer}'s request: ${asked}. It needs a live session or your decision.`;
     }
     else if (run.reply) {
         const verb = VERB[run.reply.act] ?? "Replied to";
@@ -150,7 +152,7 @@ export function composeWorker(run, ctx) {
     const where = `${run.goal ? ` in "${run.goal.title}"` : ""}${run.obligationRef ? ` (act ${run.obligationRef})` : ""}`;
     const prompt = run.ok
         ? `My Pantheon worker just handled ${peer}'s request${where}${run.reply ? `; it replied with act ${run.reply.id}` : ""}. Read that reply and the thread it belongs to, tell me in plain words what it did and whether anything is still owed by me, then give me numbered next steps (reply, review the branch, follow up with ${peer}, or nothing). Do not act until I choose.`
-        : `A Pantheon run on this machine could not finish ${peer}'s request${where}. Read the thread, tell me what is still owed and why the run stopped, then give me numbered next steps. Do not act until I choose.`;
+        : `A Pantheon run on this machine could not finish ${peer}'s request${where}. The worker's own diagnosis: ${run.diagnosis ? `${run.diagnosis.says} ${run.diagnosis.fix}` : "none recorded"}. Read the thread, tell me what is still owed and why the run stopped, then give me numbered next steps. Do not act until I choose.`;
     return {
         kind: run.ok ? "worker" : "worker_failed",
         who: fit(`Your worker · for ${peer}`, BUDGET.who),
@@ -161,6 +163,9 @@ export function composeWorker(run, ctx) {
         sound: !run.ok,
         primary: primaryFor(ctx.tools, ctx.preferred, prompt),
         details: { ...(run.reply ? { act: run.reply.id } : run.obligationRef ? { act: run.obligationRef } : {}) },
+        ...(run.diagnosis?.dir && run.diagnosis.lines?.length
+            ? { fix: { label: "Fix it here", dir: run.diagnosis.dir, lines: run.diagnosis.lines, why: run.diagnosis.fix } }
+            : {}),
     };
 }
 //# sourceMappingURL=notice.js.map

package/dist/notifier.js

@@ -9,26 +9,37 @@ import { CONFIG_DIR } from "./config.js";
 import { loadProfile } from "./profile.js";
 import { APP_TOOLS, composeDecision, composeDelivery, TOOL_LABELS } from "./notice.js";
 import { cliOnPath, detectAvailable } from "./agents.js";
+import { whichPantheon } from "./service.js";
 export const DEFAULT_REMINDER_MS = 4 * 60 * 60 * 1_000;
+export const MAX_REMINDERS = 4;
+const DAY_MS = 24 * 60 * 60 * 1_000;
 export function humanObligations(obligations, member) {
     return obligations.filter((o) => o.kind === "HUMAN" && o.owner === `human:${member}`);
 }
 export function dueHumanObligations(obligations, member, state, now, reminderMs) {
     return humanObligations(obligations, member).filter((o) => {
         const last = state.notified_at[o.id];
-        return last === undefined || now - last >= reminderMs;
+        if (last === undefined)
+            return true;
+        const n = state.reminded?.[o.id] ?? 0;
+        if (n >= MAX_REMINDERS)
+            return false;
+        const gap = Math.min(reminderMs * 2 ** n, Math.max(reminderMs, DAY_MS));
+        return now - last >= gap;
     });
 }
 export function pruneNotificationState(state, obligations, member, now = Date.now()) {
     const active = new Set(humanObligations(obligations, member).map((o) => o.id));
+    const reminded = Object.fromEntries(Object.entries(state.reminded ?? {}).filter(([id]) => active.has(id)));
     return {
         notified_at: Object.fromEntries(Object.entries(state.notified_at).filter(([id, at]) => active.has(id) || (id.startsWith("act:") && now - at < 7 * 86_400_000))),
+        ...(Object.keys(reminded).length ? { reminded } : {}),
     };
 }
 function readState(file) {
     try {
         const parsed = JSON.parse(readFileSync(file, "utf8"));
-        return { notified_at: parsed.notified_at ?? {} };
+        return { notified_at: parsed.notified_at ?? {}, ...(parsed.reminded ? { reminded: parsed.reminded } : {}) };
     }
     catch {
         return { notified_at: {} };
@@ -111,7 +122,7 @@ export function sendDesktopNotification(notice, home = CONFIG_DIR) {
     if (!existsSync(binary))
         return false;
     try {
-        const child = spawn(binary, ["post", "--json", JSON.stringify({ ...notice, bin_dir: join(home, "bin") })], { detached: true, stdio: "ignore" });
+        const child = spawn(binary, ["post", "--json", JSON.stringify({ ...notice, bin_dir: join(home, "bin"), pantheon: whichPantheon() ?? "pantheon" })], { detached: true, stdio: "ignore" });
         child.unref();
         return true;
     }
@@ -139,7 +150,7 @@ export class HumanNotifier {
         const pollMs = this.opts.pollMs ?? 5_000;
         let state = readState(stateFile);
         this.opts.log(`notifier online as ${this.cfg.member}`);
-        this.opts.log(`  reminders every ${Math.round(this.opts.reminderMs / 60_000)} minutes while unresolved`);
+        this.opts.log(`  reminders after ${Math.round(this.opts.reminderMs / 60_000)} minutes, then doubling to daily, ${MAX_REMINDERS} at most — after that a decision waits on pantheon brief and the menu bar`);
         while (!this.stopped) {
             const pruned = pruneNotificationState(state, client.obligations, this.cfg.member, now());
             let dirty = JSON.stringify(pruned) !== JSON.stringify(state);
@@ -153,13 +164,16 @@ export class HumanNotifier {
             const peerOf = (from) => from ? { member: from, agent: client.roster.find((m) => m.id === from)?.agent } : undefined;
             const withLabel = (n) => this.opts.label ? { ...n, context: n.context ? `${this.opts.label} · ${n.context}` : this.opts.label } : n;
             for (const obligation of due) {
+                const isReminder = state.notified_at[obligation.id] !== undefined;
                 const act = client.seenAct(obligation.ref);
                 const notice = withLabel(composeDecision(obligation, act, obligation.goal ? client.goals.get(obligation.goal) : undefined, peerOf(act?.from), { tools, preferred: preferredTool(profile, tools), now: now() }));
                 const ok = send(notice);
                 if (ok) {
                     state.notified_at[obligation.id] = now();
+                    if (isReminder)
+                        state.reminded = { ...(state.reminded ?? {}), [obligation.id]: (state.reminded?.[obligation.id] ?? 0) + 1 };
                     dirty = true;
-                    this.opts.log(`> notified for ${obligation.id} (${oneLine(obligation.body, 100)})`);
+                    this.opts.log(`> ${isReminder ? `reminder ${state.reminded[obligation.id]}/${MAX_REMINDERS}` : "notified"} for ${obligation.id} (${oneLine(obligation.body, 100)})`);
                 }
                 else {
                     this.opts.log(`! could not show a desktop notification for ${obligation.id}`);

package/dist/relay.js

@@ -12,7 +12,7 @@ import { Accounts, normalizeUsername, validEmail, validUsername } from "./accoun
 import { emailSenderFromEnv } from "./email.js";
 import { Allowlist } from "./roster-file.js";
 import { StateStore } from "./store.js";
-import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
+import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, spaceHealth, fleetReport, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
 import { fmtLimit, parseLimits, PLAN_NAME } from "./plans.js";
 import { routeDecision } from "./profile.js";
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
@@ -263,6 +263,17 @@ export class Relay {
                         : {}),
             });
         }
+        if (url.pathname === "/act") {
+            const space = this.spaces.get(url.searchParams.get("space") ?? "");
+            const token = url.searchParams.get("token") ?? "";
+            if (!space || space.token !== token)
+                return this.json(res, 404, { error: "no such space" });
+            const act = space.ledger.find(url.searchParams.get("id") ?? "");
+            if (!act)
+                return this.json(res, 404, { error: "no such act" });
+            const goal = act.goal ? space.goals.get(act.goal) : undefined;
+            return this.json(res, 200, { act, ...(goal ? { goal: { id: goal.id, title: goal.title, state: goal.state } } : {}) });
+        }
         if (url.pathname === "/history") {
             const space = this.spaces.get(url.searchParams.get("space") ?? "");
             const token = url.searchParams.get("token") ?? "";
@@ -350,7 +361,7 @@ export class Relay {
     onAuthHttp(req, res, url, ip) {
         if (url.pathname === "/")
             return this.landingPage(res);
-        if (url.pathname === "/admin" || url.pathname === "/admin/space" || url.pathname === "/admin/export" || url.pathname === "/admin/backup" || url.pathname === "/admin/action" || url.pathname === "/admin/login" || url.pathname === "/admin/logout") {
+        if (url.pathname === "/admin" || url.pathname === "/admin/space" || url.pathname === "/admin/export" || url.pathname === "/admin/backup" || url.pathname === "/admin/action" || url.pathname === "/admin/login" || url.pathname === "/admin/logout" || url.pathname === "/admin/report") {
             const A0 = this.accounts;
             if (!A0 || !this.adminToken)
                 return this.json(res, 404, { error: "not found" });
@@ -381,6 +392,15 @@ export class Relay {
                 return void res.end();
             }
             const authed = (fromCookie && tokenOk(fromCookie)) || (fromQuery && tokenOk(fromQuery));
+            if (url.pathname === "/admin/report") {
+                if (!authed)
+                    return this.json(res, 401, { error: "admin token required" });
+                const rows = this.fleetHealth();
+                if (url.searchParams.get("format") === "json")
+                    return this.json(res, 200, { relay: VERSION, generated: Date.now(), spaces: rows });
+                res.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
+                return void res.end(fleetReport(rows, VERSION) + "\n");
+            }
             if (url.pathname === "/admin/export") {
                 if (!authed)
                     return this.json(res, 403, { error: "sign in at /admin, or append ?token=…" });
@@ -693,6 +713,37 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
     adminCsrf() {
         return createHash("sha256").update("pantheon-admin-csrf " + (this.adminToken ?? "")).digest("hex").slice(0, 32);
     }
+    fleetHealth(now = Date.now()) {
+        const out = [];
+        const seen = new Set();
+        const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
+        for (const sp of this.spaces.values()) {
+            seen.add(safeOf(sp.name));
+            out.push(spaceHealth({
+                name: sp.name, records: sp.ledger.all(), members: sp.allow.all(),
+                online: [...sp.members.values()].filter((m) => m.sessions.size > 0).length, relayPkg: VERSION, now,
+            }));
+        }
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir);
+        }
+        catch { }
+        for (const f of files) {
+            if (!f.endsWith(".members.json"))
+                continue;
+            const safe = f.slice(0, -".members.json".length);
+            if (seen.has(safe))
+                continue;
+            let members = [];
+            try {
+                members = new Allowlist(this.dataDir, safe).all();
+            }
+            catch { }
+            out.push(spaceHealth({ name: safe, records: this.sleepingRecords(safe), members, online: 0, relayPkg: VERSION, now }));
+        }
+        return out;
+    }
     spacesOverview() {
         const now = Date.now();
         const out = new Map();
@@ -2444,6 +2495,7 @@ pantheon signup --email you@work.com --username you</code></pre>
         m.agent = agent;
         m.last_seen = Date.now();
         m.sessions.set(session, { id: session, role, agent, ...(pkg ? { pkg } : {}), ws });
+        sp.allow.touch(id, pkg, agent);
         return m;
     }
     work(m) {

package/dist/roster-file.js

@@ -146,6 +146,23 @@ export class Allowlist {
         this.flush();
         return true;
     }
+    static TOUCH_EVERY_MS = 10 * 60_000;
+    touch(member, pkg, agent, now = Date.now()) {
+        const e = this.entries.get(member);
+        if (!e)
+            return false;
+        const known = agent && agent !== "unknown" ? agent : undefined;
+        const changed = (pkg !== undefined && pkg !== e.last_pkg) || (known !== undefined && known !== e.last_agent);
+        if (!changed && e.last_seen !== undefined && now - e.last_seen < Allowlist.TOUCH_EVERY_MS)
+            return false;
+        e.last_seen = now;
+        if (pkg !== undefined)
+            e.last_pkg = pkg;
+        if (known !== undefined)
+            e.last_agent = known;
+        this.flush();
+        return true;
+    }
     admittedCount() { return [...this.entries.values()].filter((e) => e.admitted).length; }
     founder() {
         const f = [...this.entries.values()].filter((e) => e.admitted && (e.admitted_by === e.member || e.admitted_by === undefined)).sort((a, b) => a.first_seen - b.first_seen)[0];

package/dist/run-failure.js

@@ -0,0 +1,97 @@
+import { execFileSync } from "node:child_process";
+const sh = (dir, ...args) => execFileSync("git", ["-C", dir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000 }).trim();
+export const gitProbe = {
+    isRepo: (dir) => { try {
+        return sh(dir, "rev-parse", "--is-inside-work-tree") === "true";
+    }
+    catch {
+        return false;
+    } },
+    hasRemote: (dir) => { try {
+        return sh(dir, "remote").split("\n").some((r) => r.trim());
+    }
+    catch {
+        return false;
+    } },
+    dirty: (dir) => { try {
+        return sh(dir, "status", "--porcelain").split("\n").map((l) => l.trim()).filter(Boolean);
+    }
+    catch {
+        return [];
+    } },
+    branchOf: (dir) => { try {
+        return sh(dir, "rev-parse", "--abbrev-ref", "HEAD");
+    }
+    catch {
+        return "";
+    } },
+};
+export function exitLine(detail) {
+    const lines = detail.split("\n").map((l) => l.trim());
+    const first = lines[0] ?? "";
+    if (!/^exit\s+-?\d+$/.test(first))
+        return first.slice(0, 120);
+    const said = lines.slice(1).find((l) => l && !/^\s*$/.test(l));
+    return (said ? `${first}: ${said}` : first).slice(0, 120);
+}
+const list = (paths, max = 3) => paths.length <= max ? paths.join(", ") : `${paths.slice(0, max).join(", ")} and ${paths.length - max} more`;
+const ask = (fn, fallback) => { try {
+    return fn();
+}
+catch {
+    return fallback;
+} };
+export function diagnoseRun(f, probe = gitProbe) {
+    if (!f.exited) {
+        return {
+            cause: "crashed",
+            says: `The agent did not finish — ${exitLine(f.detail)}.`,
+            fix: `Read the transcript at ${f.runLog}. If the agent CLI is broken or missing, pantheon doctor names it.`,
+            dir: f.worktree,
+            lines: [`cat ${f.runLog}`],
+        };
+    }
+    if (!f.branch) {
+        return {
+            cause: "not_a_repo",
+            says: "There is no git repo here, so the run had no branch and nothing it could deliver.",
+            fix: `It can still answer and escalate. To let it deliver work, point the worker at a checkout: pantheon service install worker from inside the repo.`,
+        };
+    }
+    if (!f.allowBash) {
+        return {
+            cause: "no_commands",
+            says: "This worker may edit files but not run commands, so it could not run tests, commit or push.",
+            fix: "Allow commands if you want unattended runs to deliver work: pantheon setup --commands yes. Until then a woken run can answer and draft, never deliver.",
+            capability: "run_commands",
+        };
+    }
+    if (!ask(() => probe.hasRemote(f.project), true)) {
+        return {
+            cause: "no_remote",
+            says: "This repo has no remote, so nothing the run builds can be fetched by the teammate who asked.",
+            fix: "Add a remote your teammate can reach, then the run can push a branch and DELIVER it.",
+            dir: f.project,
+            lines: ["git remote add origin <url>", "git push -u origin HEAD"],
+        };
+    }
+    const dirty = ask(() => probe.dirty(f.project), []);
+    if (dirty.length) {
+        const on = ask(() => probe.branchOf(f.project), "");
+        return {
+            cause: "human_has_it",
+            says: `The work is uncommitted in your own checkout${on ? ` on ${on}` : ""} — a run never sees that, it starts from what origin has.`,
+            fix: "Commit and push it yourself, then the run (or your teammate) can see it. A worker deliberately never touches your working tree.",
+            dir: f.project,
+            lines: [`git status --short   # ${list(dirty)}`, "git add -A", `git commit -m "…"`, `git push${on ? ` -u origin ${on}` : ""}`],
+        };
+    }
+    return {
+        cause: "silent",
+        says: "The run finished cleanly but sent nothing back, so the request is still open.",
+        fix: `Read what it did at ${f.runLog}. If it was right to stay silent, answer the teammate yourself; if not, the transcript says where it stopped.`,
+        dir: f.worktree,
+        lines: [`cat ${f.runLog}`],
+    };
+}
+//# sourceMappingURL=run-failure.js.map

package/dist/setup-guide.js

@@ -1,4 +1,5 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { approvalSummary, installForUser } from "./install.js";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -33,6 +34,7 @@ export function guideDefaults(profile, cfg) {
     return {
         wake: profile.agent.wake_default ?? "anyone",
         commands: profile.agent.allow_bash ?? false,
+        approval: profile.agent.approval ?? "approve",
         name: profile.human.display_name || cfg.display || cfg.member,
         title: profile.human.title || "",
         decides: Object.entries(profile.authority).filter(([, m]) => m === "human_required").map(([d]) => d),
@@ -64,7 +66,7 @@ export function questionnaire() {
         "",
         "Only 3 and 4 need the person every time. Ask 2 whenever there is a repo (it is the one default people are",
         "surprised by). The rest have defaults you may take and say out loud:",
-        "  --wake anyone --decides none --alerts decisions --playbook yes --base <what origin calls its default>",
+        "  --wake anyone --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
         "Without a repo, --wake, --commands, --playbook and --base do nothing yet: skip them and say so.",
         "",
         "1. While they're away, may teammates hand work to this machine? (their agent runs here on its own,",
@@ -86,6 +88,13 @@ export function questionnaire() {
         "8. Which branch should workers start from, and deliveries be checked against? Usually the branch this",
         "   project deploys or releases from (often the default branch).     → --base <branch>",
         "",
+        "9. Should their own agent ask them before each message it sends to a teammate in their name? Default no:",
+        "   the agent coordinates for them without stopping. Reads and waiting never prompt either way.",
+        opt("approve-all", "", "No — send, open goals and claim work without asking (recommended; the default)"),
+        opt("ask-before-sending", "", "Yes — show each send, goal and claim for approval first"),
+        "   These are switches: pass --approve-all or --ask-before-sending with no value. Either way the install",
+        "   output prints the exact line written to ~/.codex/config.toml, and pantheon leave removes it.",
+        "",
         "Example:  pantheon setup --yes --wake anyone --commands yes --name \"Praneet Sinha\" --title Founder \\",
         "            --decides deployment --alerts decisions --playbook yes --base main",
     ].join("\n");
@@ -133,6 +142,12 @@ export function parseSetupFlags(argv) {
     const playbook = yn("playbook");
     if (playbook !== undefined)
         preset.persona = playbook;
+    if (argv.includes("--ask-before-sending") && argv.includes("--approve-all"))
+        errors.push("--ask-before-sending and --approve-all contradict each other; pass one");
+    else if (argv.includes("--ask-before-sending"))
+        preset.approval = "ask-before-sending";
+    else if (argv.includes("--approve-all"))
+        preset.approval = "approve";
     const base = val("base");
     if (base !== undefined && base.trim())
         preset.base = base.trim();
@@ -179,6 +194,9 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
                 : a.wake === "anyone" ? "teammates may hand work to this machine while you're away; invites you send grant it, and you can revoke anyone (pantheon admit <name> --revoke)"
                     : "only people you approve by hand (pantheon admit <name> --may-wake)"}`);
         io.say(`  • Alerts: ${shortAlert(a.notifications).toLowerCase()}`);
+        io.say(`  • Approval: ${a.approval === "approve"
+            ? "your agent sends to teammates in your name without asking each time (Claude Code, Cursor and Codex)"
+            : "your agent asks you before each send, goal and claim; reading and waiting never prompt"}`);
         io.say(`  • Decisions: ${a.decides.length ? `you personally decide ${a.decides.join(", ")}` : "none reserved for you — your agent may decide; add an area when one comes up"}`);
         if (a.wake !== "no" && ctx.project)
             io.say(`  • Playbook: ${a.persona ? "a short starter playbook for your worker, in this repo" : "none"}`);
@@ -212,6 +230,8 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
                 const b = await io.choose("Which branch should your worker start from, and deliveries be checked against? Usually the branch this project deploys or releases from.", [`${suggestedBase}${suggestedBase === detected ? " (what origin calls its default)" : ""}`, "A different branch"], 0);
                 a.base = b === 0 ? suggestedBase : ((await io.ask("Branch name", suggestedBase)).trim() || suggestedBase);
             }
+            const ap = await io.choose("Should your agent ask you before each message it sends to a teammate in your name? Reading the board and waiting for peers never prompt either way.", ["No — coordinate for me without stopping to ask (recommended)", "Yes — show me each send, goal and claim first"], a.approval === "approve" ? 0 : 1);
+            a.approval = ap === 0 ? "approve" : "ask-before-sending";
         }
     }
     let next = a.title ? applyProfileInit(profile, { name: a.name, title: a.title }) : { ...profile, human: { ...profile.human, display_name: a.name } };
@@ -227,7 +247,7 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     next = {
         ...next,
         authority,
-        agent: { ...next.agent, wake_enabled: a.wake !== "no", wake_default: a.wake, allow_bash: a.commands },
+        agent: { ...next.agent, wake_enabled: a.wake !== "no", wake_default: a.wake, allow_bash: a.commands, approval: a.approval },
         notifications: {
             decisions: a.notifications !== "none",
             deliveries: a.notifications === "deliveries" || a.notifications === "worker",
@@ -246,6 +266,14 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
             warnings.push(`profile saved but not published (${e.message}) — run \`pantheon profile publish\` when the relay is reachable`);
         }
     }
+    const wiring = deps.applyAgentWiring ?? ((ap) => installForUser(ap).map((t) => ({ tool: t.tool, status: t.status })));
+    try {
+        const codex = wiring(a.approval).find((t) => t.tool === "codex");
+        applied.push(`approval: ${approvalSummary(a.approval)}${codex ? ` — codex: ${codex.status}` : ""}`);
+    }
+    catch (e) {
+        warnings.push(`agent wiring not re-applied (${e.message}) — run pantheon install --user`);
+    }
     if (a.wake === "no") {
         if (installed("worker")) {
             try {

package/dist/tools.js

@@ -1,6 +1,13 @@
 export const PANTHEON_TOOL_NAMES = [
-    "pantheon_status", "pantheon_brief", "pantheon_wait", "pantheon_send",
-    "pantheon_claim", "pantheon_open_goal", "pantheon_history",
+    "pantheon_status", "pantheon_brief", "pantheon_directory", "pantheon_route_decision",
+    "pantheon_wait", "pantheon_history",
+    "pantheon_send", "pantheon_open_goal", "pantheon_claim",
 ];
+export const WRITE_TOOL_NAMES = ["pantheon_send", "pantheon_open_goal", "pantheon_claim"];
+export const READ_TOOL_NAMES = PANTHEON_TOOL_NAMES.filter((t) => !WRITE_TOOL_NAMES.includes(t));
 export const PANTHEON_TOOLS = PANTHEON_TOOL_NAMES.map((t) => `mcp__pantheon__${t}`);
+export const APPROVAL_MODES = ["approve", "ask-before-sending"];
+export function toolsAllowed(approval) {
+    return approval === "ask-before-sending" ? READ_TOOL_NAMES : PANTHEON_TOOL_NAMES;
+}
 //# sourceMappingURL=tools.js.map

package/dist/tray.js

@@ -11,7 +11,7 @@ import { requireDeveloperTools } from "./notifier.js";
 import { plistPath, serviceInstalled, whichPantheon } from "./service.js";
 import { VERSION } from "./version.js";
 import { LIMITS } from "./protocol.js";
-import { allDecisionsPrompt, decisionPrompt, decisionTitle, workerSummary } from "./decision-ui.js";
+import { allDecisionsPrompt, decisionPrompt, decisionTitle, owedPrompt, stripCeremony, waitingPrompt, workerSummary } from "./decision-ui.js";
 import { loadProfile, SURFACE_BUNDLE_IDS } from "./profile.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const trayBinaryPath = (home = CONFIG_DIR) => join(home, "bin", "pantheon-tray");
@@ -93,6 +93,9 @@ export async function trayStatus(cfg = load(), f = loadAll()) {
             members: ok.reduce((n, p) => n + (p.members ?? 0), 0),
             decisions: ok.flatMap((p) => (p.decisions ?? []).map((d) => ({ ...d, body: `[${p.space}] ${d.body}` }))),
             decisions_prompt: allDecisionsPrompt(ok.reduce((n, p) => n + (p.decisions?.length ?? 0), 0)),
+            items: ok.flatMap((p) => (p.items ?? []).map((i) => ({ ...i, space: p.space }))),
+            owed_count: ok.reduce((n, p) => n + (p.owed_count ?? 0), 0),
+            waiting_count: ok.reduce((n, p) => n + (p.waiting_count ?? 0), 0),
         };
     }
     return trayStatusOne(cfg);
@@ -104,14 +107,40 @@ async function trayStatusOne(cfg) {
     const q = `space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}`;
     const [health, obligations] = await Promise.all([
         getJson(`${base}/health?space=${encodeURIComponent(cfg.space)}`),
-        getJson(`${base}/obligations?${q}&member=${encodeURIComponent(`human:${cfg.member}`)}`),
+        getJson(`${base}/obligations?${q}`),
     ]);
     const space = health
         ?.spaces?.find((s) => s.name === cfg.space);
     const pending = obligations?.obligations;
-    const decisionsOk = Array.isArray(pending) && pending.every((o) => o && typeof o.id === "string" && typeof o.body === "string");
-    const decisions = (decisionsOk ? pending : [])
+    const ok = Array.isArray(pending) && pending.every((o) => o && typeof o.id === "string" && typeof o.body === "string" && typeof o.owner === "string");
+    const all = (ok ? pending : []);
+    const mineHuman = all.filter((o) => o.owner === `human:${cfg.member}`);
+    const decisionsOk = ok;
+    const decisions = mineHuman
         .map((o) => ({ id: o.id, body: decisionTitle(o.body), detail: o.body, prompt: decisionPrompt(o.id) }));
+    const senderOf = (o) => stripCeremony(o.body).from;
+    const row = (o, kind, who, prompt) => ({
+        id: o.id, kind, title: decisionTitle(o.body), headline: decisionTitle(o.body, 200), detail: o.body, prompt, who,
+        when: o.created_at ?? 0,
+        ...(o.goal ? { goal: o.goal } : {}),
+        ...(o.ref ? { ref: o.ref } : {}),
+    });
+    const owed = all.filter((o) => o.owner === cfg.member);
+    const waiting = all.filter((o) => o.owner !== cfg.member && o.owner !== `human:${cfg.member}`);
+    const items = [
+        ...mineHuman.map((o) => {
+            const from = senderOf(o);
+            return row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id));
+        }),
+        ...owed.map((o) => row(o, "owed", "you", owedPrompt(decisionTitle(o.body), o.goal))),
+        ...waiting.map((o) => {
+            const who = o.owner.replace(/^human:/, "");
+            const r = row(o, "waiting", who, waitingPrompt(who, decisionTitle(o.body), o.goal));
+            return o.owner.startsWith("human:")
+                ? { ...r, title: `${who} decides: ${r.title}`, headline: `${who} decides: ${r.headline}` }
+                : r;
+        }),
+    ];
     const profile = loadProfile(cfg);
     const surface = profile.agent.primary_surface;
     const surfaceName = surface === "claude-code" ? "Claude" : surface === "cursor" ? "Cursor" : "Codex";
@@ -137,6 +166,9 @@ async function trayStatusOne(cfg) {
         surface_bundle_id: SURFACE_BUNDLE_IDS[surface],
         decisions_prompt: allDecisionsPrompt(decisions.length),
         decisions,
+        items,
+        owed_count: owed.length,
+        waiting_count: waiting.length,
     };
 }
 //# sourceMappingURL=tray.js.map