@join-pantheon/cli 0.24.4 → 0.25.1

package/dist/doctor.js

@@ -1,18 +1,22 @@
 import { execFileSync } from "node:child_process";
+import { instructionBudget } from "./mcp-instructions.js";
 import { describeWindows, scanMcpWindows } from "./mcp-windows.js";
+import { grantsSeen, measureMcp, toolsReport, HOST_STARTUP_ALLOWANCE_MS, STARTUP_WARN_MS } from "./measure.js";
+import { FEEDBACK_ADDRESS } from "./feedback.js";
 import { loadProfile, profileInitialized } from "./profile.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { PantheonClient } from "./client.js";
 import { load, resolveFor, loadAll, CONFIG_PATH } from "./config.js";
 import { fingerprint, signChallenge, verifyChallenge } from "./identity.js";
-import { onPath } from "./install.js";
+import { approvalSummary, chosenApproval, onPath } from "./install.js";
 import { hookState, readIntent, agentHookStates } from "./notify.js";
 import { loadPersonas } from "./persona.js";
-import { workerProc } from "./machine.js";
+import { workerProc, menubarProc, notifierProc } from "./machine.js";
 import { VERSION } from "./version.js";
 import { serviceInstalled } from "./service.js";
 import { hostEnv } from "./host-env.js";
+const HOSTED_RELAY = "relay.joinpantheon.network";
 const sh = (cmd, cwd) => {
     try {
         return execFileSync("sh", ["-lc", cmd], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -43,58 +47,60 @@ function isPrivate(host) {
 }
 export async function doctor(projectDir) {
     const out = [];
-    const add = (level, name, detail, fix) => out.push({ level, name, detail, ...(fix ? { fix } : {}) });
+    const add = (level, name, detail, fix, share) => out.push({ level, name, detail, ...(fix ? { fix } : {}), ...(share ? { share } : {}) });
     const major = Number(process.versions.node.split(".")[0]);
     major >= 22
-        ? add("pass", "node", `v${process.versions.node}`)
-        : add("fail", "node", `v${process.versions.node} is too old`, "pantheon needs Node 22 or newer (the relay uses node:sqlite) — install it and re-run");
+        ? add("pass", "node", `v${process.versions.node}`, undefined, `v${process.versions.node}`)
+        : add("fail", "node", `v${process.versions.node} is too old`, "pantheon needs Node 22 or newer (the relay uses node:sqlite) — install it and re-run", `v${process.versions.node}, too old`);
     const host = hostEnv();
     if (host.ephemeral) {
-        add("warn", "machine", `${host.platform} in ${host.kind === "container" ? "a container" : "a cloud workspace"} — ${host.evidence.join("; ")}`, `this is not the computer you work on, which is why it reports ${host.platform} to someone who may be sitting at a Mac. The team and your account are fine here, but the menu bar, desktop alerts and the worker belong on your own machine — run the setup from a terminal there.`);
+        add("warn", "machine", `${host.platform} in ${host.kind === "container" ? "a container" : "a cloud workspace"} — ${host.evidence.join("; ")}`, `this is not the computer you work on, which is why it reports ${host.platform} to someone who may be sitting at a Mac. The team and your account are fine here, but the menu bar, desktop alerts and the worker belong on your own machine — run the setup from a terminal there.`, `${host.platform} in ${host.kind === "container" ? "a container" : "a cloud workspace"}`);
     }
     else {
-        add("pass", "machine", `${host.platform}${host.desktop ? " — menu bar and desktop alerts can run here" : " — no menu bar or desktop alerts (macOS only); use phone or chat delivery"}`);
+        add("pass", "machine", `${host.platform}${host.desktop ? " — menu bar and desktop alerts can run here" : " — no menu bar or desktop alerts (macOS only); use phone or chat delivery"}`, undefined, `${host.platform}${host.desktop ? ", desktop" : ""}`);
     }
     let cfg = null;
     try {
         cfg = load();
     }
     catch (e) {
-        add("fail", "config", `unreadable: ${e.message}`);
+        add("fail", "config", `unreadable: ${e.message}`, undefined, "unreadable");
     }
     if (!cfg) {
-        add("fail", "config", "no config found", "run `pantheon signup` (new here) then `pantheon start` (create a team), or `pantheon join <invite>` (join one)");
+        if (!out.some((c) => c.name === "config")) {
+            add("fail", "config", "no config found", "run `pantheon signup` (new here) then `pantheon start` (create a team), or `pantheon join <invite>` (join one)", "none");
+        }
         return out;
     }
-    add("pass", "config", `${cfg.member} in "${cfg.space}" via ${cfg.relay}  (${CONFIG_PATH})`);
+    add("pass", "config", `${cfg.member} in "${cfg.space}" via ${cfg.relay}  (${CONFIG_PATH})`, undefined, "present");
     const here = resolveFor(projectDir, { strict: true });
     const nTeams = Object.keys(loadAll()?.spaces ?? {}).length;
     if (here.reason === "binding")
-        add("pass", "team", `this repo is bound to "${here.cfg.space}"${here.repo?.origin ? ` (${here.repo.origin})` : ""}`);
+        add("pass", "team", `this repo is bound to "${here.cfg.space}"${here.repo?.origin ? ` (${here.repo.origin})` : ""}`, undefined, `this repo is bound to a team (${nTeams} on this machine)`);
     else if (here.reason === "single")
-        add("pass", "team", `"${cfg.space}" — your only team, so every folder resolves to it`);
+        add("pass", "team", `"${cfg.space}" — your only team, so every folder resolves to it`, undefined, "one team on this machine");
     else if (here.reason === "unbound")
-        add("fail", "team", `this folder is not bound to any of your ${nTeams} teams — agents opened here will refuse to send`, `from the team's checkout: pantheon use <team> --here   (pantheon spaces lists them)`);
+        add("fail", "team", `this folder is not bound to any of your ${nTeams} teams — agents opened here will refuse to send`, `from the team's checkout: pantheon use <team> --here   (pantheon spaces lists them)`, `folder not bound to any of ${nTeams} teams`);
     else if (here.reason === "stale")
-        add("fail", "team", `this repo is bound to a team this machine has left (${here.binding?.space})`, "pantheon use <team> --here, or pantheon join <invite>");
+        add("fail", "team", `this repo is bound to a team this machine has left (${here.binding?.space})`, "pantheon use <team> --here, or pantheon join <invite>", "bound to a team this machine has left");
     if (here.repo && !here.repo.shared)
-        add("warn", "team", "this repo has no origin remote", "DELIVERED must name a commit a teammate can fetch; add a remote before delivering");
+        add("warn", "team", "this repo has no origin remote", "DELIVERED must name a commit a teammate can fetch; add a remote before delivering", "repo has no origin remote");
     const nonce = "doctor-selftest";
     const sig = signChallenge(cfg.privateKey, cfg.space, cfg.member, nonce);
     verifyChallenge(cfg.publicKey, cfg.space, cfg.member, nonce, sig)
-        ? add("pass", "identity", `keypair valid — fingerprint ${fingerprint(cfg.publicKey)}`)
-        : add("fail", "identity", "your keypair does not verify against itself", "the config is corrupt — re-run `pantheon join` to mint a new identity, then get re-admitted");
+        ? add("pass", "identity", `keypair valid — fingerprint ${fingerprint(cfg.publicKey)}`, undefined, "keypair valid")
+        : add("fail", "identity", "your keypair does not verify against itself", "the config is corrupt — re-run `pantheon join` to mint a new identity, then get re-admitted", "keypair does not verify");
     const prof = loadProfile(cfg);
     if (profileInitialized(prof)) {
         const owns = Object.entries(prof.authority).filter(([, mode]) => mode === "human_required").map(([d]) => d);
-        add("pass", "profile", `${prof.human.display_name} — ${prof.human.title}${owns.length ? `; you personally decide: ${owns.join(", ")}` : "; no human-required domains yet"}`);
+        add("pass", "profile", `${prof.human.display_name} — ${prof.human.title}${owns.length ? `; you personally decide: ${owns.join(", ")}` : "; no human-required domains yet"}`, undefined, `published, ${owns.length} human-required domain${owns.length === 1 ? "" : "s"}`);
     }
     else {
-        add("warn", "profile", "no profile published — decisions cannot be routed to you, and a HUMAN_REQUIRED naming you arrives marked unverified", "pantheon profile set --name <you> --title <role> --human-required <domains you personally decide>");
+        add("warn", "profile", "no profile published — decisions cannot be routed to you, and a HUMAN_REQUIRED naming you arrives marked unverified", "pantheon profile set --name <you> --title <role> --human-required <domains you personally decide>", "none published");
     }
     const mcpFile = join(projectDir, ".mcp.json");
     if (!existsSync(mcpFile)) {
-        add("warn", "mcp entry", "no .mcp.json in this project", "run `pantheon install`");
+        add("warn", "mcp entry", "no .mcp.json in this project", "run `pantheon install`", "no .mcp.json in this project");
     }
     else {
         let entry = {};
@@ -103,64 +109,67 @@ export async function doctor(projectDir) {
         }
         catch { }
         if (!entry.command) {
-            add("fail", "mcp entry", ".mcp.json has no pantheon server", "run `pantheon install`");
+            add("fail", "mcp entry", ".mcp.json has no pantheon server", "run `pantheon install`", ".mcp.json has no pantheon server");
         }
         else if (entry.command === "pantheon") {
-            add("pass", "mcp entry", "portable (`pantheon mcp`) — safe to commit, works on your teammate's machine");
+            add("pass", "mcp entry", "portable (`pantheon mcp`) — safe to commit, works on your teammate's machine", undefined, "portable");
         }
         else {
-            add("fail", "mcp entry", `hard-codes this machine: ${entry.command}`, "make sure `pantheon` is on your PATH, then run `pantheon install` again — it writes the portable `pantheon mcp` entry. Committed as-is it silently fails on the other machine: the MCP server never starts and no error is shown.");
+            add("fail", "mcp entry", `hard-codes this machine: ${entry.command}`, "make sure `pantheon` is on your PATH, then run `pantheon install` again — it writes the portable `pantheon mcp` entry. Committed as-is it silently fails on the other machine: the MCP server never starts and no error is shown.", "hard-codes a path on this machine");
         }
     }
     onPath()
-        ? add("pass", "PATH", "`pantheon` resolves by name")
-        : add("warn", "PATH", "`pantheon` is not on PATH", "install it globally (`npm install -g @join-pantheon/cli`) and make sure your npm global bin dir (`npm bin -g`) is on PATH");
+        ? add("pass", "PATH", "`pantheon` resolves by name", undefined, "pantheon resolves by name")
+        : add("warn", "PATH", "`pantheon` is not on PATH", "install it globally (`npm install -g @join-pantheon/cli`) and make sure your npm global bin dir (`npm bin -g`) is on PATH", "pantheon is not on PATH");
     const inRepo = sh("git rev-parse --is-inside-work-tree", projectDir) === "true";
     if (!inRepo) {
-        add("warn", "git", `${projectDir} is not a git repo`, "DELIVERED requires a pushed branch + commit, so the work needs to live in a repo you both clone");
+        add("warn", "git", `${projectDir} is not a git repo`, "DELIVERED requires a pushed branch + commit, so the work needs to live in a repo you both clone", "not a git repo");
     }
     else {
         const remote = sh("git remote get-url origin", projectDir);
         remote
-            ? add("pass", "git", `repo with origin ${remote}`)
-            : add("fail", "git", "repo has no `origin` remote", "DELIVERED names a commit your teammate fetches. Without a shared remote they cannot verify anything you deliver.");
+            ? add("pass", "git", `repo with origin ${remote}`, undefined, "repo with an origin remote")
+            : add("fail", "git", "repo has no `origin` remote", "DELIVERED names a commit your teammate fetches. Without a shared remote they cannot verify anything you deliver.", "repo without an origin remote");
         const branch = sh("git rev-parse --abbrev-ref HEAD", projectDir);
         if (branch)
             add("pass", "git branch", branch);
     }
     const agents = ["claude", "codex", "cursor-agent"].filter((a) => sh(`command -v ${a}`));
     agents.length
-        ? add("pass", "agent cli", agents.join(", "))
-        : add("warn", "agent cli", "found none of claude / codex / cursor-agent on PATH", "fine if you only drive agents through a GUI (Conductor, Cursor), but `pantheon worker` needs a CLI to spawn");
+        ? add("pass", "agent cli", agents.join(", "), undefined, agents.join(", "))
+        : add("warn", "agent cli", "found none of claude / codex / cursor-agent on PATH", "fine if you only drive agents through a GUI (Conductor, Cursor), but `pantheon worker` needs a CLI to spawn", "none of claude / codex / cursor-agent on PATH");
     const url = new URL(cfg.relay);
+    const hosted = url.host === HOSTED_RELAY;
     if (url.protocol === "ws:" && !isPrivate(url.host)) {
-        add("fail", "transport", `plain ws:// to a public address (${url.host}) — your space token crosses the internet in clear text`, "put it behind TLS (cloudflared/Caddy) and use a pantheons:// invite, or move the relay onto a private network (Tailscale)");
+        add("fail", "transport", `plain ws:// to a public address (${url.host}) — your space token crosses the internet in clear text`, "put it behind TLS (cloudflared/Caddy) and use a pantheons:// invite, or move the relay onto a private network (Tailscale)", "plain ws:// to a public address");
     }
     else {
-        add("pass", "transport", url.protocol === "wss:" ? "wss:// (TLS)" : `ws:// on a private address (${url.host})`);
+        add("pass", "transport", url.protocol === "wss:" ? "wss:// (TLS)" : `ws:// on a private address (${url.host})`, undefined, url.protocol === "wss:" ? "wss:// (TLS)" : "ws:// on a private address");
     }
     const health = `${cfg.relay.replace(/^ws/, "http")}/health`;
+    const where = hosted ? "hosted" : "self-hosted";
     try {
         const res = await fetch(health, { signal: AbortSignal.timeout(5000) });
         const body = (await res.json());
         if (!body.ok) {
-            add("fail", "relay", `answered but not healthy: ${JSON.stringify(body)}`);
+            add("fail", "relay", `answered but not healthy: ${JSON.stringify(body)}`, undefined, `answered but not healthy (${where})`);
         }
         else {
-            add("pass", "relay", `reachable at ${health}`);
+            add("pass", "relay", `reachable at ${health}`, undefined, `reachable (${where})`);
             if (body.pkg && body.pkg !== VERSION) {
-                add("warn", "version", `this machine is ${VERSION}, the relay is ${body.pkg}`, "run `pantheon upgrade` on the older side — features land on both halves of the wire, and the protocol version cannot tell you they are missing");
+                add("warn", "version", `this machine is ${VERSION}, the relay is ${body.pkg}`, "run `pantheon upgrade` on the older side — features land on both halves of the wire, and the protocol version cannot tell you they are missing", `this machine ${VERSION}, relay ${body.pkg}`);
             }
             else if (body.pkg) {
-                add("pass", "version", `${VERSION}, matching the relay`);
+                add("pass", "version", `${VERSION}, matching the relay`, undefined, `${VERSION}, matching the relay`);
             }
             else {
-                add("warn", "version", `this machine is ${VERSION}; the relay is too old to report its own`, "update the relay host, then re-run this");
+                add("warn", "version", `this machine is ${VERSION}; the relay is too old to report its own`, "update the relay host, then re-run this", `this machine ${VERSION}; relay too old to say`);
             }
         }
     }
     catch (e) {
-        add("fail", "relay", `cannot reach ${health} — ${e.message}`, "start it with `pantheon relay`, or check the tunnel/tailnet. Your teammate must be able to reach the SAME address.");
+        const msg = e.message;
+        add("fail", "relay", `cannot reach ${health} — ${msg}`, "start it with `pantheon relay`, or check the tunnel/tailnet. Your teammate must be able to reach the SAME address.", `unreachable (${where}): ${/abort|timeout/i.test(msg) ? "timed out" : /ECONNREFUSED/.test(msg) ? "connection refused" : /ENOTFOUND|EAI_AGAIN/.test(msg) ? "name did not resolve" : "fetch failed"}`);
         return out;
     }
     const client = new PantheonClient(cfg);
@@ -168,22 +177,23 @@ export async function doctor(projectDir) {
     await client.connect().then(() => { joined = true; }).catch(() => { });
     if (!joined) {
         client.pending
-            ? add("fail", "membership", "registered but not admitted", `ask an admitted member to run: pantheon admit ${cfg.member} --may-wake   (confirm fingerprint ${fingerprint(cfg.publicKey)} with them by voice first)`)
-            : add("fail", "membership", `refused: ${client.lastError ?? "unknown"}`, "if this is KEY_MISMATCH, someone else already registered your member name — pick another with --me, or have them revoke it");
+            ? add("fail", "membership", "registered but not admitted", `ask an admitted member to run: pantheon admit ${cfg.member} --may-wake   (confirm fingerprint ${fingerprint(cfg.publicKey)} with them by voice first)`, "registered, not admitted")
+            : add("fail", "membership", `refused: ${client.lastError ?? "unknown"}`, "if this is KEY_MISMATCH, someone else already registered your member name — pick another with --me, or have them revoke it", `refused: ${String(client.lastError ?? "unknown").split(/[\s:]/)[0]}`);
         client.close();
         return out;
     }
     await new Promise((r) => setTimeout(r, 400));
-    add("pass", "membership", `admitted as ${cfg.member}`);
+    add("pass", "membership", `admitted as ${cfg.member}`, undefined, "admitted");
     const admittedPeers = client.members.filter((m) => m.admitted && m.member !== cfg.member);
     const online = new Set(client.roster.filter((m) => m.online).map((m) => m.id));
     const pending = client.members.filter((m) => !m.admitted);
+    const peersOnline = admittedPeers.filter((p) => online.has(p.member)).length;
     admittedPeers.length
         ? add("pass", "peers", admittedPeers
-            .map((p) => `${p.member}[${online.has(p.member) ? "online" : "no session open"}]`).join("  "))
-        : add("warn", "peers", "nobody else is admitted to this space yet", "send your teammate an invite from `pantheon invite` (or the one `pantheon start` printed)");
+            .map((p) => `${p.member}[${online.has(p.member) ? "online" : "no session open"}]`).join("  "), undefined, `${admittedPeers.length} admitted, ${peersOnline} with a session open`)
+        : add("warn", "peers", "nobody else is admitted to this space yet", "send your teammate an invite from `pantheon invite` (or the one `pantheon start` printed)", "nobody else admitted yet");
     if (pending.length) {
-        add("warn", "pending", pending.map((p) => `${p.member} (${p.fingerprint})`).join("  "), `confirm the fingerprint by voice, then: pantheon admit ${pending[0].member} --may-wake`);
+        add("warn", "pending", pending.map((p) => `${p.member} (${p.fingerprint})`).join("  "), `confirm the fingerprint by voice, then: pantheon admit ${pending[0].member} --may-wake`, `${pending.length} waiting to be admitted`);
     }
     const wakers = client.members.filter((m) => m.admitted && m.may_wake && m.member !== cfg.member);
     const hookStates = agentHookStates(projectDir);
@@ -191,57 +201,91 @@ export async function doctor(projectDir) {
     const reportsActivity = hookStates.some((s) => s.events?.some((e) => /prompt|UserPromptSubmit|beforeSubmitPrompt/i.test(e))) || (hook.events?.includes("UserPromptSubmit") ?? false);
     const workerUp = workerProc().running;
     if (!wakers.length) {
-        add("warn", "wake rights", "no peer may wake a worker on this machine", "that is a safe default; grant it with `pantheon admit <them> --may-wake` when you want unattended replies");
+        add("warn", "wake rights", "no peer may wake a worker on this machine", "that is a safe default; grant it with `pantheon admit <them> --may-wake` when you want unattended replies", `no peer may wake; worker ${workerUp ? "running" : "not running"}`);
     }
     else {
         const who = `${wakers.map((m) => m.member).join(", ")} may wake a worker (space-wide grant)`;
         if (workerUp) {
-            add("pass", "wake rights", `${who} — worker is running`);
+            add("pass", "wake rights", `${who} — worker is running`, undefined, `${wakers.length} may wake; worker running`);
         }
         else {
-            add("warn", "wake rights", `${who}, but no worker is running here, so nothing can be woken`, "start one with `pantheon service install worker --project <a git repo>`; until then a peer's act waits for you to type");
+            add("warn", "wake rights", `${who}, but no worker is running here, so nothing can be woken`, "start one with `pantheon service install worker --project <a git repo>`; until then a peer's act waits for you to type", `${wakers.length} may wake; worker not running`);
         }
     }
     if (host.desktop) {
-        serviceInstalled("menubar")
-            ? add("pass", "menu bar", "installed — status, pause/resume, and a badge when a decision needs you")
-            : add("warn", "menu bar", "not installed on a Mac that can run it", "install it with: pantheon service install menubar (needs the Xcode Command Line Tools — xcode-select --install — and a setup that ran on this computer, not in a cloud agent). --no-menubar at setup also leaves it off; that is fine if it was your choice");
+        if (!serviceInstalled("menubar")) {
+            add("warn", "menu bar", "not installed on a Mac that can run it", "install it with: pantheon service install menubar (needs the Xcode Command Line Tools — xcode-select --install — and a setup that ran on this computer, not in a cloud agent). --no-menubar at setup also leaves it off; that is fine if it was your choice", "not installed");
+        }
+        else if (!menubarProc().running) {
+            add("warn", "menu bar", "installed, but not running — launchd is not holding it, so there is no icon right now", "pantheon service restart menubar   (loads it back; something unloaded it — a stop, a crash loop, or a test run on this machine)", "installed, not running");
+        }
+        else {
+            add("pass", "menu bar", "installed and running — status, pause/resume, and a badge when a decision needs you", undefined, "installed and running");
+        }
+        if (!serviceInstalled("notifier")) {
+            add("warn", "alerts", "not installed — no desktop notification when a teammate needs you", "pantheon service install notifier   (--no-notifications at setup also leaves it off; that is fine if it was your choice)", "not installed");
+        }
+        else if (!notifierProc().running) {
+            add("warn", "alerts", "installed, but not running — nothing on this Mac will show you a teammate's message", "pantheon service restart notifier   (loads it back; something unloaded it — a stop, a crash loop, or a test run on this machine)", "installed, not running");
+        }
+        else {
+            add("pass", "alerts", "installed and running — a desktop notification when a teammate needs you", undefined, "installed and running");
+        }
     }
     if (!hookStates.length && !hook.installed) {
-        add("warn", "wake-up hook", "not installed — your agent will not notice a peer's message until you ask it to", "pantheon hook install --user (auto-detects claude / codex / cursor on PATH)");
+        add("warn", "wake-up hook", "not installed — your agent will not notice a peer's message until you ask it to", "pantheon hook install --user (auto-detects claude / codex / cursor on PATH)", "not installed");
     }
     else if (!reportsActivity) {
-        add("warn", "wake-up hook", `installed (${hook.events?.join(", ")}) but predates the activity hook, so a worker cannot tell your idle editor from one you are using`, "re-run `pantheon hook install --user` to add the UserPromptSubmit half");
+        add("warn", "wake-up hook", `installed (${hook.events?.join(", ")}) but predates the activity hook, so a worker cannot tell your idle editor from one you are using`, "re-run `pantheon hook install --user` to add the UserPromptSubmit half", `installed (${hook.events?.join(", ")}), predates the activity hook`);
     }
     else {
         const intent = readIntent();
         intent?.repairs
-            ? add("warn", "wake-up hook", `${hook.events?.join(", ")} (${hook.scope} scope) — but it has been removed and put back ${intent.repairs} time${intent.repairs === 1 ? "" : "s"}`, "something on this machine rewrites ~/.claude/settings.json and drops the hooks key. The worker repairs it, but only while the worker is running")
-            : add("pass", "wake-up hook", `${hook.events?.join(", ")} (${hook.scope} scope)`);
+            ? add("warn", "wake-up hook", `${hook.events?.join(", ")} (${hook.scope} scope) — but it has been removed and put back ${intent.repairs} time${intent.repairs === 1 ? "" : "s"}`, "something on this machine rewrites ~/.claude/settings.json and drops the hooks key. The worker repairs it, but only while the worker is running", `${hook.events?.join(", ")} (${hook.scope} scope), repaired ${intent.repairs} time${intent.repairs === 1 ? "" : "s"}`)
+            : add("pass", "wake-up hook", `${hook.events?.join(", ")} (${hook.scope} scope)`, undefined, `${hook.events?.join(", ")} (${hook.scope} scope)`);
+    }
+    const budget = instructionBudget(cfg);
+    const budgetLine = `${budget.chars} chars (~${budget.tokens} tokens) of session instructions per turn; the ${budget.protocolChars}-char protocol arrives with the first tool call instead`;
+    add(budget.chars > 1_200 ? "warn" : "pass", "mcp context", budgetLine, budget.chars > 1_200 ? "this used to be ~3,800 chars on every turn, and it competed with the work people asked for" : undefined, budgetLine);
+    const approval = chosenApproval();
+    add("pass", "approval", approvalSummary(approval), `change with pantheon setup --ask-before-sending (or --approve-all); pantheon leave removes the Codex line`, approval);
+    const measured = await measureMcp({ cwd: projectDir });
+    if ("error" in measured) {
+        add("warn", "mcp startup", `could not measure: ${measured.error}`, "this is what an agent window sees when it starts pantheon here — reinstall with npm install -g @join-pantheon/cli, then re-run this", `could not measure: ${/missing/.test(measured.error) ? "server file missing" : /no answer/.test(measured.error) ? "no answer to initialize" : "exited before answering"}`);
     }
+    else {
+        const startupLine = `answered initialize in ${measured.initializeMs}ms, listed its tools by ${measured.toolsMs}ms (Codex gives it ${HOST_STARTUP_ALLOWANCE_MS / 1000}s)`;
+        add(measured.initializeMs > STARTUP_WARN_MS ? "warn" : "pass", "mcp startup", startupLine, measured.initializeMs > STARTUP_WARN_MS ? "slow for a step that no longer waits on the network — a loaded machine, a slow disk, or a very old Node; re-run when the machine is quiet" : undefined, startupLine);
+    }
+    const tools = toolsReport("error" in measured ? null : measured.tools, grantsSeen(), approval);
+    add(tools.level, "mcp tools", tools.detail, tools.fix, tools.detail);
     if (hookStates.some((s) => s.agent === "codex")) {
-        add("warn", "codex hooks", "installed — but codex skips new or changed hooks until they are approved", "run /hooks inside codex once to approve them (needs codex ≥ 0.115; sessions still report presence over MCP either way)");
+        add("warn", "codex hooks", "installed — but codex skips new or changed hooks until they are approved", "run /hooks inside codex once to approve them (needs codex ≥ 0.115; sessions still report presence over MCP either way)", "installed, not yet approved inside codex");
     }
     const windows = scanMcpWindows();
     const w = describeWindows(windows, VERSION);
-    add(w.level, "agent windows", w.detail, w.fix);
+    const live = windows.filter((x) => x.kind !== "orphan");
+    const byVersion = [...live.reduce((m, x) => m.set(x.running ?? "unknown", (m.get(x.running ?? "unknown") ?? 0) + 1), new Map())]
+        .map(([v, n]) => `${n} on ${v}`).join(", ");
+    add(w.level, "agent windows", w.detail, w.fix, live.length ? `${live.length} open: ${byVersion}` : "none open");
     const orphans = windows.filter((x) => x.kind === "orphan");
     if (orphans.length) {
-        add("warn", "orphans", `${orphans.length} pantheon server${orphans.length > 1 ? "s" : ""} left behind by windows that no longer exist (pid ${orphans.map((x) => x.pid).join(", ")})`, `harmless but pointless — pantheon upgrade ends them, or: kill ${orphans.map((x) => x.pid).join(" ")}`);
+        add("warn", "orphans", `${orphans.length} pantheon server${orphans.length > 1 ? "s" : ""} left behind by windows that no longer exist (pid ${orphans.map((x) => x.pid).join(", ")})`, `harmless but pointless — pantheon upgrade ends them, or: kill ${orphans.map((x) => x.pid).join(" ")}`, `${orphans.length}`);
     }
     const personas = loadPersonas(projectDir);
     if (personas.length) {
         const broken = personas.filter((p) => p.warnings.length);
         broken.length
-            ? add("warn", "personas", `${personas.map((p) => p.name).join(", ")} — ${broken.map((p) => `${p.name}: ${p.warnings[0]}`).join("; ")}`, "a persona line that does not parse grants nothing and filters nothing — pantheon persona show <name>")
-            : add("pass", "personas", `${personas.map((p) => p.name).join(", ")} — the worker only takes work a persona covers`);
+            ? add("warn", "personas", `${personas.map((p) => p.name).join(", ")} — ${broken.map((p) => `${p.name}: ${p.warnings[0]}`).join("; ")}`, "a persona line that does not parse grants nothing and filters nothing — pantheon persona show <name>", `${personas.length}, ${broken.length} that do not parse`)
+            : add("pass", "personas", `${personas.map((p) => p.name).join(", ")} — the worker only takes work a persona covers`, undefined, `${personas.length}`);
     }
     const open = [...client.goals.values()].filter((g) => g.state !== "CLOSED");
-    add("pass", "state", `${client.head} acts in the ledger, ${open.length} open goal(s) — restored across relay restarts`);
+    const stateLine = `${client.head} acts in the ledger, ${open.length} open goal(s) — restored across relay restarts`;
+    add("pass", "state", stateLine, undefined, stateLine);
     if (existsSync(join(projectDir, "pantheon-data", `${cfg.space}.jsonl`))) {
         serviceInstalled("relay")
-            ? add("pass", "relay service", "installed — survives closing this terminal and restarts at login")
-            : add("warn", "relay service", "this machine hosts the relay, but not as a service", "closing the terminal running it takes the space down for your teammates too: pantheon service install relay");
+            ? add("pass", "relay service", "installed — survives closing this terminal and restarts at login", undefined, "this machine hosts the relay, as a service")
+            : add("warn", "relay service", "this machine hosts the relay, but not as a service", "closing the terminal running it takes the space down for your teammates too: pantheon service install relay", "this machine hosts the relay, not as a service");
     }
     client.close();
     return out;
@@ -261,6 +305,18 @@ export function render(checks) {
         ? `\x1b[31m${failed} blocking problem${failed > 1 ? "s" : ""}\x1b[0m${warned ? `, ${warned} warning${warned > 1 ? "s" : ""}` : ""} — fix the FAILs before you start`
         : warned ? `\x1b[36mno blockers\x1b[0m, ${warned} warning${warned > 1 ? "s" : ""} — readable above`
             : `\x1b[36mall clear\x1b[0m — both machines are ready`);
+    lines.push(`\x1b[2mpantheon doctor --share  prints this without names or paths, to paste to ${FEEDBACK_ADDRESS}\x1b[0m`);
     return { text: lines.join("\n"), failed };
 }
+export function shareBlock(checks, now = new Date()) {
+    const mark = { pass: "ok  ", warn: "warn", fail: "FAIL" };
+    return [
+        `pantheon ${VERSION} — doctor, ${now.toISOString().slice(0, 16).replace("T", " ")} UTC`,
+        "no names, teams, paths or addresses are in this block; it is safe to paste",
+        "",
+        ...checks.filter((c) => c.share).map((c) => `  ${mark[c.level]}  ${c.name.padEnd(12)} ${c.share}`),
+        "",
+        `send it to ${FEEDBACK_ADDRESS} with one line on what you expected to happen`,
+    ].join("\n");
+}
 //# sourceMappingURL=doctor.js.map

package/dist/feedback.js

@@ -0,0 +1,3 @@
+export const FEEDBACK_ADDRESS = "sid@joinpantheon.network";
+export const FEEDBACK_LINE = `Something wrong, or Pantheon let you down? Tell us: ${FEEDBACK_ADDRESS}`;
+//# sourceMappingURL=feedback.js.map

package/dist/grants.js

@@ -1,9 +1,13 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { PANTHEON_TOOLS, PANTHEON_TOOL_NAMES } from "./tools.js";
+import { PANTHEON_TOOLS, PANTHEON_TOOL_NAMES, toolsAllowed } from "./tools.js";
 export const CLAUDE_ALLOW = PANTHEON_TOOLS;
 export const CURSOR_ALLOW = PANTHEON_TOOL_NAMES.map((t) => `Mcp(pantheon:${t})`);
+export const claudeAllow = (approval) => toolsAllowed(approval).map((t) => `mcp__pantheon__${t}`);
+export const cursorAllow = (approval) => toolsAllowed(approval).map((t) => `Mcp(pantheon:${t})`);
+const isOursClaude = (t) => t.startsWith("mcp__pantheon__");
+const isOursCursor = (t) => t.startsWith("Mcp(pantheon:");
 export const claudeSettingsFile = () => join(homedir(), ".claude", "settings.json");
 export const cursorCliConfigFile = () => join(homedir(), ".cursor", "cli-config.json");
 function readJson(file) {
@@ -26,16 +30,21 @@ function allowList(doc) {
         perms.allow = [];
     return perms.allow;
 }
-export function grantClaudeToolPermissions(file = claudeSettingsFile()) {
+function reconcile(allow, wanted, isOurs) {
+    const keep = allow.filter((t) => !isOurs(t) || wanted.includes(t));
+    const missing = wanted.filter((t) => !keep.includes(t));
+    if (keep.length === allow.length && !missing.length)
+        return false;
+    allow.splice(0, allow.length, ...keep, ...missing);
+    return true;
+}
+export function grantClaudeToolPermissions(file = claudeSettingsFile(), approval = "approve") {
     const doc = readJson(file);
     if (doc === "invalid")
         return `failed: ${file} is not valid JSON — fix it, then re-run pantheon install --user`;
     const next = doc ?? {};
-    const allow = allowList(next);
-    const missing = CLAUDE_ALLOW.filter((t) => !allow.includes(t));
-    if (!missing.length)
+    if (!reconcile(allowList(next), claudeAllow(approval), isOursClaude))
         return "already granted";
-    allow.push(...missing);
     try {
         writeJson(file, next);
     }
@@ -44,38 +53,50 @@ export function grantClaudeToolPermissions(file = claudeSettingsFile()) {
     }
     return "granted";
 }
-export function grantCursorToolPermissions(file = cursorCliConfigFile()) {
+export function grantCursorToolPermissions(file = cursorCliConfigFile(), approval = "approve") {
     const doc = readJson(file);
     if (doc === "invalid")
         return `failed: ${file} is not valid JSON — fix it, then re-run pantheon install --user`;
     const next = doc ?? { version: 1 };
     const allow = allowList(next);
     const perms = next.permissions;
-    if (!Array.isArray(perms.deny))
+    const hadDeny = Array.isArray(perms.deny);
+    if (!hadDeny)
         perms.deny = [];
-    const missing = CURSOR_ALLOW.filter((t) => !allow.includes(t));
-    if (!missing.length)
+    const changed = reconcile(allow, cursorAllow(approval), isOursCursor);
+    if (!changed && hadDeny)
         return "already granted";
-    allow.push(...missing);
     try {
         writeJson(file, next);
     }
     catch (e) {
         return `failed: ${e.message}`;
     }
-    return "granted";
+    return changed ? "granted" : "already granted";
+}
+function granted(file, isOurs) {
+    const doc = readJson(file);
+    if (doc === null)
+        return { state: "absent" };
+    if (doc === "invalid")
+        return { state: "invalid" };
+    const perms = doc.permissions;
+    const allow = perms && Array.isArray(perms.allow) ? perms.allow : [];
+    return { state: "ok", tools: allow.filter((t) => typeof t === "string" && isOurs(t)) };
 }
-export function grantToolPermissions() {
+export const claudeGranted = (file = claudeSettingsFile()) => granted(file, isOursClaude);
+export const cursorGranted = (file = cursorCliConfigFile()) => granted(file, isOursCursor);
+export function grantToolPermissions(approval = "approve") {
     return [
-        { tool: "claude perms", status: grantClaudeToolPermissions() },
-        { tool: "cursor perms", status: grantCursorToolPermissions() },
+        { tool: "claude perms", status: grantClaudeToolPermissions(undefined, approval) },
+        { tool: "cursor perms", status: grantCursorToolPermissions(undefined, approval) },
     ];
 }
 export function revokeToolPermissions(claudeFile = claudeSettingsFile(), cursorFile = cursorCliConfigFile()) {
     const out = [];
     for (const [file, isOurs] of [
-        [claudeFile, (t) => t.startsWith("mcp__pantheon__")],
-        [cursorFile, (t) => t.startsWith("Mcp(pantheon:")],
+        [claudeFile, isOursClaude],
+        [cursorFile, isOursCursor],
     ]) {
         const doc = readJson(file);
         if (!doc || doc === "invalid")

package/dist/humanize.js

@@ -9,6 +9,7 @@ export function stripIds(text, goalTitle) {
     }
     return out
         .replace(/^needs (?:you|your input|a human)[,:]?\s*[a-z0-9._-]*\s*[:—-]\s*/i, "")
+        .replace(/^decision (?:for|required for|needed from) (?:you|[a-z0-9._-]+)\s*[:—-]\s*/i, "")
         .replace(/^[a-z0-9._-]+\s+(?:escalated|needs a decision)\s*:\s*/i, "")
         .replace(/\(\s*goal\s+g_[a-z0-9]+\s*,\s*/gi, "(")
         .replace(/\s*\(\s*goal\s+g_[a-z0-9]+\s*\)/gi, "")
@@ -198,6 +199,7 @@ export function humanize(body, opts = {}) {
     let headline = sentences(firstPara?.text ?? clean)[0] ?? clean;
     headline = headline
         .replace(/^needs (?:you|your input|a human)[,:]?\s*[a-z0-9._-]*\s*[:—-]\s*/i, "")
+        .replace(/^decision (?:for|required for|needed from) (?:you|[a-z0-9._-]+)\s*[:—-]\s*/i, "")
         .replace(/^[a-z0-9._-]+\s+(?:escalated|needs a decision)\s*:\s*/i, "")
         .trim();
     if (headline)