@join-pantheon/cli 0.25.1 → 0.25.3

package/dist/measure.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { claudeGranted, cursorGranted, claudeAllow, cursorAllow } from "./grants.js";
+import { claudeGrantedEffective, cursorGrantedEffective, claudeAllow, cursorAllow, isServerWide } from "./grants.js";
 import { codexApprovalState } from "./install.js";
 import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES } from "./tools.js";
 const ROOT = process.env.PANTHEON_MCP_ROOT ?? resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -71,29 +71,55 @@ export function measureMcp(opts = {}) {
         });
     });
 }
-function agentLine(name, seen, wanted, strip) {
+function agentLine(name, seen, wanted, strip, approval) {
     if (seen.state === "absent")
         return { text: `${name} not set up here`, drift: false };
     if (seen.state === "invalid")
         return { text: `${name} settings unreadable`, drift: true };
-    const have = seen.tools.map(strip);
+    const wide = seen.tools.filter(isServerWide);
+    const named = seen.tools.filter((t) => !isServerWide(t)).map(strip);
+    const known = named.filter((t) => PANTHEON_TOOL_NAMES.includes(t));
+    const unknown = named.length - known.length;
     const want = wanted.map(strip);
-    const missing = want.filter((t) => !have.includes(t));
-    const extra = have.filter((t) => !want.includes(t));
-    if (!missing.length && !extra.length)
-        return { text: `${name} allows ${have.length}`, drift: false };
+    const missing = wide.length ? [] : want.filter((t) => !known.includes(t));
+    const extra = known.filter((t) => !want.includes(t));
     const parts = [];
-    if (missing.length)
+    let drift = false;
+    if (wide.length && approval === "ask-before-sending") {
+        parts.push(`a server-wide rule (${wide.join(", ")}) allows every tool, against your choice`);
+        drift = true;
+    }
+    if (missing.length) {
         parts.push(`${missing.length} would prompt on every call (${missing.map((t) => t.replace(/^pantheon_/, "")).join(", ")})`);
-    if (extra.length)
+        drift = true;
+    }
+    if (extra.length) {
         parts.push(`${extra.length} allowed against your choice (${extra.map((t) => t.replace(/^pantheon_/, "")).join(", ")})`);
-    return { text: `${name} allows ${have.length} — ${parts.join("; ")}`, drift: true };
+        drift = true;
+    }
+    const deniedKnown = (seen.denied ?? []).filter((t) => !isServerWide(t)).map(strip).filter((t) => PANTHEON_TOOL_NAMES.includes(t));
+    const deniedWide = (seen.denied ?? []).filter(isServerWide);
+    if (deniedWide.length) {
+        parts.push(`a deny rule (${deniedWide.join(", ")}) refuses every pantheon tool`);
+        drift = true;
+    }
+    else if (deniedKnown.length) {
+        parts.push(`${deniedKnown.length} refused by a deny rule (${deniedKnown.map((t) => t.replace(/^pantheon_/, "")).join(", ")})`);
+        drift = true;
+    }
+    const count = wide.length && approval !== "ask-before-sending" ? `allows all ${want.length} via a server-wide rule` : `allows ${known.length}`;
+    const fromProject = seen.fromProject?.length ? ` (${seen.fromProject.length} of them from this repo's own settings)` : "";
+    const rest = unknown ? `, plus ${unknown} entr${unknown === 1 ? "y" : "ies"} that ${unknown === 1 ? "is" : "are"} not a pantheon tool (left as ${unknown === 1 ? "it is" : "they are"})` : "";
+    return { text: `${name} ${count}${fromProject}${rest}${parts.length ? ` — ${parts.join("; ")}` : ""}`, drift };
 }
-export function toolsReport(registered, seen, approval) {
+export function toolsReport(registered, seen, approval, opts = {}) {
     const problems = [];
     const expected = [...PANTHEON_TOOL_NAMES].sort();
     let head;
-    if (registered === null) {
+    if (opts.unbound) {
+        head = `${expected.length} tools in this build; the server offers pantheon_status alone in a folder bound to no team, so the list was not compared`;
+    }
+    else if (registered === null) {
         head = `${expected.length} tools`;
     }
     else if (JSON.stringify(registered) !== JSON.stringify(expected)) {
@@ -105,8 +131,8 @@ export function toolsReport(registered, seen, approval) {
     }
     const stripClaude = (t) => t.replace(/^mcp__pantheon__/, "");
     const stripCursor = (t) => t.replace(/^Mcp\(pantheon:(.*)\)$/, "$1");
-    const claude = agentLine("Claude Code", seen.claude, claudeAllow(approval), stripClaude);
-    const cursor = agentLine("Cursor", seen.cursor, cursorAllow(approval), stripCursor);
+    const claude = agentLine("Claude Code", seen.claude, claudeAllow(approval), stripClaude, approval);
+    const cursor = agentLine("Cursor", seen.cursor, cursorAllow(approval), stripCursor, approval);
     if (claude.drift)
         problems.push("Claude Code's allow-list does not match");
     if (cursor.drift)
@@ -134,9 +160,9 @@ export function toolsReport(registered, seen, approval) {
     const detail = `${head}; ${claude.text}, ${cursor.text}, ${codex}`;
     if (!problems.length)
         return { level: "pass", detail };
-    return { level: "warn", detail, fix: `${problems.join("; ")} — pantheon install --user rewrites every grant to match this build and your approval choice` };
+    return { level: "warn", detail, fix: `${problems.join("; ")} — pantheon install --user rewrites every grant in your own settings to match this build and your approval choice; a rule in this repo's .claude/settings*.json or .cursor/cli.json is yours to edit by hand` };
 }
-export function grantsSeen() {
-    return { claude: claudeGranted(), cursor: cursorGranted(), codex: codexApprovalState() };
+export function grantsSeen(projectDir = null) {
+    return { claude: claudeGrantedEffective(projectDir), cursor: cursorGrantedEffective(projectDir), codex: codexApprovalState() };
 }
 //# sourceMappingURL=measure.js.map

package/dist/notice.js

@@ -95,7 +95,7 @@ export function composeDecision(o, act, goal, peer, ctx) {
         body: fit(body, BUDGET.body),
         ttl: 0,
         sound: true,
-        primary: primaryFor(ctx.tools, ctx.preferred, decisionPrompt(o.id)),
+        primary: primaryFor(ctx.tools, ctx.preferred, decisionPrompt(o.id, decisionTitle(o.body))),
         details: { decision: o.id, ...(act ? { act: act.id } : {}) },
     };
 }

package/dist/relay.js

@@ -405,10 +405,11 @@ export class Relay {
                 if (!authed)
                     return this.json(res, 401, { error: "admin token required" });
                 const rows = this.fleetHealth();
+                const relayAgeMs = Date.now() - this.startedAt;
                 if (url.searchParams.get("format") === "json")
-                    return this.json(res, 200, { relay: VERSION, generated: Date.now(), spaces: rows });
+                    return this.json(res, 200, { relay: VERSION, relay_age_ms: relayAgeMs, generated: Date.now(), spaces: rows });
                 res.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
-                return void res.end(fleetReport(rows, VERSION) + "\n");
+                return void res.end(fleetReport(rows, VERSION, Date.now(), relayAgeMs) + "\n");
             }
             if (url.pathname === "/admin/export") {
                 if (!authed)
@@ -762,9 +763,11 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
         for (const sp of this.spaces.values()) {
             seen.add(safeOf(sp.name));
+            const sessions = [...sp.members.values()].flatMap((m) => [...m.sessions.values()]);
             out.push(spaceHealth({
                 name: sp.name, records: sp.ledger.all(), members: sp.allow.all(),
-                online: [...sp.members.values()].filter((m) => m.sessions.size > 0).length, relayPkg: VERSION, now,
+                online: sessions.length, interactive: sessions.filter((x) => x.role === "interactive").length,
+                relayPkg: VERSION, now, relayAgeMs: now - this.startedAt,
             }));
         }
         let files = [];
@@ -783,7 +786,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
                 members = new Allowlist(this.dataDir, safe).all();
             }
             catch { }
-            out.push(spaceHealth({ name: safe, records: this.sleepingRecords(safe), members, online: 0, relayPkg: VERSION, now }));
+            out.push(spaceHealth({ name: safe, records: this.sleepingRecords(safe), members, online: 0, interactive: 0, relayPkg: VERSION, now, relayAgeMs: now - this.startedAt }));
         }
         return out;
     }

package/dist/setup-guide.js

@@ -268,8 +268,17 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     }
     const wiring = deps.applyAgentWiring ?? ((ap) => installForUser(ap).map((t) => ({ tool: t.tool, status: t.status })));
     try {
-        const codex = wiring(a.approval).find((t) => t.tool === "codex");
-        applied.push(`approval: ${approvalSummary(a.approval)}${codex ? ` — codex: ${codex.status}` : ""}`);
+        const rows = wiring(a.approval);
+        const failed = rows.filter((t) => /^failed/.test(t.status));
+        const codex = rows.find((t) => t.tool === "codex");
+        if (failed.length) {
+            for (const f of failed)
+                warnings.push(`${f.tool}: ${f.status} — that agent keeps its previous permissions until this is fixed; then run pantheon install --user`);
+            applied.push(`approval: "${a.approval}" is saved but NOT applied everywhere — see the warnings; nothing about it should be relied on yet`);
+        }
+        else {
+            applied.push(`approval: ${approvalSummary(a.approval)}${codex ? ` — codex: ${codex.status}` : ""}`);
+        }
     }
     catch (e) {
         warnings.push(`agent wiring not re-applied (${e.message}) — run pantheon install --user`);

package/dist/tray.js

@@ -86,6 +86,7 @@ export async function trayStatus(cfg = load(), f = loadAll()) {
         return {
             ...first,
             space: ok.map((p) => p.space).join(" · "),
+            spaces: ok.map((p) => p.space),
             relay_ok: ok.every((p) => p.relay_ok),
             decisions_ok: ok.every((p) => p.decisions_ok),
             unavailable_spaces: ok.flatMap((p) => p.unavailable_spaces ?? []),
@@ -117,11 +118,11 @@ async function trayStatusOne(cfg) {
     const mineHuman = all.filter((o) => o.owner === `human:${cfg.member}`);
     const decisionsOk = ok;
     const decisions = mineHuman
-        .map((o) => ({ id: o.id, body: decisionTitle(o.body), detail: o.body, prompt: decisionPrompt(o.id) }));
+        .map((o) => ({ id: o.id, body: decisionTitle(o.body), detail: o.body, prompt: decisionPrompt(o.id, decisionTitle(o.body)) }));
     const senderOf = (o) => stripCeremony(o.body).from;
     const row = (o, kind, who, prompt) => ({
         id: o.id, kind, title: decisionTitle(o.body), headline: decisionTitle(o.body, 200), detail: o.body, prompt, who,
-        when: o.created_at ?? 0,
+        when: o.created_at ?? 0, space: cfg.space,
         ...(o.goal ? { goal: o.goal } : {}),
         ...(o.ref ? { ref: o.ref } : {}),
     });
@@ -130,7 +131,7 @@ async function trayStatusOne(cfg) {
     const items = [
         ...mineHuman.map((o) => {
             const from = senderOf(o);
-            return row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id));
+            return row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body)));
         }),
         ...owed.map((o) => row(o, "owed", "you", owedPrompt(decisionTitle(o.body), o.goal))),
         ...waiting.map((o) => {
@@ -149,6 +150,7 @@ async function trayStatusOne(cfg) {
         configured: true,
         version: VERSION,
         space: cfg.space,
+        spaces: [cfg.space],
         member: cfg.member,
         relay: cfg.relay,
         relay_ok: !!space,