@join-pantheon/cli 0.28.0 → 0.29.0

package/dist/cli.js

@@ -7,21 +7,21 @@ process.emitWarning = ((warning, ...rest) => {
     return _emitWarning(warning, ...rest);
 });
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
-import { agentSpawn } from "./which.js";
-import { fromInvite, looksLikeInviteCode, resolveInviteCode, load, save, toInvite, toJoinLink, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
+import { agentSpawn, CmdLineUnsafe } from "./which.js";
+import { fromInvite, looksLikeInviteCode, resolveInviteCode, load, save, toInvite, toJoinLink, resolveFor, loadAll, identity, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
 import { fmtLimit } from "./plans.js";
 import { validEmail, validUsername } from "./accounts.js";
-import { install, launcher, installForUser, removeCodexUserScope } from "./install.js";
+import { install, launcher, installForUser } from "./install.js";
 import { Relay } from "./relay.js";
 import { runMcp } from "./mcp.js";
 import { Worker } from "./worker.js";
 import { DEFAULT_REMINDER_MS, ensureNativeNotifier, HumanNotifier, sendDesktopNotification } from "./notifier.js";
 import { desktopUnavailable, hostEnv } from "./host-env.js";
 import { AGENT_SURFACES, applyProfileInit, cleanList, isAgentSurface, loadProfile, organizationProfile, profileInitialized, saveProfile, wakeDefault } from "./profile.js";
-import { runGuide, terminalIO, parseSetupFlags, questionnaire } from "./setup-guide.js";
+import { runGuide, terminalIO, parseSetupFlags, questionnaire, optOutsFrom } from "./setup-guide.js";
 import { selectActs, formatAct, resolveRef } from "./history-view.js";
 import { doctor, render, shareBlock } from "./doctor.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
@@ -30,17 +30,18 @@ import { assess } from "./untrusted.js";
 import { report as spendReport, recentRuns } from "./spend.js";
 import { renderBrief, renderTeam } from "./brief.js";
 import { resolveDataDir, saveAll } from "./config.js";
-import { currentPlan, installNetwork, redactProxy, normalizeProxy, usedSystemFallback } from "./network.js";
+import { currentPlan, installNetwork, redactProxy, redactText, normalizeProxy, proxyToRemember, describeNetError } from "./network.js";
 import { createInterface } from "node:readline";
 import { homedir } from "node:os";
 import { removeHook, decideStop, writeIntent, clearIntent, readIntent, installHooks, agentHookStates } from "./notify.js";
 import { pending, render as renderPending } from "./pending.js";
-import { start as qsStart, join as qsJoin, wireUp } from "./quickstart.js";
+import { start as qsStart, join as qsJoin, wireUp, teamNameFor } from "./quickstart.js";
 import { installService, uninstallService } from "./service.js";
 import { LIMITS } from "./protocol.js";
 import { loadPersonas, personaByName, describePersona, initPersona, personaDir } from "./persona.js";
 import { fingerprint, newKeypair, signAccount } from "./identity.js";
 import { VERSION } from "./version.js";
+import { connectFailure } from "./refusal.js";
 import * as mcpWindows from "./mcp-windows.js";
 import { updateBanner } from "./update-check.js";
 const argv = process.argv.slice(2);
@@ -62,7 +63,7 @@ async function signedFetch(cfg, method, path, params = {}) {
     return res;
 }
 function requireSignInOnHostedRelay(relayFlag) {
-    const cfg = load();
+    const cfg = identity();
     if (cfg?.account)
         return;
     const relay = relayFlag ?? cfg?.relay ?? process.env.PANTHEON_RELAY ?? DEFAULT_RELAY;
@@ -72,7 +73,7 @@ function requireSignInOnHostedRelay(relayFlag) {
     die(`sign in first — this relay verifies email.\n  New here:        pantheon signup --email you@work.com --username you\n  Have an account: pantheon login  --email you@work.com\n  Then run pantheon start again.`);
 }
 async function interactiveOnboard(relayArg) {
-    const prior = load();
+    const prior = identity();
     const relay = relayArg ?? prior?.relay ?? process.env.PANTHEON_RELAY ?? DEFAULT_RELAY;
     const base = relay.replace(/^ws/, "http").replace(/\/+$/, "");
     if (!process.stdin.isTTY) {
@@ -152,7 +153,7 @@ async function interactiveOnboard(relayArg) {
                     console.error(D(`    could not resend: ${rs?.j.error ?? "the relay did not send an email"} — try again in a minute.`));
                 continue;
             }
-            const v = await postJson("/auth/verify", { email, code });
+            const v = await postJson("/auth/verify", { email, code, pubkey: kp.publicKey });
             if (v.status === 200) {
                 const acct = v.j.account;
                 const cfg = { ...(prior ?? {}), relay, member: acct.username, space: prior?.space ?? "", token: prior?.token ?? "",
@@ -252,10 +253,44 @@ function targets() {
     const r = resolveFor(process.cwd());
     if (r.cfg && r.cfg.space && r.reason !== "default")
         return [r.cfg];
-    if (r.reason === "default" && f)
+    if ((r.reason === "default" || r.reason === "unbound") && f && Object.keys(f.spaces ?? {}).length)
         return Object.values(f.spaces ?? {}).map((m) => configFor(f, m, null));
     return [need()];
 }
+async function launchAgent(binary, args, prompt, cwd) {
+    const { spawnSync } = await import("node:child_process");
+    let sp;
+    let handoff = null;
+    try {
+        sp = agentSpawn(binary, args(prompt));
+    }
+    catch (e) {
+        if (!(e instanceof CmdLineUnsafe))
+            throw e;
+        const where = cwd ?? process.cwd();
+        const rel = join(".pantheon", "handoff", `${Date.now()}-${randomBytes(3).toString("hex")}.md`);
+        handoff = join(where, rel);
+        mkdirSync(dirname(handoff), { recursive: true });
+        writeFileSync(handoff, prompt + "\n");
+        try {
+            const { excludeRunFiles } = await import("./worker.js");
+            excludeRunFiles(where);
+        }
+        catch { }
+        console.error(D(`  the question is in ${rel} — the agent is asked to read it`));
+        sp = agentSpawn(binary, args(`Read the file ${rel.split(/[\\/]/).join("/")} in this folder and do what it asks.`));
+    }
+    try {
+        spawnSync(sp.command, sp.args, { stdio: "inherit", ...(cwd ? { cwd } : {}), ...sp.options });
+    }
+    finally {
+        if (handoff)
+            try {
+                rmSync(handoff, { force: true });
+            }
+            catch { }
+    }
+}
 function needStrict() {
     const r = resolveFor(process.cwd(), { strict: true });
     return r.cfg && r.cfg.space ? r.cfg : null;
@@ -286,7 +321,7 @@ async function guidedSetup(cfg, project, opts = {}) {
     const io = rl ? terminalIO(rl, (l) => console.error(l)) : null;
     console.error(`\n${B("A few choices, then you're done.")}${io ? "" : Object.keys(preset).length ? D("  (applying the answers you passed)") : D("  (no terminal — taking the defaults)")}`);
     try {
-        const r = await runGuide(io, { cfg, project }, {
+        const r = await runGuide(io, { cfg, project, optOut: optOutsFrom(argv) }, {
             publish: async (p) => {
                 const c = new PantheonClient(cfg, undefined, { role: "cli" });
                 try {
@@ -336,23 +371,27 @@ async function workdirFor(cfg, hud) {
     const bindings = all && m ? Object.values(all.bindings ?? {}).filter((b) => b.space === m.id) : [];
     let hints = [];
     if (bindings.length > 1 && hud.goal) {
-        const acts = await fetchHistory(cfg).catch(() => []);
+        const acts = await fetchHistory(cfg, { goal: hud.goal }).catch(() => []);
         hints = acts.filter((x) => x.goal === hud.goal).flatMap((x) => [x.body, JSON.stringify(x.meta ?? {})]);
     }
     return pickWorkdir(bindings, hints, team);
 }
-async function fetchHistory(cfg, since = 0) {
+async function fetchHistory(cfg, opts = {}) {
     const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
-    const res = await fetch(`${base}/history?space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}&since=${since}`, { signal: AbortSignal.timeout(8000) });
+    const q = `space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}`
+        + (opts.goal ? `&goal=${encodeURIComponent(opts.goal)}` : opts.since !== undefined ? `&since=${opts.since}` : "");
+    const res = await fetch(`${base}/history?${q}`, { signal: AbortSignal.timeout(8000) });
     if (!res.ok)
         throw new Error(`relay answered ${res.status} for the ledger`);
     return (await res.json()).acts ?? [];
 }
-async function fetchAct(cfg, id) {
+async function fetchAct(cfg, id, budgetMs = Number.POSITIVE_INFINITY) {
     const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
     const q = `space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}`;
+    const deadline = Date.now() + budgetMs;
+    const left = () => Math.max(1, Math.min(8000, deadline - Date.now()));
     try {
-        const res = await fetch(`${base}/act?${q}&id=${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(8000) });
+        const res = await fetch(`${base}/act?${q}&id=${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(left()) });
         if (res.ok) {
             const body = await res.json();
             if (body.act)
@@ -364,7 +403,9 @@ async function fetchAct(cfg, id) {
     catch { }
     let head = 0;
     try {
-        const h = await (await fetch(`${base}/health?space=${encodeURIComponent(cfg.space)}`, { signal: AbortSignal.timeout(8000) })).json();
+        if (Date.now() >= deadline)
+            return null;
+        const h = await (await fetch(`${base}/health?space=${encodeURIComponent(cfg.space)}`, { signal: AbortSignal.timeout(left()) })).json();
         head = h.spaces?.[0]?.seq ?? 0;
     }
     catch { }
@@ -372,8 +413,10 @@ async function fetchAct(cfg, id) {
     if (windows[windows.length - 1] !== 0)
         windows.push(0);
     for (const since of windows) {
+        if (Date.now() >= deadline)
+            return null;
         try {
-            const acts = await fetchHistory(cfg, since);
+            const acts = await fetchHistory(cfg, { since });
             const act = acts.find((a) => a.id === id || String(a.seq) === id);
             if (act)
                 return { act };
@@ -551,18 +594,31 @@ ${B("less common")}
   pantheon version            the pantheon version this machine is running
 `;
 const QUIET = new Set(["mcp", "hook", "pending", "version", "tray-status"]);
+function usageFor(command, help) {
+    const plain = help.replace(/\x1b\[[0-9;]*m/g, "").split("\n");
+    const out = [];
+    const names = new RegExp(`(^\\s+|·\\s+)pantheon ${command.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(\\s|$)`);
+    for (let i = 0; i < plain.length; i++) {
+        if (!names.test(plain[i]))
+            continue;
+        out.push(plain[i]);
+        while (i + 1 < plain.length && /^\s{20,}\S/.test(plain[i + 1]) && !/^\s+pantheon /.test(plain[i + 1]))
+            out.push(plain[++i]);
+    }
+    return out.length ? out.join("\n") : null;
+}
+const HELP_OPAQUE = new Set(["mcp", "hook", "pending", "tray-status", "help", "version", "-v", "--help", "-h"]);
 function rememberWorkingProxy() {
     try {
-        const plan = currentPlan();
-        const via = plan.https ?? plan.http;
-        if (!via || (plan.source !== "env" && !(plan.fallbackOnly && usedSystemFallback())))
-            return;
         const all = loadAll();
-        if (!all || all.network?.source === "pantheon network" || all.network?.proxy === via)
+        if (!all)
             return;
-        const custom = plan.noProxy.filter((h) => !["localhost", "127.0.0.1", "::1", "[::1]"].includes(h));
-        saveAll({ ...all, network: { proxy: via, ...(custom.length ? { no_proxy: custom.join(",") } : {}), source: plan.source, saved_at: Date.now() } });
-        console.error(D(`  saved the proxy ${redactProxy(via)} for this machine's other Pantheon processes (worker, editors) — change it with pantheon network`));
+        const latest = Object.values(all.spaces ?? {}).sort((a, b) => (b.joined_at ?? 0) - (a.joined_at ?? 0))[0];
+        const keep = proxyToRemember(latest?.relay ?? all.relay, currentPlan(), all.network);
+        if (!keep)
+            return;
+        saveAll({ ...all, network: { ...keep, saved_at: Date.now() } });
+        console.error(D(`  saved the proxy ${redactProxy(keep.proxy)} for this machine's other Pantheon processes (worker, editors) — change it with pantheon network`));
     }
     catch { }
 }
@@ -578,19 +634,27 @@ async function main() {
         catch { }
     }
     if (argv.length === 0) {
-        const cfg = load();
+        const cfg = identity();
         if (cfg?.account) {
             console.error(`${B("pantheon")} — signed in as ${C(cfg.account.username)}. ${D(`Your plate: pantheon brief · all commands: pantheon help`)}`);
             return;
         }
         return interactiveOnboard();
     }
+    if (!HELP_OPAQUE.has(cmd)) {
+        const helpAt = cmd === "say" ? [argv[1]] : argv.slice(1);
+        if (helpAt.some((a) => a === "--help" || a === "-h")) {
+            const u = usageFor(cmd, HELP_ALL);
+            console.error(u ? `${u}\n\n${D("nothing was run · all commands: pantheon help --all")}` : HELP);
+            return;
+        }
+    }
     switch (cmd) {
         case "network": {
             const all = loadAll() ?? die("not configured — sign up or join a team first");
             const set = flag("proxy");
             if (set !== undefined) {
-                const p = normalizeProxy(set) ?? die(`"${set}" is not a proxy address — use http://host:port (add user:password@ if it needs a login)`);
+                const p = normalizeProxy(set) ?? die(`"${redactText(set)}" is not a proxy address — use http://host:port (add user:password@ if it needs a login)`);
                 saveAll({ ...all, network: { proxy: p, ...(flag("no-proxy") ? { no_proxy: flag("no-proxy") } : {}), source: "pantheon network", saved_at: Date.now() } });
                 console.error(`${B("saved")} every Pantheon process on this machine now reaches the relay through ${redactProxy(p)}`);
                 return;
@@ -608,7 +672,7 @@ async function main() {
             }
             const plan = currentPlan();
             const via = plan.https ?? plan.http;
-            console.log(`${B("network")}  ${via ? `through ${redactProxy(via)}` : "direct"}${plan.source !== "none" ? D(`   from ${plan.source}${plan.fallbackOnly ? ", used only if a direct connection fails" : ""}`) : ""}`);
+            console.log(`${B("network")}  ${via ? `through ${redactProxy(via)}` : "direct"}${plan.source !== "none" ? D(`   from ${plan.source}${plan.fallbackOnly ? ", used only if a direct connection fails" : plan.retryDirect ? " (saved by start/join; direct is tried if it cannot be reached)" : ""}`) : all.network?.proxy === "" ? D("   saved by pantheon network --direct") : ""}`);
             if (via)
                 console.log(D(`  not for: ${plan.noProxy.join(", ")}`));
             if (plan.pac)
@@ -624,7 +688,7 @@ async function main() {
             requireSignInOnHostedRelay(flag("relay"));
             console.error(`${B("pantheon start")}\n`);
             if (!flag("space") && !repoInfo(process.cwd()))
-                console.error(D(`  No git repo here, so the team will be named after this folder: "${basename(process.cwd()).toLowerCase().replace(/[^a-z0-9._-]/g, "-") || "team"}". Pass --space <name> to choose.\n`));
+                console.error(D(`  No git repo here, so the team will be named after this folder: "${teamNameFor(process.cwd())}". Pass --space <name> to choose.\n`));
             const r = await qsStart({
                 port,
                 dataDir: resolveDataDir(flag("data")).dir,
@@ -633,6 +697,7 @@ async function main() {
                 ...(flag("space") ? { space: flag("space") } : {}),
                 ...(flag("me") ? { me: flag("me") } : {}),
                 ...(flag("relay") ? { relay: flag("relay") } : {}),
+                ...(setupFlags.preset.wake ? { wake: setupFlags.preset.wake } : {}),
                 hook: !argv.includes("--no-hook"),
                 notifications: !argv.includes("--no-notifications"),
                 menubar: !argv.includes("--no-menubar"),
@@ -685,7 +750,7 @@ async function main() {
         case "invite": {
             const cfg = need();
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.connect().catch((e) => die(client.pending ?? connectFailure(e, cfg.relay)));
             await new Promise((r) => setTimeout(r, 250));
             const revokeAt = argv.indexOf("--revoke");
             const revokeArg = revokeAt >= 0 ? (argv[revokeAt + 1] && !argv[revokeAt + 1].startsWith("--") ? argv[revokeAt + 1] : "all") : undefined;
@@ -728,6 +793,7 @@ async function main() {
             return;
         }
         case "relay": {
+            process.on("unhandledRejection", (e) => { console.error(`! unhandled rejection: ${e?.stack ?? String(e)}`); });
             const relay = new Relay({
                 port: Number(flag("port", process.env.PORT ?? "8787")),
                 host: flag("host", "0.0.0.0"),
@@ -757,16 +823,18 @@ async function main() {
             return;
         }
         case "init": {
-            const kp = newKeypair();
+            const had = argv.includes("--reset") ? null : identity();
+            const kp = had?.publicKey && had.privateKey ? { publicKey: had.publicKey, privateKey: had.privateKey } : newKeypair();
             const cfg = {
                 relay: flag("relay", "ws://localhost:8787"),
                 space: flag("space", "team"),
                 token: flag("token", randomBytes(16).toString("hex")),
-                member: flag("me", process.env.USER ?? "me"),
+                member: flag("me") ?? had?.member ?? process.env.USER ?? "me",
                 publicKey: kp.publicKey,
                 privateKey: kp.privateKey,
                 display: flag("display"),
                 agent: flag("agent", "unknown"),
+                ...(had?.account ? { account: had.account } : {}),
             };
             save(cfg);
             console.error(`${B("space claimed.")} config: ${D(CONFIG_PATH)}\n`);
@@ -813,7 +881,7 @@ async function main() {
                 parsed = await resolveInviteCode(invite, candidates).catch((err) => die(err.message.replace(/^INVITE_CODE_[A-Z]+:\s*/, "")));
                 console.error(D(`That was just the code — it opens "${parsed.space}" on ${new URL(parsed.relay).host}. Joining that team.\n`));
             }
-            if (!load()?.account && sameHost(parsed.relay, DEFAULT_RELAY)) {
+            if (!identity()?.account && sameHost(parsed.relay, DEFAULT_RELAY)) {
                 die(`sign in first — this relay verifies email.\n  New here:        pantheon signup --email you@work.com --username you\n  Have an account: pantheon login  --email you@work.com\n  Then run this same \`pantheon join\` command again — the invite is still good.`);
             }
             const wp = unattendedProject();
@@ -888,6 +956,22 @@ async function main() {
         }
         case "rewire": {
             const rows = installForUser().map((t) => ({ tool: t.tool, status: t.status }));
+            try {
+                const { refreshServiceDefinition, serviceInstalled: installed, restartService: restart } = await import("./service.js");
+                for (const kind of ["worker", "notifier", "menubar"]) {
+                    if (!installed(kind))
+                        continue;
+                    const fresh = refreshServiceDefinition(kind);
+                    if (fresh.line)
+                        console.error(fresh.line);
+                    if (fresh.changed && kind !== "worker")
+                        for (const l of restart(kind, undefined, { reload: true }))
+                            console.error(l);
+                    else if (fresh.changed)
+                        console.error(D("  worker: the new definition applies at its next restart"));
+                }
+            }
+            catch { }
             if (argv.includes("--json")) {
                 console.log(JSON.stringify(rows));
                 return;
@@ -958,6 +1042,7 @@ async function main() {
                     }
                 }
             }
+            const { refreshServiceDefinition } = await import("./service.js");
             for (const kind of ["worker", "notifier", "menubar"]) {
                 if (!serviceInstalled(kind))
                     continue;
@@ -965,7 +1050,10 @@ async function main() {
                     console.error(`  ${D("worker: a run is in progress — left alone. When it is done:")}  pantheon service restart worker`);
                     continue;
                 }
-                for (const l of restartService(kind))
+                const fresh = refreshServiceDefinition(kind);
+                if (fresh.line)
+                    console.error(fresh.line);
+                for (const l of restartService(kind, undefined, { reload: fresh.changed }))
                     console.error(l);
             }
             if (r.restart.includes("relay"))
@@ -1005,7 +1093,7 @@ async function main() {
                         console.error(client.pending);
                         process.exit(2);
                     }
-                    die(`cannot reach relay at ${cfg.relay} — ${e.message}`);
+                    die(connectFailure(e, cfg.relay));
                 });
                 await new Promise((r) => setTimeout(r, 350));
                 const peers = client.roster.filter((m) => m.id !== cfg.member);
@@ -1073,7 +1161,7 @@ async function main() {
             for (const cfg of targets()) {
                 const profile = loadProfile(cfg);
                 const client = new PantheonClient(cfg, undefined, { role: "cli" });
-                await client.connect().catch((e) => die(client.pending ?? e.message));
+                await client.connect().catch((e) => die(client.pending ?? connectFailure(e, cfg.relay)));
                 await new Promise((r) => setTimeout(r, 350));
                 process.stdout.write(renderBrief({
                     space: cfg.space,
@@ -1103,7 +1191,7 @@ async function main() {
             }
             const cfg = need();
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.connect().catch((e) => die(client.pending ?? connectFailure(e, cfg.relay)));
             await new Promise((r) => setTimeout(r, 350));
             process.stdout.write(renderTeam({
                 space: cfg.space,
@@ -1131,7 +1219,7 @@ async function main() {
             };
             const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
             const q = `space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}`;
-            const first = await fetch(`${base}/history?${q}`).catch((e) => die(`cannot reach relay — ${e.message}`));
+            const first = await fetch(`${base}/history?${q}`).catch((e) => die(describeNetError(e, cfg.relay)));
             if (!first.ok)
                 die(`relay answered ${first.status} — check the space name and token`);
             let since = ((await first.json()).acts ?? []).at(-1)?.seq ?? 0;
@@ -1160,7 +1248,8 @@ async function main() {
         }
         case "history": {
             const cfg = need();
-            const acts = await fetchHistory(cfg, numFlag("since", 0)).catch((e) => die(`cannot read the ledger — ${e.message}`));
+            const acts = await fetchHistory(cfg, flag("goal") ? { goal: flag("goal") } : flag("since") ? { since: numFlag("since", 0) } : {})
+                .catch((e) => die(`cannot read the ledger — ${e.message}`));
             const picked = selectActs(acts, {
                 ...(flag("goal") ? { goal: flag("goal") } : {}), ...(flag("from") ? { from: flag("from") } : {}),
                 last: numFlag("last", 20), presence: argv.includes("--presence"),
@@ -1192,11 +1281,11 @@ async function main() {
         case "show": {
             const cfg = need();
             const key = argv[1] ?? die("usage: pantheon show <act id | sequence number>");
-            const acts = await fetchHistory(cfg).catch((e) => die(`cannot read the ledger — ${e.message}`));
-            const a = acts.find((x) => x.id === key || String(x.seq) === key) ?? die(`no act ${key} in what the relay still holds (pantheon history lists them)`);
-            console.log(formatAct(a));
+            const found = await fetchAct(cfg, key);
+            const a = found?.act ?? die(`no act ${key} in what the relay still holds (pantheon history lists them)`);
+            console.log(formatAct(a, found?.goalTitle ? { goalTitle: found.goalTitle } : {}));
             if (a.ref) {
-                const r = acts.find((x) => x.id === a.ref);
+                const r = (await fetchAct(cfg, a.ref))?.act;
                 if (r)
                     console.log(D(`\nin reply to:\n`) + formatAct(r, { short: true }));
             }
@@ -1211,7 +1300,7 @@ async function main() {
                 die("nothing to say — pantheon say NOTE 'your message here'");
             const summary = flag("summary");
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(`cannot reach relay — ${e.message}`));
+            await client.connect().catch((e) => die(connectFailure(e, cfg.relay)));
             const to = flag("to");
             const meta = {};
             for (const k of ["branch", "commit", "remote"]) {
@@ -1225,7 +1314,15 @@ async function main() {
             let goalArg = flag("goal") ?? null;
             let ref = flag("ref") ?? null;
             if (ref !== null || ["ANSWER", "ACCEPT", "OBJECT"].includes(act)) {
-                const acts = await fetchHistory(cfg).catch(() => []);
+                let acts;
+                if (ref && ref !== "last") {
+                    const hit = (await fetchAct(cfg, ref))?.act;
+                    acts = hit ? [hit] : [];
+                    if (!hit && /^a_/.test(ref))
+                        console.error(D(`  ${ref} is not in what this relay holds — sending it as given`));
+                }
+                else
+                    acts = await fetchHistory(cfg, goalArg ? { goal: goalArg } : {}).catch(() => []);
                 const rr = resolveRef(acts, ref, act, goalArg, cfg.member);
                 if (rr.error) {
                     client.close();
@@ -1351,23 +1448,17 @@ async function main() {
             return;
         }
         case "stop": {
-            const what = (argv[1] ?? "all").toLowerCase();
+            const what = (argv[1] && !argv[1].startsWith("--") ? argv[1] : "all").toLowerCase();
+            if (!["all", "relay", "worker", "notifier", "menubar"].includes(what))
+                die(`usage: pantheon stop [relay|worker|notifier|menubar|all]`);
+            const { stopMachine } = await import("./machine.js");
             console.log(B("stopping"));
-            if (what === "relay" || what === "all")
-                for (const l of stopProc("relay"))
-                    console.log(`  ${l}`);
-            if (what === "worker" || what === "all")
-                for (const l of stopProc("worker"))
-                    console.log(`  ${l}`);
-            if (what === "notifier" || what === "all")
-                for (const l of stopProc("notifier"))
-                    console.log(`  ${l}`);
-            if (what === "menubar" || what === "all")
-                for (const l of stopProc("menubar"))
-                    console.log(`  ${l}`);
-            if (what === "relay" || what === "all") {
-                console.log(D(`\n  Your teammates are offline until a relay is running again.`));
-            }
+            const everyTeam = Object.values(loadAll()?.spaces ?? {}).map((m) => ({ name: m.name, relay: m.relay }));
+            const res = stopMachine(what, { port: Number(flag("port", "8787")), teams: everyTeam.length ? everyTeam : (load()?.relay ? [{ name: load().space, relay: load().relay }] : []) });
+            for (const l of res.lines)
+                console.log(`  ${l}`);
+            if (res.note)
+                console.log(D(`\n  ${res.note}`));
             return;
         }
         case "logs": {
@@ -1375,7 +1466,7 @@ async function main() {
             const proc = kind === "relay" ? relayProc(Number(flag("port", "8787"))) : kind === "worker" ? workerProc() : notifierProc();
             const f = logFileFor(kind, proc);
             if (!f)
-                die(`no ${kind} log found. If it runs as a service, the plist names the path; if you started it by hand, its output went to that terminal.`);
+                die(`no ${kind} log found. ${process.platform === "linux" ? `If it runs as a service: journalctl --user -u pantheon-${kind}` : process.platform === "darwin" ? "If it runs as a service, the plist names the path" : "Services are not used on Windows"}; if you started it by hand, its output went to that terminal.`);
             console.error(D(`${f}  (${statFile(f)})\n`));
             const follow = argv.includes("-f") || argv.includes("--follow");
             const { spawn } = await import("node:child_process");
@@ -1664,7 +1755,7 @@ async function main() {
             if (!argv.includes("--yes"))
                 die(`this deletes "${m.name}" for everyone in it — its history, goals and invites — and cannot be undone.\n  If you mean it:  pantheon space delete ${m.name} --yes`);
             const client = new PantheonClient(configFor(all, m, null), undefined, { role: "cli" });
-            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.connect().catch((e) => die(client.pending ?? connectFailure(e, m.relay)));
             await client.deleteSpace(m.name).catch((e) => { client.close(); die(e.message); });
             client.close();
             const bound = Object.values(all.bindings ?? {}).filter((b) => b.space === m.id).length;
@@ -1682,53 +1773,103 @@ async function main() {
                 console.error(D(`Your teammates still list you in "${m.name}". Ask one of them to run:  pantheon admit ${m.name === all.member ? "you" : all.member} --revoke   if you are not coming back.`));
                 return;
             }
-            const cfg = load();
+            const all = loadAll();
+            const me = identity(all);
+            const { leavePlan } = await import("./machine.js");
+            const plan = leavePlan(all);
             const project = resolve(flag("project", "."));
-            console.error(`${B("leaving pantheon")}\n`);
-            for (const l of stopProc("worker"))
-                console.error(`  ${l}`);
-            for (const l of stopProc("notifier"))
-                console.error(`  ${l}`);
-            for (const l of stopProc("menubar"))
+            const keepIdentity = argv.includes("--keep-identity");
+            if (plan.teams.length > 1 && !keepIdentity && !argv.includes("--yes")) {
+                const list = plan.teams.map((t) => `"${t.name}"`).join(", ");
+                if (!process.stdin.isTTY)
+                    die(`this machine is in ${plan.teams.length} teams — ${list}. Leaving removes its key, so it leaves ALL of them.\n  If you mean it:  pantheon leave --yes\n  Just one team:   pantheon leave <team>`);
+                const rl = createInterface({ input: process.stdin, output: process.stderr });
+                const answer = await new Promise((res) => rl.question(`This machine is in ${plan.teams.length} teams: ${list}. Leaving removes its key, so it leaves ALL of them. Type "yes" to continue: `, (x) => res(x.trim())));
+                rl.close();
+                if (answer.toLowerCase() !== "yes")
+                    die(`nothing was changed. Leave one team with: pantheon leave <team>`);
+            }
+            console.error(`${B("leaving pantheon")}${plan.teams.length ? D(`   — ${plan.teams.map((t) => t.name).join(", ")}`) : ""}\n`);
+            const { uninstallMachine, realUninstallIo } = await import("./machine.js");
+            const { removeUserMcpEntries } = await import("./install.js");
+            const done = uninstallMachine({ project, stopRelay: argv.includes("--stop-relay") }, realUninstallIo({
+                port: Number(flag("port", "8787")),
+                removeMcpEntries: () => removeUserMcpEntries({ project }),
+                hasIntent: () => readIntent() !== null,
+                clearIntent: () => clearIntent(),
+            }));
+            for (const l of done.lines)
                 console.error(`  ${l}`);
-            if (argv.includes("--stop-relay"))
-                for (const l of stopProc("relay"))
-                    console.error(`  ${l}`);
-            else if (relayProc(Number(flag("port", "8787"))).running) {
-                console.error(`  relay:  left running — others may be using it. Stop it with: pantheon stop relay`);
-            }
+            const removed = [...done.removed];
+            const left = [...done.left];
             for (const l of removeHook(project))
                 console.error(`  hook:   ${l.trim()}`);
             const { revokeToolPermissions } = await import("./grants.js");
-            for (const l of revokeToolPermissions())
+            for (const l of revokeToolPermissions()) {
                 console.error(`  perms:${l}`);
-            {
-                const l = removeCodexUserScope();
-                if (l)
-                    console.error(`  perms:${l}`);
+                removed.push(l.trim().replace(/^removed /, ""));
             }
-            const { unlinkSync, existsSync: exists, rmSync } = await import("node:fs");
-            if (cfg && exists(CONFIG_PATH)) {
-                if (argv.includes("--keep-identity")) {
-                    console.error(`  config: kept at ${CONFIG_PATH} (--keep-identity)`);
+            const { unlinkSync, existsSync: exists, rmSync, readdirSync } = await import("node:fs");
+            if (all && exists(CONFIG_PATH)) {
+                if (keepIdentity) {
+                    left.push(`your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} (--keep-identity)`);
                 }
                 else {
                     unlinkSync(CONFIG_PATH);
+                    removed.push(`${CONFIG_PATH} — your key and ${plan.teams.length ? `the token${plan.teams.length === 1 ? "" : "s"} for ${plan.teams.map((t) => `"${t.name}"`).join(", ")}` : "account"}; rejoining means a new invite`);
+                    const runHomes = join(CONFIG_PATH, "..", "run-homes");
+                    const { restorePendingQuarantines, pendingQuarantines } = await import("./agents.js");
+                    const put = restorePendingQuarantines(runHomes);
+                    if (put.length)
+                        removed.push(`nothing of your repos' — what interrupted runs had held aside: ${put.join("; ")}`);
+                    const still = pendingQuarantines(runHomes);
+                    const keptAside = (dir) => { try {
+                        return readdirSync(join(dir, "quarantine-kept")).length > 0;
+                    }
+                    catch {
+                        return false;
+                    } };
+                    let homes = [];
                     try {
-                        rmSync(join(CONFIG_PATH, "..", "run-homes"), { recursive: true, force: true });
+                        homes = readdirSync(runHomes);
                     }
                     catch { }
-                    console.error(`  config: removed ${CONFIG_PATH} — your keypair is gone, so rejoining means a new invite`);
-                }
-            }
-            else {
-                console.error(`  config: none to remove`);
-            }
-            console.error(`\n  ${D("Not touched: the MCP entries in Claude Code, Cursor, Copilot, VS Code and Kiro (pantheon install wrote them; remove them there),")}`);
-            console.error(`  ${D("the relay's ledger on disk, and anything you pushed to git. Codex's entry and approval line were removed above.")}`);
-            if (cfg) {
-                console.error(`\n  ${D(`Your teammates still list you in "${cfg.space}". Ask one of them to run:`)}`);
-                console.error(`  ${D(`pantheon admit ${cfg.member} --revoke`)}`);
+                    const keep = new Set([...still.map((x) => x.runHome), ...homes.map((h) => join(runHomes, h)).filter(keptAside)]);
+                    for (const h of homes) {
+                        const dir = join(runHomes, h);
+                        if (keep.has(dir))
+                            continue;
+                        try {
+                            rmSync(dir, { recursive: true, force: true });
+                        }
+                        catch { }
+                    }
+                    if (!keep.size) {
+                        try {
+                            rmSync(runHomes, { recursive: true, force: true });
+                        }
+                        catch { }
+                    }
+                    for (const x of still)
+                        left.push(`${x.runHome} — it still holds ${x.paths.join(", ")} from ${x.worktree}, which could not be put back safely; compare and move them back by hand, then delete the folder`);
+                    for (const dir of keep)
+                        if (keptAside(dir) && !still.some((x) => x.runHome === dir))
+                            left.push(`${join(dir, "quarantine-kept")} — agent config an interrupted run held, set aside because the repo had moved on; check it, then delete the folder`);
+                }
+            }
+            console.error(`\n${B("Removed")}`);
+            for (const r of removed)
+                console.error(`  ${C("✓")} ${r}`);
+            if (!removed.length)
+                console.error(`  ${D("nothing — Pantheon had nothing installed here")}`);
+            console.error(`\n${B("Left")}`);
+            for (const l of left)
+                console.error(`  • ${l}`);
+            console.error(`  • ${D("files committed in your repos (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, the brief in AGENTS.md / CLAUDE.md) — your team's; delete them in a commit if the whole team is leaving")}`);
+            console.error(`  • ${D("the relay's ledger on disk, and anything you pushed to git")}`);
+            if (plan.teams.length) {
+                console.error(`\n  ${D(`Your teammates still list you in ${plan.teams.map((t) => `"${t.name}"`).join(", ")}. Ask someone in each to run:`)}`);
+                console.error(`  ${D(`pantheon admit ${me?.member ?? plan.member ?? "<your name>"} --revoke`)}`);
             }
             console.error(`\n  ${D(`If Pantheon let you down, one line on why to ${FEEDBACK_ADDRESS} would help more than you might think.`)}`);
             return;
@@ -1741,35 +1882,42 @@ async function main() {
             return;
         }
         case "panic": {
-            const cfg = need();
             console.error(`${B("PANIC — locking down this machine")}\n`);
-            for (const l of stopProc("worker"))
-                console.error(`  ${l}`);
-            const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            const up = await client.connect().then(() => true).catch(() => false);
-            if (!up) {
-                console.error(`  ${D("cannot reach the relay, so wake grants were not changed")}`);
-                console.error(`\n  ${C("The worker is stopped, so nothing can start a run here regardless.")}`);
-                return;
-            }
-            await new Promise((r) => setTimeout(r, 300));
-            const wakers = client.members.filter((m) => m.admitted && m.may_wake && m.member !== cfg.member);
-            for (const w of wakers) {
-                await client.admit(w.member, false, false).catch(() => { });
-                console.error(`  revoked wake rights from ${C(w.member)}`);
-            }
-            if (!wakers.length)
-                console.error(`  ${D("no peer had wake rights to revoke")}`);
-            client.close();
-            console.error(`\n  ${C("Nothing can start an agent run on this machine now.")}`);
+            const { panicMachine, waitStopped } = await import("./machine.js");
+            const all = loadAll();
+            const teams = Object.values(all?.spaces ?? {});
+            const r = await panicMachine({
+                stopWorker: () => stopProc("worker"),
+                workerDown: () => waitStopped("worker", 5000),
+                teams,
+                revoke: async (m) => {
+                    const cfg = configFor(all, m, null);
+                    const client = new PantheonClient(cfg, undefined, { role: "cli" });
+                    try {
+                        await client.connect();
+                        await new Promise((res) => setTimeout(res, 300));
+                        const wakers = client.members.filter((x) => x.admitted && x.may_wake && x.member !== cfg.member);
+                        for (const w of wakers)
+                            await client.admit(w.member, false, false).catch(() => { });
+                        return wakers.map((w) => w.member);
+                    }
+                    finally {
+                        client.close();
+                    }
+                },
+            });
+            for (const l of r.lines)
+                console.error(l);
             console.error(D(`  Your peers can still message you; only unattended runs are off.`));
             console.error(D(`  To undo: pantheon service install worker   and   pantheon admit <who> --may-wake`));
+            if (!r.ok)
+                process.exitCode = 1;
             return;
         }
         case "members": {
             const cfg = need();
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.connect().catch((e) => die(client.pending ?? connectFailure(e, cfg.relay)));
             await new Promise((r) => setTimeout(r, 300));
             console.log(`${B(`who is in ${cfg.space}`)}\n`);
             for (const e of client.members) {
@@ -1790,7 +1938,7 @@ async function main() {
             const cfg = need();
             const who = argv[1] ?? die("usage: pantheon admit <member> [--may-wake] [--revoke] [--forget]");
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.connect().catch((e) => die(client.pending ?? connectFailure(e, cfg.relay)));
             await new Promise((r) => setTimeout(r, 250));
             const forget = argv.includes("--forget");
             const revoke = argv.includes("--revoke");
@@ -1837,16 +1985,21 @@ async function main() {
             return;
         }
         case "whoami": {
-            const cfg = need();
+            const cfg = identity() ?? die("not set up on this machine — pantheon signup, or pantheon join <invite>");
+            const team = resolveFor(process.cwd()).cfg;
             if (cfg.account) {
                 console.log(`account      ${C(cfg.account.username)}  ${D(`<${cfg.account.email}>`)}  ${D("verified")}`);
             }
+            else if (cfg.pendingAuth) {
+                console.log(`account      ${D(`not signed in yet — a code was sent to ${cfg.pendingAuth.email}: pantheon verify <code>`)}`);
+            }
             else {
                 console.log(`account      ${D("not signed in")}  ${D("— pantheon signup / pantheon login")}`);
             }
             console.log(`member       ${C(cfg.member)}`);
-            console.log(`space        ${cfg.space}`);
-            console.log(`relay        ${cfg.relay}`);
+            const teams = Object.values(loadAll()?.spaces ?? {}).map((m) => m.name);
+            console.log(`space        ${team?.space || (teams.length ? D(`none picked here — you are in ${teams.join(", ")}`) : D("none yet — pantheon start, or pantheon join <invite>"))}`);
+            console.log(`relay        ${team?.space ? team.relay : cfg.relay}`);
             console.log(`this device  ${C(fingerprint(cfg.publicKey))}`);
             console.log(D(`\nManage your devices and sessions: pantheon sessions`));
             return;
@@ -1858,7 +2011,7 @@ async function main() {
                 return interactiveOnboard(flag("relay"));
             const email = flag("email") ?? die(`usage: pantheon ${purpose} --email you@work.com${purpose === "signup" ? " --username <name>" : ""} [--relay wss://...]`);
             const username = purpose === "signup" ? (flag("username") ?? die("usage: pantheon signup --email you@work.com --username <name>")) : undefined;
-            const prior = load();
+            const prior = identity();
             const relay = flag("relay") ?? prior?.relay ?? process.env.PANTHEON_RELAY ?? DEFAULT_RELAY;
             const kp = prior?.publicKey && prior.privateKey ? { publicKey: prior.publicKey, privateKey: prior.privateKey } : newKeypair();
             const label = flag("label") ?? `${process.env.USER ?? "a"}'s ${process.platform === "darwin" ? "mac" : process.platform}`;
@@ -1866,7 +2019,7 @@ async function main() {
             const body = purpose === "signup" ? { email, username, pubkey: kp.publicKey, label } : { email, pubkey: kp.publicKey, label };
             const r = await fetch(`${base}/auth/${purpose}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) })
                 .then(async (x) => ({ status: x.status, j: await x.json() }))
-                .catch((e) => die(`could not reach the relay at ${base}: ${e.message}`));
+                .catch((e) => die(describeNetError(e, relay)));
             if (r.status !== 200)
                 die(String(r.j.error ?? `signup failed (${r.status})`));
             save({ ...(prior ?? {}), relay, member: username ?? prior?.member ?? "me", space: prior?.space ?? "", token: prior?.token ?? "",
@@ -1883,7 +2036,7 @@ async function main() {
             return;
         }
         case "verify": {
-            const cfg = load() ?? die("run `pantheon signup` or `pantheon login` first");
+            const cfg = identity() ?? die("run `pantheon signup` or `pantheon login` first");
             const pending = cfg.pendingAuth ?? die("nothing to verify — run `pantheon signup` or `pantheon login` first");
             let code = (argv[1] ?? flag("code") ?? "").trim();
             if (!code && process.stdin.isTTY) {
@@ -1894,9 +2047,9 @@ async function main() {
             if (!code)
                 die("usage: pantheon verify <6-digit-code>");
             const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
-            const r = await fetch(`${base}/auth/verify`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email: pending.email, code }) })
+            const r = await fetch(`${base}/auth/verify`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email: pending.email, code, pubkey: cfg.publicKey }) })
                 .then(async (x) => ({ status: x.status, j: await x.json() }))
-                .catch((e) => die(`could not reach the relay: ${e.message}`));
+                .catch((e) => die(describeNetError(e, cfg.relay)));
             if (r.status !== 200)
                 die(String(r.j.error ?? "verification failed"));
             const acct = r.j.account;
@@ -1910,7 +2063,7 @@ async function main() {
             return;
         }
         case "sessions": {
-            const cfg = need();
+            const cfg = identity() ?? die("not set up on this machine — pantheon signup first");
             if (!cfg.account)
                 die("not signed in — run `pantheon signup` or `pantheon login` first");
             const sub = argv[1];
@@ -1922,7 +2075,7 @@ async function main() {
                     const me = await signedFetch(cfg, "GET", "/account/sessions").then((x) => x.json()).catch(() => ({}));
                     thisDevice = me.this_device ?? "";
                 }
-                const r = await signedFetch(cfg, "POST", "/account/revoke", { kind, id }).then((x) => x.json()).catch((e) => die(e.message));
+                const r = await signedFetch(cfg, "POST", "/account/revoke", { kind, id }).then((x) => x.json()).catch((e) => die(describeNetError(e, cfg.relay)));
                 if (kind === "device" && id === thisDevice) {
                     const cl = { ...cfg };
                     delete cl.account;
@@ -1931,7 +2084,7 @@ async function main() {
                 console.error(`${C("revoked")} — ${r.revoked ?? 0} session(s)${r.device_removed ? ", device removed" : ""}${kind === "device" && id === thisDevice ? " (this device — you are now signed out)" : ""}`);
                 return;
             }
-            const r = await signedFetch(cfg, "GET", "/account/sessions").then((x) => x.json()).catch((e) => die(e.message));
+            const r = await signedFetch(cfg, "GET", "/account/sessions").then((x) => x.json()).catch((e) => die(describeNetError(e, cfg.relay)));
             console.log(`${B(r.account.username)}  ${D(`<${r.account.email}>`)}\n`);
             console.log(B("devices"));
             for (const d of r.devices)
@@ -1946,12 +2099,12 @@ async function main() {
             return;
         }
         case "audit": {
-            const cfg = need();
+            const cfg = identity() ?? die("not set up on this machine — pantheon signup first");
             if (!cfg.account)
                 die("not signed in — run `pantheon signup` first");
             const space = flag("space");
             const since = flag("since") ? String(Date.now() - Number(flag("since")) * 3_600_000) : undefined;
-            const r = await signedFetch(cfg, "GET", "/audit", { ...(space ? { space } : {}), ...(since ? { since } : {}) }).then((x) => x.json()).catch((e) => die(e.message));
+            const r = await signedFetch(cfg, "GET", "/audit", { ...(space ? { space } : {}), ...(since ? { since } : {}) }).then((x) => x.json()).catch((e) => die(describeNetError(e, cfg.relay)));
             if (r.error)
                 die(r.error);
             if (argv.includes("--json")) {
@@ -1966,22 +2119,34 @@ async function main() {
             return;
         }
         case "logout": {
-            const cfg = need();
+            const cfg = identity() ?? die("not set up on this machine — pantheon signup first");
             if (!cfg.account) {
                 console.error(D("not signed in — nothing to log out"));
                 return;
             }
-            const list = await signedFetch(cfg, "GET", "/account/sessions").then((x) => x.json()).catch((e) => die(e.message));
-            if (list.this_device)
-                await signedFetch(cfg, "POST", "/account/revoke", { kind: "device", id: list.this_device }).catch(() => { });
+            const list = await signedFetch(cfg, "GET", "/account/sessions").then(async (x) => ({ ok: x.ok, status: x.status, j: await x.json().catch(() => ({})) }))
+                .catch((e) => die(describeNetError(e, cfg.relay)));
+            if (!list.ok && list.status !== 403)
+                die(`the relay did not sign this device out (${list.j.error ?? list.status}) — nothing changed. Try again, or remove it from another device: pantheon sessions`);
+            let revoked = list.status === 403;
+            if (list.ok && list.j.this_device) {
+                const r = await signedFetch(cfg, "POST", "/account/revoke", { kind: "device", id: list.j.this_device })
+                    .then(async (x) => ({ ok: x.ok, j: await x.json().catch(() => ({})) }))
+                    .catch((e) => die(describeNetError(e, cfg.relay)));
+                if (!r.ok)
+                    die(`the relay did not sign this device out (${r.j.error ?? "refused"}) — nothing changed. Try again, or remove it from another device: pantheon sessions`);
+                revoked = true;
+            }
+            else if (list.ok)
+                revoked = true;
             const cleared = { ...cfg };
             delete cleared.account;
             save(cleared);
-            console.error(`${C("logged out")} — this device is signed out. Sign back in with ${C("pantheon login --email " + cfg.account.email)}.`);
+            console.error(`${C("logged out")} — ${revoked ? "this device is signed out" : "signed out here"}. Sign back in with ${C("pantheon login --email " + cfg.account.email)}.`);
             return;
         }
         case "account": {
-            const cfg = need();
+            const cfg = identity() ?? die("not set up on this machine — pantheon signup first");
             if (!cfg.account)
                 die("not signed in");
             const sub = argv[1];
@@ -1989,7 +2154,7 @@ async function main() {
                 die("usage: pantheon account delete");
             if (!argv.includes("--yes"))
                 die(`This permanently deletes your account (${cfg.account.username} <${cfg.account.email}>), all your devices, and all your sessions. Re-run with --yes to confirm.`);
-            const r = await signedFetch(cfg, "POST", "/account/delete").then((x) => x.json()).catch((e) => die(e.message));
+            const r = await signedFetch(cfg, "POST", "/account/delete").then((x) => x.json()).catch((e) => die(describeNetError(e, cfg.relay)));
             if (!r.ok)
                 die(String(r.error ?? "delete failed"));
             const cleared = { ...cfg };
@@ -2179,7 +2344,7 @@ async function main() {
                 if (overlap)
                     die("an overlapping delegation already exists for one of these domains; remove it first");
                 const client = new PantheonClient(cfg, undefined, { role: "cli" });
-                await client.connect().catch((e) => die(e.message));
+                await client.connect().catch((e) => die(connectFailure(e, cfg.relay)));
                 if (!client.profiles.has(to)) {
                     client.close();
                     die(`${to} has no published profile; delegation would have nowhere verifiable to land`);
@@ -2221,7 +2386,7 @@ async function main() {
         case "directory": {
             const cfg = need();
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(e.message));
+            await client.connect().catch((e) => die(connectFailure(e, cfg.relay)));
             if (!client.profiles.size)
                 console.log(`${D("no organization profiles published yet")}`);
             for (const p of client.profiles.values()) {
@@ -2278,12 +2443,41 @@ async function main() {
             return;
         }
         case "explain": {
-            const cfg = need();
             const { readFileSync, rmSync } = await import("node:fs");
+            const CONFIG_DIR = dirname(CONFIG_PATH);
+            let hud = null;
+            if (argv.includes("--queued")) {
+                const f = join(CONFIG_DIR, "bin", ".hud-action.json");
+                try {
+                    hud = JSON.parse(readFileSync(f, "utf8"));
+                    rmSync(f, { force: true });
+                }
+                catch {
+                    hud = null;
+                }
+            }
+            const cfg = (() => {
+                if (!hud?.space)
+                    return need();
+                const f = loadAll();
+                const m = f ? findMembership(f, hud.space) : undefined;
+                if (f && m)
+                    return configFor(f, m, null);
+                const here = resolveFor(process.cwd()).cfg;
+                if (here?.space === hud.space)
+                    return here;
+                const why = `this machine is no longer in the team "${hud.space}"`;
+                if (hud.action === "reply" || hud.action === "retract") {
+                    console.log(`not sent: ${why}`);
+                    process.exit(1);
+                }
+                return die(why);
+            })();
+            if (hud && hud.goal === "")
+                delete hud.goal;
             const { pickExplainAgent, decisionPrompt: dp, allDecisionsPrompt: adp, decisionTitle: dt, sessionName } = await import("./decision-ui.js");
             const { loadProfile } = await import("./profile.js");
             const { detectAvailable, launchArgs } = await import("./agents.js");
-            const CONFIG_DIR = dirname(CONFIG_PATH);
             let id = argv.find((a, i) => i > 0 && !a.startsWith("--"));
             if (argv.includes("--queued")) {
                 const queued = join(CONFIG_DIR, "bin", ".explain-id");
@@ -2295,17 +2489,6 @@ async function main() {
                 if (id === "all")
                     id = undefined;
             }
-            let hud = null;
-            if (argv.includes("--queued")) {
-                const f = join(CONFIG_DIR, "bin", ".hud-action.json");
-                try {
-                    hud = JSON.parse(readFileSync(f, "utf8"));
-                    rmSync(f, { force: true });
-                }
-                catch {
-                    hud = null;
-                }
-            }
             if (hud?.action === "fix") {
                 const dir = hud.dir && existsSync(hud.dir) ? hud.dir : process.cwd();
                 const steps = hud.lines ?? [];
@@ -2353,22 +2536,31 @@ async function main() {
                 if (!body)
                     notSent("nothing to send");
                 const c2 = new PantheonClient(cfg, undefined, { role: "cli" });
-                await c2.connect().catch((e) => notSent(e.message));
+                await c2.connect().catch((e) => notSent(connectFailure(e, cfg.relay)));
                 const o = hud.decision ? c2.obligations.find((x) => x.id === hud.decision) : undefined;
-                const acts = await fetchHistory(cfg).catch(() => []);
-                const target = acts.find((x) => x.id === (o?.ref ?? hud.act));
-                const goal = o?.goal ?? target?.goal ?? hud.goal ?? null;
+                const targetId = o?.ref ?? hud.act;
+                const target = targetId ? (await fetchAct(cfg, targetId, 8_000))?.act : undefined;
+                let goal = o?.goal ?? target?.goal ?? hud.goal ?? null;
                 if (kind === "ANSWER" && !o && !target) {
                     c2.close();
                     notSent("that decision is no longer waiting — nothing to answer");
                 }
+                if (goal && c2.goals.get(goal)?.state === "CLOSED") {
+                    if (kind === "ASK") {
+                        c2.close();
+                        notSent("that goal is closed — open a new one to ask more");
+                    }
+                    goal = null;
+                }
                 const ref = kind === "ANSWER" ? (o?.ref ?? target?.id ?? null) : kind === "ASK" ? (target?.id ?? null) : null;
                 const to = kind === "ASK" ? (target && target.from !== cfg.member ? [target.from] : null) : null;
                 if (kind === "ASK" && !to) {
                     c2.close();
                     notSent("cannot tell who raised this — use Show the thread and reply from there");
                 }
-                const sent = await c2.send({ act: kind, body, goal, ref, to, after_seq: c2.readSeq, meta: { surface: "menubar" } })
+                const summary = body.length > LIMITS.summaryRequiredOver
+                    ? (body.split(/\n|(?<=[.!?])\s/)[0] ?? body).trim().slice(0, LIMITS.summaryChars) : undefined;
+                const sent = await c2.send({ act: kind, body, goal, ref, to, after_seq: c2.readSeq, meta: { surface: "menubar" }, ...(summary ? { summary } : {}) })
                     .catch((e) => notSent(e.message));
                 c2.close();
                 console.log(`sent ${kind} id=${sent.id} seq=${sent.seq}`);
@@ -2379,7 +2571,7 @@ async function main() {
                 if (!hud.act)
                     notSent("nothing to retract");
                 const c2 = new PantheonClient(cfg, undefined, { role: "cli" });
-                await c2.connect().catch((e) => notSent(e.message));
+                await c2.connect().catch((e) => notSent(connectFailure(e, cfg.relay)));
                 const sent = await c2.send({ act: "RETRACT", body: "Retracted from the menu bar.", goal: null, ref: hud.act, to: null, meta: { surface: "menubar" } })
                     .catch((e) => notSent(e.message));
                 c2.close();
@@ -2388,14 +2580,15 @@ async function main() {
             }
             if (hud?.action === "done") {
                 const c2 = new PantheonClient(cfg, undefined, { role: "cli" });
-                await c2.connect().catch((e) => die(e.message));
+                await c2.connect().catch((e) => die(connectFailure(e, cfg.relay)));
                 const o = hud.decision ? c2.obligations.find((x) => x.id === hud.decision) : undefined;
                 if (!o) {
                     c2.close();
                     console.error(D("that decision is no longer waiting on you"));
                     return;
                 }
-                await c2.send({ act: "ANSWER", ref: o.ref, goal: o.goal, after_seq: c2.readSeq,
+                const open = o.goal && c2.goals.get(o.goal)?.state !== "CLOSED" ? o.goal : null;
+                await c2.send({ act: "ANSWER", ref: o.ref, goal: open, after_seq: c2.readSeq,
                     body: "Marked done from the alert — handled outside this thread." }).catch((e) => die(e.message));
                 c2.close();
                 console.error(D(`done — ${o.id} is no longer waiting on you`));
@@ -2411,19 +2604,18 @@ async function main() {
                 }
                 if (wd)
                     console.error(D(`  ${wd.note}`));
-                const acts = await fetchHistory(cfg).catch(() => []);
-                const a = hud.act ? acts.find((x) => x.id === hud.act) : undefined;
+                const a = hud.act ? (await fetchAct(cfg, hud.act))?.act : undefined;
                 let o;
                 if (hud.decision) {
                     const c2 = new PantheonClient(cfg, undefined, { role: "cli" });
-                    await c2.connect().catch((e) => die(e.message));
+                    await c2.connect().catch((e) => die(connectFailure(e, cfg.relay)));
                     o = c2.obligations.find((x) => x.id === hud.decision);
                     c2.close();
                 }
                 if (a) {
                     console.log(formatAct(a));
                     if (a.ref) {
-                        const r = acts.find((x) => x.id === a.ref);
+                        const r = (await fetchAct(cfg, a.ref))?.act;
                         if (r)
                             console.log(D("\nin reply to:\n") + formatAct(r, { short: true }));
                     }
@@ -2451,11 +2643,7 @@ async function main() {
                             rl.close();
                             const prompt = o ? dp(o.id, dt(o.body)) : `Read Pantheon act ${a.id}${goalId ? ` and the thread of goal ${goalId}` : ""}. Explain in plain words what happened and whether anything is owed by me, then give me numbered next steps. Do not act until I choose.`;
                             console.error(D(`opening ${agent.id}…`));
-                            const { spawnSync } = await import("node:child_process");
-                            {
-                                const sp = agentSpawn(agent.binary, launchArgs(agent.id, prompt, sessionName(prompt)));
-                                spawnSync(sp.command, sp.args, { stdio: "inherit", ...sp.options });
-                            }
+                            await launchAgent(agent.binary, (p) => launchArgs(agent.id, p, sessionName(prompt)), prompt);
                             return;
                         }
                         if (choice === "2") {
@@ -2496,7 +2684,8 @@ async function main() {
                             continue;
                         }
                         if (choice === "3" && goalId) {
-                            for (const t of selectActs(acts, { goal: goalId, last: 40 }))
+                            const thread = await fetchHistory(cfg, { goal: goalId }).catch(() => []);
+                            for (const t of selectActs(thread, { goal: goalId, last: 40 }))
                                 console.log(formatAct(t, { short: true }));
                             continue;
                         }
@@ -2523,10 +2712,7 @@ async function main() {
                     const bin = cliOnPath("grok") ?? die("grok is not on PATH here");
                     console.error(D("opening grok…"));
                     const { spawnSync } = await import("node:child_process");
-                    {
-                        const sp = agentSpawn(bin, [hud.prompt]);
-                        spawnSync(sp.command, sp.args, { stdio: "inherit", ...(cwd ? { cwd } : {}), ...sp.options });
-                    }
+                    await launchAgent(bin, (p) => [p], hud.prompt, cwd ?? undefined);
                     return;
                 }
                 if (hud.prompt) {
@@ -2535,10 +2721,7 @@ async function main() {
                         die("no agent CLI found on this machine (claude, cursor-agent, codex, copilot, or kiro-cli)");
                     console.error(D(`opening ${agent.id}…`));
                     const { spawnSync } = await import("node:child_process");
-                    {
-                        const sp = agentSpawn(agent.binary, launchArgs(agent.id, hud.prompt, sessionName(hud.prompt)));
-                        spawnSync(sp.command, sp.args, { stdio: "inherit", ...(cwd ? { cwd } : {}), ...sp.options });
-                    }
+                    await launchAgent(agent.binary, (p) => launchArgs(agent.id, p, sessionName(hud.prompt)), hud.prompt, cwd ?? undefined);
                     return;
                 }
                 if (hud.decision)
@@ -2551,7 +2734,7 @@ async function main() {
                 }
             }
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(e.message));
+            await client.connect().catch((e) => die(connectFailure(e, cfg.relay)));
             const waiting = client.obligations.filter((o) => o.kind === "HUMAN" && o.owner === `human:${cfg.member}`);
             client.close();
             const one = id ? waiting.find((o) => o.id === id) : waiting.length === 1 ? waiting[0] : undefined;
@@ -2567,10 +2750,7 @@ async function main() {
                 die("no agent CLI found on this machine (claude, cursor-agent, codex, copilot, or kiro-cli)");
             console.error(D(`opening ${agent.id} with the question…`));
             const { spawnSync } = await import("node:child_process");
-            {
-                const sp = agentSpawn(agent.binary, launchArgs(agent.id, prompt, sessionName(prompt)));
-                spawnSync(sp.command, sp.args, { stdio: "inherit", ...sp.options });
-            }
+            await launchAgent(agent.binary, (p) => launchArgs(agent.id, p, sessionName(prompt)), prompt);
             return;
         }
         case "approvals": {
@@ -2579,7 +2759,7 @@ async function main() {
             const conns = [];
             for (const c of targets()) {
                 const cl = new PantheonClient(c, undefined, { role: "cli" });
-                await cl.connect().catch((e) => die(`${c.space}: ${e.message}`));
+                await cl.connect().catch((e) => die(`${c.space}: ${connectFailure(e, c.relay)}`));
                 conns.push({ cfg: c, client: cl });
             }
             const closeAll = () => { for (const c of conns)
@@ -2624,7 +2804,7 @@ async function main() {
             const cfg = need();
             const sub = argv[1] ?? "list";
             const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(e.message));
+            await client.connect().catch((e) => die(connectFailure(e, cfg.relay)));
             const waiting = client.obligations.filter((o) => o.kind === "HUMAN" && o.owner === `human:${cfg.member}`);
             const id = argv[2];
             if (sub === "answer") {
@@ -2937,7 +3117,7 @@ async function main() {
             const sub = argv[1] ?? "list";
             const { repo: _r, repoOrigin: _o, ...plain } = cfg;
             const client = new PantheonClient(plain, undefined, { role: "cli" });
-            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.connect().catch((e) => die(client.pending ?? connectFailure(e, plain.relay)));
             if (sub === "add") {
                 const r = repoInfo(flag("path") ?? process.cwd()) ?? die("not inside a git repo");
                 const base = flag("base") ?? null;
@@ -2981,5 +3161,10 @@ async function main() {
             process.exit(cmd === "help" || cmd === "--help" ? 0 : 1);
     }
 }
-main().catch((e) => die(e.message));
+main().catch((e) => die(describeNetError(e, (() => { try {
+    return load()?.relay;
+}
+catch {
+    return undefined;
+} })())));
 //# sourceMappingURL=cli.js.map