@join-pantheon/cli 0.28.0 → 0.29.1

package/dist/roster-file.js

@@ -83,10 +83,11 @@ export class Allowlist {
     get hasToken() {
         return this.tokenHash !== null;
     }
-    mintInvite(by, mayWake, ttlMinutes, token) {
+    mintInvite(by, mayWake, ttlMinutes, token, spaceToken) {
         const inv = {
             token, created_by: by, created_at: Date.now(),
             expires_at: Date.now() + ttlMinutes * 60_000, may_wake: mayWake,
+            ...(spaceToken ? { space_token: spaceToken } : {}),
         };
         this.invites.set(token, inv);
         this.flush();
@@ -101,6 +102,9 @@ export class Allowlist {
         if (Date.now() > inv.expires_at)
             return { ok: false, why: "that invite has expired — ask for a fresh one" };
         const existing = this.entries.get(member);
+        if (existing?.revoked_at && inv.created_at <= existing.revoked_at) {
+            return { ok: false, why: `"${member}" was removed from this team${existing.revoked_by ? ` by ${existing.revoked_by}` : ""}, so an invite from before that cannot bring them back — ask the founder for a new one` };
+        }
         if (existing && existing.publicKey !== publicKey) {
             return {
                 ok: false,
@@ -191,7 +195,7 @@ export class Allowlist {
         }
         if (cur.publicKey !== publicKey)
             return "key-mismatch";
-        return cur.admitted ? "ok" : "pending";
+        return cur.admitted ? "ok" : cur.revoked_at ? "revoked" : "pending";
     }
     admit(member, by, mayWake) {
         const e = this.entries.get(member);
@@ -200,6 +204,8 @@ export class Allowlist {
         e.admitted = true;
         e.admitted_by = by;
         e.may_wake = mayWake;
+        delete e.revoked_at;
+        delete e.revoked_by;
         this.flush();
         return e;
     }
@@ -207,18 +213,28 @@ export class Allowlist {
         const e = this.entries.get(member);
         return e && e.admitted ? e.publicKey : null;
     }
+    cancelInvitesBy(member) {
+        for (const [t, i] of this.invites)
+            if (i.created_by === member && !i.used_by)
+                this.invites.delete(t);
+    }
     forget(member) {
         const gone = this.entries.delete(member);
+        this.cancelInvitesBy(member);
         if (gone)
             this.flush();
         return gone;
     }
-    revoke(member) {
+    revoke(member, by) {
         const e = this.entries.get(member);
         if (!e)
             return false;
         e.admitted = false;
         e.may_wake = false;
+        e.revoked_at = Date.now();
+        if (by)
+            e.revoked_by = by;
+        this.cancelInvitesBy(member);
         this.flush();
         return true;
     }

package/dist/run-failure.js

@@ -74,6 +74,8 @@ export function diagnoseRun(f, probe = gitProbe) {
             fix: `It can still answer and escalate. To let it deliver work, point the worker at a checkout: pantheon service install worker from inside the repo.`,
         };
     }
+    if (!f.allowBash && !(f.needsCommands || BLOCKED_RE.test(f.transcript ?? f.detail) || BLOCKED_RE.test(f.detail)))
+        return silent(f);
     if (!f.allowBash) {
         return {
             cause: "no_commands",
@@ -102,12 +104,21 @@ export function diagnoseRun(f, probe = gitProbe) {
             lines: [`git status --short   # ${list(dirty)}`, "git add -A", `git commit -m "…"`, `git push${on ? ` -u origin ${on}` : ""}`],
         };
     }
-    return {
-        cause: "silent",
-        says: "The run finished cleanly but sent nothing back, so the request is still open.",
-        fix: `Read what it did at ${f.runLog}. If it was right to stay silent, answer the teammate yourself; if not, the transcript says where it stopped.`,
-        dir: f.worktree,
-        lines: [`cat ${f.runLog}`],
-    };
+    return silent(f);
+}
+const silent = (f) => ({
+    cause: "silent",
+    says: "The run finished cleanly but sent nothing back, so the request is still open.",
+    fix: `Read what it did at ${f.runLog}. If it was right to stay silent, answer the teammate yourself; if not, the transcript says where it stopped.`,
+    dir: f.worktree,
+    lines: [`cat ${f.runLog}`],
+});
+export const BLOCKED_RE = /(?:permission|approval)[^\n]{0,40}\b(?:denied|required|needed|to use (?:the )?(?:bash|shell))|\bnot (?:allowed|permitted) to (?:run|execute|use (?:the )?(?:bash|shell))|\b(?:bash|shell|command|tool)\b[^\n]{0,30}\b(?:was |is )?(?:blocked|denied|not allowed|rejected)\b|read-only sandbox|sandbox[^\n]{0,20}read-only/i;
+export function workNeedsCommands(kind, trigger, triggerAct) {
+    if (triggerAct === "DELIVERED")
+        return true;
+    if (kind === "REVISE" && /\bDELIVERED\b/.test(trigger))
+        return true;
+    return /\bDELIVER(?:ED)?\b|\b(?:commit|push)\b(?! ?(?:message|hook))|\bpull request\b|\bopen a PR\b|\bimplement\b/i.test(trigger);
 }
 //# sourceMappingURL=run-failure.js.map

package/dist/service.js

@@ -1,12 +1,47 @@
-import { writeFileSync, mkdirSync, existsSync, unlinkSync } from "node:fs";
+import { writeFileSync, mkdirSync, existsSync, unlinkSync, readFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { homedir, platform } from "node:os";
+import { homedir, platform, userInfo } from "node:os";
 import { which } from "./which.js";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { launcher } from "./install.js";
+import { CONFIG_DIR } from "./config.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 const LABEL = (kind) => `dev.pantheon.${kind}`;
+export function borrowedHome() {
+    if (process.env.PANTHEON_SERVICES_ANY_HOME === "1")
+        return false;
+    try {
+        return resolve(homedir()) !== resolve(userInfo().homedir);
+    }
+    catch {
+        return false;
+    }
+}
+const READ_ONLY = (c, a) => c === "launchctl" ? ["print", "print-disabled", "list"].includes(a[0] ?? "")
+    : c === "systemctl" ? a.some((x) => ["is-enabled", "is-active", "status", "show", "show-environment"].includes(x))
+        : true;
+function guardedExecFile(c, a) {
+    if ((c === "launchctl" || c === "systemctl") && !READ_ONLY(c, a) && borrowedHome()) {
+        throw new Error(`refused: ${c} ${a[0] ?? ""} would change this user's real services, but HOME (${homedir()}) is not the user's home — a test or a sandbox. Set PANTHEON_SERVICES_ANY_HOME=1 to allow it.`);
+    }
+    return execFileSync(c, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }) ?? "";
+}
+export const realSys = () => ({
+    platform: platform(),
+    exec: guardedExecFile,
+    uid: process.getuid?.() ?? 501,
+    user: (() => { try {
+        return userInfo().username;
+    }
+    catch {
+        return process.env.USER ?? "";
+    } })(),
+});
+export function serviceLogDir() {
+    return join(CONFIG_DIR, "logs");
+}
+export const serviceLogFile = (kind) => join(serviceLogDir(), `${kind}.log`);
 const SERVICE_BASE_PATH = [
     "/usr/local/bin", "/opt/homebrew/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin",
 ];
@@ -22,7 +57,7 @@ export function servicesUnavailable(plat = platform()) {
 export function plistPath(kind = "worker") {
     return join(homedir(), "Library", "LaunchAgents", `${LABEL(kind)}.plist`);
 }
-function unitPath(kind) {
+export function unitPath(kind) {
     return join(homedir(), ".config", "systemd", "user", `pantheon-${kind}.service`);
 }
 function xml(s) {
@@ -71,7 +106,11 @@ ${argv.map((a) => `    <string>${xml(a)}</string>`).join("\n")}
 </plist>
 `;
 }
-export function systemdUnit(kind, cwd, args) {
+export function systemdQuote(arg) {
+    return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/%/g, "%%").replace(/\$/g, "$$$$")}"`;
+}
+const systemdValue = (v) => v.replace(/%/g, "%%");
+export function systemdUnit(kind, cwd, args, path = servicePath()) {
     const description = kind === "relay"
         ? "pantheon relay — the coordination plane for a space"
         : kind === "worker"
@@ -83,8 +122,9 @@ After=network-online.target
 
 [Service]
 Type=simple
-WorkingDirectory=${cwd}
-ExecStart=${argvFor(kind, args).join(" ")}
+WorkingDirectory=${systemdValue(cwd)}
+ExecStart=${argvFor(kind, args).map(systemdQuote).join(" ")}
+Environment=${systemdQuote(`PATH=${path}`)}
 Restart=always
 RestartSec=30
 
@@ -92,29 +132,43 @@ RestartSec=30
 WantedBy=default.target
 `;
 }
-export function installService(kind, cwd, args) {
-    const noServices = servicesUnavailable();
+export function lingerEnabled(sys = realSys()) {
+    try {
+        const out = sys.exec("loginctl", ["show-user", sys.user || String(sys.uid), "--property=Linger"]);
+        const m = /Linger=(yes|no)/.exec(out);
+        return m ? m[1] === "yes" : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function installService(kind, cwd, args, sys = realSys()) {
+    const noServices = servicesUnavailable(sys.platform);
     if (noServices)
         throw new Error(noServices.replace(/^not available — /, ""));
     const out = [];
     const abs = resolve(cwd);
-    const logDir = join(abs, ".pantheon");
-    mkdirSync(logDir, { recursive: true });
-    if (platform() === "darwin") {
+    const logDir = serviceLogDir();
+    if (sys.platform === "darwin") {
+        mkdirSync(logDir, { recursive: true });
         const p = plistPath(kind);
         mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
         writeFileSync(p, servicePlist(kind, abs, logDir, args));
         out.push(`  wrote ${p}`);
         try {
-            execFileSync("launchctl", ["unload", p], { stdio: "ignore" });
+            sys.exec("launchctl", ["enable", `gui/${sys.uid}/${LABEL(kind)}`]);
+        }
+        catch { }
+        try {
+            sys.exec("launchctl", ["unload", p]);
         }
         catch { }
         try {
-            execFileSync("launchctl", ["load", "-w", p], { stdio: "ignore" });
+            sys.exec("launchctl", ["load", "-w", p]);
             out.push(`  loaded — the ${kind} now starts at login and restarts if it dies`);
         }
         catch (e) {
-            out.push(`  could not load it: ${e.message}`);
+            out.push(`  could not load it: ${e.message.split("\n")[0]}`);
             out.push(`  load it yourself with:  launchctl load -w ${p}`);
         }
         out.push(`  logs:   ${join(logDir, `${kind}.log`)}`);
@@ -122,15 +176,15 @@ export function installService(kind, cwd, args) {
     }
     else {
         if (kind === "menubar" || kind === "notifier") {
-            throw new Error(`${kind === "menubar" ? "the menu bar" : "desktop alerts"} run on macOS only, and this machine reports ${platform()}`);
+            throw new Error(`${kind === "menubar" ? "the menu bar" : "desktop alerts"} run on macOS only, and this machine reports ${sys.platform}`);
         }
         const unit = unitPath(kind);
         mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });
         writeFileSync(unit, systemdUnit(kind, abs, args));
         out.push(`  wrote ${unit}`);
         try {
-            execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
-            execFileSync("systemctl", ["--user", "enable", "--now", `pantheon-${kind}`], { stdio: "ignore" });
+            sys.exec("systemctl", ["--user", "daemon-reload"]);
+            sys.exec("systemctl", ["--user", "enable", "--now", `pantheon-${kind}`]);
             out.push(`  enabled — the ${kind} now starts at login and restarts if it dies`);
             out.push(`  logs:   journalctl --user -u pantheon-${kind} -f`);
             out.push(`  stop:   pantheon service uninstall ${kind}`);
@@ -138,12 +192,15 @@ export function installService(kind, cwd, args) {
         catch (e) {
             throw new Error(`the ${kind} unit is written at ${unit} but could not be enabled — systemd --user is not running here (${e.message.split("\n")[0]}). When it is, run:  systemctl --user enable --now pantheon-${kind}   (WSL: set [boot] systemd=true in /etc/wsl.conf and restart WSL)`);
         }
+        if (lingerEnabled(sys) === false) {
+            out.push(`  ! the ${kind} stops when you log out (closing an SSH session counts). To keep it running:  loginctl enable-linger ${sys.user || "$USER"}`);
+        }
     }
     return out;
 }
-export function uninstallService(kind) {
+export function uninstallService(kind, sys = realSys()) {
     const out = [];
-    if (platform() === "win32") {
+    if (sys.platform === "win32") {
         const stray = unitPath(kind);
         if (existsSync(stray)) {
             unlinkSync(stray);
@@ -151,17 +208,22 @@ export function uninstallService(kind) {
         }
         return [`  no ${kind} service installed`];
     }
-    if (platform() === "darwin") {
+    if (sys.platform === "darwin") {
         const p = plistPath(kind);
         if (!existsSync(p))
             return [`  no ${kind} service installed`];
+        let stopped = false;
         try {
-            execFileSync("launchctl", ["unload", "-w", p], { stdio: "ignore" });
-            out.push("  unloaded");
+            sys.exec("launchctl", ["bootout", `gui/${sys.uid}/${LABEL(kind)}`]);
+            stopped = true;
         }
-        catch {
-            out.push("  was not loaded");
+        catch { }
+        try {
+            sys.exec("launchctl", ["unload", "-w", p]);
+            stopped = true;
         }
+        catch { }
+        out.push(stopped ? "  stopped" : "  was not loaded");
         unlinkSync(p);
         out.push(`  removed ${p}`);
     }
@@ -170,44 +232,134 @@ export function uninstallService(kind) {
         if (!existsSync(unit))
             return [`  no ${kind} service installed`];
         try {
-            execFileSync("systemctl", ["--user", "disable", "--now", `pantheon-${kind}`], { stdio: "ignore" });
+            sys.exec("systemctl", ["--user", "disable", "--now", `pantheon-${kind}`]);
             out.push("  disabled and stopped");
         }
         catch {
             out.push(`  could not reach systemd --user — if it runs elsewhere:  systemctl --user disable --now pantheon-${kind}`);
         }
         unlinkSync(unit);
+        try {
+            sys.exec("systemctl", ["--user", "daemon-reload"]);
+        }
+        catch { }
         out.push(`  removed ${unit}`);
     }
     return out;
 }
-export function restartService(kind, exec = (c, a) => execFileSync(c, a, { stdio: "ignore" })) {
-    if (!serviceInstalled(kind))
-        return [`  ${kind}: not installed here`];
-    const uid = process.getuid?.() ?? 501;
+export function disableService(kind, sys = realSys()) {
+    if (sys.platform === "darwin") {
+        try {
+            sys.exec("launchctl", ["bootout", `gui/${sys.uid}/${LABEL(kind)}`]);
+        }
+        catch { }
+        sys.exec("launchctl", ["disable", `gui/${sys.uid}/${LABEL(kind)}`]);
+        return;
+    }
+    sys.exec("systemctl", ["--user", "disable", "--now", `pantheon-${kind}`]);
+}
+const realExec = guardedExecFile;
+function outOf(exec, c, a) {
     try {
-        if (platform() === "darwin")
-            exec("launchctl", ["kickstart", "-k", `gui/${uid}/${LABEL(kind)}`]);
-        else
-            exec("systemctl", ["--user", "restart", `pantheon-${kind}`]);
-        return [`  ${kind}: restarted on the new code`];
+        return { out: String(exec(c, a) ?? ""), ok: true };
     }
     catch (e) {
-        if (platform() === "darwin") {
-            try {
+        return { out: String(e.stdout ?? ""), ok: false };
+    }
+}
+export function serviceState(kind, exec = realExec, plat = platform(), uid = process.getuid?.() ?? 501) {
+    if (plat === "darwin") {
+        const dis = outOf(exec, "launchctl", ["print-disabled", `gui/${uid}`]).out;
+        const disabled = new RegExp(`"${LABEL(kind).replace(/\./g, "\\.")}"\\s*=>\\s*(disabled|true)`).test(dis);
+        const pr = outOf(exec, "launchctl", ["print", `gui/${uid}/${LABEL(kind)}`]);
+        return { disabled, loaded: pr.ok, running: pr.ok && /^\s*state = running/m.test(pr.out) };
+    }
+    const en = outOf(exec, "systemctl", ["--user", "is-enabled", `pantheon-${kind}`]).out.trim();
+    const act = outOf(exec, "systemctl", ["--user", "is-active", `pantheon-${kind}`]).out.trim();
+    return { disabled: /^(disabled|masked)/.test(en), loaded: true, running: act === "active" || act === "activating" };
+}
+export function restartService(kind, exec = realExec, opts = {}) {
+    const plat = opts.platform ?? platform();
+    if (!serviceInstalled(kind, plat))
+        return [`  ${kind}: not installed here`];
+    const uid = process.getuid?.() ?? 501;
+    const st = serviceState(kind, exec, plat, uid);
+    if (st.disabled)
+        return [`  ${kind}: left stopped (you stopped it) — start it again: pantheon service install ${kind}`];
+    try {
+        if (plat === "darwin") {
+            if (st.loaded && !st.running)
+                return [`  ${kind}: not running — left as it is (launchd starts it again on its own schedule)`];
+            if (!st.loaded) {
                 exec("launchctl", ["bootstrap", `gui/${uid}`, plistPath(kind)]);
                 return [`  ${kind}: was not loaded in launchd — loaded and started on the new code`];
             }
-            catch { }
+            if (opts.reload) {
+                exec("launchctl", ["bootout", `gui/${uid}/${LABEL(kind)}`]);
+                exec("launchctl", ["bootstrap", `gui/${uid}`, plistPath(kind)]);
+                return [`  ${kind}: reloaded with its new definition and restarted on the new code`];
+            }
+            exec("launchctl", ["kickstart", "-k", `gui/${uid}/${LABEL(kind)}`]);
+            return [`  ${kind}: restarted on the new code`];
         }
+        if (!st.running)
+            return [`  ${kind}: not running — left as it is (it starts at login)`];
+        if (opts.reload)
+            exec("systemctl", ["--user", "daemon-reload"]);
+        exec("systemctl", ["--user", "restart", `pantheon-${kind}`]);
+        return [`  ${kind}: restarted on the new code`];
+    }
+    catch (e) {
         return [`  ${kind}: could not restart (${e.message.split("\n")[0]}) — pantheon service restart ${kind}`];
     }
 }
-export function serviceInstalled(kind) {
+export function refreshServiceDefinition(kind, plat = platform()) {
+    try {
+        if (plat === "darwin") {
+            const p = plistPath(kind);
+            if (!existsSync(p))
+                return { changed: false };
+            const xml = readFileSync(p, "utf8");
+            const log = /<key>StandardOutPath<\/key>\s*<string>([^<]*)<\/string>/.exec(xml)?.[1] ?? "";
+            const logDir = serviceLogDir();
+            if (unxml(log).startsWith(logDir + "/"))
+                return { changed: false };
+            const argv = [...(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(xml)?.[1] ?? "").matchAll(/<string>([^<]*)<\/string>/g)].map((m) => unxml(m[1]));
+            const at = argv.indexOf(kind);
+            const cwd = unxml(/<key>WorkingDirectory<\/key>\s*<string>([^<]*)<\/string>/.exec(xml)?.[1] ?? homedir());
+            if (at < 0)
+                return { changed: false };
+            mkdirSync(logDir, { recursive: true });
+            writeFileSync(p, servicePlist(kind, cwd, logDir, argv.slice(at + 1)));
+            return { changed: true, line: `  ${kind}: its log now goes to ${join(logDir, `${kind}.log`)}${log ? ` (was ${unxml(log)})` : ""}` };
+        }
+        if (plat === "win32")
+            return { changed: false };
+        const u = unitPath(kind);
+        if (!existsSync(u))
+            return { changed: false };
+        const unit = readFileSync(u, "utf8");
+        if (/^Environment="PATH=/m.test(unit))
+            return { changed: false };
+        const exec = /^ExecStart=(.*)$/m.exec(unit)?.[1] ?? "";
+        const words = exec.startsWith('"') ? [...exec.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1].replace(/\\(.)/g, "$1").replace(/%%/g, "%").replace(/\$\$/g, "$")) : exec.split(/\s+/);
+        const at = words.indexOf(kind);
+        const cwd = (/^WorkingDirectory=(.*)$/m.exec(unit)?.[1] ?? homedir()).replace(/%%/g, "%");
+        if (at < 0)
+            return { changed: false };
+        writeFileSync(u, systemdUnit(kind, cwd, words.slice(at + 1)));
+        return { changed: true, line: `  ${kind}: its unit now quotes its paths and carries your PATH` };
+    }
+    catch (e) {
+        return { changed: false, line: `  ${kind}: could not refresh its service definition (${e.message.split("\n")[0]})` };
+    }
+}
+const unxml = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+export function serviceInstalled(kind, plat = platform()) {
     try {
-        if (platform() === "win32")
+        if (plat === "win32")
             return false;
-        return existsSync(platform() === "darwin" ? plistPath(kind) : unitPath(kind));
+        return existsSync(plat === "darwin" ? plistPath(kind) : unitPath(kind));
     }
     catch {
         return false;

package/dist/setup-guide.js

@@ -27,7 +27,7 @@ export const ALERT_OPTIONS = [
     { id: "decisions", label: "Only decisions that need me (recommended) — never for ordinary agent traffic." },
     { id: "deliveries", label: "Decisions, and when a teammate delivers work to me." },
     { id: "worker", label: "Decisions, deliveries, and when my own worker finishes a run." },
-    { id: "none", label: "None — I will look at pantheon status and the menu bar." },
+    { id: "none", label: "None — I will look at pantheon status (and the menu bar, on a Mac)." },
 ];
 export function guideDefaults(profile, cfg) {
     const n = profile.notifications ?? { decisions: true, deliveries: false, worker_done: false };
@@ -42,6 +42,9 @@ export function guideDefaults(profile, cfg) {
         persona: false,
     };
 }
+export function optOutsFrom(argv) {
+    return { worker: argv.includes("--no-worker"), notifications: argv.includes("--no-notifications") };
+}
 export function detectBaseBranch(project) {
     const git = (...a) => { try {
         return execFileSync("git", a, { cwd: project, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -154,6 +157,9 @@ export function parseSetupFlags(argv) {
     return { preset, errors };
 }
 export async function runGuide(io, ctx, deps = {}, preset = {}) {
+    const optOut = ctx.optOut ?? {};
+    const os = deps.platform ?? process.platform;
+    const mac = os === "darwin";
     const install = deps.installService ?? realInstall;
     const uninstall = deps.uninstallService ?? realUninstall;
     const installed = deps.serviceInstalled ?? realInstalled;
@@ -283,7 +289,10 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     catch (e) {
         warnings.push(`agent wiring not re-applied (${e.message}) — run pantheon install --user`);
     }
-    if (a.wake === "no") {
+    if (optOut.worker && a.wake !== "no") {
+        applied.push(`worker: not installed (--no-worker) — ${a.wake === "anyone" ? "teammates may hand you work once it is on" : "only people you approve may hand you work once it is on"}: pantheon service install worker`);
+    }
+    else if (a.wake === "no") {
         if (installed("worker")) {
             try {
                 uninstall("worker");
@@ -313,6 +322,8 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     else {
         applied.push("worker: run this again from your project's repo to switch it on there");
     }
+    const waitIn = mac ? "pantheon status, approvals, and the menu bar" : "pantheon status and pantheon approvals";
+    const chosenAlerts = ALERT_OPTIONS.find((o) => o.id === a.notifications).label.split(" — ")[0].replace(/ \(recommended\)/, "");
     if (a.notifications === "none") {
         if (installed("notifier")) {
             try {
@@ -320,10 +331,16 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
             }
             catch { }
         }
-        applied.push("alerts off — decisions still wait in pantheon status, approvals, and the menu bar");
+        applied.push(`alerts off — decisions still wait in ${waitIn}`);
+    }
+    else if (optOut.notifications) {
+        applied.push(`alerts: not installed (--no-notifications) — decisions wait in ${waitIn}. Your choice (${chosenAlerts.toLowerCase()}) is saved for when you turn them on${mac ? ": pantheon service install notifier" : ""}`);
+    }
+    else if (!mac) {
+        applied.push(`alerts: none on this machine — desktop alerts are macOS-only. Decisions wait in ${waitIn} (your choice, ${chosenAlerts.toLowerCase()}, is saved)`);
     }
     else {
-        if (!installed("notifier") && process.platform === "darwin") {
+        if (!installed("notifier")) {
             if (existsSync(hudBinaryPath(deps.home))) {
                 try {
                     install("notifier", deps.home ?? homedir(), []);

package/dist/store.js

@@ -20,8 +20,7 @@ export class StateStore {
             for (const g of snap.goals ?? [])
                 goals.set(g.id, g);
             for (const o of snap.obligations ?? []) {
-                const { claimed_by: _drop, ...rest } = o;
-                obligations.set(o.id, rest);
+                obligations.set(o.id, o.claimed_by ? { ...o, claimed_by: { ...o.claimed_by, at: Date.now() } } : o);
             }
             for (const p of snap.profiles ?? [])
                 profiles.set(p.member, p);
@@ -41,9 +40,16 @@ export class StateStore {
             if (!this.dirty)
                 return;
             this.dirty = false;
-            this.flush(goals, obligations, profiles);
+            try {
+                this.flush(goals, obligations, profiles);
+            }
+            catch (e) {
+                this.dirty = true;
+                this.onError?.(e);
+            }
         }, 250);
     }
+    onError;
     flush(goals, obligations, profiles) {
         const snap = {
             v: 2,

package/dist/which.js

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, existsSync, statSync } from "node:fs";
-import { posix, win32 } from "node:path";
+import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, posix, resolve, win32 } from "node:path";
 import { platform } from "node:os";
 export const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.PS1";
 const isWindows = (os = platform()) => os === "win32";
@@ -83,10 +83,72 @@ export function npmSpawn(args, os = platform(), resolveNpm = () => which("npm",
     const s = agentSpawn(resolveNpm() ?? "npm.cmd", args, os);
     return { ...s, options: { ...s.options, ...env } };
 }
-const cmdQuote = (a) => (/[\s"&|<>^()]/.test(a) || a === "" ? `"${a.replace(/"/g, '\\"')}"` : a);
-export function agentSpawn(binary, args, os = platform()) {
+const CMD_UNSAFE = /["%!^&|<>\r\n\0]/;
+export const cmdSafe = (a) => !CMD_UNSAFE.test(a);
+const cmdQuote = (a) => {
+    if (!cmdSafe(a))
+        throw new CmdLineUnsafe(a);
+    return /[\s&|<>^()]/.test(a) || a === "" ? `"${a.replace(/(\\+)$/, "$1$1")}"` : a;
+};
+export class CmdLineUnsafe extends Error {
+    arg;
+    constructor(arg, binary, why) {
+        super(`${binary ? `${binary} ${why ?? "is a Windows command script Pantheon could not read"}, and ` : ""}this text cannot be passed through cmd.exe safely (it contains a quote, a %, a !, a cmd.exe operator or a line break) — it was not run`);
+        this.arg = arg;
+        this.name = "CmdLineUnsafe";
+    }
+}
+export function inspectCmdShim(shim, read = (f) => { try {
+    return readFileSync(f, "utf8");
+}
+catch {
+    return null;
+} }, exists = existsSync, depth = 0) {
+    const text = read(shim);
+    if (text === null)
+        return { why: "is a Windows command script Pantheon could not read" };
+    if (text.length > 64 * 1024)
+        return { why: "was read but not recognised as a package manager's shim (it is too large to be one)" };
+    const dir = dirname(shim);
+    const re = /"%(?:~dp0|dp0%)\\?([^"%\r\n]+)"[ \t]*%\*[ \t]*\)?[ \t]*\r?$/gm;
+    let rel = null;
+    for (let m = re.exec(text); m; m = re.exec(text))
+        rel = m[1];
+    if (!rel)
+        return { why: "was read but not recognised as a package manager's shim" };
+    const parts = rel.split(/[\\/]+/).filter(Boolean);
+    if (!parts.length)
+        return { why: "was read but not recognised as a package manager's shim" };
+    const target = resolve(dir, ...parts);
+    if (!exists(target))
+        return { why: `was read, but what it runs is not there (${target})` };
+    if (/\.exe$/i.test(target))
+        return { command: target, args: [] };
+    if (/\.(?:cmd|bat)$/i.test(target)) {
+        if (depth >= 4)
+            return { why: "was read, but it runs shims that run shims too deep to follow" };
+        return inspectCmdShim(target, read, exists, depth + 1);
+    }
+    const js = /\.(?:c|m)?js$/i.test(target);
+    if (!js && (/\.[A-Za-z0-9]+$/.test(target) || !/\bnode(?:\.exe)?\b/i.test(text))) {
+        return { why: `was read, but it runs ${target}, which is not something Pantheon can start without cmd.exe` };
+    }
+    const localNode = join(dir, "node.exe");
+    return { command: exists(localNode) ? localNode : process.execPath, args: [target] };
+}
+export function resolveCmdShim(shim, read, exists) {
+    const r = inspectCmdShim(shim, read, exists);
+    return "command" in r ? r : null;
+}
+export function agentSpawn(binary, args, os = platform(), shim = (f) => inspectCmdShim(f)) {
     if (!isWindows(os) || !/\.(cmd|bat)$/i.test(binary))
         return { command: binary, args: [...args], options: {} };
+    if (!args.every(cmdSafe) || !cmdSafe(binary)) {
+        const direct = shim(binary);
+        if (!direct || !("command" in direct))
+            throw new CmdLineUnsafe(args.find((a) => !cmdSafe(a)) ?? binary, binary, direct?.why);
+        return { command: direct.command, args: [...direct.args, ...args], options: {} };
+    }
     const line = [binary, ...args].map(cmdQuote).join(" ");
     return {
         command: process.env.ComSpec || "cmd.exe",

package/dist/workdir.js

@@ -9,6 +9,12 @@ export function gitActivity(path) {
     }
     return 0;
 }
+export function mentions(text, name) {
+    if (!name)
+        return false;
+    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[^A-Za-z0-9._-])${esc}(?=$|[\\/]|\\.git(?![A-Za-z0-9_-])|\\.(?![A-Za-z0-9_-])|[^A-Za-z0-9._-])`).test(text);
+}
 export function pickWorkdir(bindings, hints, team, activity = gitActivity, exists = existsSync) {
     const live = bindings.filter((b) => exists(b.path));
     if (!live.length) {
@@ -17,7 +23,7 @@ export function pickWorkdir(bindings, hints, team, activity = gitActivity, exist
             note: `no folder on this machine is bound to "${team}", so this opens in your home folder. To fix it, run  pantheon use ${team} --here  inside the repo.`,
         };
     }
-    const named = live.filter((b) => hints.some((h) => (b.origin ? h.includes(b.origin) : false) || h.includes(b.path)));
+    const named = live.filter((b) => hints.some((h) => (b.origin ? mentions(h, b.origin) : false) || mentions(h, b.path)));
     const pool = named.length ? named : live;
     const chosen = [...pool].sort((x, y) => (activity(y.path) - activity(x.path)) || (y.bound_at - x.bound_at))[0];
     const others = live.filter((b) => b.path !== chosen.path).map((b) => basename(b.path));