@join-pantheon/cli 0.29.0 → 0.30.0

package/dist/roster-file.js

@@ -1,8 +1,19 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { createHash, timingSafeEqual } from "node:crypto";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { fingerprint } from "./identity.js";
+import { writeFileAtomic } from "./store.js";
+export class RosterUnreadable extends Error {
+    file;
+    constructor(file, detail) {
+        super(`the member list ${file} cannot be read (${detail})`);
+        this.file = file;
+        this.name = "RosterUnreadable";
+    }
+}
+export const PENDING_CAP = 50;
+export const PENDING_TTL_MS = 7 * 24 * 3_600_000;
 function hashToken(token) {
     return createHash("sha256").update(token).digest("hex");
 }
@@ -10,35 +21,109 @@ export class Allowlist {
     entries = new Map();
     invites = new Map();
     tokenHash = null;
+    retiredHashes = [];
+    removedAt = null;
     id = null;
+    founderName = null;
+    founderGuessed = null;
+    name = null;
+    extra = {};
     repos = new Map();
     file;
     constructor(dir, space) {
         this.file = join(dir, `${space}.members.json`);
         if (existsSync(this.file)) {
-            const raw = JSON.parse(readFileSync(this.file, "utf8"));
-            const doc = Array.isArray(raw) ? { members: raw, invites: [] } : raw;
-            for (const e of doc.members ?? [])
-                this.entries.set(e.member, e);
+            let raw;
+            try {
+                raw = JSON.parse(readFileSync(this.file, "utf8"));
+            }
+            catch (e) {
+                throw new RosterUnreadable(this.file, e.message);
+            }
+            if (!raw || typeof raw !== "object")
+                throw new RosterUnreadable(this.file, "not a member list");
+            const doc = (Array.isArray(raw) ? { members: raw, invites: [] } : raw);
+            if ((doc.members !== undefined && !Array.isArray(doc.members)) || (doc.invites !== undefined && !Array.isArray(doc.invites))) {
+                throw new RosterUnreadable(this.file, "not a member list");
+            }
             for (const i of doc.invites ?? [])
                 this.invites.set(i.token, i);
+            let legacyRemoval = false;
+            for (const e of doc.members ?? []) {
+                if (!e.admitted && e.admitted_by && !e.revoked_at) {
+                    e.revoked_at = Date.now();
+                    e.may_wake = false;
+                    legacyRemoval = true;
+                }
+                this.entries.set(e.member, e);
+            }
+            if (legacyRemoval) {
+                for (const e of this.entries.values())
+                    if (e.revoked_at && !e.admitted)
+                        this.cancelInvitesBy(e.member);
+            }
             this.tokenHash = doc.tokenHash ?? null;
+            if ("retiredTokenHashes" in doc && Array.isArray(doc.retiredTokenHashes))
+                this.retiredHashes = doc.retiredTokenHashes.filter((h) => typeof h === "string");
+            if ("removed_at" in doc && typeof doc.removed_at === "number")
+                this.removedAt = doc.removed_at;
+            if (legacyRemoval && this.removedAt === null)
+                this.removedAt = Date.now();
+            const known = new Set(["members", "invites", "tokenHash", "retiredTokenHashes", "removed_at", "id", "name", "repos", "founder", "founder_guessed"]);
+            if (!Array.isArray(raw))
+                for (const [k, v] of Object.entries(raw))
+                    if (!known.has(k))
+                        this.extra[k] = v;
             this.id = doc.id ?? null;
+            this.name = typeof doc.name === "string" && doc.name ? doc.name : null;
             for (const r of doc.repos ?? [])
                 this.repos.set(r.fingerprint, r);
+            if (typeof doc.founder === "string" && doc.founder) {
+                this.founderName = doc.founder;
+                const g = raw.founder_guessed;
+                if (typeof g === "string" && g)
+                    this.founderGuessed = g;
+            }
+            else if (this.entries.size) {
+                const d = Allowlist.deriveFounderHow([...this.entries.values()]);
+                this.founderName = d?.member ?? null;
+                if (d?.how === "earliest")
+                    this.founderGuessed = "no member was admitted by themselves, so the earliest member to connect was taken";
+                if (this.founderName) {
+                    try {
+                        this.flush();
+                    }
+                    catch { }
+                }
+            }
         }
     }
+    static deriveFounder(entries) {
+        return Allowlist.deriveFounderHow(entries)?.member ?? null;
+    }
+    static deriveFounderHow(entries) {
+        const byAge = [...entries].sort((a, b) => a.first_seen - b.first_seen);
+        const self = byAge.find((e) => e.admitted && (e.admitted_by === e.member || e.admitted_by === undefined));
+        if (self)
+            return { member: self.member, how: "self" };
+        const m = byAge.find((e) => e.admitted_by !== undefined || e.admitted)?.member;
+        return m ? { member: m, how: "earliest" } : null;
+    }
+    founderGuess() { return this.founderGuessed; }
     flush() {
-        mkdirSync(dirname(this.file), { recursive: true });
-        const tmp = `${this.file}.tmp`;
-        writeFileSync(tmp, JSON.stringify({
+        writeFileAtomic(this.file, JSON.stringify({
+            ...this.extra,
             ...(this.id ? { id: this.id } : {}),
+            ...(this.founderName ? { founder: this.founderName } : {}),
+            ...(this.founderName && this.founderGuessed ? { founder_guessed: this.founderGuessed } : {}),
+            ...(this.name ? { name: this.name } : {}),
             members: [...this.entries.values()],
             invites: [...this.invites.values()],
             ...(this.tokenHash ? { tokenHash: this.tokenHash } : {}),
+            ...(this.retiredHashes.length ? { retiredTokenHashes: this.retiredHashes } : {}),
+            ...(this.removedAt !== null ? { removed_at: this.removedAt } : {}),
             ...(this.repos.size ? { repos: [...this.repos.values()] } : {}),
-        }, null, 2) + "\n", { mode: 0o600 });
-        renameSync(tmp, this.file);
+        }, null, 2) + "\n");
     }
     peekId() { return this.id; }
     spaceId() {
@@ -48,6 +133,13 @@ export class Allowlist {
         }
         return this.id;
     }
+    recordedName() { return this.name; }
+    recordName(name) {
+        if (this.name || !name)
+            return;
+        this.name = name;
+        this.flush();
+    }
     repoList() { return [...this.repos.values()]; }
     repoCount() { return this.repos.size; }
     hasRepo(fingerprint) { return this.repos.has(fingerprint); }
@@ -80,6 +172,42 @@ export class Allowlist {
         this.tokenHash = h;
         this.flush();
     }
+    tokenRetired(token) {
+        if (!token)
+            return false;
+        const a = Buffer.from(hashToken(token), "hex");
+        return this.retiredHashes.some((h) => { const b = Buffer.from(h, "hex"); return a.length === b.length && timingSafeEqual(a, b); });
+    }
+    tokenHashes() {
+        return [...(this.tokenHash ? [this.tokenHash] : []), ...this.retiredHashes];
+    }
+    static RETIRED_KEPT = 64;
+    rotateToken(next) {
+        if (this.tokenHash) {
+            this.retiredHashes.push(this.tokenHash);
+            if (this.retiredHashes.length > Allowlist.RETIRED_KEPT)
+                this.retiredHashes = this.retiredHashes.slice(-Allowlist.RETIRED_KEPT);
+        }
+        this.tokenHash = hashToken(next);
+        for (const i of this.invites.values())
+            if (!i.used_by && i.space_token)
+                i.space_token = next;
+        this.flush();
+    }
+    currentTokenFromInvites() {
+        for (const i of this.invites.values()) {
+            if (i.space_token && this.tokenMatches(i.space_token) === true)
+                return i.space_token;
+        }
+        return null;
+    }
+    noteRemoval(at = Date.now()) {
+        this.removedAt = at;
+        this.flush();
+    }
+    removalRecorded() {
+        return this.removedAt !== null || [...this.entries.values()].some((e) => !!e.revoked_at);
+    }
     get hasToken() {
         return this.tokenHash !== null;
     }
@@ -108,18 +236,17 @@ export class Allowlist {
         if (existing && existing.publicKey !== publicKey) {
             return {
                 ok: false,
-                why: `"${member}" is registered here with a different key, so this machine cannot claim that name`,
+                why: `"${member}" is registered here with a different key — the name is taken in this team`,
                 fix: [
-                    `If you still have the original ~/.pantheon/config.json, restore it — the key is in there and nothing else needs to change.`,
-                    `  Otherwise an admitted member retires the old key, after checking your new fingerprint with you out of band:`,
-                    `    pantheon admit ${member} --forget`,
-                    `  Then redeem this same invite again; it is still unused.`,
-                    `  Joining as --me <another-name> also works, but you would leave behind every goal and obligation held by "${member}".`,
+                    `If you are not "${member}", join under your own name:  --me <your-name>   (this same invite is still unused).`,
+                    `  If you ARE "${member}" on a new machine: restore your original ~/.pantheon/config.json if you still have it — the key is in it.`,
+                    `  Failing that, a teammate who has confirmed it is you retires the old key (this removes whoever holds "${member}" now): pantheon admit ${member} --forget`,
+                    `  Then redeem this same invite again.`,
                 ].join("\n"),
             };
         }
         const entry = {
-            member, publicKey, admitted: true, admitted_by: inv.created_by,
+            member, publicKey, admitted: true, admitted_by: this.founderName === member ? member : inv.created_by,
             first_seen: existing?.first_seen ?? Date.now(), may_wake: inv.may_wake,
         };
         this.entries.set(member, entry);
@@ -168,9 +295,9 @@ export class Allowlist {
         return true;
     }
     admittedCount() { return [...this.entries.values()].filter((e) => e.admitted).length; }
+    pendingCount() { return [...this.entries.values()].filter((e) => !e.admitted && !e.revoked_at && !e.admitted_by).length; }
     founder() {
-        const f = [...this.entries.values()].filter((e) => e.admitted && (e.admitted_by === e.member || e.admitted_by === undefined)).sort((a, b) => a.first_seen - b.first_seen)[0];
-        return f?.member ?? null;
+        return this.founderName;
     }
     get(member) {
         return this.entries.get(member);
@@ -181,15 +308,30 @@ export class Allowlist {
     get empty() {
         return this.entries.size === 0;
     }
-    present(member, publicKey) {
+    present(member, publicKey, now = Date.now()) {
         const cur = this.entries.get(member);
         if (!cur) {
             const founder = this.empty;
+            if (!founder) {
+                let expired = false;
+                for (const [k, e] of this.entries) {
+                    if (!e.admitted && !e.revoked_at && !e.admitted_by && now - e.first_seen > PENDING_TTL_MS) {
+                        this.entries.delete(k);
+                        expired = true;
+                    }
+                }
+                if (expired)
+                    this.flush();
+                if (this.pendingCount() >= PENDING_CAP)
+                    return "pending-full";
+            }
             this.entries.set(member, {
                 member, publicKey, admitted: founder,
                 ...(founder ? { admitted_by: member } : {}),
                 first_seen: Date.now(), may_wake: founder,
             });
+            if (founder)
+                this.founderName = member;
             this.flush();
             return founder ? "founder" : "new";
         }
@@ -201,8 +343,9 @@ export class Allowlist {
         const e = this.entries.get(member);
         if (!e)
             return null;
+        if (!e.admitted || e.admitted_by === undefined)
+            e.admitted_by = by;
         e.admitted = true;
-        e.admitted_by = by;
         e.may_wake = mayWake;
         delete e.revoked_at;
         delete e.revoked_by;
@@ -221,8 +364,10 @@ export class Allowlist {
     forget(member) {
         const gone = this.entries.delete(member);
         this.cancelInvitesBy(member);
-        if (gone)
+        if (gone) {
+            this.removedAt = Date.now();
             this.flush();
+        }
         return gone;
     }
     revoke(member, by) {
@@ -232,6 +377,7 @@ export class Allowlist {
         e.admitted = false;
         e.may_wake = false;
         e.revoked_at = Date.now();
+        this.removedAt = e.revoked_at;
         if (by)
             e.revoked_by = by;
         this.cancelInvitesBy(member);

package/dist/run-failure.js

@@ -1,4 +1,6 @@
 import { execFileSync } from "node:child_process";
+import { checkRepoCommand } from "./agents.js";
+import { bashRuleMatches, GIT_DENY_RULES } from "./claude-confine.js";
 export const AUTH_RE = /not (?:logged|signed) in|not authenticated|no (?:github )?(?:authentication|credentials?|token) (?:found|available)|login required|please (?:log|sign) in|run .*login|invalid api key|unauthori[sz]ed|authentication (?:failed|required)|\b401\b|expired (?:token|session)/i;
 export const SIGN_IN_FIX = {
     "claude-code": "run `claude`, then /login",
@@ -58,13 +60,20 @@ export function diagnoseRun(f, probe = gitProbe) {
             fix: `Sign in once and the next run works: ${fix}. Until then every woken run on this machine fails the same way.`,
         };
     }
+    if (f.allowBash && (f.agent ?? "claude-code") === "claude-code" && (f.os ?? process.platform) === "linux" && SANDBOX_RE.test(f.detail)) {
+        return {
+            cause: "sandbox_unavailable",
+            says: "The run could not run commands: Claude Code's sandbox did not start on this machine, and a command run never goes without it.",
+            fix: "On Linux the sandbox needs bubblewrap and socat. Install them (Debian/Ubuntu: sudo apt install bubblewrap socat; Fedora: sudo dnf install bubblewrap socat), then the next run works.",
+        };
+    }
     if (!f.exited) {
         return {
             cause: "crashed",
             says: `The agent did not finish — ${exitLine(f.detail)}.`,
             fix: `Read the transcript at ${f.runLog}. If the agent CLI is broken or missing, pantheon doctor names it.`,
             dir: f.worktree,
-            lines: [`cat ${f.runLog}`],
+            lines: [`cat ${shq(f.runLog)}`],
         };
     }
     if (!f.branch) {
@@ -84,6 +93,55 @@ export function diagnoseRun(f, probe = gitProbe) {
             capability: "run_commands",
         };
     }
+    const claimed = blockedCommands(f.transcript ?? f.detail);
+    const allowed = (c) => !!f.allowedRules?.some((r) => ruleAllows(r, c));
+    const denied = (c) => GIT_DENY_RULES.find((r) => bashRuleMatches(r, c));
+    const byDeny = f.allowedRules ? claimed.filter((c) => allowed(c) && denied(c)) : [];
+    if (f.allowBash && byDeny.length) {
+        return {
+            cause: "command_not_listed",
+            says: `The run needed \`${byDeny.join("`, `")}\`, which a woken run is never given (${denied(byDeny[0])}): it would move or delete a branch the person's own checkout shares, or run a program through git.`,
+            fix: "That is by design and no list entry changes it. If the work needs it, do that step yourself, or ask the run for the part that does not need it.",
+        };
+    }
+    const blocked = f.allowedRules ? claimed.filter((c) => !allowed(c)) : claimed;
+    const wronglyBlocked = f.allowedRules ? claimed.filter((c) => allowed(c) && !denied(c)) : [];
+    if (f.allowBash && blocked.length) {
+        const cmd = blocked[0];
+        const base = f.baseRef ? f.baseRef.replace(/^origin\//, "") : "the base branch";
+        const says = `The run needed \`${blocked.join("`, `")}\`, which is not on the list of commands a woken run may use, so it was refused.`;
+        const why = checkRepoCommand(cmd);
+        if (why || !/^[A-Za-z0-9 ._\/:=@+,%-]+$/.test(cmd)) {
+            return {
+                cause: "command_not_listed", says,
+                fix: why
+                    ? `It cannot be added to ${REPO_COMMANDS_FILE_NAME}: ${why}. If the run needs it, give it a fixed form the list accepts (a script path such as ./node_modules/.bin/vitest, or a make/npm script), or run it yourself.`
+                    : `Check the command in the transcript at ${f.runLog}; if it is safe to run unattended, add it to ${REPO_COMMANDS_FILE_NAME} on ${base} yourself.`,
+                dir: f.project,
+                lines: [],
+            };
+        }
+        const onBase = !!f.baseRef && ask(() => probe.branchOf(f.project), "") === base;
+        return {
+            cause: "command_not_listed", says,
+            fix: `If it is safe to run unattended, add it to ${REPO_COMMANDS_FILE_NAME} on ${base} (one command per line) and get that onto ${base} the way your team changes it. ` +
+                `The next run reads the list from the tip of ${base} after it fetches — not from its own worktree, so committing it on the run's branch does nothing.`,
+            dir: f.project,
+            lines: onBase ? [
+                `mkdir -p .pantheon && printf '%s\\n' ${shq(cmd)} >> ${REPO_COMMANDS_FILE_NAME}`,
+                `git add ${REPO_COMMANDS_FILE_NAME} && git commit -m ${shq(`let woken runs use ${cmd.split(/\s+/).slice(0, 2).join(" ")}`)}`,
+            ] : [],
+        };
+    }
+    if (f.allowBash && wronglyBlocked.length) {
+        return {
+            cause: "command_failed",
+            says: `The run reported \`${wronglyBlocked.join("`, `")}\` as refused, but it is allowed — most likely it failed inside the command (a failing test, a missing dependency, the sandbox refusing a file or host).`,
+            fix: `Read the transcript at ${f.runLog} for what the command printed. Adding it to ${REPO_COMMANDS_FILE_NAME} would change nothing.`,
+            dir: f.worktree,
+            lines: [`cat ${shq(f.runLog)}`],
+        };
+    }
     if (!ask(() => probe.hasRemote(f.project), true)) {
         return {
             cause: "no_remote",
@@ -101,17 +159,39 @@ export function diagnoseRun(f, probe = gitProbe) {
             says: `The work is uncommitted in your own checkout${on ? ` on ${on}` : ""} — a run never sees that, it starts from what origin has.`,
             fix: "Commit and push it yourself, then the run (or your teammate) can see it. A worker deliberately never touches your working tree.",
             dir: f.project,
-            lines: [`git status --short   # ${list(dirty)}`, "git add -A", `git commit -m "…"`, `git push${on ? ` -u origin ${on}` : ""}`],
+            lines: [`git status --short   # ${list(dirty).replace(/[\r\n]+/g, " ")}`, "git add -A", `git commit -m "…"`, `git push${on ? ` -u origin ${shq(on)}` : ""}`],
         };
     }
     return silent(f);
 }
+export function ruleAllows(rule, command) {
+    const m = /^Bash\((.*)\)$/s.exec(rule);
+    if (!m)
+        return false;
+    const pat = m[1];
+    const cmd = command.trim();
+    if ((pat.match(/\*/g) ?? []).length === 1 && pat.endsWith(" *") && cmd === pat.slice(0, -2))
+        return true;
+    return new RegExp(`^${pat.split("*").map((x) => x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\s\\S]*")}$`).test(cmd);
+}
+const REPO_COMMANDS_FILE_NAME = ".pantheon/commands";
+const SANDBOX_RE = /\b(?:bubblewrap|bwrap)\b[^\n]*(?:not found|not installed|missing|unavailable|required)|sandbox[^\n]{0,80}(?:is unavailable|not available|could not (?:be )?start|failed to start)/i;
+const shq = (v) => /^[A-Za-z0-9._\/:=@+,%-]+$/.test(v) ? v : `'${v.replace(/'/g, "'\\''")}'`;
+export function blockedCommands(text) {
+    const out = [];
+    for (const m of (text ?? "").matchAll(/^\s*BLOCKED-COMMAND:\s*`?([^`\n]{1,200}?)`?\s*$/gm)) {
+        const c = m[1].trim();
+        if (c && !out.includes(c))
+            out.push(c);
+    }
+    return out.slice(0, 5);
+}
 const silent = (f) => ({
     cause: "silent",
     says: "The run finished cleanly but sent nothing back, so the request is still open.",
     fix: `Read what it did at ${f.runLog}. If it was right to stay silent, answer the teammate yourself; if not, the transcript says where it stopped.`,
     dir: f.worktree,
-    lines: [`cat ${f.runLog}`],
+    lines: [`cat ${shq(f.runLog)}`],
 });
 export const BLOCKED_RE = /(?:permission|approval)[^\n]{0,40}\b(?:denied|required|needed|to use (?:the )?(?:bash|shell))|\bnot (?:allowed|permitted) to (?:run|execute|use (?:the )?(?:bash|shell))|\b(?:bash|shell|command|tool)\b[^\n]{0,30}\b(?:was |is )?(?:blocked|denied|not allowed|rejected)\b|read-only sandbox|sandbox[^\n]{0,20}read-only/i;
 export function workNeedsCommands(kind, trigger, triggerAct) {

package/dist/secret-guard.js

@@ -0,0 +1,141 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const MIN_EXACT = 12;
+const PEM = /-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----|-----BEGIN OPENSSH PRIVATE KEY-----/;
+const TOKEN_SHAPES = [
+    { re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/, kind: "a GitHub token" },
+    { re: /\bgithub_pat_[A-Za-z0-9_]{40,}\b/, kind: "a GitHub token" },
+    { re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, kind: "an AWS access key id" },
+    { re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/, kind: "a Slack token" },
+    { re: /\bnpm_[A-Za-z0-9]{36}\b/, kind: "an npm token" },
+    { re: /\bglpat-[A-Za-z0-9_-]{20,}\b/, kind: "a GitLab token" },
+    { re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/, kind: "an Anthropic API key" },
+];
+function derPrivateKey(b64) {
+    let b;
+    try {
+        b = Buffer.from(b64.replace(/[-_]/g, (c) => (c === "-" ? "+" : "/")), "base64");
+    }
+    catch {
+        return false;
+    }
+    if (b.length < 32)
+        return false;
+    if (b.subarray(0, 15).toString("latin1") === "openssh-key-v1\0")
+        return true;
+    if (b[0] !== 0x30)
+        return false;
+    let i = 1;
+    const l = b[i];
+    if (l & 0x80)
+        i += 1 + (l & 0x7f);
+    else
+        i += 1;
+    return b[i] === 0x02 && b[i + 1] === 0x01 && (b[i + 2] === 0x00 || b[i + 2] === 0x01);
+}
+export function secretFileValues(home = homedir()) {
+    const out = [];
+    const take = (file, re) => {
+        let text = "";
+        try {
+            text = readFileSync(join(home, file), "utf8");
+        }
+        catch {
+            return;
+        }
+        if (text.length > 1 << 20)
+            return;
+        for (const m of text.matchAll(re)) {
+            const v = (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
+            if (v.length >= MIN_EXACT)
+                out.push({ value: v, file: `~/${file}` });
+        }
+    };
+    take(".aws/credentials", /^\s*(?:aws_secret_access_key|aws_session_token)\s*=\s*(\S+)/gim);
+    take(".config/gh/hosts.yml", /^\s*oauth_token:\s*(\S+)/gim);
+    take("AppData/Roaming/GitHub CLI/hosts.yml", /^\s*oauth_token:\s*(\S+)/gim);
+    take(".netrc", /\bpassword\s+(\S+)/gi);
+    take(".git-credentials", /^[a-z][a-z0-9+.-]*:\/\/[^:\s/]+:([^@\s]+)@/gim);
+    take(".docker/config.json", /"(?:auth|identitytoken)"\s*:\s*"([^"]+)"/gi);
+    take(".npmrc", /_(?:authToken|auth|password)\s*=\s*(\S+)/gi);
+    return out;
+}
+const squash = (t) => t.replace(/[^A-Za-z0-9+/]/g, "");
+function decodedRuns(text) {
+    const out = [];
+    const flat = text.replace(/\s+/g, "");
+    for (const m of flat.matchAll(/(?:[0-9a-fA-F]{2}){12,}/g)) {
+        if (out.length > 50)
+            break;
+        out.push(Buffer.from(m[0], "hex").toString("latin1"));
+    }
+    for (const m of flat.matchAll(/[A-Za-z0-9+/_-]{16,}={0,2}/g)) {
+        if (out.length > 100)
+            break;
+        try {
+            out.push(Buffer.from(m[0].replace(/[-_]/g, (c) => (c === "-" ? "+" : "/")), "base64").toString("latin1"));
+        }
+        catch { }
+    }
+    return out;
+}
+export function secretGuard(own, home = homedir()) {
+    const exact = [];
+    if (own.privateKey && own.privateKey.length >= MIN_EXACT)
+        exact.push({ value: own.privateKey, kind: "this machine's private key" });
+    for (const t of own.tokens ?? [])
+        if (t && t.length >= MIN_EXACT && !exact.some((e) => e.value === t))
+            exact.push({ value: t, kind: "a team token this machine holds" });
+    let files = [];
+    let readAt = 0;
+    return {
+        check(text) {
+            if (!text)
+                return null;
+            for (const e of exact)
+                if (text.includes(e.value))
+                    return { kind: e.kind };
+            if (exact.length) {
+                const flat = squash(text);
+                const decoded = decodedRuns(text);
+                for (const e of exact) {
+                    const v = squash(e.value);
+                    if (v.length >= MIN_EXACT && (flat.includes(v) || decoded.some((d) => d.includes(e.value) || squash(d).includes(v))))
+                        return { kind: e.kind };
+                }
+            }
+            if (PEM.test(text))
+                return { kind: "a private key (a PEM block)" };
+            for (const s of TOKEN_SHAPES)
+                if (s.re.test(text))
+                    return { kind: s.kind };
+            for (const m of text.matchAll(/[A-Za-z0-9+/_-]{60,}={0,2}/g))
+                if (derPrivateKey(m[0]))
+                    return { kind: "something shaped like a private key (base64 key material)" };
+            if (Date.now() - readAt > 60_000) {
+                files = secretFileValues(home);
+                readAt = Date.now();
+            }
+            for (const f of files)
+                if (text.includes(f.value))
+                    return { kind: `a secret from ${f.file}` };
+            return null;
+        },
+    };
+}
+export function refuseSecrets(guard, fields) {
+    for (const [name, v] of Object.entries(fields)) {
+        for (const s of Array.isArray(v) ? v : [v]) {
+            if (typeof s !== "string")
+                continue;
+            const hit = guard.check(s);
+            if (hit) {
+                return `pantheon: NOT sent — the ${name} contains ${hit.kind}. Secrets never go on the ledger: every act is stored on the relay and shown to the whole team. ` +
+                    `Take it out and send again. If a teammate asked for it, say that you cannot share it and that their human should ask yours directly.`;
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=secret-guard.js.map