@join-pantheon/cli 0.29.0 → 0.30.0

package/dist/service.js

@@ -2,15 +2,34 @@ import { writeFileSync, mkdirSync, existsSync, unlinkSync, readFileSync } from "
 import { execFileSync } from "node:child_process";
 import { homedir, platform, userInfo } from "node:os";
 import { which } from "./which.js";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { launcher } from "./install.js";
 import { CONFIG_DIR } from "./config.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 const LABEL = (kind) => `dev.pantheon.${kind}`;
+export function borrowedHome() {
+    if (process.env.PANTHEON_SERVICES_ANY_HOME === "1")
+        return false;
+    try {
+        return resolve(homedir()) !== resolve(userInfo().homedir);
+    }
+    catch {
+        return false;
+    }
+}
+const READ_ONLY = (c, a) => c === "launchctl" ? ["print", "print-disabled", "list"].includes(a[0] ?? "")
+    : c === "systemctl" ? a.some((x) => ["is-enabled", "is-active", "status", "show", "show-environment"].includes(x))
+        : true;
+function guardedExecFile(c, a) {
+    if ((c === "launchctl" || c === "systemctl") && !READ_ONLY(c, a) && borrowedHome()) {
+        throw new Error(`refused: ${c} ${a[0] ?? ""} would change this user's real services, but HOME (${homedir()}) is not the user's home — a test or a sandbox. Set PANTHEON_SERVICES_ANY_HOME=1 to allow it.`);
+    }
+    return execFileSync(c, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }) ?? "";
+}
 export const realSys = () => ({
     platform: platform(),
-    exec: (c, a) => execFileSync(c, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }) ?? "",
+    exec: guardedExecFile,
     uid: process.getuid?.() ?? 501,
     user: (() => { try {
         return userInfo().username;
@@ -38,8 +57,44 @@ export function servicesUnavailable(plat = platform()) {
 export function plistPath(kind = "worker") {
     return join(homedir(), "Library", "LaunchAgents", `${LABEL(kind)}.plist`);
 }
-export function unitPath(kind) {
-    return join(homedir(), ".config", "systemd", "user", `pantheon-${kind}.service`);
+export function parseSystemdEnvironment(out) {
+    const env = {};
+    for (const line of out.split(/\r?\n/)) {
+        const m = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+        if (!m)
+            continue;
+        let v = m[2];
+        if (v.startsWith("$'") && v.endsWith("'"))
+            v = v.slice(2, -1).replace(/\\(.)/g, (_, c) => (c === "n" ? "\n" : c === "t" ? "\t" : c));
+        env[m[1]] = v;
+    }
+    return env;
+}
+const sdEnvCache = new WeakMap();
+export function systemdUserEnv(sys = realSys()) {
+    if (sys.platform !== "linux" || (sys.borrowed ?? borrowedHome)())
+        return {};
+    const home = homedir();
+    const hit = sdEnvCache.get(sys.exec);
+    if (hit && hit.home === home)
+        return hit.env;
+    let env = {};
+    try {
+        env = parseSystemdEnvironment(sys.exec("systemctl", ["--user", "show-environment"]));
+    }
+    catch { }
+    sdEnvCache.set(sys.exec, { home, env });
+    return env;
+}
+export function unitPath(kind, env = systemdUserEnv()) {
+    const xdg = env.XDG_CONFIG_HOME && isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : join(homedir(), ".config");
+    return join(xdg, "systemd", "user", `pantheon-${kind}.service`);
+}
+export function unitPaths(kind, env = systemdUserEnv(), shellEnv = process.env) {
+    return [...new Set([unitPath(kind, env), unitPath(kind, {}), unitPath(kind, shellEnv)])];
+}
+export function existingUnitPath(kind, env = systemdUserEnv(), shellEnv = process.env) {
+    return unitPaths(kind, env, shellEnv).find((p) => existsSync(p)) ?? null;
 }
 function xml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -51,16 +106,13 @@ function argvFor(kind, args) {
     const abs = whichPantheon();
     return abs ? [abs, kind, ...args] : [process.execPath, resolve(HERE, "cli.js"), kind, ...args];
 }
-export function whichPantheon() {
-    if (platform() === "win32")
-        return which("pantheon");
-    try {
-        const p = execFileSync("/usr/bin/which", ["pantheon"], { encoding: "utf8" }).trim();
-        return p.startsWith("/") && existsSync(p) ? p : null;
-    }
-    catch {
+export function whichPantheon(find = which) {
+    const p = find("pantheon");
+    if (!p)
         return null;
-    }
+    if (platform() === "win32")
+        return p;
+    return p.startsWith("/") && existsSync(p) ? p : null;
 }
 export function servicePlist(kind, cwd, logDir, args) {
     const argv = argvFor(kind, args);
@@ -88,9 +140,15 @@ ${argv.map((a) => `    <string>${xml(a)}</string>`).join("\n")}
 `;
 }
 export function systemdQuote(arg) {
-    return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/%/g, "%%").replace(/\$/g, "$$$$")}"`;
+    return `"${cEscape(arg).replace(/%/g, "%%").replace(/\$/g, "$$$$")}"`;
 }
-const systemdValue = (v) => v.replace(/%/g, "%%");
+const cEscape = (s) => s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+export const systemdEnvQuote = (assignment) => `"${cEscape(assignment).replace(/%/g, "%%")}"`;
+const systemdValue = (v) => {
+    if (/[\r\n]/.test(v))
+        throw new Error(`a path with a line break in it cannot be written into a systemd unit: ${JSON.stringify(v)}`);
+    return v.replace(/%/g, "%%");
+};
 export function systemdUnit(kind, cwd, args, path = servicePath()) {
     const description = kind === "relay"
         ? "pantheon relay — the coordination plane for a space"
@@ -105,7 +163,7 @@ After=network-online.target
 Type=simple
 WorkingDirectory=${systemdValue(cwd)}
 ExecStart=${argvFor(kind, args).map(systemdQuote).join(" ")}
-Environment=${systemdQuote(`PATH=${path}`)}
+Environment=${systemdEnvQuote(`PATH=${path}`)}
 Restart=always
 RestartSec=30
 
@@ -128,6 +186,9 @@ export function installService(kind, cwd, args, sys = realSys()) {
     if (noServices)
         throw new Error(noServices.replace(/^not available — /, ""));
     const out = [];
+    let loaded = true;
+    let reason;
+    const done = () => Object.assign(out, { loaded, ...(reason ? { reason } : {}) });
     const abs = resolve(cwd);
     const logDir = serviceLogDir();
     if (sys.platform === "darwin") {
@@ -149,8 +210,16 @@ export function installService(kind, cwd, args, sys = realSys()) {
             out.push(`  loaded — the ${kind} now starts at login and restarts if it dies`);
         }
         catch (e) {
-            out.push(`  could not load it: ${e.message.split("\n")[0]}`);
-            out.push(`  load it yourself with:  launchctl load -w ${p}`);
+            const why = e.message.split("\n")[0];
+            loaded = false;
+            reason = why;
+            out.push(`  could not load it: ${why}`);
+            if ((sys.borrowed ?? borrowedHome)()) {
+                reason = `HOME (${homedir()}) is not your own home, so launchd was not touched`;
+                out.push(`  left unloaded — ${reason}; your own services are unchanged`);
+            }
+            else
+                out.push(`  load it yourself with:  launchctl load -w ${p}`);
         }
         out.push(`  logs:   ${join(logDir, `${kind}.log`)}`);
         out.push(`  stop:   pantheon service uninstall ${kind}`);
@@ -159,8 +228,8 @@ export function installService(kind, cwd, args, sys = realSys()) {
         if (kind === "menubar" || kind === "notifier") {
             throw new Error(`${kind === "menubar" ? "the menu bar" : "desktop alerts"} run on macOS only, and this machine reports ${sys.platform}`);
         }
-        const unit = unitPath(kind);
-        mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });
+        const unit = unitPath(kind, systemdUserEnv(sys));
+        mkdirSync(dirname(unit), { recursive: true });
         writeFileSync(unit, systemdUnit(kind, abs, args));
         out.push(`  wrote ${unit}`);
         try {
@@ -177,17 +246,15 @@ export function installService(kind, cwd, args, sys = realSys()) {
             out.push(`  ! the ${kind} stops when you log out (closing an SSH session counts). To keep it running:  loginctl enable-linger ${sys.user || "$USER"}`);
         }
     }
-    return out;
+    return done();
 }
 export function uninstallService(kind, sys = realSys()) {
     const out = [];
     if (sys.platform === "win32") {
-        const stray = unitPath(kind);
-        if (existsSync(stray)) {
-            unlinkSync(stray);
-            return [`  removed ${stray}`];
-        }
-        return [`  no ${kind} service installed`];
+        const strays = unitPaths(kind, {}).filter((u) => existsSync(u));
+        for (const u of strays)
+            unlinkSync(u);
+        return strays.length ? strays.map((u) => `  removed ${u}`) : [`  no ${kind} service installed`];
     }
     if (sys.platform === "darwin") {
         const p = plistPath(kind);
@@ -209,8 +276,8 @@ export function uninstallService(kind, sys = realSys()) {
         out.push(`  removed ${p}`);
     }
     else {
-        const unit = unitPath(kind);
-        if (!existsSync(unit))
+        const units = unitPaths(kind, systemdUserEnv(sys)).filter((u) => existsSync(u));
+        if (!units.length)
             return [`  no ${kind} service installed`];
         try {
             sys.exec("systemctl", ["--user", "disable", "--now", `pantheon-${kind}`]);
@@ -219,12 +286,14 @@ export function uninstallService(kind, sys = realSys()) {
         catch {
             out.push(`  could not reach systemd --user — if it runs elsewhere:  systemctl --user disable --now pantheon-${kind}`);
         }
-        unlinkSync(unit);
+        for (const u of units)
+            unlinkSync(u);
         try {
             sys.exec("systemctl", ["--user", "daemon-reload"]);
         }
         catch { }
-        out.push(`  removed ${unit}`);
+        for (const u of units)
+            out.push(`  removed ${u}`);
     }
     return out;
 }
@@ -239,7 +308,7 @@ export function disableService(kind, sys = realSys()) {
     }
     sys.exec("systemctl", ["--user", "disable", "--now", `pantheon-${kind}`]);
 }
-const realExec = (c, a) => execFileSync(c, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+const realExec = guardedExecFile;
 function outOf(exec, c, a) {
     try {
         return { out: String(exec(c, a) ?? ""), ok: true };
@@ -316,11 +385,11 @@ export function refreshServiceDefinition(kind, plat = platform()) {
         }
         if (plat === "win32")
             return { changed: false };
-        const u = unitPath(kind);
-        if (!existsSync(u))
+        const u = existingUnitPath(kind);
+        if (!u)
             return { changed: false };
         const unit = readFileSync(u, "utf8");
-        if (/^Environment="PATH=/m.test(unit))
+        if (/^Environment="PATH=/m.test(unit) && !/^Environment="PATH=.*\$\$/m.test(unit))
             return { changed: false };
         const exec = /^ExecStart=(.*)$/m.exec(unit)?.[1] ?? "";
         const words = exec.startsWith('"') ? [...exec.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1].replace(/\\(.)/g, "$1").replace(/%%/g, "%").replace(/\$\$/g, "$")) : exec.split(/\s+/);
@@ -340,7 +409,7 @@ export function serviceInstalled(kind, plat = platform()) {
     try {
         if (plat === "win32")
             return false;
-        return existsSync(plat === "darwin" ? plistPath(kind) : unitPath(kind));
+        return plat === "darwin" ? existsSync(plistPath(kind)) : existingUnitPath(kind) !== null;
     }
     catch {
         return false;

package/dist/setup-guide.js

@@ -3,7 +3,7 @@ import { approvalSummary, installForUser } from "./install.js";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { applyProfileInit, loadProfile, profilePath, saveProfile } from "./profile.js";
+import { applyProfileInit, loadProfile, profilePath, saveProfile, wakeMode } from "./profile.js";
 import { installService as realInstall, uninstallService as realUninstall, serviceInstalled as realInstalled } from "./service.js";
 import { personaDir } from "./persona.js";
 import { hudBinaryPath } from "./notifier.js";
@@ -19,8 +19,8 @@ export const DECISION_AREAS = [
 ];
 export const TITLE_OPTIONS = ["Founder", "Engineer", "Designer", "Product", "Operations", "Something else"];
 export const WAKE_OPTIONS = [
-    { id: "anyone", label: "Yes — anyone on my teams (recommended). Invites you send grant it; you can revoke a person any time." },
-    { id: "approved", label: "Only people I approve one by one — invites do not grant it; I run `pantheon admit <name> --may-wake` per person." },
+    { id: "anyone", label: "Yes — anyone on my teams. Invites you send grant it; you can revoke a person any time." },
+    { id: "approved", label: "Only people I approve one by one (the default) — invites do not grant it; I run `pantheon wake allow <name>` per person, on this machine." },
     { id: "no", label: "No — this machine only works while I am at it." },
 ];
 export const ALERT_OPTIONS = [
@@ -32,7 +32,7 @@ export const ALERT_OPTIONS = [
 export function guideDefaults(profile, cfg) {
     const n = profile.notifications ?? { decisions: true, deliveries: false, worker_done: false };
     return {
-        wake: profile.agent.wake_default ?? "anyone",
+        wake: wakeMode(profile),
         commands: profile.agent.allow_bash ?? false,
         approval: profile.agent.approval ?? "approve",
         name: profile.human.display_name || cfg.display || cfg.member,
@@ -69,7 +69,9 @@ export function questionnaire() {
         "",
         "Only 3 and 4 need the person every time. Ask 2 whenever there is a repo (it is the one default people are",
         "surprised by). The rest have defaults you may take and say out loud:",
-        "  --wake anyone --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
+        "  --wake approved --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
+        "--wake approved (the default) means nobody wakes this machine until they approve a person with `pantheon wake allow <name>`.",
+        "Never pick --wake anyone for them: it is their call, and only if they say so.",
         "Without a repo, --wake, --commands, --playbook and --base do nothing yet: skip them and say so.",
         "",
         "1. While they're away, may teammates hand work to this machine? (their agent runs here on its own,",
@@ -98,7 +100,7 @@ export function questionnaire() {
         "   These are switches: pass --approve-all or --ask-before-sending with no value. Either way the install",
         "   output prints the exact line written to ~/.codex/config.toml, and pantheon leave removes it.",
         "",
-        "Example:  pantheon setup --yes --wake anyone --commands yes --name \"Praneet Sinha\" --title Founder \\",
+        "Example:  pantheon setup --yes --wake approved --commands yes --name \"Praneet Sinha\" --title Founder \\",
         "            --decides deployment --alerts decisions --playbook yes --base main",
     ].join("\n");
 }
@@ -198,7 +200,7 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         io.say(`  • Wake: ${a.wake === "no" ? "off — this machine only works while you are at it"
             : !ctx.project ? "on once this machine has a repo (run pantheon setup from your project's repo)"
                 : a.wake === "anyone" ? "teammates may hand work to this machine while you're away; invites you send grant it, and you can revoke anyone (pantheon admit <name> --revoke)"
-                    : "only people you approve by hand (pantheon admit <name> --may-wake)"}`);
+                    : "only people you approve by hand, on this machine (pantheon wake allow <name>)"}`);
         io.say(`  • Alerts: ${shortAlert(a.notifications).toLowerCase()}`);
         io.say(`  • Approval: ${a.approval === "approve"
             ? "your agent sends to teammates in your name without asking each time (Claude Code, Cursor, Codex, and Kiro's IDE and pantheon agent; Copilot asks once per tool per folder)"
@@ -317,7 +319,7 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         }
         applied.push(a.wake === "anyone"
             ? "wake permission: invites you send grant it (revoke one person: pantheon admit <name> --revoke)"
-            : "wake permission: only people you grant by hand (pantheon admit <name> --may-wake)");
+            : "wake permission: only people you approve on this machine (pantheon wake allow <name>)");
     }
     else {
         applied.push("worker: run this again from your project's repo to switch it on there");
@@ -403,8 +405,25 @@ ${never.map((n) => `- ${n}`).join("\n")}
 When in doubt, ask the teammate who woke you rather than ${who}; if only ${who} can answer, ESCALATE and finish.
 `;
 }
+export function questionOrNull(rl, q) {
+    return new Promise((res) => {
+        let done = false;
+        const onClose = () => { if (!done) {
+            done = true;
+            res(null);
+        } };
+        rl.once?.("close", onClose);
+        try {
+            rl.question(q, (a) => { if (done)
+                return; done = true; rl.off?.("close", onClose); res(a.trim()); });
+        }
+        catch {
+            onClose();
+        }
+    });
+}
 export function terminalIO(rl, out) {
-    const ask = (q) => new Promise((res) => rl.question(q, (x) => res(x.trim())));
+    const ask = async (q) => (await questionOrNull(rl, q)) ?? "";
     return {
         say: out,
         async ask(question, def) {

package/dist/spend.js

@@ -31,9 +31,13 @@ export function since(ms, home) {
         byPeer[r.triggeredBy] = (byPeer[r.triggeredBy] ?? 0) + 1;
     return { runs: runs.length, failed: runs.filter((r) => !r.ok).length, byPeer };
 }
-export function recentRuns(ms, home, limit = 12) {
+export function recentRuns(ms, home, limit = 12, only) {
     const from = Date.now() - ms;
-    return read(home).runs.filter((r) => r.at > from).sort((a, b) => b.at - a.at).slice(0, limit);
+    const teams = (only?.teams ?? []).filter((t) => !!t);
+    return read(home).runs
+        .filter((r) => r.at > from)
+        .filter((r) => !only || (!!r.space && teams.includes(r.space) && (!r.member || r.member === only.member)))
+        .sort((a, b) => b.at - a.at).slice(0, limit);
 }
 export function allowed(caps, home) {
     const hour = since(3_600_000, home).runs;

package/dist/store.js

@@ -1,22 +1,86 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync, renameSync, openSync, writeSync, fsyncSync, closeSync, chmodSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { emptyRefusals } from "./admin-stats.js";
+export function ensurePrivateDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(dir, 0o700);
+    }
+    catch { }
+}
+export function writeFileAtomic(file, data, mode = 0o600) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp`;
+    const fd = openSync(tmp, "w", mode);
+    try {
+        writeSync(fd, typeof data === "string" ? Buffer.from(data) : data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    renameRetrying(tmp, file);
+    fsyncDir(dirname(file));
+}
+const sleepSync = (ms) => { try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+catch { } };
+export function renameRetrying(from, to, o = {}) {
+    const platform = o.platform ?? process.platform;
+    const rename = o.rename ?? renameSync;
+    for (let i = 0;; i++) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (e) {
+            if (platform !== "win32" || i >= 20 || !["EPERM", "EACCES", "EBUSY"].includes(e.code ?? ""))
+                throw e;
+            sleepSync(o.waitMs ?? 10);
+        }
+    }
+}
+export function fsyncDir(dir) {
+    let fd = null;
+    try {
+        fd = openSync(dir, "r");
+        fsyncSync(fd);
+    }
+    catch { }
+    finally {
+        if (fd !== null)
+            try {
+                closeSync(fd);
+            }
+            catch { }
+    }
+}
 export class StateStore {
     file;
     timer = null;
     dirty = false;
     refusals = emptyRefusals();
+    headOf;
+    rebuilt = null;
+    extra = {};
     constructor(dir, space) {
         this.file = join(dir, `${space}.state.json`);
     }
-    load() {
+    load(opts = {}) {
         const goals = new Map();
         const obligations = new Map();
         const profiles = new Map();
-        if (!existsSync(this.file))
-            return { goals, obligations, profiles };
+        if (!existsSync(this.file)) {
+            return { goals, obligations, profiles, unclean: opts.expectHistory ? "the state snapshot is missing but the ledger has history" : null };
+        }
         try {
             const snap = JSON.parse(readFileSync(this.file, "utf8"));
+            if (!snap || typeof snap !== "object" || Array.isArray(snap)
+                || (snap.goals !== undefined && !Array.isArray(snap.goals))
+                || (snap.obligations !== undefined && !Array.isArray(snap.obligations))) {
+                throw new Error("not a state snapshot");
+            }
             for (const g of snap.goals ?? [])
                 goals.set(g.id, g);
             for (const o of snap.obligations ?? []) {
@@ -24,12 +88,32 @@ export class StateStore {
             }
             for (const p of snap.profiles ?? [])
                 profiles.set(p.member, p);
+            const known = new Set(["v", "goals", "obligations", "profiles", "refusals", "ledger_head", "rebuilt", "saved_at"]);
+            this.extra = {};
+            for (const [k, v] of Object.entries(snap))
+                if (!known.has(k))
+                    this.extra[k] = v;
             if (snap.refusals)
                 this.refusals = { total: snap.refusals.total ?? 0, by_code: snap.refusals.by_code ?? {}, recent: snap.refusals.recent ?? [], stamps: snap.refusals.stamps ?? [] };
+            return {
+                goals, obligations, profiles, unclean: null,
+                ...(typeof snap.ledger_head === "number" && Number.isFinite(snap.ledger_head) ? { ledgerHead: snap.ledger_head } : {}),
+                ...(typeof snap.rebuilt === "string" && snap.rebuilt ? { rebuilt: snap.rebuilt } : {}),
+            };
         }
-        catch {
+        catch (e) {
+            const why = `the state snapshot could not be read (${e.message})`;
+            let quarantined;
+            if (opts.quarantine) {
+                const aside = `${this.file}.corrupt-${Date.now()}`;
+                try {
+                    renameSync(this.file, aside);
+                    quarantined = aside;
+                }
+                catch { }
+            }
+            return { goals: new Map(), obligations: new Map(), profiles: new Map(), unclean: why, ...(quarantined ? { quarantined } : {}) };
         }
-        return { goals, obligations, profiles };
     }
     save(goals, obligations, profiles) {
         this.dirty = true;
@@ -52,17 +136,17 @@ export class StateStore {
     onError;
     flush(goals, obligations, profiles) {
         const snap = {
+            ...this.extra,
             v: 2,
             goals: [...goals.values()],
             obligations: [...obligations.values()],
             profiles: [...profiles.values()],
             ...(this.refusals.total ? { refusals: this.refusals } : {}),
+            ...(this.headOf ? { ledger_head: this.headOf() } : {}),
+            ...(this.rebuilt ? { rebuilt: this.rebuilt } : {}),
             saved_at: Date.now(),
         };
-        mkdirSync(dirname(this.file), { recursive: true });
-        const tmp = `${this.file}.tmp`;
-        writeFileSync(tmp, JSON.stringify(snap, null, 2) + "\n", { mode: 0o600 });
-        renameSync(tmp, this.file);
+        writeFileAtomic(this.file, JSON.stringify(snap, null, 2) + "\n");
     }
     close(goals, obligations, profiles) {
         if (this.timer) {

package/dist/text-file.js

@@ -0,0 +1,74 @@
+export const stripBom = (text) => (text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+export const parseJsonText = (text) => JSON.parse(stripBom(text));
+export function stripJsonc(text) {
+    let out = "";
+    let i = 0;
+    const n = text.length;
+    while (i < n) {
+        const ch = text[i];
+        if (ch === '"') {
+            let j = i + 1;
+            while (j < n && text[j] !== '"')
+                j += text[j] === "\\" ? 2 : 1;
+            out += text.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (ch === "/" && text[i + 1] === "/") {
+            while (i < n && text[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (ch === "/" && text[i + 1] === "*") {
+            const end = text.indexOf("*/", i + 2);
+            i = end < 0 ? n : end + 2;
+            continue;
+        }
+        if (ch === ",") {
+            let j = i + 1;
+            for (;;) {
+                while (j < n && /\s/.test(text[j]))
+                    j++;
+                if (text[j] === "/" && text[j + 1] === "/") {
+                    while (j < n && text[j] !== "\n")
+                        j++;
+                    continue;
+                }
+                if (text[j] === "/" && text[j + 1] === "*") {
+                    const e = text.indexOf("*/", j + 2);
+                    j = e < 0 ? n : e + 2;
+                    continue;
+                }
+                break;
+            }
+            if (text[j] === "}" || text[j] === "]") {
+                i++;
+                continue;
+            }
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+export function isJsonc(text) {
+    const t = stripBom(text);
+    try {
+        JSON.parse(t);
+        return false;
+    }
+    catch { }
+    try {
+        JSON.parse(stripJsonc(t));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function eolOf(text) {
+    const i = text.indexOf("\n");
+    return i > 0 && text[i - 1] === "\r" ? "\r\n" : "\n";
+}
+export const withEol = (text, eol) => eol === "\n" ? text : text.replace(/\r?\n/g, "\r\n");
+//# sourceMappingURL=text-file.js.map

package/dist/tray.js

@@ -11,6 +11,7 @@ import { requireDeveloperTools } from "./notifier.js";
 import { plistPath, serviceInstalled, whichPantheon } from "./service.js";
 import { VERSION } from "./version.js";
 import { LIMITS } from "./protocol.js";
+import { signedRead } from "./reads.js";
 import { allDecisionsPrompt, decisionPrompt, decisionTitle, owedPrompt, stripCeremony, waitingPrompt, workerSummary } from "./decision-ui.js";
 import { loadProfile, SURFACE_BUNDLE_IDS } from "./profile.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -75,6 +76,15 @@ async function getJson(url) {
         clearTimeout(t);
     }
 }
+async function signedObligations(cfg) {
+    try {
+        const res = await signedRead(cfg, "/obligations", {}, { timeoutMs: LIMITS.pendingTimeoutMs });
+        return res.ok ? await res.json() : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function trayStatus(cfg = load(), f = loadAll()) {
     const ms = Object.values(f?.spaces ?? {});
     if (f && ms.length > 1) {
@@ -105,10 +115,9 @@ async function trayStatusOne(cfg) {
     if (!cfg)
         return { configured: false, version: VERSION };
     const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
-    const q = `space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}`;
     const [health, obligations] = await Promise.all([
         getJson(`${base}/health?space=${encodeURIComponent(cfg.space)}`),
-        getJson(`${base}/obligations?${q}`),
+        signedObligations(cfg),
     ]);
     const space = health
         ?.spaces?.find((s) => s.name === cfg.space);

package/dist/update-check.js

@@ -20,6 +20,8 @@ export function updateStatus(deps) {
     if (cache && deps.now() - cache.checkedAt < deps.throttleMs) {
         return { behind: cache.behind, refreshed: false, latest: cache.latest };
     }
+    if (process.env["PANTHEON_NO_UPDATE_CHECK"])
+        return { behind: cache?.behind ?? 0, refreshed: false, latest: cache?.latest };
     if (deps.isGit()) {
         try {
             const behind = deps.fetchBehind();