@join-pantheon/cli 0.29.0 → 0.30.0

package/dist/worker.js

@@ -1,26 +1,31 @@
 import { spawn as procSpawn } from "node:child_process";
 import { execFileSync } from "node:child_process";
-import { chmodSync, mkdirSync, writeFileSync, existsSync, readFileSync, rmSync } from "node:fs";
+import { chmodSync, mkdirSync, writeFileSync, existsSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { detectClaudeFeatures, describeFeatures, ensureRunTmp, NO_CLAUDE_FEATURES, runTmpDir } from "./claude-confine.js";
+import { snapshotHome, restoreHome, describeChange, trustWrite } from "./home-guard.js";
 import { PantheonClient } from "./client.js";
 import { createHash } from "node:crypto";
-import { headlessSpawn, materializeSpawnFiles, chooseAgent, describeChoice, unattendedRefusal, quarantineRepoAgentConfig, AGENT_EDIT_SUFFIX, REPO_AGENT_CONFIG, } from "./agents.js";
+import { headlessSpawn, materializeSpawnFiles, chooseAgent, describeChoice, unattendedRefusal, quarantineRepoAgentConfig, AGENT_EDIT_SUFFIX, REPO_AGENT_CONFIG, COMMAND_GRANT_SCOPE, repoCommands, REPO_COMMANDS_FILE, claudeCommandRules, } from "./agents.js";
 import { agentSpawn, CmdLineUnsafe } from "./which.js";
 import { VERSION } from "./version.js";
-import { applyAnswer, loadPolicy, mayAsk, needsSelfUpgrade, recordAsk, savePolicy, useGrant, } from "./worker-policy.js";
+import { applyAnswer, CAPABILITY_ARGS, CARRY_REASON, carryOverWakers, dropLedgerGrants, isApprovedWaker, OLD_RELAY_WAKE, relayKnowsAdmitters, loadPolicy, mayAsk, needsSelfUpgrade, parseGrantAnswer, recordAsk, savePolicy, useGrant, WOKEN_RUN_ENV, } from "./worker-policy.js";
 import { agentHookStates, repairHook } from "./notify.js";
 import { fence, assess } from "./untrusted.js";
 import { allowed, recordRun } from "./spend.js";
 import { loadContinued, markContinued } from "./continued.js";
-import { loadProfile, reservedDecisionsNote } from "./profile.js";
+import { loadProfile, reservedDecisionsNote, saveProfile, wakeMode } from "./profile.js";
 import { clip } from "./brief.js";
 import { composeWorker } from "./notice.js";
 import { diagnoseRun, gitProbe, workNeedsCommands } from "./run-failure.js";
 import { installedTools, preferredTool } from "./notifier.js";
 import { loadPersonas, matchPersona, personaByName, personaMatches, effectivePolicy, personaBrief, describePersona, } from "./persona.js";
+import { CONFIG_PATH, loadAll, updateMembershipToken } from "./config.js";
 import { isContinuationFor, LIMITS, shouldDeferToHuman } from "./protocol.js";
 import { proxyEnvFor } from "./network.js";
+import { signedRead } from "./reads.js";
+import { commandState } from "./command-state.js";
 export function heldNote() {
     return `
 
@@ -50,6 +55,14 @@ function configuredSshCommand(cwd) {
     sshCommandSeen.set(cwd, set);
     return set;
 }
+export const AGENT_ENV_SECRETS = ["PANTHEON_TOKEN", "PANTHEON_PRIVKEY"];
+export function agentBaseEnv(base, proxy) {
+    const env = { ...base, ...proxy };
+    for (const k of AGENT_ENV_SECRETS)
+        delete env[k];
+    env[WOKEN_RUN_ENV] = "1";
+    return env;
+}
 const GIT_TIMEOUT_MS = 60_000;
 export const WORKTREE_ADD_TIMEOUT_MS = 15 * 60_000;
 export const FETCH_TIMEOUT_MS = 90_000;
@@ -171,10 +184,10 @@ function planWorktree(project, scratch, goal, log, branch, base, fetch) {
     const worktree = join(scratch, goal);
     if (!isRepo(project)) {
         if (existsSync(join(worktree, ".git")))
-            return { done: { branch, worktree, baseRef: "", baseSha: "", fetched: null } };
+            return { done: { branch, worktree, baseRef: "", baseSha: "", tipSha: "", fetched: null } };
         mkdirSync(worktree, { recursive: true });
         log(`  scratch  ${worktree} — ${project} is not a git repo, so there is no worktree and nothing to deliver`);
-        return { done: { branch: "", worktree, baseRef: "", baseSha: "", fetched: null } };
+        return { done: { branch: "", worktree, baseRef: "", baseSha: "", tipSha: "", fetched: null } };
     }
     const reuse = settleWorktree(project, worktree, log);
     if (!reuse)
@@ -205,11 +218,21 @@ function planWorktree(project, scratch, goal, log, branch, base, fetch) {
     catch (e) {
         throw new Error(`${e.message.split("\n")[0]}${oldGitNote()}`);
     }
-    const result = { branch, worktree, baseRef, baseSha, fetched };
+    const tipSha = baseSha;
+    if (reuse) {
+        try {
+            baseSha = git(worktree, "merge-base", "HEAD", tipSha) || tipSha;
+        }
+        catch { }
+    }
+    const result = { branch, worktree, baseRef, baseSha, tipSha, fetched };
     if (reuse)
         return { done: result };
     const has = git(project, "branch", "--list", "--", branch).length > 0;
-    return { add: has ? ["worktree", "add", "--", worktree, branch] : ["worktree", "add", "-b", branch, "--", worktree, baseRef], result };
+    return { add: worktreeAddArgs(has ? ["worktree", "add", "--", worktree, branch] : ["worktree", "add", "-b", branch, "--", worktree, baseRef]), result };
+}
+export function worktreeAddArgs(add, os = process.platform) {
+    return os === "win32" ? ["-c", "core.longpaths=true", ...add] : add;
 }
 function finishWorktree(r, log) {
     const mark = checkoutMark(r.worktree);
@@ -237,10 +260,11 @@ export function prepareWorktree(project, scratch, goal, log, branch = `pantheon/
     return finishWorktree(p.result, log);
 }
 export async function prepareWorktreeAsync(project, scratch, goal, log, branch = `pantheon/${goal}`, base = null, opts = {}) {
-    const needsFetch = isRepo(project) && safeSegment(goal) !== null && !settleWorktree(project, join(scratch, goal), log);
-    const fetched = needsFetch ? await fetchOrigin(project) : undefined;
+    const inRepo = isRepo(project) && safeSegment(goal) !== null;
+    const reusing = inRepo && settleWorktree(project, join(scratch, goal), log);
+    const fetched = inRepo ? await fetchOrigin(project) : undefined;
     if (fetched && !fetched.ok)
-        log(`  fetch   origin not fetched (${fetched.why}) — cutting from the refs this checkout already has`);
+        log(`  fetch   origin not fetched (${fetched.why}) — ${reusing ? "the base branch is read as this checkout last saw it" : "cutting from the refs this checkout already has"}`);
     const p = planWorktree(project, scratch, goal, log, branch, base, fetched ?? { ok: false, why: "not fetched" });
     if ("done" in p)
         return p.done;
@@ -269,6 +293,14 @@ export function branchName(space, goalId, title) {
     const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "");
     return `pantheon/${space}/${slug ? `${slug}-${goalId.slice(-4)}` : goalId}`;
 }
+export function commandNote(worktree, rev, log = () => { }) {
+    const repo = repoCommands(worktree, rev);
+    for (const r of repo.refused)
+        log(`  commands: ignored "${r.line}" in ${REPO_COMMANDS_FILE} — ${r.why}`);
+    return `\n\nCOMMANDS FOR THIS RUN: git by subcommand (status, diff, log, add, commit, push, fetch, checkout, …), the repo's test/build/run scripts through npm/pnpm/yarn/bun, make, cargo, go, pytest, mvn/gradle and dotnet` +
+        (repo.ok.length ? `, and this repo's own list (${REPO_COMMANDS_FILE}): ${repo.ok.join(", ")}` : "") +
+        `. Anything else is refused — do not try to get around it. If a command you needed was refused, say so in your reply, and end your final message with one line per command: BLOCKED-COMMAND: <the command>`;
+}
 export function baseNote(baseRef, baseSha, fetched = null) {
     if (!baseSha)
         return "";
@@ -284,20 +316,52 @@ YOUR BRANCH STARTS AT ${baseSha.slice(0, 12)} (${baseRef}, ${fresh}).
   another branch's unmerged work. When you DELIVER, name this base too (pantheon_send base=${baseSha.slice(0, 12)})
   so your peer can check that nothing else came with it.`;
 }
-const RUN_DROPPINGS = [".pantheon-task.md", ".pantheon-run.log", ".pantheon-mcp.json", ".pantheon/", `*${AGENT_EDIT_SUFFIX}`, `*${AGENT_EDIT_SUFFIX}-*`];
+const RUN_DROPPINGS = [".pantheon-task.md", ".pantheon-run.log", ".pantheon-mcp.json", ".pantheon/*", "!.pantheon/commands", "!.pantheon/personas/",
+    `*${AGENT_EDIT_SUFFIX}`, `*${AGENT_EDIT_SUFFIX}-*`];
+const RUN_DROPPINGS_OLD = [".pantheon/"];
 export function excludeRunFiles(worktree) {
     try {
         const common = git(worktree, "rev-parse", "--git-common-dir");
         const file = resolve(worktree, common, "info", "exclude");
-        const cur = existsSync(file) ? readFileSync(file, "utf8") : "";
+        const had = existsSync(file) ? readFileSync(file, "utf8") : "";
+        const cur = had.split("\n").filter((l) => !RUN_DROPPINGS_OLD.includes(l)).join("\n");
         const missing = RUN_DROPPINGS.filter((l) => !cur.split("\n").includes(l));
-        if (!missing.length)
+        if (!missing.length && cur === had)
             return;
         mkdirSync(resolve(worktree, common, "info"), { recursive: true });
-        writeFileSync(file, `${cur.replace(/\n?$/, "\n")}${missing.join("\n")}\n`);
+        writeFileSync(file, missing.length ? `${cur.replace(/\n?$/, "\n")}${missing.join("\n")}\n` : cur);
     }
     catch { }
 }
+export function gitOut(cwd, args, timeoutMs = GIT_TIMEOUT_MS) {
+    return new Promise((res) => {
+        let child;
+        try {
+            child = procSpawn("git", args, { cwd, env: gitEnv(process.env, proxyEnvFor(), cwd), stdio: ["ignore", "pipe", "ignore"] });
+        }
+        catch {
+            res(null);
+            return;
+        }
+        let out = "";
+        child.stdout?.on("data", (b) => { if (out.length < 100_000)
+            out += b.toString(); });
+        const timer = setTimeout(() => { child.kill("SIGKILL"); res(null); }, timeoutMs);
+        child.on("error", () => { clearTimeout(timer); res(null); });
+        child.on("close", (code) => { clearTimeout(timer); res(code === 0 ? out.trim() : null); });
+    });
+}
+export async function onRemote(cwd, branch, commit) {
+    if (!validBase(branch))
+        return false;
+    const line = await gitOut(cwd, ["ls-remote", "origin", `refs/heads/${branch}`], FETCH_TIMEOUT_MS);
+    const tip = line?.split(/\s+/)[0] ?? "";
+    if (!tip)
+        return false;
+    if (tip.startsWith(commit.toLowerCase()) || commit.toLowerCase().startsWith(tip))
+        return true;
+    return (await gitOut(cwd, ["merge-base", "--is-ancestor", commit, tip])) !== null;
+}
 export const MASS_DELETE_SHARE = 0.5;
 export const asksForMassDelete = (text) => /\b(?:delete|remove|wipe|drop|rm)\b[^\n]{0,40}\b(?:all|every|entire|whole|most)\b/i.test(text);
 const GIT_HOOK_NAMES = [
@@ -335,12 +399,16 @@ if [ -n "$PANTHEON_ORIG_HOOKS" ] && [ -x "$PANTHEON_ORIG_HOOKS/pre-commit" ]; th
 exit 0
 `;
 const PRE_PUSH = `#!/bin/sh
-# Pantheon: a woken run may not push the deletion of most of the repo.
+# Pantheon: a woken run pushes its own branch and nothing else — never another
+# branch (HEAD:main), never a deletion — and not the deletion of most of the repo.
 ${MASS_CHECK}
 input=$(cat)
 printf '%s\\n' "$input" | while read -r lref lsha rref rsha; do
   [ -z "$lsha" ] && continue
-  case "$lsha" in 0000000*) continue;; esac
+  if [ -z "$PANTHEON_BRANCH" ] || [ "$rref" != "refs/heads/$PANTHEON_BRANCH" ]; then
+    echo "pantheon: a woken run may push only its own branch ($PANTHEON_BRANCH), not $rref" >&2; exit 1
+  fi
+  case "$lsha" in 0000000*) echo "pantheon: a woken run may not delete a branch on the remote" >&2; exit 1;; esac
   pantheon_mass_check "$lsha" push pushed || exit 1
 done || exit 1
 if [ -n "$PANTHEON_ORIG_HOOKS" ] && [ -x "$PANTHEON_ORIG_HOOKS/pre-push" ]; then printf '%s\\n' "$input" | "$PANTHEON_ORIG_HOOKS/pre-push" "$@"; exit $?; fi
@@ -390,7 +458,18 @@ function owedLine(kind) {
         default: return `${printable(kind)} — the message above`;
     }
 }
-export function buildBrief(o, trigger, branch, persona) {
+export function deliveryStep(branch, canPush, ref) {
+    const r = ref ? ` ref ${printable(ref)},` : "";
+    return canPush
+        ? `If you wrote code: commit it on this branch, push it (git push origin ${branch} — this branch, never any other), then
+    pantheon_send DELIVERED with${r} branch ${branch} and the commit sha, so your human and your peer can review it.
+    If the push is refused, send the DELIVERED anyway: the worker pushes this branch after you finish, and corrects
+    the DELIVERED on the ledger if it cannot.`
+        : `This run cannot commit or push, so never send DELIVERED — your peer could not fetch it. If you wrote code,
+    pantheon_send NOTE with${r || " a ref,"} saying what you changed and that it waits on branch ${branch} on this machine
+    for your human to review and push. If the request asked for code, that NOTE is your reply.`;
+}
+export function buildBrief(o, trigger, branch, persona, canPush = false) {
     const placed = branch
         ? `in an isolated git worktree on branch ${branch}`
         : `in a scratch directory (your human's workspace is not a git repo, so there is no branch and nothing can be DELIVERED from here)`;
@@ -414,12 +493,11 @@ DO THIS
  1. pantheon_claim with obligation id ${printable(o.id)}. If the claim is REFUSED, another session has it —
     stop immediately and say nothing.
  2. pantheon_status and, if there is a goal, pantheon_history to understand the context.
- 3. Do the work here. You may read and edit files in this worktree. Do NOT merge, do NOT push,
+ 3. Do the work here. You may read and edit files in this worktree. Do NOT merge, ${branch && canPush ? `do NOT push any branch but ${branch}` : "do NOT push"},
     do NOT touch any checkout other than this one.
  4. Reply with pantheon_send — ANSWER an ASK, ACCEPT or OBJECT a PROPOSE, and so on.
  5. ${branch
-        ? `If you wrote code, pantheon_send DELIVERED naming this branch (${branch}) so your human can
-    review it when they are back.`
+        ? deliveryStep(branch, canPush, o.ref)
         : `Do not promise code. There is no repo here, so nothing you write can be fetched by your
     peer — say what you would do and leave the writing to your human.`}
  6. If this genuinely needs your human — money, scope, anything irreversible, or one of their
@@ -428,7 +506,7 @@ DO THIS
 There is no human in this session. Do not ask for approval; you will not get an answer.
 Keep going until you have replied, then finish.`;
 }
-export function buildContinuationBrief(act, trigger, branch, persona) {
+export function buildContinuationBrief(act, trigger, branch, persona, canPush = false) {
     const placed = branch
         ? `in an isolated git worktree on branch ${branch}`
         : `in a scratch directory (your human's workspace is not a git repo, so nothing can be DELIVERED from here)`;
@@ -464,7 +542,8 @@ DO THIS
     already responded after this ${kind}, STOP and send nothing; it was handled live.
  2. ${what}
  3. Prefer finishing over widening: do not open a new question unless the goal cannot advance
-    without one. Every act you send may wake an agent on another machine.
+    without one. Every act you send may wake an agent on another machine.${branch ? `
+    ${deliveryStep(branch, canPush, null)}` : ""}
  4. If this genuinely needs your human — money, scope, anything irreversible, or one of their
     stated red lines — pantheon_send ESCALATE and stop.
 
@@ -473,6 +552,98 @@ Act, reply if a reply is owed, then finish.`;
 }
 export const TASK_POINTER = "Your task for this run is in the file .pantheon-task.md in the current directory. Read that file first and follow it: it is the whole brief.";
 let fleetLock = null;
+export const RUN_TIMEOUT_MS = 20 * 60_000;
+export function killRunTree(pid, os = process.platform) {
+    if (!Number.isInteger(pid) || pid <= 1)
+        return;
+    if (os === "win32") {
+        try {
+            execFileSync("taskkill", ["/T", "/F", "/PID", String(pid)], { stdio: "ignore", timeout: 10_000, windowsHide: true });
+        }
+        catch { }
+        return;
+    }
+    try {
+        process.kill(-pid, "SIGKILL");
+    }
+    catch { }
+}
+export const killTreeOnExit = (os = process.platform) => os !== "win32";
+const liveRuns = new Set();
+let reaperInstalled = false;
+function installRunReaper() {
+    if (reaperInstalled)
+        return;
+    reaperInstalled = true;
+    const reap = () => { for (const pid of liveRuns)
+        killRunTree(pid); };
+    process.on("exit", reap);
+    for (const sig of ["SIGTERM", "SIGHUP"]) {
+        process.on(sig, () => { reap(); process.exit(sig === "SIGTERM" ? 143 : 129); });
+    }
+}
+export const RUN_RECORD = "worker-run.json";
+function writeRunRecord(dir, r) {
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, RUN_RECORD), JSON.stringify(r) + "\n", { mode: 0o600 });
+    }
+    catch { }
+}
+function clearRunRecord(dir, pid) {
+    try {
+        const f = join(dir, RUN_RECORD);
+        const r = JSON.parse(readFileSync(f, "utf8"));
+        if (r.pid === pid)
+            rmSync(f, { force: true });
+    }
+    catch { }
+}
+export function killRecordedRun(dir, now = Date.now()) {
+    const f = join(dir, RUN_RECORD);
+    let r;
+    try {
+        r = JSON.parse(readFileSync(f, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    rmSync(f, { force: true });
+    if (!r || !Number.isInteger(r.pid) || typeof r.at !== "number" || !Number.isFinite(r.at) || r.at > now + 60_000)
+        return null;
+    if (now - r.at > RUN_TIMEOUT_MS + 5 * 60_000)
+        return null;
+    if (!recordedRunAlive(r.pid))
+        return null;
+    killRunTree(r.pid);
+    return `stopped the woken run in progress (pid ${r.pid}, ${r.space}) and everything it started`;
+}
+export function recordedRunAlive(pid, os = process.platform, probe = (p) => { process.kill(p, 0); }) {
+    try {
+        probe(os === "win32" ? pid : -pid);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function runInFlight(dir, now = Date.now()) {
+    let r;
+    try {
+        r = JSON.parse(readFileSync(join(dir, RUN_RECORD), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!r || !Number.isInteger(r.pid) || typeof r.at !== "number" || !Number.isFinite(r.at))
+        return null;
+    if (now - r.at > RUN_TIMEOUT_MS + 5 * 60_000)
+        return null;
+    if (!recordedRunAlive(r.pid))
+        return null;
+    return { pid: r.pid, at: r.at };
+}
+export const EXIT_GRACE_MS = 3_000;
 const CONTINUATION_HORIZON_MS = 24 * 60 * 60_000;
 export function answerWindow(askSeq, hint, fullScanDue) {
     if (askSeq !== null)
@@ -531,6 +702,13 @@ export class Worker {
         for (const id of loadContinued(this.spaceKey(), this.opts.home))
             this.contDone.add(id);
     }
+    failuresOf(id) {
+        const mem = this.failedRuns.get(id);
+        if (mem !== undefined)
+            return mem;
+        this.loadContinued();
+        return this.contDone.has(`parked:${id}`) ? 2 : this.contDone.has(`failed1:${id}`) ? 1 : 0;
+    }
     markDone(id) {
         this.contDone.add(id);
         markContinued(this.spaceKey(), id, this.opts.home);
@@ -578,17 +756,33 @@ export class Worker {
     get jobs() {
         return this.done;
     }
-    runHomeDir;
-    runHome() {
-        if (this.runHomeDir)
-            return this.runHomeDir;
+    runHomePath() {
         const base = this.opts.home ?? process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
-        const dir = join(base, "run-homes", encodeURIComponent(this.cfg.spaceId ?? this.cfg.space));
+        return join(base, "run-homes", encodeURIComponent(this.cfg.spaceId ?? this.cfg.space));
+    }
+    openRunHome() {
+        const dir = this.runHomePath();
         mkdirSync(dir, { recursive: true, mode: 0o700 });
-        writeFileSync(join(dir, "config.json"), JSON.stringify(this.cfg, null, 2) + "\n", { mode: 0o600 });
-        this.runHomeDir = dir;
+        const file = join(dir, "config.json");
+        writeFileSync(file, JSON.stringify(this.cfg, null, 2) + "\n", { mode: 0o600 });
+        try {
+            chmodSync(file, 0o600);
+        }
+        catch { }
         return dir;
     }
+    sealRunHome(dir) {
+        const { token: _t, privateKey: _k, pendingAuth: _p, ...stub } = this.cfg;
+        try {
+            writeFileSync(join(dir, "config.json"), JSON.stringify({ ...stub, sealed: "the token and key are written here only while a woken run holds them" }, null, 2) + "\n", { mode: 0o600 });
+        }
+        catch {
+            try {
+                rmSync(join(dir, "config.json"), { force: true });
+            }
+            catch { }
+        }
+    }
     selectPersona(client, o) {
         const personas = this.personas();
         if (!personas.length && !this.opts.persona) {
@@ -617,7 +811,13 @@ export class Worker {
         };
     }
     async run() {
-        const client = new PantheonClient(this.cfg, undefined, { role: "worker" });
+        const client = new PantheonClient(this.cfg, (e) => {
+            if ((e.t === "welcome" || e.t === "members") && this.client === client)
+                queueMicrotask(() => this.carryWakers(client));
+        }, {
+            role: "worker",
+            persistToken: (space, oldToken, newToken) => { updateMembershipToken(space, oldToken, newToken); trustWrite(CONFIG_PATH); },
+        });
         await client.connect();
         this.client = client;
         const agentLabel = this.opts.agentCmd
@@ -628,11 +828,14 @@ export class Worker {
             catch {
                 return "auto";
             } })();
+        this.dropLedgerGrants();
         this.opts.log(`worker online as ${this.cfg.member} (session ${client.session})`);
         this.opts.log(`  project ${resolve(this.opts.project)}`);
         this.opts.log(`  scratch ${resolve(this.opts.scratch)}`);
         this.opts.log(`  agent   ${agentLabel}`);
-        this.opts.log(`  policy  ${this.opts.maxRunsPerHour} runs/hour, one at a time, ${this.opts.allowBash ? "bash allowed" : "edits only (bash gated)"}`);
+        const cmds = commandState({ home: this.opts.home, project: this.opts.project, allowBash: this.opts.allowBash });
+        this.opts.log(`  policy  ${this.opts.maxRunsPerHour} runs/hour, one at a time, commands ${cmds.level === "off" ? "off: edits only (bash gated)" : cmds.summary}`);
+        this.carryWakers(client);
         const personas = this.personas();
         if (this.opts.persona && !personaByName(personas, this.opts.persona)) {
             client.close();
@@ -652,6 +855,12 @@ export class Worker {
         this.writeState("watching", "waiting for work");
         while (!this.stopped) {
             const arrived = await client.next(5000);
+            if (client.refused && !this.refusedSaid) {
+                this.refusedSaid = true;
+                this.opts.log(`! the relay refused this machine (${client.refused}): ${String(client.lastError ?? "").replace(/^[A-Z_]+: /, "")} — it keeps trying, every ${Math.round(PantheonClient.REFUSED_RETRY_MS / 60_000)} minutes after the first ${Math.round(PantheonClient.REFUSED_GRACE_MS / 60_000)}`);
+            }
+            else if (!client.refused)
+                this.refusedSaid = false;
             if (this.opts.continuations !== false)
                 this.enqueueContinuations(client, arrived);
             const fixed = repairHook(this.opts.home);
@@ -679,17 +888,25 @@ export class Worker {
                 .filter((o) => o.kind !== "HUMAN" && !o.claimed_by)
                 .filter((o) => Date.now() - o.created_at >= grace)
                 .filter((o) => {
-                if ((this.failedRuns.get(o.id) ?? 0) < 2)
+                if (this.failuresOf(o.id) < 2)
                     return true;
                 if (!this.skipLogged.has(`parked:${o.id}`)) {
                     this.skipLogged.add(`parked:${o.id}`);
-                    this.opts.log(`- parking ${o.kind} ${o.id}: 2 runs failed on it — it stays owed for a live session or your human (see the last .pantheon-run.log)`);
+                    this.opts.log(`- parking ${o.kind} ${o.id}: its run failed in a way another run would repeat — it stays owed for a live session or your human (see the last .pantheon-run.log)`);
                 }
                 return false;
             });
             let candidate;
             let persona;
             for (const o of aged) {
+                const refusedWake = await this.wakeRefusal(client, o.ref);
+                if (refusedWake) {
+                    if (!this.skipLogged.has(`wake:${o.id}`)) {
+                        this.skipLogged.add(`wake:${o.id}`);
+                        this.opts.log(`- not taking ${o.kind} ${o.id}: ${refusedWake.why} — it waits for a live session`);
+                    }
+                    continue;
+                }
                 const sel = this.selectPersona(client, o);
                 if (sel.skip) {
                     if (!this.skipLogged.has(o.id)) {
@@ -705,7 +922,19 @@ export class Worker {
             let continuation;
             if (!candidate) {
                 const pick = this.nextContinuation(client);
-                if (pick)
+                const refusedWake = pick ? await this.wakeRefusal(client, pick.continuation.id, { from: pick.continuation.from, role: pick.continuation.role }) : null;
+                if (pick && refusedWake?.transient) {
+                    this.requeueContinuation(pick.continuation, 30_000);
+                    if (!this.skipLogged.has(`wait:${pick.continuation.id}`)) {
+                        this.skipLogged.add(`wait:${pick.continuation.id}`);
+                        this.opts.log(`- holding ${pick.continuation.act} ${pick.continuation.id}: ${refusedWake.why} — asking again shortly`);
+                    }
+                }
+                else if (pick && refusedWake) {
+                    this.markDone(pick.continuation.id);
+                    this.opts.log(`- not continuing from ${pick.continuation.act} ${pick.continuation.id}: ${refusedWake.why}`);
+                }
+                else if (pick)
                     ({ continuation, persona } = pick);
             }
             if (!candidate && !continuation) {
@@ -800,13 +1029,15 @@ export class Worker {
                 await this.reportRefused(client, job.obligation, job.diagnosis, !!candidate);
             }
             else if (candidate && !job.ok) {
-                const failures = (this.failedRuns.get(candidate.id) ?? 0) + 1;
+                const attempts = this.failuresOf(candidate.id) + 1;
+                const failures = job.diagnosis?.cause === "no_commands" ? 2 : attempts;
                 this.failedRuns.set(candidate.id, failures);
+                this.markDone(failures >= 2 ? `parked:${candidate.id}` : `failed1:${candidate.id}`);
                 if (this.failedRuns.size > 200) {
                     this.failedRuns.delete(this.failedRuns.keys().next().value);
                 }
                 if (failures >= 2 && job.diagnosis)
-                    await this.reportStuck(client, candidate, job.diagnosis);
+                    await this.reportStuck(client, candidate, job.diagnosis, attempts);
             }
             this.running = false;
             if (fleetLock === this)
@@ -819,6 +1050,23 @@ export class Worker {
     }
     stop() {
         this.stopped = true;
+        for (const pid of this.runPids)
+            killRunTree(pid);
+    }
+    runPids = new Set();
+    trackRun(pid) {
+        this.runPids.add(pid);
+        liveRuns.add(pid);
+        installRunReaper();
+        writeRunRecord(this.stateDir(), { pid, member: this.cfg.member, space: this.cfg.space, at: Date.now() });
+    }
+    untrackRun(pid) {
+        this.runPids.delete(pid);
+        liveRuns.delete(pid);
+        clearRunRecord(this.stateDir(), pid);
+    }
+    stateDir() {
+        return this.opts.home ?? process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
     }
     hooksInstalledHere() {
         try {
@@ -836,7 +1084,7 @@ export class Worker {
             ?? `(the triggering act ${printable(o.ref)} is not in this session's buffer; the relay's one-line summary of it follows)\n${o.body}`;
         const act = client.seenAct(o.ref);
         const needs = workNeedsCommands(o.kind, trigger, o.kind === "REVISE" && act?.ref ? client.seenAct(act.ref)?.act : act?.act);
-        return this.runJob(client, o, persona, policy, (branch) => buildBrief(o, trigger, branch, persona), true, needs, trigger);
+        return this.runJob(client, o, persona, policy, (branch, canPush) => buildBrief(o, trigger, branch, persona, canPush), true, needs, trigger);
     }
     async handleContinuation(client, act, persona, policy) {
         this.markDone(act.id);
@@ -850,7 +1098,7 @@ export class Worker {
         this.client?.reportWorkerState("running", `${act.act} ${act.id}`);
         const trigger = client.recent(act.id) ?? `${act.act} from ${act.from} id=${act.id}\n${act.body}`;
         const needs = workNeedsCommands("CONTINUE", trigger, act.act);
-        return this.runJob(client, o, persona, policy, (branch) => buildContinuationBrief(act, trigger, branch, persona), false, needs, trigger);
+        return this.runJob(client, o, persona, policy, (branch, canPush) => buildContinuationBrief(act, trigger, branch, persona, canPush), false, needs, trigger);
     }
     commandGrant(persona) {
         if (persona?.allowBash === false)
@@ -899,30 +1147,50 @@ export class Worker {
         if (this.opts.allowBash && !policy.allowBash && persona) {
             this.opts.log(`  bash    off for this run — persona "${persona.name}" says allow_bash: false`);
         }
-        const allowBash = policy.allowBash || this.commandGrant(persona);
-        let baseRef = "", baseSha = "";
+        let allowBash = policy.allowBash || this.commandGrant(persona);
+        let baseRef = "", baseSha = "", tipSha = "";
         let fetched = null;
         try {
-            ({ branch, worktree, baseRef, baseSha, fetched } = await prepareWorktreeAsync(this.opts.project, this.opts.scratch, goal, this.opts.log, branch, this.repoBase()));
+            ({ branch, worktree, baseRef, baseSha, tipSha, fetched } = await prepareWorktreeAsync(this.opts.project, this.opts.scratch, goal, this.opts.log, branch, this.repoBase()));
         }
         catch (e) {
             const detail = `could not prepare a worktree: ${e.message}`;
             this.opts.log(`! ${detail}`);
             return { obligation: o, branch, worktree, ok: false, detail };
         }
+        const agentId = this.opts.agentCmd ? "claude-code" : choice?.backend.id;
+        const binary = this.opts.agentCmd ?? choice?.binary ?? "claude";
+        const features = agentId === "claude-code"
+            ? (this.opts.claudeFeatures ?? (this.opts.agentCmd ? NO_CLAUDE_FEATURES : detectClaudeFeatures(binary)))
+            : null;
+        if (features) {
+            const said = describeFeatures(features);
+            if (said !== this.lastFeaturesSaid) {
+                this.opts.log(`  claude  ${said}`);
+                this.lastFeaturesSaid = said;
+            }
+        }
+        if (allowBash && features?.unknown) {
+            allowBash = false;
+            this.opts.log(`  bash    off for this run — \`${binary} --help\` did not answer, so its sandbox and deny rules cannot be confirmed`);
+        }
+        const holdRepoConfig = !allowBash && !(features?.settingSources);
+        const canPush = allowBash && !!branch;
         const reserved = reservedDecisionsNote(loadProfile(this.cfg));
-        const brief = makeBrief(branch) + baseNote(baseRef, baseSha, fetched) + (allowBash ? "" : heldNote()) + (reserved ? `\n\n${reserved}` : "");
+        const brief = makeBrief(branch, canPush) + baseNote(baseRef, baseSha, fetched) +
+            (allowBash ? (agentId === "claude-code" ? commandNote(worktree, tipSha || baseSha, (m) => this.opts.log(m)) : "") : holdRepoConfig ? heldNote() : "") +
+            (reserved ? `\n\n${reserved}` : "");
         const startedAt = Date.now();
         writeFileSync(join(worktree, ".pantheon-task.md"), brief);
         let command;
-        const agentId = this.opts.agentCmd ? "claude-code" : choice?.backend.id;
         let args;
-        let env = { ...process.env, ...proxyEnvFor() };
+        let env = agentBaseEnv(process.env, proxyEnvFor());
         let sp;
+        let bashRules = [];
         let fenced = null;
+        const runHome = this.openRunHome();
         try {
-            const runHome = this.runHome();
-            if (!allowBash) {
+            if (holdRepoConfig) {
                 fenced = quarantineRepoAgentConfig(worktree, runHome);
                 if (fenced.moved.length)
                     this.opts.log(`  config  moved the repo's agent config aside for this edits-only run: ${fenced.moved.join(", ")}`);
@@ -942,11 +1210,20 @@ export class Worker {
                     this.opts.log(`  config  ${l}`);
             }
             const backend = this.opts.agentCmd ? { id: "claude-code", label: "Claude Code", binaries: ["claude"] } : choice.backend;
-            const binary = this.opts.agentCmd ?? choice.binary;
+            const personHome = this.opts.personHome ?? homedir();
+            if (features && allowBash && !ensureRunTmp(runTmpDir(runHome))) {
+                throw new Error(`the run's temp dir ${runTmpDir(runHome)} is not this user's own folder (another user's, or a link) — a command run is not started with it`);
+            }
             const plan = headlessSpawn({
                 backend, binary, prompt: brief, worktree, cfg: this.cfg, branch, allowBash, runHome,
-                ...(baseSha ? { base: baseSha } : {}), goal,
+                ...(baseSha ? { base: baseSha } : {}), ...(tipSha ? { commandsRev: tipSha } : {}), goal,
+                ...(features ? { claude: { features, pantheonHome: this.stateDir(), home: personHome, userSettings: join(personHome, ".claude", "settings.json") } } : {}),
             });
+            for (const n of plan.notes ?? [])
+                if (!this.notesSaid.has(n)) {
+                    this.notesSaid.add(n);
+                    this.opts.log(`  confine ${n}`);
+                }
             materializeSpawnFiles(worktree, plan);
             for (const f of plan.writeFiles ?? []) {
                 const rel = isAbsolute(f.path) ? relative(worktree, f.path) : f.path;
@@ -954,6 +1231,7 @@ export class Worker {
                     fenced?.wrote(rel.split("\\").join("/"));
             }
             ({ command, args, env } = { command: plan.command, args: plan.args, env: { ...env, ...plan.env } });
+            bashRules = allowBash && agentId === "claude-code" ? claudeCommandRules(repoCommands(worktree, tipSha || baseSha).ok) : [];
             if (allowBash && baseSha)
                 env = { ...env, ...massDeleteGuardEnv(runHome, worktree, asksForMassDelete(trigger), env) };
             if (!this.opts.agentCmd)
@@ -973,23 +1251,28 @@ export class Worker {
             if (fenced)
                 for (const l of fenced.restore().lines)
                     this.opts.log(`  config  ${l}`);
+            this.sealRunHome(runHome);
             const detail = `could not plan the run: ${e.message}`;
             this.opts.log(`! ${detail}`);
-            recordRun({ at: Date.now(), goal: o.goal, obligation: o.id, ok: false, triggeredBy: client.recentFrom(o.ref) ?? "unknown", summary: clip(o.body) }, this.opts.home);
+            recordRun({ at: Date.now(), goal: o.goal, obligation: o.id, ok: false, triggeredBy: (await this.actOf(client, o.ref))?.from ?? "unknown", summary: clip(o.body), space: this.spaceKey(), member: this.cfg.member }, this.opts.home);
             return { obligation: o, branch, worktree, ok: false, detail };
         }
         let detail;
         let transcript = "";
+        const homeBefore = snapshotHome(this.stateDir());
         try {
             detail = await new Promise((res) => {
                 let child;
                 try {
-                    child = procSpawn(sp.command, sp.args, { cwd: worktree, stdio: ["ignore", "pipe", "pipe"], env, ...sp.options });
+                    child = procSpawn(sp.command, sp.args, { cwd: worktree, stdio: ["ignore", "pipe", "pipe"], env, ...sp.options, detached: process.platform !== "win32" });
                 }
                 catch (e) {
                     res(`could not start "${command}": ${e.message}`);
                     return;
                 }
+                const pid = child.pid;
+                if (pid)
+                    this.trackRun(pid);
                 let head = "", tail = "";
                 const take = (b) => {
                     const s = b.toString();
@@ -999,9 +1282,46 @@ export class Worker {
                 };
                 child.stdout.on("data", take);
                 child.stderr.on("data", take);
-                const kill = setTimeout(() => child.kill("SIGKILL"), 20 * 60_000);
-                child.on("close", (code) => { clearTimeout(kill); transcript = `${head}\n${tail}`; res(`exit ${code}\n${tail.slice(-4000)}`); });
-                child.on("error", (e) => { clearTimeout(kill); res(`could not start "${command}": ${e.message}`); });
+                let timedOut = false;
+                let dead = false;
+                const markDead = () => { if (dead)
+                    return; dead = true; if (pid)
+                    this.untrackRun(pid); };
+                let settled = false;
+                let exitGrace = null;
+                let exitCode = null;
+                const limit = this.opts.runTimeoutMs ?? RUN_TIMEOUT_MS;
+                const finish = (code, signal) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(kill);
+                    if (exitGrace)
+                        clearTimeout(exitGrace);
+                    markDead();
+                    transcript = `${head}\n${tail}`;
+                    res(`exit ${code ?? signal}${timedOut ? ` (stopped after ${Math.round(limit / 1000)}s)` : ""}\n${tail.slice(-4000)}`);
+                };
+                const kill = setTimeout(() => { if (dead)
+                    return; timedOut = true; if (pid)
+                    killRunTree(pid); }, limit);
+                child.on("exit", (code, signal) => {
+                    clearTimeout(kill);
+                    if (pid && !dead && killTreeOnExit())
+                        killRunTree(pid);
+                    markDead();
+                    const c = child;
+                    exitCode = { code, signal };
+                    exitGrace = setTimeout(() => { try {
+                        c.stdout.destroy();
+                        c.stderr.destroy();
+                    }
+                    catch { } finish(code, signal); }, this.opts.exitGraceMs ?? EXIT_GRACE_MS);
+                });
+                child.on("close", (code, signal) => finish(exitCode?.code ?? code, exitCode?.signal ?? signal));
+                child.on("error", (e) => { if (settled)
+                    return; settled = true; clearTimeout(kill); if (exitGrace)
+                    clearTimeout(exitGrace); markDead(); res(`could not start "${command}": ${e.message}`); });
             });
         }
         finally {
@@ -1010,29 +1330,39 @@ export class Worker {
                 for (const l of r.lines)
                     this.opts.log(`  config  ${l}`);
             }
+            this.sealRunHome(runHome);
+            this.restoreHomeAfterRun(homeBefore, o);
         }
         const runLog = join(worktree, ".pantheon-run.log");
         let extra = "";
+        let massDelete = false;
         if (allowBash && baseSha) {
             const d = deletedSinceBase(worktree, baseSha);
             if (d && d.total >= 4 && d.gone > d.total * MASS_DELETE_SHARE) {
+                massDelete = true;
                 extra = `\n! this branch deletes ${d.gone} of the ${d.total} files tracked at its base — do not merge it without looking`;
                 this.opts.log(`! ${o.id}: the branch ${branch} deletes ${d.gone} of the ${d.total} files tracked at ${baseSha.slice(0, 7)} — do not merge it without looking`);
             }
         }
         writeFileSync(runLog, `obligation ${o.id}\nbranch ${branch}\n\n${detail}\n${extra}`);
         const exited = /^exit 0/.test(detail);
-        const replied = requireReply ? client.repliedTo(o) : true;
+        const sent = client.mineSince(startedAt, o.goal);
+        const repliedWith = sent.find((a) => ["DELIVERED", "ANSWER", "ESCALATE", "ACCEPT", "OBJECT", "PROPOSE", "CONTRACT", "CLOSE", "WITHDRAW"].includes(a.act) || (a.act === "NOTE" && !!a.ref));
+        const replied = requireReply ? client.repliedTo(o) || !!repliedWith : true;
+        if (requireReply && replied && !client.repliedTo(o) && repliedWith) {
+            this.opts.log(`  reply   ${repliedWith.act} ${repliedWith.id} answers ${o.id}, though the relay still lists it as owed${repliedWith.ref ? "" : " (the act named no ref)"}`);
+        }
         const ok = exited && replied;
-        const triggeredBy = client.recentFrom(o.ref) ?? "unknown";
+        await this.checkDeliveries(client, sent, { branch, worktree, canPush: canPush && !massDelete, goal: o.goal ?? null });
+        const triggeredBy = (await this.actOf(client, o.ref))?.from ?? "unknown";
         const summary = clip(o.body);
         recordRun({
             at: Date.now(), goal: o.goal, obligation: o.id, ok,
-            triggeredBy, summary,
+            triggeredBy, summary, space: this.spaceKey(), member: this.cfg.member,
         }, this.opts.home);
-        const sent = client.mineSince(startedAt, o.goal);
         const quiet = ok && !requireReply && sent.length === 0;
-        const diagnosis = ok ? undefined : diagnoseRun({ exited, replied, allowBash, branch, project: this.opts.project, worktree, detail, transcript, runLog, needsCommands, ...(agentId ? { agent: agentId } : {}) }, this.opts.probe ?? gitProbe);
+        const diagnosis = ok ? undefined : diagnoseRun({ exited, replied, allowBash, branch, project: this.opts.project, worktree, detail, transcript, runLog, needsCommands, ...(agentId ? { agent: agentId } : {}),
+            ...(agentId === "claude-code" && allowBash ? { allowedRules: bashRules } : {}), ...(baseRef ? { baseRef } : {}) }, this.opts.probe ?? gitProbe);
         if (this.opts.notify && !quiet && (!ok || loadProfile(this.cfg).notifications?.worker_done)) {
             try {
                 const reply = sent[sent.length - 1] ?? null;
@@ -1045,6 +1375,92 @@ export class Worker {
                 : `! ${o.id} stopped [${diagnosis.cause}]: ${diagnosis.says} (transcript: ${runLog})`);
         return { obligation: o, branch, worktree, ok, detail, ...(diagnosis ? { diagnosis } : {}) };
     }
+    lastFeaturesSaid = "";
+    notesSaid = new Set();
+    restoreHomeAfterRun(before, o) {
+        let changes = [];
+        try {
+            changes = restoreHome(before);
+        }
+        catch (e) {
+            this.opts.log(`! could not check Pantheon's own files after the run: ${e.message}`);
+            return;
+        }
+        if (!changes.length)
+            return;
+        for (const c of changes)
+            this.opts.log(`${c.what === "reported" ? " " : "!"} ${o.id}: ${describeChange(c)}`);
+        const taken = changes.filter((c) => c.what !== "reported");
+        if (taken.length && this.opts.notify) {
+            try {
+                this.opts.notify({
+                    kind: "worker", who: "Your worker", heading: "A woken run tried to widen what the next run may do", context: this.cfg.space,
+                    body: `${taken.map(describeChange).join(" ")} None of it took effect.`,
+                    ttl: 0, sound: true,
+                });
+            }
+            catch { }
+        }
+    }
+    async checkDeliveries(client, sent, run) {
+        const deliveries = sent.filter((a) => a.act === "DELIVERED");
+        if (!deliveries.length || !run.branch)
+            return;
+        const origin = await gitOut(this.opts.project, ["remote", "get-url", "origin"]);
+        if (origin === null)
+            return;
+        for (const d of deliveries) {
+            const m = (d.meta ?? {});
+            const br = typeof m.branch === "string" ? m.branch : "";
+            const commit = typeof m.commit === "string" && /^[0-9a-f]{7,64}$/i.test(m.commit) ? m.commit : "";
+            if (!br || !commit)
+                continue;
+            if (typeof m.remote === "string" && m.remote && m.remote !== origin)
+                continue;
+            if (await onRemote(run.worktree, br, commit))
+                continue;
+            let pushed = false;
+            if (run.canPush && br === run.branch && validBase(br)
+                && (await gitOut(run.worktree, ["merge-base", "--is-ancestor", commit, `refs/heads/${br}`])) !== null) {
+                const r = await gitOut(run.worktree, ["push", "--quiet", "origin", `refs/heads/${br}:refs/heads/${br}`], FETCH_TIMEOUT_MS);
+                pushed = r !== null && await onRemote(run.worktree, br, commit);
+                if (pushed)
+                    this.opts.log(`* pushed ${br} for the run: its DELIVERED ${d.id} named ${commit.slice(0, 7)}, which origin did not have`);
+            }
+            if (pushed)
+                continue;
+            const why = br !== run.branch ? `it names ${br}, not this run's own branch ${run.branch}, which the worker will not push`
+                : !run.canPush ? "this run was not allowed to run commands, so nothing could be pushed"
+                    : "the worker could not push it either";
+            this.opts.log(`! DELIVERED ${d.id} names ${br} at ${commit.slice(0, 7)}, which is not on origin — ${why}`);
+            try {
+                await client.send({
+                    act: "NOTE", goal: d.goal ?? run.goal, ref: d.id, after_seq: Math.max(client.readSeq, client.seq),
+                    ...(d.to?.length ? { to: d.to } : {}),
+                    summary: clip(`Correction: that delivery cannot be fetched yet — ${br} at ${commit.slice(0, 7)} is not on origin`, 190),
+                    body: [
+                        `Correction to DELIVERED ${d.id}: ${br} at ${commit.slice(0, 12)} is not on origin, so \`git fetch origin ${br}\` will not find it.`,
+                        `Why: ${why}. The work is on this machine, on that branch; ${this.cfg.member}'s human has been told and will push it or say what happened.`,
+                        `Do not ACCEPT it until the branch is fetchable.`,
+                    ].join("\n"),
+                });
+            }
+            catch (e) {
+                this.opts.log(`! could not correct the unpushed DELIVERED on the ledger: ${e.message}`);
+            }
+            if (this.opts.notify) {
+                try {
+                    this.opts.notify({
+                        kind: "worker", who: "Your worker", heading: "A delivery was not pushed", context: this.cfg.space,
+                        body: `A woken run sent DELIVERED for ${br} at ${commit.slice(0, 7)}, but origin does not have it (${why}). Your teammate was told. Push it yourself: git push origin ${br}`,
+                        ttl: 0, sound: false,
+                        fix: { label: "Push it", dir: run.worktree, lines: [`git push origin ${br}`], why: `DELIVERED ${d.id} is not on origin` },
+                    });
+                }
+                catch { }
+            }
+        }
+    }
     refusalsNotified = new Set();
     async reportRefused(client, o, d, owed) {
         if (this.opts.notify && !this.refusalsNotified.has(d.says)) {
@@ -1078,7 +1494,7 @@ export class Worker {
             this.opts.log(`! could not tell the teammate that ${o.id} is waiting: ${e.message}`);
         }
     }
-    async reportStuck(client, o, d) {
+    async reportStuck(client, o, d, attempts) {
         const key = `stuck:${o.id}`;
         const space = this.spaceKey();
         if (loadContinued(space, this.opts.home).has(key))
@@ -1087,7 +1503,7 @@ export class Worker {
         const asking = !!d.capability && mayAsk(policy, d.capability);
         const what = clip(o.body, 120);
         const lines = [
-            `Two runs on this machine could not finish ${o.kind === "CONTINUE" ? "a follow-up" : `the ${o.kind}`} it owes: ${what}`,
+            `${attempts === 1 ? "A run" : `${attempts === 2 ? "Two" : attempts} runs`} on this machine could not finish ${o.kind === "CONTINUE" ? "a follow-up" : `the ${o.kind}`} it owes: ${what}`,
             ``,
             `WHY IT STOPPED. ${d.says}`,
             `WHAT UNBLOCKS IT. ${d.fix}`,
@@ -1097,13 +1513,13 @@ export class Worker {
             `It will not be retried unattended — a live session here, or you, has to move it.`,
         ];
         if (asking) {
-            lines.push(``, `MAY THE WORKER RUN COMMANDS ON THIS MACHINE? Answer "allow always", "allow once", or "deny".`, `Today it may edit files only, which is why it could not commit or push. Allowing it lets a woken`, `run execute tests and git in its own isolated worktree — never in your checkout.`);
+            lines.push(``, `MAY THE WORKER RUN COMMANDS ON THIS MACHINE? Answer "allow always", "allow once", or "deny".`, `Today it may edit files only, which is why it could not commit or push. What allowing it permits: ${COMMAND_GRANT_SCOPE}`, `A teammate this machine lets wake it can start such a run.`, `Answer it on this machine — the menu bar, or: pantheon approvals answer <this-decision-id> 'allow always'`, `(or: pantheon policy grant run-commands). An answer sent from anywhere else settles this decision but grants nothing.`);
         }
         try {
             const sent = await client.send({
-                act: "ESCALATE", goal: o.goal, ref: o.ref, after_seq: client.readSeq,
-                summary: clip(`Stuck on you: ${d.says}`, 190),
-                body: lines.join("\n"),
+                act: "ESCALATE", goal: o.goal, ref: o.ref, after_seq: Math.max(client.readSeq, client.seq),
+                summary: clip(this.ledgerPaths(`Stuck on you: ${d.says}`), 190),
+                body: this.ledgerPaths(lines.join("\n")),
             });
             markContinued(space, key, this.opts.home);
             if (asking && d.capability) {
@@ -1116,6 +1532,31 @@ export class Worker {
             this.opts.log(`! could not report the stuck obligation on the ledger: ${e.message}`);
         }
     }
+    ledgerPaths(text) {
+        const swaps = [];
+        const proj = resolve(this.opts.project);
+        swaps.push([`${proj}${sep}`, ""], [proj, "the repo's own checkout"]);
+        const scratch = resolve(this.opts.scratch);
+        if (!scratch.startsWith(`${proj}${sep}`))
+            swaps.push([`${scratch}${sep}`, "<worktrees>/"]);
+        const home = this.opts.personHome ?? homedir();
+        if (home && home !== sep)
+            swaps.push([`${home}${sep}`, "~/"], [home, "~"]);
+        const win = process.platform === "win32";
+        const esc = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        let out = text;
+        for (const [from, to] of swaps) {
+            let real = from;
+            try {
+                real = realpathSync(from.endsWith(sep) ? from.slice(0, -1) : from) + (from.endsWith(sep) ? sep : "");
+            }
+            catch { }
+            for (const v of new Set([from, real, from.replace(/\\/g, "/"), real.replace(/\\/g, "/")])) {
+                out = out.replace(new RegExp(esc(v), win ? "gi" : "g"), () => to);
+            }
+        }
+        return out;
+    }
     enqueueContinuations(client, arrived) {
         this.loadContinued();
         for (const r of arrived) {
@@ -1177,17 +1618,23 @@ export class Worker {
             let changed = false;
             for (const cap of Object.keys(policy.asks)) {
                 const open = policy.asks[cap];
-                if (!open)
+                if (!open || this.ledgerAllowSeen.has(open.act))
                     continue;
                 const fromStream = arrived.find((a) => a.act === "ANSWER" && a.ref === open.act && a.from === this.cfg.member);
                 const body = fromStream?.body ?? await this.fetchGrantAnswer(open.act, client.head - 200);
                 if (body === null)
                     continue;
-                const applied = applyAnswer(policy, open.act, body);
-                if (applied) {
+                const verdict = parseGrantAnswer(body);
+                if (verdict === "deny") {
+                    applyAnswer(policy, open.act, body);
                     this.askAt.delete(open.act);
                     changed = true;
-                    this.opts.log(`* grant request answered: ${applied.cap} -> ${applied.verdict}`);
+                    this.opts.log(`* grant request answered on the ledger: ${cap} -> deny`);
+                }
+                else if (verdict) {
+                    this.ledgerAllowSeen.add(open.act);
+                    this.opts.log(`! an ANSWER on the ledger says "${verdict}" to this worker's ${cap} request (${open.act}) — NOT applied: ` +
+                        `a grant takes effect only from this machine. To grant it: pantheon policy grant ${CAPABILITY_ARGS[cap]}`);
                 }
             }
             if (changed)
@@ -1224,7 +1671,7 @@ export class Worker {
             }
             if (result.ok && !result.alreadyCurrent) {
                 await client.send({
-                    act: "NOTE", goal: null, after_seq: client.readSeq,
+                    act: "NOTE", goal: null, after_seq: Math.max(client.readSeq, client.seq),
                     summary: `self-upgraded pantheon ${result.from} -> ${result.to}; worker restarting on the new build`,
                     body: `This machine's worker upgraded pantheon ${result.from} -> ${result.to} (fast-forward pull + rebuild, granted by its human) and is restarting on the new build. Agent windows on this machine opened on 0.24 or later switch to the new version by themselves; a window opened on an older pantheon needs one reconnect (/mcp → pantheon → Reconnect, or reopen it).`,
                 }).catch((e) => this.opts.log(`! could not report the upgrade on the ledger: ${e.message}`));
@@ -1240,14 +1687,15 @@ export class Worker {
         if (mayAsk(policy, "self_upgrade")) {
             try {
                 const sent = await client.send({
-                    act: "ESCALATE", goal: null, after_seq: client.readSeq,
+                    act: "ESCALATE", goal: null, after_seq: Math.max(client.readSeq, client.seq),
                     summary: `Allow this worker to keep pantheon updated? It runs ${VERSION}, the team's relay ${relayPkg}. Answer "allow always", "allow once", or "deny".`,
                     body: [
                         `Allow this worker to keep pantheon updated? Answer "allow always", "allow once", or "deny".`,
                         ``,
                         `Your worker is asking for a capability, not reporting a problem. The team's relay runs pantheon ${relayPkg}; this machine runs ${VERSION}, so until it upgrades it can miss or mishandle teammate requests.`,
                         `The upgrade is mechanical and reversible: fast-forward pull of the existing checkout, rebuild, restart its own services, then report versions on the ledger. Nothing else is authorized by this grant.`,
-                        `From a terminal: pantheon approvals answer <this-decision-id> 'allow always'`,
+                        `Answer it on this machine — the menu bar, or: pantheon approvals answer <this-decision-id> 'allow always' (or: pantheon policy grant self-upgrade).`,
+                        `An answer sent from anywhere else settles this decision for the team but grants nothing.`,
                     ].join("\n"),
                 });
                 recordAsk(policy, "self_upgrade", sent.id);
@@ -1260,21 +1708,196 @@ export class Worker {
         }
     }
     askAt = new Map();
+    ledgerAllowSeen = new Set();
     lastFullScan = 0;
-    async actSeq(id) {
+    async fetchActById(id) {
         try {
-            const base = this.cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
-            const q = `space=${encodeURIComponent(this.cfg.space)}&token=${encodeURIComponent(this.cfg.token)}`;
-            const res = await fetch(`${base}/act?${q}&id=${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(3000) });
+            const res = await signedRead(this.cfg, "/act", { id }, { timeoutMs: 3000 });
             if (!res.ok)
                 return null;
             const j = await res.json();
-            return typeof j.act?.seq === "number" ? j.act.seq : null;
+            return j.act ?? null;
         }
         catch {
             return null;
         }
     }
+    async actSeq(id) {
+        const a = await this.fetchActById(id);
+        return typeof a?.seq === "number" ? a.seq : null;
+    }
+    senders = new Map();
+    async actOf(client, id) {
+        const seen = client.seenAct(id);
+        if (seen?.from)
+            return { from: seen.from, ...(seen.role ? { role: seen.role } : {}) };
+        const kept = this.senders.get(id);
+        if (kept)
+            return kept;
+        const a = await this.fetchActById(id);
+        if (typeof a?.from !== "string")
+            return null;
+        const hit = { from: a.from, ...(typeof a.role === "string" ? { role: a.role } : {}) };
+        if (this.senders.size > 500)
+            this.senders.delete(this.senders.keys().next().value);
+        this.senders.set(id, hit);
+        return hit;
+    }
+    carryWakers(client) {
+        if (this.stopped)
+            return;
+        const team = this.cfg.spaceId ?? this.cfg.space;
+        let mode = "approved";
+        let choice;
+        let fromProfile = false;
+        let p;
+        let result;
+        try {
+            p = loadPolicy(this.opts.home);
+            if (p.wakersCarried?.[team])
+                return;
+            const profile = loadProfile(this.cfg);
+            mode = this.opts.wakeMode ?? wakeMode(profile);
+            if (this.opts.wakeChoice !== undefined)
+                choice = this.opts.wakeChoice === "unset" ? undefined : this.opts.wakeChoice;
+            else {
+                fromProfile = true;
+                choice = profile.agent.wake_default;
+                if (choice === undefined && this.joinedBefore030())
+                    choice = "unset-before-0.30";
+            }
+            result = carryOverWakers(p, team, this.cfg.member, client.members, choice);
+        }
+        catch (e) {
+            this.opts.log(`  wake    could not carry over who may wake this machine: ${e.message}`);
+            return;
+        }
+        if (result === null)
+            return;
+        if (result === "deferred") {
+            if (p.wakersDeferred?.[team])
+                return;
+            (p.wakersDeferred ??= {})[team] = Date.now();
+            try {
+                savePolicy(p, this.opts.home);
+            }
+            catch (e) {
+                this.opts.log(`  wake    could not save the worker policy: ${e.message}`);
+            }
+            const why = OLD_RELAY_WAKE;
+            this.opts.log(`  wake    ${why}`);
+            if (this.opts.notify && mode === "approved") {
+                try {
+                    this.opts.notify({ kind: "worker", who: "Your worker", heading: "Who can wake this machine", context: this.cfg.space, body: `${why}.`, ttl: 0, sound: false });
+                }
+                catch { }
+            }
+            return;
+        }
+        try {
+            savePolicy(p, this.opts.home);
+        }
+        catch (e) {
+            this.opts.log(`  wake    could not record who may wake this machine: ${e.message} — trying again later`);
+            return;
+        }
+        if (fromProfile && choice === "unset-before-0.30") {
+            try {
+                const prof = loadProfile(this.cfg);
+                if (prof.agent.wake_default === undefined)
+                    saveProfile({ ...prof, agent: { ...prof.agent, wake_default: "approved" } });
+                mode = this.opts.wakeMode ?? "approved";
+            }
+            catch (e) {
+                this.opts.log(`  wake    could not record the wake setting: ${e.message}`);
+            }
+        }
+        const carried = result;
+        const names = new Set(carried.map((c) => c.member));
+        const dropped = client.members.filter((m) => m.admitted && m.may_wake && m.member !== this.cfg.member && !names.has(m.member)).map((m) => m.member);
+        const who = carried.map((c) => `${c.member} (${CARRY_REASON[c.why]})`).join(", ");
+        const allow = "a person here allows them with: pantheon wake allow <name>";
+        if (mode !== "approved") {
+            const today = mode === "anyone" ? "anyone the team lets wake workers may wake this machine (you chose \"anyone\")" : "this machine is set not to be woken";
+            this.opts.log(`  wake    ${today}${carried.length ? `; kept for if you choose "approved": ${who}` : ""}`);
+            return;
+        }
+        const now = carried.length ? `${who} can wake this machine` : "nobody can wake this machine yet";
+        const before = dropped.length ? `; ${dropped.join(", ")} could before, through someone else's approval, and no longer can — ${allow}` : "";
+        const setting = fromProfile && choice === "unset-before-0.30" ? "; this machine now wakes only for the people listed (pantheon wake list; pantheon setup to change)" : "";
+        this.opts.log(`  wake    ${now}${before}${setting}`);
+        if (this.opts.notify && (carried.length || dropped.length)) {
+            try {
+                this.opts.notify({
+                    kind: "worker", who: "Your worker", heading: "Who can wake this machine", context: this.cfg.space,
+                    body: `${now}. ${dropped.length ? `${dropped.join(", ")} could before and no longer can — ${allow}.` : `Anyone else: ${allow.replace(/^a person here allows them with: /, "")}.`}`,
+                    ttl: 0, sound: false,
+                });
+            }
+            catch { }
+        }
+    }
+    joinedBefore030() {
+        try {
+            const f = loadAll();
+            const m = Object.values(f?.spaces ?? {}).find((x) => (this.cfg.spaceId && x.id === this.cfg.spaceId) || (x.name === this.cfg.space && x.relay === this.cfg.relay));
+            return !!m && !m.since;
+        }
+        catch {
+            return false;
+        }
+    }
+    refusedSaid = false;
+    oldRelaySaid = false;
+    dropLedgerGrants() {
+        try {
+            const p = loadPolicy(this.opts.home);
+            const gone = dropLedgerGrants(p);
+            if (!gone.length)
+                return;
+            savePolicy(p, this.opts.home);
+            const names = gone.map((c) => CAPABILITY_ARGS[c]);
+            const body = `a ${names.join(" and ")} permission recorded from a message was removed — only a person on this machine grants one now; grant it here with ${names.map((n) => `pantheon policy grant ${n}`).join(" / ")}, or answer the worker's request when it asks`;
+            this.opts.log(`  policy  ${body}`);
+            if (this.opts.notify) {
+                try {
+                    this.opts.notify({ kind: "worker", who: "Your worker", heading: "A permission was removed", context: this.cfg.space, body: `${body}.`, ttl: 0, sound: false });
+                }
+                catch { }
+            }
+        }
+        catch (e) {
+            this.opts.log(`  policy  could not check the grants recorded here: ${e.message}`);
+        }
+    }
+    async wakeRefusal(client, ref, known) {
+        const mode = this.opts.wakeMode ?? wakeMode(loadProfile(this.cfg));
+        if (mode === "no")
+            return { why: "this machine is set not to be woken by teammates (pantheon setup to change it)" };
+        const sender = known?.from ? { from: known.from, role: known.role ?? undefined } : await this.actOf(client, ref);
+        if (sender?.from === this.cfg.member && sender.role === "worker")
+            return { why: "it was sent by a woken run of this member, and a woken run never starts another" };
+        if (mode === "anyone")
+            return null;
+        if (sender?.from === this.cfg.member)
+            return null;
+        if (!sender?.from)
+            return { why: "cannot tell who sent it, and only teammates a person here approved may wake this machine", transient: true };
+        const from = sender.from;
+        const pol = loadPolicy(this.opts.home);
+        if (isApprovedWaker(pol, [this.cfg.spaceId, this.cfg.space], from))
+            return null;
+        if (!pol.wakersCarried?.[this.cfg.spaceId ?? this.cfg.space] && !relayKnowsAdmitters(client.members, this.cfg.member)) {
+            if (!this.oldRelaySaid) {
+                this.oldRelaySaid = true;
+                this.opts.log(`  wake    ${OLD_RELAY_WAKE}`);
+            }
+            return null;
+        }
+        const teamSays = client.members.find((m) => m.member === from)?.may_wake;
+        return { why: `${from} is not approved to wake this machine (the team's may_wake is not enough) — a person here can: pantheon wake allow ${from}, or choose wake "anyone" in pantheon setup` +
+                (teamSays === false ? `; the team does not let ${from} wake workers either (a member runs: pantheon admit ${from} --may-wake)` : "") };
+    }
     async fetchGrantAnswer(askActId, since = 0) {
         let seq = this.askAt.get(askActId) ?? null;
         if (seq === null) {
@@ -1290,9 +1913,7 @@ export class Worker {
         }
         const from = answerWindow(seq, since, due);
         try {
-            const base = this.cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
-            const url = `${base}/history?space=${encodeURIComponent(this.cfg.space)}&token=${encodeURIComponent(this.cfg.token)}&since=${from}`;
-            const res = await fetch(url, { signal: AbortSignal.timeout(3000) });
+            const res = await signedRead(this.cfg, "/history", { since: from }, { timeoutMs: 3000 });
             const j = await res.json();
             const ans = (j.acts ?? []).find((a) => a.act === "ANSWER" && a.ref === askActId && a.from === this.cfg.member);
             return ans ? ans.body : null;