@join-pantheon/cli 0.29.0 → 0.30.0

package/dist/client.js

@@ -1,4 +1,5 @@
 import WebSocket from "ws";
+import { updateMembershipToken } from "./config.js";
 import { signChallenge } from "./identity.js";
 import { newId } from "./protocol.js";
 import { VERSION } from "./version.js";
@@ -23,6 +24,11 @@ export class PantheonClient {
         return !this.connected && !this.closed && this.everConnected;
     }
     cid = 0;
+    static REFUSED_RETRY_MS = 5 * 60_000;
+    static REFUSED_GRACE_MS = 2 * 60_000;
+    get refused() { return this.connected ? null : this.refusedCode; }
+    refusedCode = null;
+    refusedSince = 0;
     seq = 0;
     readSeq = 0;
     head = 0;
@@ -46,13 +52,24 @@ export class PantheonClient {
     enroll = null;
     inviteUrl = null;
     invitesList = null;
+    persistToken;
     constructor(cfg, onEvent, opts) {
         this.cfg = cfg;
         this.onEvent = onEvent;
+        this.persistToken = opts?.persistToken ?? ((space, oldToken, newToken) => { updateMembershipToken(space, oldToken, newToken); });
         this.enroll = opts?.enroll ?? null;
         this.session = opts?.session ?? newId("s");
         this.role = opts?.role ?? "interactive";
     }
+    adoptToken(token) {
+        const old = this.cfg.token;
+        if (!token || token === old)
+            return;
+        try {
+            this.persistToken(this.cfg.space, old, token);
+        }
+        catch { }
+    }
     async loopbackFallback() {
         let u;
         try {
@@ -217,6 +234,7 @@ export class PantheonClient {
                     case "welcome":
                         this.connected = true;
                         this.pending = null;
+                        this.refusedCode = null;
                         this.session = msg.session;
                         this.everConnected = true;
                         this.head = msg.seq;
@@ -228,7 +246,10 @@ export class PantheonClient {
                             this.readSeq = msg.seq;
                         this.everReadMarked = true;
                         if (msg.token) {
-                            this.enrolledToken = msg.token;
+                            if (this.enroll)
+                                this.enrolledToken = msg.token;
+                            else
+                                this.adoptToken(msg.token);
                             this.cfg.token = msg.token;
                         }
                         if (msg.space_id) {
@@ -250,6 +271,12 @@ export class PantheonClient {
                             resolve();
                         }
                         break;
+                    case "token":
+                        if (typeof msg.token === "string" && msg.token) {
+                            this.adoptToken(msg.token);
+                            this.cfg.token = msg.token;
+                        }
+                        break;
                     case "repos":
                         this.repos = msg.repos;
                         this.adoptKnownRepo();
@@ -285,6 +312,12 @@ export class PantheonClient {
                     }
                     case "error": {
                         this.lastError = `${msg.code}: ${msg.message}`;
+                        if (!msg.cid) {
+                            const code = ["REVOKED", "KEY_MISMATCH", "BAD_TOKEN"].includes(msg.code) ? msg.code : null;
+                            if (code && !this.refusedCode)
+                                this.refusedSince = Date.now();
+                            this.refusedCode = code;
+                        }
                         if (msg.code === "SPACE_DELETED")
                             this.closed = true;
                         const fn = msg.cid ? this.acks.get(msg.cid) : undefined;
@@ -325,8 +358,10 @@ export class PantheonClient {
                     }
                     reject(new Error(this.lastError ?? "relay connection failed"));
                 }
+                const slow = !!this.refused && Date.now() - this.refusedSince >= PantheonClient.REFUSED_GRACE_MS;
+                const wait = slow ? PantheonClient.REFUSED_RETRY_MS : Math.round(this.backoff * (0.5 + Math.random()));
                 setTimeout(() => { if (!this.closed)
-                    this.connect().catch(() => { }); }, Math.round(this.backoff * (0.5 + Math.random())));
+                    this.connect().catch(() => { }); }, wait);
                 this.backoff = Math.min(this.backoff * 2, 15_000);
             };
             ws.on("close", down);

package/dist/command-state.js

@@ -0,0 +1,79 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { platform } from "node:os";
+import { parseRepoCommands, REPO_COMMANDS_FILE } from "./agents.js";
+import { loadPersonas } from "./persona.js";
+import { plistPath, existingUnitPath } from "./service.js";
+import { loadPolicy } from "./worker-policy.js";
+export function workerServiceAllowsBash(plat = platform()) {
+    try {
+        if (plat === "darwin") {
+            const p = plistPath("worker");
+            if (!existsSync(p))
+                return null;
+            const xml = readFileSync(p, "utf8");
+            const args = [...(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(xml)?.[1] ?? "").matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
+            return args.includes("--allow-bash");
+        }
+        if (plat === "win32")
+            return null;
+        const u = existingUnitPath("worker");
+        if (!u)
+            return null;
+        const exec = /^ExecStart=(.*)$/m.exec(readFileSync(u, "utf8"))?.[1] ?? "";
+        return /(^|\s|")--allow-bash("|\s|$)/.test(exec);
+    }
+    catch {
+        return null;
+    }
+}
+export function commandState(o = {}) {
+    const allowBash = o.allowBash ?? workerServiceAllowsBash(o.plat) ?? false;
+    let grant = null;
+    try {
+        grant = loadPolicy(o.home).grants.run_commands ?? null;
+    }
+    catch { }
+    let personasOff = [];
+    try {
+        personasOff = loadPersonas(o.project ?? process.cwd(), o.home).filter((p) => p.allowBash === false).map((p) => p.name);
+    }
+    catch { }
+    const level = allowBash || grant?.mode === "always" ? "always" : grant ? "once" : "off";
+    const except = personasOff.length ? `, except runs handled by ${personasOff.length === 1 ? "persona" : "personas"} ${personasOff.join(", ")} (allow_bash: false)` : "";
+    const summary = level === "off"
+        ? "off — woken runs edit files only; a run that needs more asks here (pantheon policy grant run-commands)"
+        : allowBash
+            ? `on — the worker runs with --allow-bash${grant ? ", and run-commands is granted here too" : ""}${except}`
+            : grant.mode === "always"
+                ? `on — run-commands granted on this machine (${grant.by}, ${new Date(grant.at).toLocaleDateString()})${except}`
+                : `on for the next run only — run-commands granted once on this machine${except}`;
+    return { level, allowBash, grant, personasOff, summary };
+}
+export function repoCommandsAtBase(project, base) {
+    const git = (...a) => execFileSync("git", ["-C", project, ...a], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000 }).trim();
+    const exists = (ref) => { try {
+        git("rev-parse", "--verify", "--quiet", `${ref}^{commit}`);
+        return true;
+    }
+    catch {
+        return false;
+    } };
+    let remoteHead = null;
+    try {
+        remoteHead = git("symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD") || null;
+    }
+    catch { }
+    const ref = [base ? `origin/${base}` : null, base ?? null, remoteHead, "HEAD"].filter((r) => !!r).find(exists) ?? null;
+    if (!ref)
+        return { ref: null, ok: [], refused: [] };
+    let text = "";
+    try {
+        text = git("show", `${ref}:${REPO_COMMANDS_FILE}`);
+    }
+    catch {
+        return { ref, ok: [], refused: [] };
+    }
+    return { ref, ...parseRepoCommands(text) };
+}
+//# sourceMappingURL=command-state.js.map

package/dist/config.js

@@ -1,8 +1,9 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { readFileSync, mkdirSync, existsSync, openSync, writeSync, fsyncSync, closeSync, renameSync, rmSync, statSync, chmodSync, realpathSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, sep } from "node:path";
+import { VERSION } from "./version.js";
 export const CONFIG_DIR = process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
 export const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 export const DEFAULT_RELAY = process.env.PANTHEON_DEFAULT_RELAY
@@ -60,13 +61,34 @@ function sameRepo(host, path) {
     return [host, path];
 }
 const repoCache = new Map();
+const gitUnanswered = new Set();
+export function repoUnknown(dir = process.cwd()) {
+    const key = resolve(dir);
+    if (!gitUnanswered.has(key))
+        return false;
+    for (let d = key;; d = resolve(d, "..")) {
+        if (existsSync(join(d, ".git")))
+            return true;
+        if (resolve(d, "..") === d)
+            return false;
+    }
+}
 export function repoInfo(dir = process.cwd()) {
     const key = resolve(dir);
     if (repoCache.has(key))
         return repoCache.get(key);
     let info = null;
     try {
-        const root = execFileSync("git", ["-C", key, "rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 }).trim();
+        let root;
+        try {
+            root = execFileSync("git", ["-C", key, "rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 }).trim();
+        }
+        catch (e) {
+            if (e.status !== 128)
+                gitUnanswered.add(key);
+            throw e;
+        }
+        gitUnanswered.delete(key);
         let origin = null;
         try {
             origin = normalizeOrigin(execFileSync("git", ["-C", root, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 }));
@@ -103,7 +125,7 @@ export function migrate(raw) {
 export function loadAll() {
     if (!existsSync(CONFIG_PATH))
         return null;
-    return migrate(JSON.parse(readFileSync(CONFIG_PATH, "utf8")));
+    return migrate(JSON.parse(readFileSync(CONFIG_PATH, "utf8").replace(/^\uFEFF/, "")));
 }
 export function saveAll(f) {
     const out = { ...f, version: 2, spaces: f.spaces ?? {}, bindings: f.bindings ?? {} };
@@ -114,10 +136,113 @@ export function saveAll(f) {
     const def = out.default_space ? out.spaces[out.default_space] : undefined;
     out.space = def?.name ?? "";
     out.token = def?.token ?? "";
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(CONFIG_PATH, JSON.stringify(out, null, 2) + "\n", { mode: 0o600 });
+    writeConfigAtomic(JSON.stringify(out, null, 2) + "\n");
     return CONFIG_PATH;
 }
+function privateDir() {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    if (process.platform === "win32")
+        return;
+    try {
+        if ((statSync(CONFIG_DIR).mode & 0o077) !== 0)
+            chmodSync(CONFIG_DIR, 0o700);
+    }
+    catch { }
+}
+function writeConfigAtomic(data) {
+    privateDir();
+    const tmp = `${CONFIG_PATH}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        const fd = openSync(tmp, "w", 0o600);
+        try {
+            writeSync(fd, data);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        if (process.platform !== "win32")
+            chmodSync(tmp, 0o600);
+        for (let i = 0;; i++) {
+            try {
+                renameSync(tmp, CONFIG_PATH);
+                break;
+            }
+            catch (e) {
+                if (i >= 20 || !["EPERM", "EACCES", "EBUSY"].includes(e.code ?? ""))
+                    throw e;
+                sleepSync(10);
+            }
+        }
+    }
+    catch (e) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch { }
+        throw e;
+    }
+    let dfd = null;
+    try {
+        dfd = openSync(CONFIG_DIR, "r");
+        fsyncSync(dfd);
+    }
+    catch { }
+    finally {
+        if (dfd !== null)
+            try {
+                closeSync(dfd);
+            }
+            catch { }
+    }
+}
+const CONFIG_LOCK_STALE_MS = 5_000;
+const CONFIG_LOCK_WAIT_MS = 15_000;
+const sleepSync = (ms) => { try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+catch { } };
+export function withConfigLock(fn) {
+    privateDir();
+    const lock = `${CONFIG_PATH}.lock`;
+    const t0 = Date.now();
+    let fd = null;
+    while (fd === null) {
+        try {
+            fd = openSync(lock, "wx", 0o600);
+        }
+        catch (e) {
+            const code = e.code;
+            if (code !== "EEXIST" && !(process.platform === "win32" && (code === "EPERM" || code === "EACCES" || code === "EBUSY")))
+                throw e;
+            try {
+                if (Date.now() - statSync(lock).mtimeMs > CONFIG_LOCK_STALE_MS) {
+                    rmSync(lock, { force: true });
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
+            if (Date.now() - t0 > CONFIG_LOCK_WAIT_MS)
+                throw new Error(`config.json is locked by another pantheon process (${lock})`);
+            sleepSync(2 + Math.floor(Math.random() * 8));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        try {
+            rmSync(lock, { force: true });
+        }
+        catch { }
+    }
+}
 export function configFor(f, m, repo) { return view(f, m, repo); }
 function view(f, m, repo) {
     return {
@@ -134,14 +259,19 @@ function cwdRepo(repo) {
 }
 function envView(onDisk) {
     const e = process.env;
-    if (!(e.PANTHEON_RELAY && e.PANTHEON_SPACE && e.PANTHEON_TOKEN && e.PANTHEON_MEMBER))
+    if (!(e.PANTHEON_RELAY && e.PANTHEON_SPACE && e.PANTHEON_MEMBER))
+        return null;
+    const token = e.PANTHEON_TOKEN ?? (onDisk?.member === e.PANTHEON_MEMBER
+        ? Object.values(onDisk.spaces ?? {}).find((m) => (e.PANTHEON_SPACE_ID && m.id === e.PANTHEON_SPACE_ID) || (m.relay === e.PANTHEON_RELAY && m.name === e.PANTHEON_SPACE))?.token
+        : undefined);
+    if (!token)
         return null;
     const pub = e.PANTHEON_PUBKEY ?? onDisk?.publicKey;
     const priv = e.PANTHEON_PRIVKEY ?? onDisk?.privateKey;
     if (!pub || !priv)
         return null;
     return {
-        relay: e.PANTHEON_RELAY, space: e.PANTHEON_SPACE, token: e.PANTHEON_TOKEN, member: e.PANTHEON_MEMBER,
+        relay: e.PANTHEON_RELAY, space: e.PANTHEON_SPACE, token, member: e.PANTHEON_MEMBER,
         publicKey: pub, privateKey: priv, display: e.PANTHEON_DISPLAY, agent: e.PANTHEON_AGENT,
         ...(e.PANTHEON_SPACE_ID ? { spaceId: e.PANTHEON_SPACE_ID } : {}),
         ...(e.PANTHEON_REPO ? { repo: e.PANTHEON_REPO } : {}),
@@ -166,6 +296,17 @@ export function resolveFor(cwd = process.cwd(), opts = {}) {
             return { cfg: null, reason: "stale", memberships: n, binding: { ...b, fingerprint: repo.fingerprint }, repo };
         }
     }
+    if (!repo) {
+        const fb = folderBinding(f, cwd);
+        if (fb) {
+            const m = spaces[fb.space];
+            if (m)
+                return { cfg: applyAgentEnv(view(f, m, null)), reason: "binding", memberships: n, binding: { ...fb, fingerprint: fb.key }, repo };
+            return { cfg: null, reason: "stale", memberships: n, binding: { ...fb, fingerprint: fb.key }, repo };
+        }
+    }
+    if (!repo && n > 1 && repoUnknown(cwd))
+        return { cfg: null, reason: "unbound", memberships: n, repo, repoUnknown: true };
     if (n === 1) {
         const m = Object.values(spaces)[0];
         return { cfg: applyAgentEnv({ ...view(f, m, null), ...cwdRepo(repo) }), reason: "single", memberships: 1, repo };
@@ -255,12 +396,40 @@ export function save(cfg) {
         }
         else {
             const id = cfg.spaceId ?? legacySpaceId(cfg.relay, cfg.space);
-            f.spaces[id] = { id, name: cfg.space, relay: cfg.relay, token: cfg.token, joined_at: Date.now() };
+            f.spaces[id] = { id, name: cfg.space, relay: cfg.relay, token: cfg.token, joined_at: Date.now(), since: VERSION };
             f.default_space = id;
         }
     }
     return saveAll(f);
 }
+export function updateMembershipToken(space, oldToken, newToken) {
+    if (!space || !oldToken || !newToken || oldToken === newToken)
+        return false;
+    if (!existsSync(CONFIG_PATH))
+        return false;
+    return withConfigLock(() => {
+        let f;
+        try {
+            f = loadAll();
+        }
+        catch {
+            return false;
+        }
+        if (!f)
+            return false;
+        let hit = false;
+        for (const m of Object.values(f.spaces ?? {})) {
+            if (m.name === space && m.token === oldToken) {
+                m.token = newToken;
+                hit = true;
+            }
+        }
+        if (!hit)
+            return false;
+        saveAll(f);
+        return true;
+    });
+}
 function adoptId(f, oldId, newId) {
     for (const b of Object.values(f.bindings ?? {}))
         if (b.space === oldId)
@@ -268,6 +437,38 @@ function adoptId(f, oldId, newId) {
     if (f.default_space === oldId)
         f.default_space = newId;
 }
+export function bindFolder(dir, spaceId) {
+    const f = loadAll();
+    if (!f)
+        throw new Error("not configured");
+    f.bindings ??= {};
+    const path = canonDir(dir);
+    const key = `d_${sha16(path)}`;
+    const prev = f.bindings[key] ?? null;
+    f.bindings[key] = { space: spaceId, path, origin: null, bound_at: Date.now() };
+    saveAll(f);
+    return { key, replaced: prev && prev.space !== spaceId ? prev : null };
+}
+function canonDir(dir) {
+    try {
+        return realpathSync.native(dir);
+    }
+    catch {
+        return resolve(dir);
+    }
+}
+export function folderBinding(f, dir) {
+    const here = canonDir(dir);
+    let best = null;
+    for (const [key, b] of Object.entries(f.bindings ?? {})) {
+        if (!key.startsWith("d_"))
+            continue;
+        const inside = here === b.path || here.startsWith(b.path.endsWith(sep) ? b.path : b.path + sep);
+        if (inside && (!best || b.path.length > best.path.length))
+            best = { ...b, key };
+    }
+    return best;
+}
 export function bindRepo(repo, spaceId) {
     const f = loadAll();
     if (!f)