@join-pantheon/cli 0.29.0 → 0.30.0

package/dist/quickstart.js

@@ -2,11 +2,11 @@ import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:net";
 import { basename, join as pathJoin } from "node:path";
-import { homedir, hostname, platform } from "node:os";
+import { homedir, hostname, platform, userInfo } from "node:os";
 import { lookup } from "node:dns/promises";
 import { describeNetError } from "./network.js";
 import { PantheonClient } from "./client.js";
-import { load, identity, save, toInvite, resolveFor, repoInfo, bindRepo, DEFAULT_RELAY } from "./config.js";
+import { load, loadAll, identity, save, toInvite, resolveFor, repoInfo, bindRepo, DEFAULT_RELAY } from "./config.js";
 import { loadProfile, wakeDefault } from "./profile.js";
 import { newKeypair } from "./identity.js";
 import { installForUser } from "./install.js";
@@ -29,6 +29,9 @@ const sh = (cmd) => {
         return null;
     }
 };
+const notLoaded = (r) => r && typeof r === "object" && r.loaded === false
+    ? String(r.reason ?? "the service manager did not load it")
+    : null;
 export function wireUp(opts, deps = {}) {
     const installSvc = deps.installService ?? installService;
     const ensureNotifier = deps.ensureNotifier ?? ensureNativeNotifier;
@@ -63,9 +66,14 @@ export function wireUp(opts, deps = {}) {
     else if (opts.notifications) {
         try {
             ensureNotifier();
-            installSvc("notifier", homedir(), []);
+            const why = notLoaded(installSvc("notifier", homedir(), []));
             writeTrayCommands();
-            tools.push({ tool: "notifications", status: "on — native alerts for decisions that require you" });
+            if (why) {
+                tools.push({ tool: "notifications", status: `installed, not running: ${why}` });
+                warnings.push(`human notifications are installed but not running (${why}). Try \`pantheon service restart notifier\``);
+            }
+            else
+                tools.push({ tool: "notifications", status: "on — native alerts for decisions that require you" });
         }
         catch (e) {
             tools.push({ tool: "notifications", status: `could not install: ${e.message}` });
@@ -82,8 +90,13 @@ export function wireUp(opts, deps = {}) {
         try {
             ensureTray();
             writeTrayCommands();
-            installSvc("menubar", homedir(), []);
-            tools.push({ tool: "menu bar", status: "on — status, pause/resume, and decision badge in your menu bar" });
+            const why = notLoaded(installSvc("menubar", homedir(), []));
+            if (why) {
+                tools.push({ tool: "menu bar", status: `installed, not running: ${why}` });
+                warnings.push(`the menu bar item is installed but not running (${why}). Try \`pantheon service restart menubar\``);
+            }
+            else
+                tools.push({ tool: "menu bar", status: "on — status, pause/resume, and decision badge in your menu bar" });
         }
         catch (e) {
             tools.push({ tool: "menu bar", status: `could not install: ${e.message}` });
@@ -102,7 +115,12 @@ export function wireUp(opts, deps = {}) {
     }
     else if (opts.unattended) {
         const project = opts.unattended;
-        const isRepo = sh(`git -C ${JSON.stringify(project)} rev-parse --is-inside-work-tree 2>/dev/null`) === "true";
+        const isRepo = (() => { try {
+            return execFileSync("git", ["-C", project, "rev-parse", "--is-inside-work-tree"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 }).trim() === "true";
+        }
+        catch {
+            return false;
+        } })();
         if (!isRepo && how === "explicit") {
             tools.push({ tool: "worker", status: `not installed — ${project} is not a git repo` });
             warnings.push(`--unattended needs a git repo to work in; pass --project <a clone>. Nothing was installed.`);
@@ -112,9 +130,14 @@ export function wireUp(opts, deps = {}) {
         }
         else {
             try {
-                installSvc("worker", project, []);
+                const why = notLoaded(installSvc("worker", project, []));
+                if (why) {
+                    tools.push({ tool: "worker", status: `installed, not running: ${why}` });
+                    warnings.push(`the worker is installed but not running (${why}) — this machine cannot answer the team while you are away. Try \`pantheon service restart worker\``);
+                    return { tools, granted, warnings };
+                }
                 tools.push({ tool: "worker", status: `on — answers peers while you are away (${project})` });
-                granted.push(`A peer you have granted may_wake can start an agent run on this machine, in an isolated worktree under ${project}.`);
+                granted.push(`A teammate you approve from this machine (pantheon admit <name> --may-wake) — or anyone on the team, if you choose wake "anyone" — can start an agent run here, in an isolated worktree under ${project}. Nobody can until then.`);
                 if (!existsSync(policyPath())) {
                     const pol = loadPolicy();
                     grantCap(pol, "self_upgrade", "always", "setup-default");
@@ -146,6 +169,47 @@ export function slugName(raw, fallback) {
         .replace(/^[-._]+|[-._]+$/g, "");
     return /[a-z0-9]/.test(s) ? s : fallback;
 }
+export function osUsername(env = process.env, info = () => userInfo().username) {
+    const tries = [info, () => env.USERNAME, () => env.USER];
+    for (const t of tries) {
+        try {
+            const v = t()?.trim();
+            if (v && v.toLowerCase() !== "root")
+                return v;
+        }
+        catch { }
+    }
+    return null;
+}
+export function defaultMemberName(env = process.env, info, host = hostname) {
+    const user = osUsername(env, info);
+    const random = `member-${randomBytes(3).toString("hex")}`;
+    if (user) {
+        const s = slugName(user, "");
+        if (s)
+            return s;
+    }
+    let h = "";
+    try {
+        h = host().split(".")[0] ?? "";
+    }
+    catch { }
+    const s = slugName(h, "");
+    return s && s !== "localhost" ? `${s}` : random;
+}
+export function deviceLabel(plat = platform(), env = process.env, info, host = hostname) {
+    const os = plat === "darwin" ? "Mac" : plat === "win32" ? "Windows" : plat === "linux" ? "Linux" : plat;
+    let who = osUsername(env, info);
+    if (!who) {
+        try {
+            who = host().split(".")[0] || null;
+        }
+        catch {
+            who = null;
+        }
+    }
+    return `${who ?? "a"}'s ${os}`;
+}
 export function teamNameFor(dir, repo = repoInfo(dir)) {
     const fromOrigin = repo?.origin ? (repo.origin.replace(/\.git$/i, "").split(/[/:]/).filter(Boolean).pop() ?? "") : "";
     return slugName(fromOrigin || basename(repo?.root ?? dir), "team");
@@ -297,7 +361,7 @@ export async function start(opts) {
                     `  Use a tailnet address (tailscale ip -4) or a tunnel, then re-run pantheon start.` }
             : { url: chosen, how: place === "this-machine" ? "this machine's address" : place === "tunnel" ? "a tunnel to this machine" : opts.relay ? "as given" : "your signed-in relay", shareable: true })
         : findReach(opts.port);
-    const nothing = (why) => ({ cfg: priorCfg ?? { relay: reach.url }, invite: null, claimed: false, reach, tools: [], granted: [], relay: null, warnings: [why] });
+    const nothing = (why) => ({ cfg: priorCfg ?? { relay: reach.url }, invite: null, inviteMayWake: false, claimed: false, reach, tools: [], granted: [], relay: null, warnings: [why] });
     let relay = null;
     if (chosen && !hostHere) {
         const probe = await probeRelay(reach.url, opts.remoteTimeoutMs ?? 10_000, opts.fetchImpl);
@@ -340,7 +404,7 @@ export async function start(opts) {
             relay: reach.url,
             space: opts.space ?? teamNameFor(process.cwd(), repo),
             token: randomBytes(16).toString("hex"),
-            member: opts.me ?? (keepIdentity ? existing.member : slugName(process.env.USER ?? "me", "me")),
+            member: opts.me ?? (keepIdentity ? existing.member : defaultMemberName()),
             agent: detectAgent(),
             ...(keepIdentity ? { publicKey: existing.publicKey, privateKey: existing.privateKey } : newKeypair()),
             ...(keepIdentity && existing.account ? { account: existing.account } : {}),
@@ -354,6 +418,10 @@ export async function start(opts) {
             warnings.push(`you are already "${cfg.member}" here; --me ${opts.me} ignored (use --reset to start over)`);
         }
     }
+    else if (keepIdentity && existing.space) {
+        opts.log(`  you        ${cfg.member}, as in "${existing.space}" — that team stays; this adds one`);
+        opts.log(`  default    "${cfg.space}" from now on for folders bound to no team — pantheon use ${existing.space} switches back`);
+    }
     else if (keepIdentity && existing.account) {
         opts.log(`  you        ${cfg.member} — signed in; creating your first team`);
     }
@@ -361,6 +429,7 @@ export async function start(opts) {
         warnings.push(`replacing your identity in "${existing.space}" — that space is no longer reachable from this machine`);
     }
     let invite = null;
+    let inviteMayWake = false;
     let claimed = false;
     const claim = async (c) => {
         const client = new PantheonClient(c);
@@ -374,13 +443,17 @@ export async function start(opts) {
             }
             if (repo && c.spaceId) {
                 const { replaced } = bindRepo(repo, c.spaceId);
-                if (replaced)
-                    warnings.push(`this repo was bound to another team (${replaced.space}); it now belongs to "${c.space}"`);
+                const was = replaced ?? (here.binding && here.binding.space !== c.spaceId ? here.binding : null);
+                if (was) {
+                    const name = Object.values(loadAll()?.spaces ?? {}).find((m) => m.id === was.space)?.name ?? was.space;
+                    warnings.push(`this repo was bound to "${name}"; it now belongs to "${c.space}" — agents opened here speak in "${c.space}" from now on (pantheon use ${name} --here moves it back)`);
+                }
             }
             opts.log(`  space      ${c.space} ${reuse ? "— reconnected" : "— created, you own it"}${repo ? `   ${repo.origin ?? "local repo"} → bound to it` : ""}`);
             const mayWake = opts.wake ? opts.wake === "anyone" : wakeDefault(loadProfile(c));
             const inv = await client.makeInvite(mayWake, opts.ttlMinutes);
             invite = toInvite({ ...c, token: inv.url });
+            inviteMayWake = mayWake;
             claimed = true;
         }
         finally {
@@ -421,7 +494,7 @@ export async function start(opts) {
         ...(opts.workerHow ? { workerHow: opts.workerHow } : {}),
     });
     warnings.push(...wired.warnings);
-    return { cfg, invite, claimed, reach, tools: wired.tools, granted: wired.granted, relay, warnings };
+    return { cfg, invite, inviteMayWake, claimed, reach, tools: wired.tools, granted: wired.granted, relay, warnings };
 }
 export async function join(opts) {
     const existing = opts.reset ? null : (load() ?? identity());
@@ -436,7 +509,7 @@ export async function join(opts) {
         relay: opts.invite.relay,
         space: opts.invite.space,
         token: "",
-        member: opts.me ?? existing?.member ?? slugName(process.env.USER ?? "me", "me"),
+        member: opts.me ?? existing?.member ?? defaultMemberName(),
         agent: detectAgent(),
         ...keys,
         ...(existing?.account ? { account: existing.account } : {}),

package/dist/reads.js

@@ -0,0 +1,30 @@
+import { signRead } from "./identity.js";
+let clockSkewMs = 0;
+export const relayClockSkew = () => clockSkewMs;
+export function learnRelayClock(res) {
+    const there = Date.parse(res.headers.get("date") ?? "");
+    if (!Number.isFinite(there) || Math.abs(there - Date.now() - clockSkewMs) <= 60_000)
+        return false;
+    clockSkewMs = there - Date.now();
+    return true;
+}
+export const httpBase = (relay) => relay.replace(/^ws/, "http").replace(/\/+$/, "");
+export function signedReadQuery(cfg, path, params, at) {
+    const full = { space: cfg.space, token: cfg.token };
+    for (const [k, v] of Object.entries(params))
+        if (v !== undefined)
+            full[k] = String(v);
+    full.reader = cfg.member;
+    full.ts = String(at);
+    const sig = signRead(cfg.privateKey, "GET", path, full);
+    return new URLSearchParams({ ...full, sig }).toString();
+}
+export async function signedRead(cfg, path, params = {}, opts = {}) {
+    const signal = opts.signal ?? (opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined);
+    const go = () => fetch(`${httpBase(cfg.relay)}${path}?${signedReadQuery(cfg, path, params, Date.now() + clockSkewMs)}`, signal ? { signal } : {});
+    const res = await go();
+    if (res.status === 403 && learnRelayClock(res))
+        return go();
+    return res;
+}
+//# sourceMappingURL=reads.js.map

package/dist/refusal.js

@@ -21,9 +21,22 @@ export function connectFailure(e, relay) {
     const r = refusalOf(e);
     if (r) {
         const fix = r.fix && !/pantheon \w/.test(r.message) ? `\n  ${r.fix}` : "";
-        return `the relay refused this machine (${r.code}): ${r.message}${fix}`;
+        return `the relay refused this machine (${r.code}): ${r.message}${fix}${signInHint(r.code, relay)}`;
     }
     const text = typeof e === "string" ? e : String(e?.message ?? e ?? "");
     return `cannot reach the relay at ${relay} — ${text}`;
 }
+export function signInHint(code, relay, hosted = process.env.PANTHEON_DEFAULT_RELAY ?? "wss://relay.joinpantheon.network") {
+    if (code !== "NOT_SIGNED_IN" || !relay)
+        return "";
+    try {
+        if (new URL(relay).host === new URL(hosted).host)
+            return "";
+    }
+    catch {
+        return "";
+    }
+    return `\n  This team is on ${relay}, so sign in there:  pantheon login --email you@work.com --relay ${relay}` +
+        `\n  (new here: pantheon signup --email you@work.com --username you --relay ${relay})`;
+}
 //# sourceMappingURL=refusal.js.map