@join-pantheon/cli 0.29.1 → 0.30.0

package/dist/doctor.js

@@ -1,17 +1,20 @@
+import { parseJsonText, stripJsonc } from "./text-file.js";
 import { kiroDefaultIsPantheon, readKiroAgent, kiroAgentFile } from "./kiro-files.js";
 import { execFileSync } from "node:child_process";
 import { instructionBudget } from "./mcp-instructions.js";
 import { describeWindows, scanMcpWindows } from "./mcp-windows.js";
 import { grantsSeen, measureMcp, toolsReport, HOST_STARTUP_ALLOWANCE_MS, STARTUP_WARN_MS } from "./measure.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
-import { loadProfile, profileInitialized } from "./profile.js";
+import { loadProfile, profileInitialized, wakeMode } from "./profile.js";
+import { isApprovedWaker, loadPolicy, relayKnowsAdmitters } from "./worker-policy.js";
+import { commandState } from "./command-state.js";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
 import { load, resolveFor, loadAll, CONFIG_PATH } from "./config.js";
 import { fingerprint, signChallenge, verifyChallenge } from "./identity.js";
-import { approvalSummary, chosenApproval, onPath } from "./install.js";
+import { approvalSummary, chosenApproval, copilotMcpConfigFile, kiroMcpConfigFile, onPath } from "./install.js";
 import { hookState, readIntent, agentHookStates } from "./notify.js";
 import { loadPersonas } from "./persona.js";
 import { workerProc, menubarProc, notifierProc } from "./machine.js";
@@ -33,7 +36,7 @@ const git = (args, cwd) => {
 };
 function claudeLocalOverride(projectDir) {
     try {
-        const doc = JSON.parse(readFileSync(join(homedir(), ".claude.json"), "utf8"));
+        const doc = parseJsonText(readFileSync(join(homedir(), ".claude.json"), "utf8"));
         const norm = (x) => resolve(x).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
         const want = norm(projectDir);
         return Object.entries(doc.projects ?? {}).some(([k, v]) => norm(k) === want && !!v?.mcpServers?.["pantheon"]);
@@ -42,6 +45,46 @@ function claudeLocalOverride(projectDir) {
         return false;
     }
 }
+export function userScopeWiring(home = homedir(), present = onPathNamed, env = process.env) {
+    const json = (file, pick) => {
+        if (!existsSync(file))
+            return "missing";
+        try {
+            return pick(parseJsonText(stripJsonc(readFileSync(file, "utf8")))) ? "wired" : "missing";
+        }
+        catch {
+            return "invalid";
+        }
+    };
+    const server = (key) => (d) => !!d[key]?.["pantheon"];
+    const out = [];
+    if (present("claude")) {
+        const f = join(home, ".claude.json");
+        out.push({ agent: "Claude Code", file: f, state: json(f, server("mcpServers")) });
+    }
+    if (present("cursor-agent") || existsSync(join(home, ".cursor"))) {
+        const f = join(home, ".cursor", "mcp.json");
+        out.push({ agent: "Cursor", file: f, state: json(f, server("mcpServers")) });
+    }
+    if (present("codex")) {
+        const f = join(home, ".codex", "config.toml");
+        let state = "missing";
+        try {
+            state = /^\s*\[mcp_servers\.pantheon\]/m.test(readFileSync(f, "utf8")) ? "wired" : "missing";
+        }
+        catch { }
+        out.push({ agent: "Codex", file: f, state });
+    }
+    if (present("copilot")) {
+        const f = copilotMcpConfigFile(home, env);
+        out.push({ agent: "Copilot", file: f, state: json(f, server("mcpServers")) });
+    }
+    if (present("kiro-cli")) {
+        const f = kiroMcpConfigFile(home, env);
+        out.push({ agent: "Kiro", file: f, state: json(f, server("mcpServers")) });
+    }
+    return out;
+}
 function isPrivate(host) {
     const h = host.replace(/:\d+$/, "");
     if (/^(localhost|127\.0\.0\.1|\[::1\]|::1)$/.test(h))
@@ -62,13 +105,16 @@ function isPrivate(host) {
         return true;
     return false;
 }
+export function nodeSupported(version) {
+    const [major = 0, minor = 0] = version.replace(/^v/, "").split(".").map(Number);
+    return major > 23 || (major === 23 && minor >= 4) || (major === 22 && minor >= 13);
+}
 export async function doctor(projectDir) {
     const out = [];
     const add = (level, name, detail, fix, share) => out.push({ level, name, detail, ...(fix ? { fix } : {}), ...(share ? { share } : {}) });
-    const major = Number(process.versions.node.split(".")[0]);
-    major >= 22
+    nodeSupported(process.versions.node)
         ? add("pass", "node", `v${process.versions.node}`, undefined, `v${process.versions.node}`)
-        : add("fail", "node", `v${process.versions.node} is too old`, "pantheon needs Node 22 or newer (the relay uses node:sqlite) — install it and re-run", `v${process.versions.node}, too old`);
+        : add("fail", "node", `v${process.versions.node} is too old`, "pantheon needs Node 22.13 or newer — node:sqlite, which the relay uses, is behind a flag through 22.12 — install a current Node LTS and re-run", `v${process.versions.node}, too old`);
     const host = hostEnv();
     if (host.ephemeral) {
         add("warn", "machine", `${platformName(host.platform)} in ${host.kind === "container" ? "a container" : "a cloud workspace"} — ${host.evidence.join("; ")}`, `this is not the computer you work on, which is why it reports ${platformName(host.platform)} to someone who may be sitting at a Mac. The team and your account are fine here, but the menu bar, desktop alerts and the worker belong on your own machine — run the setup from a terminal there.`, `${host.platform} in ${host.kind === "container" ? "a container" : "a cloud workspace"}`);
@@ -117,12 +163,12 @@ export async function doctor(projectDir) {
     }
     const mcpFile = join(projectDir, ".mcp.json");
     if (!existsSync(mcpFile)) {
-        add("warn", "mcp entry", "no .mcp.json in this project", "run `pantheon install`", "no .mcp.json in this project");
+        add("pass", "mcp entry", "no .mcp.json in this project — your agents are wired for your user (see below), so there is nothing to commit", undefined, "none in the project (user scope)");
     }
     else {
         let entry = {};
         try {
-            entry = (JSON.parse(readFileSync(mcpFile, "utf8")).mcpServers ?? {}).pantheon ?? {};
+            entry = (parseJsonText(stripJsonc(readFileSync(mcpFile, "utf8"))).mcpServers ?? {}).pantheon ?? {};
         }
         catch { }
         if (!entry.command) {
@@ -143,6 +189,21 @@ export async function doctor(projectDir) {
             add("fail", "mcp entry", `hard-codes this machine: ${entry.command}`, "make sure `pantheon` is on your PATH, then run `pantheon install` again — it writes the portable `pantheon mcp` entry. Committed as-is it silently fails on the other machine: the MCP server never starts and no error is shown.", "hard-codes a path on this machine");
         }
     }
+    {
+        const rows = userScopeWiring();
+        const wired = rows.filter((r) => r.state === "wired");
+        const bad = rows.filter((r) => r.state !== "wired");
+        if (rows.length && !bad.length) {
+            add("pass", "user wiring", `pantheon is wired at user scope for ${wired.map((r) => r.agent).join(", ")}`, undefined, `wired for ${wired.length} agent${wired.length === 1 ? "" : "s"}`);
+        }
+        else if (rows.length) {
+            const said = bad.map((r) => `${r.agent}: ${r.state === "invalid" ? `${r.file} does not parse` : `no pantheon server in ${r.file}`}`).join("; ");
+            const fix = bad.some((r) => r.state === "invalid")
+                ? "fix the file that does not parse (setup never overwrites it), then run `pantheon install --user`"
+                : "run `pantheon install --user` — and if it says failed, the line it prints is why";
+            add(wired.length || existsSync(mcpFile) ? "warn" : "fail", "user wiring", said, fix, `${bad.length} of ${rows.length} agent${rows.length === 1 ? "" : "s"} not wired at user scope`);
+        }
+    }
     onPath()
         ? add("pass", "PATH", "`pantheon` resolves by name", undefined, "pantheon resolves by name")
         : add("warn", "PATH", "`pantheon` is not on PATH", "install it globally (`npm install -g @join-pantheon/cli`) and make sure your npm global bin dir (`npm bin -g`) is on PATH", "pantheon is not on PATH");
@@ -245,11 +306,17 @@ export async function doctor(projectDir) {
     try {
         const res = await fetch(health, { signal: AbortSignal.timeout(5000) });
         const body = (await res.json());
-        if (!body.ok) {
+        if (!body.ok && body.storage) {
+            const since = body.storage.at ? ` (since ${new Date(body.storage.at).toLocaleString()})` : "";
+            add("fail", "relay", `the relay cannot write to its disk: ${body.storage.error ?? "unknown error"}${since}`, hosted ? `this is on the hosted relay's side — nothing on this machine can fix it; tell us at ${FEEDBACK_ADDRESS}` : "free space or fix permissions on the relay host's data folder, then restart the relay", `cannot write to its disk (${where})`);
+        }
+        else if (!body.ok) {
             add("fail", "relay", `answered but not healthy: ${JSON.stringify(body)}`, undefined, `answered but not healthy (${where})`);
         }
         else {
             add("pass", "relay", `reachable at ${health}`, undefined, `reachable (${where})`);
+        }
+        if (body.ok || body.storage) {
             if (body.pkg && body.pkg !== VERSION) {
                 add("warn", "version", `this machine is ${VERSION}, the relay is ${body.pkg}`, "run `pantheon upgrade` on the older side — features land on both halves of the wire, and the protocol version cannot tell you they are missing", `this machine ${VERSION}, relay ${body.pkg}`);
             }
@@ -298,18 +365,32 @@ export async function doctor(projectDir) {
             .map((p) => `${p.member}[${online.has(p.member) ? "online" : "no session open"}]`).join("  "), undefined, `${admittedPeers.length} admitted, ${peersOnline} with a session open`)
         : add("warn", "peers", "nobody else is admitted to this space yet", "send your teammate an invite from `pantheon invite` (or the one `pantheon start` printed)", "nobody else admitted yet");
     if (pending.length) {
-        add("warn", "pending", pending.map((p) => `${p.member} (${p.fingerprint})`).join("  "), `confirm the fingerprint by voice, then: pantheon admit ${pending[0].member}   (add --may-wake only if they should be able to wake this machine)`, `${pending.length} waiting to be admitted`);
+        add("warn", "pending", pending.map((p) => `${p.member} (${p.fingerprint})`).join("  "), `confirm the fingerprint by voice, then: pantheon admit ${pending[0].member}   (add --may-wake only if the team should let them wake workers; each of you then allows them on your own machine: pantheon wake allow <name>)`, `${pending.length} waiting to be admitted`);
     }
     const wakers = client.members.filter((m) => m.admitted && m.may_wake && m.member !== cfg.member);
     const hookStates = agentHookStates(projectDir);
     const hook = hookStates[0] ?? hookState(projectDir);
     const reportsActivity = hookStates.some((s) => s.events?.some((e) => /prompt|UserPromptSubmit|beforeSubmitPrompt/i.test(e))) || (hook.events?.includes("UserPromptSubmit") ?? false);
     const workerUp = workerProc().running;
-    if (!wakers.length) {
-        add("warn", "wake rights", "no peer may wake a worker on this machine", "that is a safe default; grant it with `pantheon admit <them> --may-wake` when you want unattended replies", `no peer may wake; worker ${workerUp ? "running" : "not running"}`);
+    const mode = wakeMode(loadProfile(cfg));
+    const policy = loadPolicy();
+    const approvedHere = admittedPeers.filter((m) => isApprovedWaker(policy, [client.spaceId ?? cfg.spaceId, cfg.space], m.member));
+    const teamKey = client.spaceId ?? cfg.spaceId ?? cfg.space;
+    const notCarried = mode === "approved" && !policy.wakersCarried?.[teamKey] && !policy.wakersCarried?.[cfg.space] && !relayKnowsAdmitters(client.members, cfg.member);
+    const effective = mode === "anyone" || notCarried ? wakers : mode === "no" ? [] : approvedHere.filter((m) => m.may_wake);
+    const blockedByTeam = mode === "approved" ? approvedHere.filter((m) => !m.may_wake) : [];
+    if (!effective.length) {
+        const why = mode === "no" ? "this machine is set not to be woken"
+            : mode === "anyone" ? "you chose \"anyone\", and the team lets nobody wake workers"
+                : blockedByTeam.length ? `approved here: ${blockedByTeam.map((m) => m.member).join(", ")}, but the team does not let them wake workers yet`
+                    : "nobody is approved on this machine";
+        add("warn", "wake rights", `no teammate can wake a worker on this machine — ${why}`, mode === "no" ? "that is what you chose; pantheon setup to change it"
+            : blockedByTeam.length ? `a member runs: pantheon admit ${blockedByTeam[0].member} --may-wake`
+                : "that is a safe default; let one teammate wake this machine with `pantheon wake allow <name>` when you want unattended replies", `nobody can wake this machine (${mode}); worker ${workerUp ? "running" : "not running"}`);
     }
     else {
-        const who = `${wakers.map((m) => m.member).join(", ")} may wake a worker (space-wide grant)`;
+        const who = `${effective.map((m) => m.member).join(", ")} can wake a worker here (${mode === "anyone" ? "you chose \"anyone\"" : notCarried ? "the team's may_wake decides until this relay is 0.30 or newer" : "approved on this machine"})`;
+        const wakers = effective;
         if (workerUp) {
             add("pass", "wake rights", `${who} — worker is running`, undefined, `${wakers.length} may wake; worker running`);
         }
@@ -320,6 +401,15 @@ export async function doctor(projectDir) {
                 : "start one with `pantheon service install worker --project <a git repo>`; until then a peer's act waits for you to type", `${wakers.length} may wake; worker not running`);
         }
     }
+    {
+        const cs = commandState({ project: projectDir });
+        add("pass", "commands", `woken runs: ${cs.summary}`, undefined, cs.level === "off" ? "woken runs edit files only" : `woken runs may run commands (${cs.allowBash ? "--allow-bash" : "granted here"})`);
+        if (cs.level !== "off" && host.platform === "linux") {
+            const missing = ["bwrap", "socat"].filter((b) => !onPathNamed(b, "linux"));
+            if (missing.length)
+                add("warn", "sandbox", `${missing.join(" and ")} not found — Claude Code's sandbox cannot start, so every woken command run will be refused`, "install them: sudo apt install bubblewrap socat (Debian/Ubuntu) or sudo dnf install bubblewrap socat (Fedora)", `sandbox tools missing: ${missing.join(", ")}`);
+        }
+    }
     if (host.desktop) {
         if (!serviceInstalled("menubar")) {
             add("warn", "menu bar", "not installed on a Mac that can run it", "install it with: pantheon service install menubar (needs the Xcode Command Line Tools — xcode-select --install — and a setup that ran on this computer, not in a cloud agent). --no-menubar at setup also leaves it off; that is fine if it was your choice", "not installed");

package/dist/grants.js

@@ -18,7 +18,7 @@ function readJson(file) {
     if (!existsSync(file))
         return null;
     try {
-        return JSON.parse(readFileSync(file, "utf8"));
+        return JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, ""));
     }
     catch {
         return "invalid";

package/dist/history-view.js

@@ -34,7 +34,8 @@ export function resolveRef(acts, ref, act, goal, me) {
     }
     const others = acts.filter((a) => a.from !== me && a.act !== "JOIN" && a.act !== "LEAVE" && inGoal(a));
     if (ref === "last") {
-        const hit = others[others.length - 1];
+        const can = REPLIES_TO[act];
+        const hit = (can ? [...others].reverse().find((a) => can.includes(a.act)) : undefined) ?? others[others.length - 1];
         return hit ? { id: hit.id, goal: hit.goal ?? goal, note: `replying to [${hit.seq}] ${hit.act} from ${hit.from}` } : { id: null, goal, error: "nothing from a peer to reply to" };
     }
     if (ref)

package/dist/home-guard.js

@@ -0,0 +1,210 @@
+import { createHash } from "node:crypto";
+import { readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseJsonText } from "./text-file.js";
+export const POLICY_FILE = "worker-policy.json";
+export const PROFILE_FILE = "profile.json";
+export const HUD_FILE = join("bin", ".hud-action.json");
+export const CONFIG_FILE = "config.json";
+export const GUARDED_FILES = [POLICY_FILE, CONFIG_FILE, PROFILE_FILE, HUD_FILE];
+const sha = (b) => createHash("sha256").update(b).digest("hex");
+const read = (f) => { try {
+    return readFileSync(f);
+}
+catch {
+    return null;
+} };
+const parse = (b) => {
+    try {
+        const v = b ? parseJsonText(b.toString("utf8")) : undefined;
+        return v && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const trusted = new Map();
+export function trustWrite(file) {
+    const b = read(file);
+    const k = resolve(file);
+    const set = trusted.get(k) ?? new Set();
+    set.add(b ? sha(b) : "absent");
+    if (set.size > 50)
+        set.delete(set.values().next().value);
+    trusted.set(k, set);
+}
+export function snapshotHome(home, files = GUARDED_FILES) {
+    return { home, files: files.map((rel) => { const b = read(join(home, rel)); return { rel, bytes: b, hash: b ? sha(b) : null }; }) };
+}
+export function changedKeys(a, b, prefix = "", depth = 0) {
+    const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+    if (!isObj(a) || !isObj(b) || depth >= 4)
+        return JSON.stringify(a) === JSON.stringify(b) ? [] : [prefix || "(the whole file)"];
+    const out = [];
+    for (const k of new Set([...Object.keys(a), ...Object.keys(b)])) {
+        const p = prefix ? `${prefix}.${k}` : k;
+        if (!(k in a))
+            out.push(`${p} added`);
+        else if (!(k in b))
+            out.push(`${p} removed`);
+        else
+            out.push(...changedKeys(a[k], b[k], p, depth + 1));
+    }
+    return out;
+}
+const obj = (x) => (x && typeof x === "object" && !Array.isArray(x) ? x : {});
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+export function narrowPolicy(before, now) {
+    const b = obj(before);
+    const keys = [];
+    const out = { ...now };
+    const bg = obj(b.grants), ng = obj(now.grants);
+    const grants = {};
+    for (const [cap, g] of Object.entries(ng)) {
+        if (!(cap in bg)) {
+            keys.push(`grants.${cap} added`);
+            continue;
+        }
+        if (!same(bg[cap], g)) {
+            keys.push(`grants.${cap} changed`);
+            grants[cap] = bg[cap];
+            continue;
+        }
+        grants[cap] = g;
+    }
+    out.grants = grants;
+    const bw = obj(b.wakers), nw = obj(now.wakers);
+    const wakers = {};
+    for (const [team, list] of Object.entries(nw)) {
+        const had = new Set(Array.isArray(bw[team]) ? bw[team].filter((x) => typeof x === "string") : []);
+        const keep = (Array.isArray(list) ? list : []).filter((m) => typeof m === "string" && had.has(m));
+        const added = (Array.isArray(list) ? list : []).filter((m) => typeof m === "string" && !had.has(m));
+        if (added.length)
+            keys.push(`wakers.${team} added ${added.length}`);
+        if (keep.length)
+            wakers[team] = keep;
+    }
+    if (Object.keys(wakers).length || "wakers" in now)
+        out.wakers = wakers;
+    const bd = obj(b.denied), nd = obj(now.denied);
+    const denied = { ...nd };
+    for (const [cap, at] of Object.entries(bd))
+        if (!(cap in nd)) {
+            denied[cap] = at;
+            keys.push(`denied.${cap} removed`);
+        }
+    out.denied = denied;
+    return { policy: out, keys };
+}
+export function narrowConfig(before, now) {
+    const keys = [];
+    const out = { ...now };
+    if (typeof before.relay === "string" && now.relay !== before.relay) {
+        out.relay = before.relay;
+        keys.push("relay changed");
+    }
+    const bs = obj(before.spaces), ns = obj(now.spaces);
+    const spaces = { ...ns };
+    for (const [id, m] of Object.entries(ns)) {
+        const was = obj(bs[id]);
+        if (typeof was.relay === "string" && obj(m).relay !== was.relay) {
+            spaces[id] = { ...obj(m), relay: was.relay };
+            keys.push(`spaces.${id}.relay changed`);
+        }
+    }
+    if ("spaces" in now)
+        out.spaces = spaces;
+    return { config: out, keys };
+}
+const WAKE_ORDER = { no: 0, approved: 1, anyone: 2 };
+export function narrowProfile(before, now) {
+    const bw = obj(obj(before).agent).wake_default, nw = obj(now.agent).wake_default;
+    const rank = (v) => (typeof v === "string" && v in WAKE_ORDER ? WAKE_ORDER[v] : WAKE_ORDER.approved);
+    if (rank(nw) <= rank(bw))
+        return { profile: now, keys: [] };
+    const agent = { ...obj(now.agent) };
+    if (bw === undefined)
+        delete agent.wake_default;
+    else
+        agent.wake_default = bw;
+    return { profile: { ...now, agent }, keys: [`agent.wake_default loosened to ${String(nw)}`] };
+}
+export function restoreHome(s) {
+    const out = [];
+    for (const f of s.files) {
+        const file = join(s.home, f.rel);
+        const now = read(file);
+        const hashNow = now ? sha(now) : null;
+        if (hashNow === f.hash)
+            continue;
+        if (trusted.get(resolve(file))?.has(hashNow ?? "absent"))
+            continue;
+        try {
+            if (f.rel === HUD_FILE) {
+                if (now) {
+                    rmSync(file, { force: true });
+                    out.push({ rel: f.rel, what: "removed", keys: [] });
+                }
+                continue;
+            }
+            const a = parse(f.bytes), b = parse(now);
+            if (f.rel === POLICY_FILE) {
+                if (!b) {
+                    if (f.bytes) {
+                        writeFileSync(file, f.bytes, { mode: 0o600 });
+                        out.push({ rel: f.rel, what: "reverted", keys: ["(the whole file)"] });
+                    }
+                    continue;
+                }
+                const n = narrowPolicy(a, b);
+                if (n.keys.length) {
+                    writeFileSync(file, JSON.stringify(n.policy, null, 2) + "\n", { mode: 0o600 });
+                    trustWrite(file);
+                    out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                }
+                continue;
+            }
+            if (f.rel === PROFILE_FILE) {
+                if (!b)
+                    continue;
+                const n = narrowProfile(a, b);
+                if (n.keys.length) {
+                    writeFileSync(file, JSON.stringify(n.profile, null, 2) + "\n", { mode: 0o600 });
+                    trustWrite(file);
+                    out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                }
+                continue;
+            }
+            if (a && b) {
+                const n = narrowConfig(a, b);
+                if (n.keys.length) {
+                    writeFileSync(file, JSON.stringify(n.config, null, 2) + "\n", { mode: 0o600 });
+                    trustWrite(file);
+                    out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                }
+                const rest = changedKeys(a, n.config).filter((k) => !/privateKey|token/i.test(k)).slice(0, 20);
+                if (rest.length)
+                    out.push({ rel: f.rel, what: "reported", keys: rest });
+            }
+            else if (a && !b && now) {
+                writeFileSync(file, f.bytes, { mode: 0o600 });
+                trustWrite(file);
+                out.push({ rel: f.rel, what: "reverted", keys: ["(the whole file)"] });
+            }
+            else
+                out.push({ rel: f.rel, what: "reported", keys: [] });
+        }
+        catch {
+            out.push({ rel: f.rel, what: "reported", keys: ["(could not be checked)"] });
+        }
+    }
+    return out;
+}
+export function describeChange(c) {
+    if (c.what === "removed")
+        return `${c.rel} was written while the run could write it — removed, not acted on`;
+    if (c.what === "reported")
+        return `${c.rel} changed while the run was going${c.keys.length ? ` (${c.keys.join(", ")})` : ""} — left as it is; if you did not change it, check it`;
+    return `${c.rel}: what the run widened was taken back (${c.keys.join(", ")}) — if you did that yourself during the run, do it again`;
+}
+//# sourceMappingURL=home-guard.js.map

package/dist/hooks-install.js

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { MAX_CONSECUTIVE_BLOCKS, isOurHookCommand } from "./notify.js";
 import { copilotHome, kiroHome } from "./agents.js";
+import { parseJsonText } from "./text-file.js";
 import { KIRO_AGENT_NAME, kiroAgentFile, kiroAgentDoc, readKiroAgent, writeKiroAgent, kiroDefaultIsPantheon, gitTracks } from "./kiro-files.js";
 function ours(cmd) {
     return isOurHookCommand(cmd);
@@ -11,7 +12,7 @@ function readJson(file) {
     if (!existsSync(file))
         return null;
     try {
-        return JSON.parse(readFileSync(file, "utf8"));
+        return parseJsonText(readFileSync(file, "utf8"));
     }
     catch {
         return null;

package/dist/identity.js

@@ -64,6 +64,30 @@ export function verifyAccount(publicKeyB64, method, path, params, ts, signatureB
         return false;
     }
 }
+function readPayload(method, path, canonical) {
+    return Buffer.from(`pantheon-read/1\n${method}\n${path}\n${canonical}`, "utf8");
+}
+export function canonicalQuery(params) {
+    return Object.entries(params)
+        .filter(([k, v]) => v !== undefined && k !== "sig")
+        .map(([k, v]) => [encodeURIComponent(k), encodeURIComponent(String(v))])
+        .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
+        .map(([k, v]) => `${k}=${v}`)
+        .join("&");
+}
+export function signRead(privateKeyB64, method, path, params) {
+    const key = { key: Buffer.from(privateKeyB64, "base64"), format: "der", type: "pkcs8" };
+    return sign(null, readPayload(method, path, canonicalQuery(params)), key).toString("base64");
+}
+export function verifyRead(publicKeyB64, method, path, params, signatureB64) {
+    try {
+        const key = createPublicKey({ key: Buffer.from(publicKeyB64, "base64"), format: "der", type: "spki" });
+        return verify(null, readPayload(method, path, canonicalQuery(params)), key, Buffer.from(signatureB64, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
 export function fingerprint(publicKeyB64) {
     const raw = Buffer.from(publicKeyB64, "base64").subarray(-16).toString("hex");
     return (raw.match(/.{4}/g) ?? []).join("-");