@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/protocol.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { randomBytes } from "node:crypto";
 export const PROTOCOL_VERSION = 3;
 export const ACTS = [
     "JOIN",
@@ -35,6 +36,7 @@ export const LIMITS = {
     activityBusyTtlMs: 30 * 60 * 1_000,
     activityPruneMs: 7 * 24 * 60 * 60 * 1_000,
     claimTtlMs: 300_000,
+    claimLiveTtlMs: 30 * 60_000,
     workerFallbackMs: 20_000 + 120_000 + 60_000,
     pendingTimeoutMs: 1_500,
     cursorTtlMs: 7 * 24 * 60 * 60 * 1_000,
@@ -80,6 +82,37 @@ function loopback(host) {
         return "0.0.0.0";
     return null;
 }
+export const DelegateCertSchema = z.object({
+    pub: z.string().min(32).max(200),
+    run: z.string().min(1).max(64),
+    expires: z.number().int().positive(),
+    sig: z.string().min(32).max(200),
+});
+export const ActSigSchema = z.object({
+    v: z.literal(1),
+    role: z.enum(["member", "run"]),
+    nonce: z.string().min(8).max(64),
+    ts: z.number().int().positive(),
+    pub: z.string().min(32).max(200),
+    s: z.string().min(32).max(200),
+    meta: z.record(z.unknown()).optional(),
+    repo: z.string().regex(/^[rl]_[0-9a-f]{16}$/).optional(),
+    cert: DelegateCertSchema.optional(),
+});
+export const GoalSigSchema = z.object({
+    v: z.literal(1),
+    role: z.enum(["member", "run"]),
+    nonce: z.string().min(8).max(64),
+    ts: z.number().int().positive(),
+    pub: z.string().min(32).max(200),
+    s: z.string().min(32).max(200),
+    invite: z.array(z.string().min(1).max(48)).max(16).nullable(),
+    budget: z.number().int().nullable().optional(),
+    deadline: z.number().int().nullable().optional(),
+    kind: z.string().max(32).nullable().optional(),
+    cert: DelegateCertSchema.optional(),
+});
+export const RELAY_FEATURES = ["act-sig", "delegate"];
 export const Hello = z.object({
     t: z.literal("hello"),
     v: z.number().int().optional(),
@@ -98,6 +131,7 @@ export const Hello = z.object({
     from_seq: z.number().int().nonnegative().optional(),
     repo: z.string().regex(/^[rl]_[0-9a-f]{16}$/).optional(),
     repo_origin: z.string().max(200).optional(),
+    delegate: DelegateCertSchema.optional(),
 });
 export const OrganizationProfileSchema = z.object({
     version: z.literal(1),
@@ -147,12 +181,14 @@ export const Admit = z.object({
     member: z.string().min(1).max(48),
     may_wake: z.boolean().default(false),
     revoke: z.boolean().default(false),
+    wake_only: z.boolean().optional(),
     forget: z.boolean().default(false),
 });
 export const SendAct = z.object({
     t: z.literal("act"),
     cid: z.string().max(64).optional(),
     after_seq: z.number().int().nonnegative().optional(),
+    id: z.string().regex(/^a_[A-Za-z0-9]{6,48}$/).optional(),
     act: z.enum(ACTS),
     body: z.string().max(LIMITS.bodyChars),
     summary: z.string().max(LIMITS.summaryChars).optional(),
@@ -163,6 +199,7 @@ export const SendAct = z.object({
     affects: z.array(z.string().min(1).max(48)).max(16).optional(),
     meta: z.record(z.unknown()).optional(),
     repo: z.string().regex(/^[rl]_[0-9a-f]{16}$/).optional(),
+    sig: ActSigSchema.optional(),
 });
 export const BindRepo = z.object({
     t: z.literal("bind_repo"),
@@ -174,12 +211,14 @@ export const BindRepo = z.object({
 export const OpenGoal = z.object({
     t: z.literal("open_goal"),
     cid: z.string().max(64).optional(),
+    id: z.string().regex(/^g_[a-z0-9]{8,40}$/).optional(),
     title: z.string().min(1).max(200),
     acceptance: z.string().max(2000).default(""),
     invite: z.array(z.string().min(1).max(48)).max(16).optional(),
     budget: z.number().int().min(4).max(1000).optional(),
     deadline: z.number().int().positive().optional(),
     kind: z.enum(["worklist"]).optional(),
+    sig: GoalSigSchema.optional(),
 });
 export const Ping = z.object({ t: z.literal("ping") });
 export const DeleteSpace = z.object({
@@ -223,6 +262,6 @@ export function isContinuationFor(act, me, ctx) {
         && ctx.goalMembers.includes(me);
 }
 export function newId(prefix) {
-    return `${prefix}_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+    return `${prefix}_${Date.now().toString(36)}${randomBytes(5).readUIntBE(0, 5).toString(36).padStart(8, "0").slice(0, 8)}`;
 }
 //# sourceMappingURL=protocol.js.map

package/dist/quickstart.js

@@ -1,24 +1,25 @@
 import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:net";
-import { basename, join as pathJoin } from "node:path";
-import { homedir, hostname, platform } from "node:os";
+import { basename, dirname, join as pathJoin, resolve as resolvePath } from "node:path";
+import { homedir, hostname, platform, userInfo } from "node:os";
 import { lookup } from "node:dns/promises";
 import { describeNetError } from "./network.js";
 import { PantheonClient } from "./client.js";
-import { load, identity, save, toInvite, resolveFor, repoInfo, bindRepo, DEFAULT_RELAY } from "./config.js";
-import { loadProfile, wakeDefault } from "./profile.js";
+import { holdsRepo } from "./repo-find.js";
+import { load, loadAll, identity, save, toInvite, resolveFor, repoInfo, bindRepo, bindFolder, folderBinding, DEFAULT_RELAY } from "./config.js";
+import { commandsChosen, loadProfile, wakeChosen, wakeDefault } from "./profile.js";
 import { newKeypair } from "./identity.js";
 import { installForUser } from "./install.js";
 import { writeIntent, installHooks } from "./notify.js";
-import { detectAvailable, agentById } from "./agents.js";
+import { detectAvailable, agentById, agentsNeedingUnsandboxed } from "./agents.js";
 import { installService, servicesUnavailable } from "./service.js";
 import { ensureNativeNotifier } from "./notifier.js";
 import { ensureTrayBinary, writeTrayCommands } from "./tray.js";
 import { desktopUnavailable, ephemeralWarning, hostEnv } from "./host-env.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { localAddresses } from "./machine.js";
-import { grant as grantCap, loadPolicy, policyPath, savePolicy } from "./worker-policy.js";
+import { grant as grantCap, loadPolicy, policyPath, savePolicy, unsandboxedAllowed } from "./worker-policy.js";
 import { Relay } from "./relay.js";
 import { which } from "./which.js";
 const sh = (cmd) => {
@@ -29,6 +30,9 @@ const sh = (cmd) => {
         return null;
     }
 };
+const notLoaded = (r) => r && typeof r === "object" && r.loaded === false
+    ? String(r.reason ?? "the service manager did not load it")
+    : null;
 export function wireUp(opts, deps = {}) {
     const installSvc = deps.installService ?? installService;
     const ensureNotifier = deps.ensureNotifier ?? ensureNativeNotifier;
@@ -63,9 +67,14 @@ export function wireUp(opts, deps = {}) {
     else if (opts.notifications) {
         try {
             ensureNotifier();
-            installSvc("notifier", homedir(), []);
+            const why = notLoaded(installSvc("notifier", homedir(), []));
             writeTrayCommands();
-            tools.push({ tool: "notifications", status: "on — native alerts for decisions that require you" });
+            if (why) {
+                tools.push({ tool: "notifications", status: `installed, not running: ${why}` });
+                warnings.push(`human notifications are installed but not running (${why}). Try \`pantheon service restart notifier\``);
+            }
+            else
+                tools.push({ tool: "notifications", status: "on — native alerts for decisions that require you" });
         }
         catch (e) {
             tools.push({ tool: "notifications", status: `could not install: ${e.message}` });
@@ -82,8 +91,13 @@ export function wireUp(opts, deps = {}) {
         try {
             ensureTray();
             writeTrayCommands();
-            installSvc("menubar", homedir(), []);
-            tools.push({ tool: "menu bar", status: "on — status, pause/resume, and decision badge in your menu bar" });
+            const why = notLoaded(installSvc("menubar", homedir(), []));
+            if (why) {
+                tools.push({ tool: "menu bar", status: `installed, not running: ${why}` });
+                warnings.push(`the menu bar item is installed but not running (${why}). Try \`pantheon service restart menubar\``);
+            }
+            else
+                tools.push({ tool: "menu bar", status: "on — status, pause/resume, and decision badge in your menu bar" });
         }
         catch (e) {
             tools.push({ tool: "menu bar", status: `could not install: ${e.message}` });
@@ -108,18 +122,68 @@ export function wireUp(opts, deps = {}) {
         catch {
             return false;
         } })();
-        if (!isRepo && how === "explicit") {
+        const boundFolder = !isRepo && (() => { try {
+            const f = loadAll();
+            return !!f && !!folderBinding(f, project);
+        }
+        catch {
+            return false;
+        } })();
+        if (boundFolder) {
+            try {
+                const why = notLoaded(installSvc("worker", project, []));
+                if (why) {
+                    tools.push({ tool: "worker", status: `installed, not running: ${why}` });
+                    warnings.push(`the worker is installed but not running (${why}) — this machine cannot answer the team while you are away. Try \`pantheon service restart worker\``);
+                }
+                else {
+                    tools.push({ tool: "worker", status: `on — answers peers from this folder while you are away (it reads it; anything it writes goes to a drafts folder for you)` });
+                    granted.push(`${wakeChosen() === "approved" ? "A teammate you approve from this machine (pantheon wake allow <name>)" : "Your teammates"} can start an agent run that READS ${project} and answers them. It never changes that folder: drafts go to a folder of its own for you to review.`);
+                    const hasClaude = (() => { try {
+                        return detectAvailable().some((a) => a.backend.id === "claude-code");
+                    }
+                    catch {
+                        return true;
+                    } })();
+                    if (!hasClaude)
+                        warnings.push(`answering from a plain folder while you are away needs Claude Code (claude), and it is not installed here — until it is, teammates' requests for this folder wait for your live session`);
+                }
+            }
+            catch (e) {
+                tools.push({ tool: "worker", status: `could not install: ${e.message}` });
+                warnings.push(`the worker did not install: ${e.message}`);
+            }
+        }
+        else if (!isRepo && how === "explicit") {
             tools.push({ tool: "worker", status: `not installed — ${project} is not a git repo` });
             warnings.push(`--unattended needs a git repo to work in; pass --project <a clone>. Nothing was installed.`);
         }
         else if (!isRepo) {
-            tools.push({ tool: "worker", status: `not on — run this from your project's git repo to enable, or later: pantheon service install worker --project <repo>` });
+            tools.push({ tool: "worker", status: `not on yet — nothing here is bound to the team. Bind a repo or docs folder (pantheon repo find, or pantheon use <team> --here), then: pantheon service install worker` });
         }
         else {
             try {
-                installSvc("worker", project, []);
+                const commandsOn = commandsChosen() !== false;
+                const why = notLoaded(installSvc("worker", project, commandsOn ? ["--allow-bash"] : []));
+                if (why) {
+                    tools.push({ tool: "worker", status: `installed, not running: ${why}` });
+                    warnings.push(`the worker is installed but not running (${why}) — this machine cannot answer the team while you are away. Try \`pantheon service restart worker\``);
+                    return { tools, granted, warnings };
+                }
                 tools.push({ tool: "worker", status: `on — answers peers while you are away (${project})` });
-                granted.push(`A peer you have granted may_wake can start an agent run on this machine, in an isolated worktree under ${project}.`);
+                granted.push(wakeChosen() === "approved"
+                    ? `A teammate you approve here can start an agent run on this machine, in an isolated worktree under ${project}: you are asked the first time each one's request needs it (Always / Just this once / No), or approve ahead with pantheon wake allow <name>. Under wake "anyone", every teammate the team lets wake can.`
+                    : `Your teammates can hand work to this machine while you're away, so nothing waits on you: it runs in its own copy of ${project} and delivers on a branch for your review. To approve each teammate first: pantheon setup --wake approved`);
+                if (commandsOn)
+                    granted.push(`That work runs your tests, commits, and pushes to its own branch, so it arrives ready to review. Edits only instead: pantheon setup --commands no`);
+                const away = (() => { try {
+                    return agentsNeedingUnsandboxed();
+                }
+                catch {
+                    return [];
+                } })();
+                if (away.length && unsandboxedAllowed(loadPolicy()))
+                    granted.push(`${away.join(", ")} ${away.length === 1 ? "answers" : "answer"} those requests, so teammates get answers even when you're offline. To have them wait for you instead: pantheon setup --unsandboxed no`);
                 if (!existsSync(policyPath())) {
                     const pol = loadPolicy();
                     grantCap(pol, "self_upgrade", "always", "setup-default");
@@ -151,6 +215,47 @@ export function slugName(raw, fallback) {
         .replace(/^[-._]+|[-._]+$/g, "");
     return /[a-z0-9]/.test(s) ? s : fallback;
 }
+export function osUsername(env = process.env, info = () => userInfo().username) {
+    const tries = [info, () => env.USERNAME, () => env.USER];
+    for (const t of tries) {
+        try {
+            const v = t()?.trim();
+            if (v && v.toLowerCase() !== "root")
+                return v;
+        }
+        catch { }
+    }
+    return null;
+}
+export function defaultMemberName(env = process.env, info, host = hostname) {
+    const user = osUsername(env, info);
+    const random = `member-${randomBytes(3).toString("hex")}`;
+    if (user) {
+        const s = slugName(user, "");
+        if (s)
+            return s;
+    }
+    let h = "";
+    try {
+        h = host().split(".")[0] ?? "";
+    }
+    catch { }
+    const s = slugName(h, "");
+    return s && s !== "localhost" ? `${s}` : random;
+}
+export function deviceLabel(plat = platform(), env = process.env, info, host = hostname) {
+    const os = plat === "darwin" ? "Mac" : plat === "win32" ? "Windows" : plat === "linux" ? "Linux" : plat;
+    let who = osUsername(env, info);
+    if (!who) {
+        try {
+            who = host().split(".")[0] || null;
+        }
+        catch {
+            who = null;
+        }
+    }
+    return `${who ?? "a"}'s ${os}`;
+}
 export function teamNameFor(dir, repo = repoInfo(dir)) {
     const fromOrigin = repo?.origin ? (repo.origin.replace(/\.git$/i, "").split(/[/:]/).filter(Boolean).pop() ?? "") : "";
     return slugName(fromOrigin || basename(repo?.root ?? dir), "team");
@@ -298,11 +403,10 @@ export async function start(opts) {
     const reach = chosen
         ? (place === "loopback"
             ? { url: chosen, how: "as given", shareable: false,
-                hint: `That address is this machine only — a teammate cannot reach it.\n` +
-                    `  Use a tailnet address (tailscale ip -4) or a tunnel, then re-run pantheon start.` }
+                hint: `A teammate cannot reach it. Use a tailnet address (tailscale ip -4) or a tunnel, then re-run pantheon start.` }
             : { url: chosen, how: place === "this-machine" ? "this machine's address" : place === "tunnel" ? "a tunnel to this machine" : opts.relay ? "as given" : "your signed-in relay", shareable: true })
         : findReach(opts.port);
-    const nothing = (why) => ({ cfg: priorCfg ?? { relay: reach.url }, invite: null, claimed: false, reach, tools: [], granted: [], relay: null, warnings: [why] });
+    const nothing = (why) => ({ cfg: priorCfg ?? { relay: reach.url }, invite: null, inviteMayWake: false, claimed: false, reach, tools: [], granted: [], relay: null, warnings: [why] });
     let relay = null;
     if (chosen && !hostHere) {
         const probe = await probeRelay(reach.url, opts.remoteTimeoutMs ?? 10_000, opts.fetchImpl);
@@ -345,7 +449,7 @@ export async function start(opts) {
             relay: reach.url,
             space: opts.space ?? teamNameFor(process.cwd(), repo),
             token: randomBytes(16).toString("hex"),
-            member: opts.me ?? (keepIdentity ? existing.member : slugName(process.env.USER ?? "me", "me")),
+            member: opts.me ?? (keepIdentity ? existing.member : defaultMemberName()),
             agent: detectAgent(),
             ...(keepIdentity ? { publicKey: existing.publicKey, privateKey: existing.privateKey } : newKeypair()),
             ...(keepIdentity && existing.account ? { account: existing.account } : {}),
@@ -359,6 +463,10 @@ export async function start(opts) {
             warnings.push(`you are already "${cfg.member}" here; --me ${opts.me} ignored (use --reset to start over)`);
         }
     }
+    else if (keepIdentity && existing.space) {
+        opts.log(`  you        ${cfg.member}, as in "${existing.space}" — that team stays; this adds one`);
+        opts.log(`  default    "${cfg.space}" from now on for folders bound to no team — pantheon use ${existing.space} switches back`);
+    }
     else if (keepIdentity && existing.account) {
         opts.log(`  you        ${cfg.member} — signed in; creating your first team`);
     }
@@ -366,6 +474,8 @@ export async function start(opts) {
         warnings.push(`replacing your identity in "${existing.space}" — that space is no longer reachable from this machine`);
     }
     let invite = null;
+    let inviteMayWake = false;
+    let folderBound = null;
     let claimed = false;
     const claim = async (c) => {
         const client = new PantheonClient(c);
@@ -377,15 +487,23 @@ export async function start(opts) {
             if (repo && !client.repos.some((r) => r.fingerprint === repo.fingerprint)) {
                 await client.bindRepo(repo.fingerprint, repo.origin).catch((e) => warnings.push(`could not register this repo with the team: ${e.message}`));
             }
+            if (!repo && c.spaceId && bindableFolder(process.cwd())) {
+                bindFolder(process.cwd(), c.spaceId);
+                folderBound = process.cwd();
+            }
             if (repo && c.spaceId) {
                 const { replaced } = bindRepo(repo, c.spaceId);
-                if (replaced)
-                    warnings.push(`this repo was bound to another team (${replaced.space}); it now belongs to "${c.space}"`);
+                const was = replaced ?? (here.binding && here.binding.space !== c.spaceId ? here.binding : null);
+                if (was) {
+                    const name = Object.values(loadAll()?.spaces ?? {}).find((m) => m.id === was.space)?.name ?? was.space;
+                    warnings.push(`this repo was bound to "${name}"; it now belongs to "${c.space}" — agents opened here speak in "${c.space}" from now on (pantheon use ${name} --here moves it back)`);
+                }
             }
-            opts.log(`  space      ${c.space} ${reuse ? "— reconnected" : "— created, you own it"}${repo ? `   ${repo.origin ?? "local repo"} → bound to it` : ""}`);
+            opts.log(`  space      ${c.space} ${reuse ? "— reconnected" : "— created, you own it"}${repo ? `   ${repo.origin ?? "local repo"} → bound to it` : folderBound ? `   this folder → bound to it` : ""}`);
             const mayWake = opts.wake ? opts.wake === "anyone" : wakeDefault(loadProfile(c));
             const inv = await client.makeInvite(mayWake, opts.ttlMinutes);
             invite = toInvite({ ...c, token: inv.url });
+            inviteMayWake = mayWake;
             claimed = true;
         }
         finally {
@@ -426,7 +544,7 @@ export async function start(opts) {
         ...(opts.workerHow ? { workerHow: opts.workerHow } : {}),
     });
     warnings.push(...wired.warnings);
-    return { cfg, invite, claimed, reach, tools: wired.tools, granted: wired.granted, relay, warnings };
+    return { cfg, invite, inviteMayWake, claimed, reach, tools: wired.tools, granted: wired.granted, relay, warnings };
 }
 export async function join(opts) {
     const existing = opts.reset ? null : (load() ?? identity());
@@ -441,7 +559,7 @@ export async function join(opts) {
         relay: opts.invite.relay,
         space: opts.invite.space,
         token: "",
-        member: opts.me ?? existing?.member ?? slugName(process.env.USER ?? "me", "me"),
+        member: opts.me ?? existing?.member ?? defaultMemberName(),
         agent: detectAgent(),
         ...keys,
         ...(existing?.account ? { account: existing.account } : {}),
@@ -456,6 +574,10 @@ export async function join(opts) {
         cfg.spaceId = client.spaceId;
     save(cfg);
     const warnings = [];
+    if (!repo && cfg.spaceId && bindableFolder(process.cwd())) {
+        bindFolder(process.cwd(), cfg.spaceId);
+        opts.log(`  folder     ${process.cwd()} → bound to "${cfg.space}"   (agents opened here speak in it; no git needed)`);
+    }
     if (repo && cfg.spaceId) {
         const { replaced } = bindRepo(repo, cfg.spaceId);
         if (replaced)
@@ -476,6 +598,33 @@ export async function join(opts) {
     });
     return { cfg, tools: wired.tools, granted: wired.granted, warnings: [...warnings, ...wired.warnings] };
 }
+export function bindableFolder(dir) {
+    const real = (d) => { try {
+        return realpathSync.native(d);
+    }
+    catch {
+        return resolvePath(d);
+    } };
+    const here = real(dir), home = real(homedir());
+    if (dirname(here) === here || here === home || home.startsWith(here.endsWith("/") ? here : `${here}/`))
+        return false;
+    if (["Downloads", "Desktop", "Documents", "Library", "tmp"].some((n) => here === pathJoin(home, n)))
+        return false;
+    try {
+        if (holdsRepo(here))
+            return false;
+    }
+    catch {
+        return false;
+    }
+    try {
+        const f = loadAll();
+        if (Object.values(f?.bindings ?? {}).some((b) => { const p = real(b.path); return p !== here && p.startsWith(`${here}/`); }))
+            return false;
+    }
+    catch { }
+    return true;
+}
 function detectAgent() {
     const found = detectAvailable();
     return found[0]?.backend.id ?? "unknown";

package/dist/reads.js

@@ -0,0 +1,37 @@
+import { signRead } from "./identity.js";
+let clockSkewMs = 0;
+export const relayClockSkew = () => clockSkewMs;
+export function learnRelayClock(res) {
+    const there = Date.parse(res.headers.get("date") ?? "");
+    if (!Number.isFinite(there) || Math.abs(there - Date.now() - clockSkewMs) <= 60_000)
+        return false;
+    clockSkewMs = there - Date.now();
+    return true;
+}
+export const httpBase = (relay) => relay.replace(/^ws/, "http").replace(/\/+$/, "");
+export function signedReadQuery(cfg, path, params, at) {
+    const full = { space: cfg.space, token: cfg.token };
+    for (const [k, v] of Object.entries(params))
+        if (v !== undefined)
+            full[k] = String(v);
+    full.reader = cfg.member;
+    full.ts = String(at);
+    const d = cfg.delegate;
+    if (d) {
+        full.dpub = d.cert.pub;
+        full.drun = d.cert.run;
+        full.dexp = String(d.cert.expires);
+        full.dcert = d.cert.sig;
+    }
+    const sig = signRead(d ? d.privateKey : cfg.privateKey, "GET", path, full);
+    return new URLSearchParams({ ...full, sig }).toString();
+}
+export async function signedRead(cfg, path, params = {}, opts = {}) {
+    const signal = opts.signal ?? (opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined);
+    const go = () => fetch(`${httpBase(cfg.relay)}${path}?${signedReadQuery(cfg, path, params, Date.now() + clockSkewMs)}`, signal ? { signal } : {});
+    const res = await go();
+    if (res.status === 403 && learnRelayClock(res))
+        return go();
+    return res;
+}
+//# sourceMappingURL=reads.js.map

package/dist/refusal.js

@@ -21,9 +21,22 @@ export function connectFailure(e, relay) {
     const r = refusalOf(e);
     if (r) {
         const fix = r.fix && !/pantheon \w/.test(r.message) ? `\n  ${r.fix}` : "";
-        return `the relay refused this machine (${r.code}): ${r.message}${fix}`;
+        return `the relay refused this machine (${r.code}): ${r.message}${fix}${signInHint(r.code, relay)}`;
     }
     const text = typeof e === "string" ? e : String(e?.message ?? e ?? "");
     return `cannot reach the relay at ${relay} — ${text}`;
 }
+export function signInHint(code, relay, hosted = process.env.PANTHEON_DEFAULT_RELAY ?? "wss://relay.joinpantheon.network") {
+    if (code !== "NOT_SIGNED_IN" || !relay)
+        return "";
+    try {
+        if (new URL(relay).host === new URL(hosted).host)
+            return "";
+    }
+    catch {
+        return "";
+    }
+    return `\n  This team is on ${relay}, so sign in there:  pantheon login --email you@work.com --relay ${relay}` +
+        `\n  (new here: pantheon signup --email you@work.com --username you --relay ${relay})`;
+}
 //# sourceMappingURL=refusal.js.map