@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/run-failure.js

@@ -1,4 +1,6 @@
 import { execFileSync } from "node:child_process";
+import { checkRepoCommand } from "./agents.js";
+import { bashRuleMatches, GIT_DENY_RULES } from "./claude-confine.js";
 export const AUTH_RE = /not (?:logged|signed) in|not authenticated|no (?:github )?(?:authentication|credentials?|token) (?:found|available)|login required|please (?:log|sign) in|run .*login|invalid api key|unauthori[sz]ed|authentication (?:failed|required)|\b401\b|expired (?:token|session)/i;
 export const SIGN_IN_FIX = {
     "claude-code": "run `claude`, then /login",
@@ -58,15 +60,24 @@ export function diagnoseRun(f, probe = gitProbe) {
             fix: `Sign in once and the next run works: ${fix}. Until then every woken run on this machine fails the same way.`,
         };
     }
+    if (f.allowBash && (f.agent ?? "claude-code") === "claude-code" && (f.os ?? process.platform) === "linux" && SANDBOX_RE.test(f.detail)) {
+        return {
+            cause: "sandbox_unavailable",
+            says: "The run could not run commands: Claude Code's sandbox did not start on this machine, and a command run never goes without it.",
+            fix: "On Linux the sandbox needs bubblewrap and socat. Install them (Debian/Ubuntu: sudo apt install bubblewrap socat; Fedora: sudo dnf install bubblewrap socat), then the next run works.",
+        };
+    }
     if (!f.exited) {
         return {
             cause: "crashed",
             says: `The agent did not finish — ${exitLine(f.detail)}.`,
             fix: `Read the transcript at ${f.runLog}. If the agent CLI is broken or missing, pantheon doctor names it.`,
             dir: f.worktree,
-            lines: [`cat ${f.runLog}`],
+            lines: [`cat ${shq(f.runLog)}`],
         };
     }
+    if (!f.branch && f.folder)
+        return silent(f);
     if (!f.branch) {
         return {
             cause: "not_a_repo",
@@ -76,6 +87,20 @@ export function diagnoseRun(f, probe = gitProbe) {
     }
     if (!f.allowBash && !(f.needsCommands || BLOCKED_RE.test(f.transcript ?? f.detail) || BLOCKED_RE.test(f.detail)))
         return silent(f);
+    if (!f.allowBash && f.commandsNeedSandbox === "agent-cmd") {
+        return {
+            cause: "no_sandbox_commands",
+            says: "Commands are on here, and this machine is set to keep runs of the agent the worker was started with (--agent-cmd) to edits, so the run edited files only.",
+            fix: "To have it run tests, commit and push too: pantheon policy grant unsandboxed-runs — or start the worker without --agent-cmd so Claude Code runs them in its sandbox.",
+        };
+    }
+    if (!f.allowBash && f.commandsNeedSandbox) {
+        return {
+            cause: "no_sandbox_commands",
+            says: "Commands are on here, and this machine is set to keep runs of this Claude Code (Windows, or older than 2.1.83) to edits, so the run edited files only.",
+            fix: "To have it run tests, commit and push too: pantheon policy grant unsandboxed-runs — or update Claude Code to 2.1.83 or later on macOS or Linux, which runs them in its sandbox.",
+        };
+    }
     if (!f.allowBash) {
         return {
             cause: "no_commands",
@@ -84,6 +109,55 @@ export function diagnoseRun(f, probe = gitProbe) {
             capability: "run_commands",
         };
     }
+    const claimed = blockedCommands(f.transcript ?? f.detail);
+    const allowed = (c) => !!f.allowedRules?.some((r) => ruleAllows(r, c));
+    const denied = (c) => GIT_DENY_RULES.find((r) => bashRuleMatches(r, c));
+    const byDeny = f.allowedRules ? claimed.filter((c) => allowed(c) && denied(c)) : [];
+    if (f.allowBash && byDeny.length) {
+        return {
+            cause: "command_not_listed",
+            says: `The run needed \`${byDeny.join("`, `")}\`, which a woken run is never given (${denied(byDeny[0])}): it would move or delete a branch the person's own checkout shares, or run a program through git.`,
+            fix: "That is by design and no list entry changes it. If the work needs it, do that step yourself, or ask the run for the part that does not need it.",
+        };
+    }
+    const blocked = f.allowedRules ? claimed.filter((c) => !allowed(c)) : claimed;
+    const wronglyBlocked = f.allowedRules ? claimed.filter((c) => allowed(c) && !denied(c)) : [];
+    if (f.allowBash && blocked.length) {
+        const cmd = blocked[0];
+        const base = f.baseRef ? f.baseRef.replace(/^origin\//, "") : "the base branch";
+        const says = `The run needed \`${blocked.join("`, `")}\`, which is not on the list of commands a woken run may use, so it was refused.`;
+        const why = checkRepoCommand(cmd);
+        if (why || !/^[A-Za-z0-9 ._\/:=@+,%-]+$/.test(cmd)) {
+            return {
+                cause: "command_not_listed", says,
+                fix: why
+                    ? `It cannot be added to ${REPO_COMMANDS_FILE_NAME}: ${why}. If the run needs it, give it a fixed form the list accepts (a script path such as ./node_modules/.bin/vitest, or a make/npm script), or run it yourself.`
+                    : `Check the command in the transcript at ${f.runLog}; if it is safe to run unattended, add it to ${REPO_COMMANDS_FILE_NAME} on ${base} yourself.`,
+                dir: f.project,
+                lines: [],
+            };
+        }
+        const onBase = !!f.baseRef && ask(() => probe.branchOf(f.project), "") === base;
+        return {
+            cause: "command_not_listed", says,
+            fix: `If it is safe to run unattended, add it to ${REPO_COMMANDS_FILE_NAME} on ${base} (one command per line) and get that onto ${base} the way your team changes it. ` +
+                `The next run reads the list from the tip of ${base} after it fetches — not from its own worktree, so committing it on the run's branch does nothing.`,
+            dir: f.project,
+            lines: onBase ? [
+                `mkdir -p .pantheon && printf '%s\\n' ${shq(cmd)} >> ${REPO_COMMANDS_FILE_NAME}`,
+                `git add ${REPO_COMMANDS_FILE_NAME} && git commit -m ${shq(`let woken runs use ${cmd.split(/\s+/).slice(0, 2).join(" ")}`)}`,
+            ] : [],
+        };
+    }
+    if (f.allowBash && wronglyBlocked.length) {
+        return {
+            cause: "command_failed",
+            says: `The run reported \`${wronglyBlocked.join("`, `")}\` as refused, but it is allowed — most likely it failed inside the command (a failing test, a missing dependency, the sandbox refusing a file or host).`,
+            fix: `Read the transcript at ${f.runLog} for what the command printed. Adding it to ${REPO_COMMANDS_FILE_NAME} would change nothing.`,
+            dir: f.worktree,
+            lines: [`cat ${shq(f.runLog)}`],
+        };
+    }
     if (!ask(() => probe.hasRemote(f.project), true)) {
         return {
             cause: "no_remote",
@@ -101,17 +175,39 @@ export function diagnoseRun(f, probe = gitProbe) {
             says: `The work is uncommitted in your own checkout${on ? ` on ${on}` : ""} — a run never sees that, it starts from what origin has.`,
             fix: "Commit and push it yourself, then the run (or your teammate) can see it. A worker deliberately never touches your working tree.",
             dir: f.project,
-            lines: [`git status --short   # ${list(dirty)}`, "git add -A", `git commit -m "…"`, `git push${on ? ` -u origin ${on}` : ""}`],
+            lines: [`git status --short   # ${list(dirty).replace(/[\r\n]+/g, " ")}`, "git add -A", `git commit -m "…"`, `git push${on ? ` -u origin ${shq(on)}` : ""}`],
         };
     }
     return silent(f);
 }
+export function ruleAllows(rule, command) {
+    const m = /^Bash\((.*)\)$/s.exec(rule);
+    if (!m)
+        return false;
+    const pat = m[1];
+    const cmd = command.trim();
+    if ((pat.match(/\*/g) ?? []).length === 1 && pat.endsWith(" *") && cmd === pat.slice(0, -2))
+        return true;
+    return new RegExp(`^${pat.split("*").map((x) => x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\s\\S]*")}$`).test(cmd);
+}
+const REPO_COMMANDS_FILE_NAME = ".pantheon/commands";
+const SANDBOX_RE = /\b(?:bubblewrap|bwrap)\b[^\n]*(?:not found|not installed|missing|unavailable|required)|sandbox[^\n]{0,80}(?:is unavailable|not available|could not (?:be )?start|failed to start)/i;
+const shq = (v) => /^[A-Za-z0-9._\/:=@+,%-]+$/.test(v) ? v : `'${v.replace(/'/g, "'\\''")}'`;
+export function blockedCommands(text) {
+    const out = [];
+    for (const m of (text ?? "").matchAll(/^\s*BLOCKED-COMMAND:\s*`?([^`\n]{1,200}?)`?\s*$/gm)) {
+        const c = m[1].trim();
+        if (c && !out.includes(c))
+            out.push(c);
+    }
+    return out.slice(0, 5);
+}
 const silent = (f) => ({
     cause: "silent",
     says: "The run finished cleanly but sent nothing back, so the request is still open.",
     fix: `Read what it did at ${f.runLog}. If it was right to stay silent, answer the teammate yourself; if not, the transcript says where it stopped.`,
     dir: f.worktree,
-    lines: [`cat ${f.runLog}`],
+    lines: [`cat ${shq(f.runLog)}`],
 });
 export const BLOCKED_RE = /(?:permission|approval)[^\n]{0,40}\b(?:denied|required|needed|to use (?:the )?(?:bash|shell))|\bnot (?:allowed|permitted) to (?:run|execute|use (?:the )?(?:bash|shell))|\b(?:bash|shell|command|tool)\b[^\n]{0,30}\b(?:was |is )?(?:blocked|denied|not allowed|rejected)\b|read-only sandbox|sandbox[^\n]{0,20}read-only/i;
 export function workNeedsCommands(kind, trigger, triggerAct) {

package/dist/secret-guard.js

@@ -0,0 +1,141 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const MIN_EXACT = 12;
+const PEM = /-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----|-----BEGIN OPENSSH PRIVATE KEY-----/;
+const TOKEN_SHAPES = [
+    { re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/, kind: "a GitHub token" },
+    { re: /\bgithub_pat_[A-Za-z0-9_]{40,}\b/, kind: "a GitHub token" },
+    { re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, kind: "an AWS access key id" },
+    { re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/, kind: "a Slack token" },
+    { re: /\bnpm_[A-Za-z0-9]{36}\b/, kind: "an npm token" },
+    { re: /\bglpat-[A-Za-z0-9_-]{20,}\b/, kind: "a GitLab token" },
+    { re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/, kind: "an Anthropic API key" },
+];
+function derPrivateKey(b64) {
+    let b;
+    try {
+        b = Buffer.from(b64.replace(/[-_]/g, (c) => (c === "-" ? "+" : "/")), "base64");
+    }
+    catch {
+        return false;
+    }
+    if (b.length < 32)
+        return false;
+    if (b.subarray(0, 15).toString("latin1") === "openssh-key-v1\0")
+        return true;
+    if (b[0] !== 0x30)
+        return false;
+    let i = 1;
+    const l = b[i];
+    if (l & 0x80)
+        i += 1 + (l & 0x7f);
+    else
+        i += 1;
+    return b[i] === 0x02 && b[i + 1] === 0x01 && (b[i + 2] === 0x00 || b[i + 2] === 0x01);
+}
+export function secretFileValues(home = homedir()) {
+    const out = [];
+    const take = (file, re) => {
+        let text = "";
+        try {
+            text = readFileSync(join(home, file), "utf8");
+        }
+        catch {
+            return;
+        }
+        if (text.length > 1 << 20)
+            return;
+        for (const m of text.matchAll(re)) {
+            const v = (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
+            if (v.length >= MIN_EXACT)
+                out.push({ value: v, file: `~/${file}` });
+        }
+    };
+    take(".aws/credentials", /^\s*(?:aws_secret_access_key|aws_session_token)\s*=\s*(\S+)/gim);
+    take(".config/gh/hosts.yml", /^\s*oauth_token:\s*(\S+)/gim);
+    take("AppData/Roaming/GitHub CLI/hosts.yml", /^\s*oauth_token:\s*(\S+)/gim);
+    take(".netrc", /\bpassword\s+(\S+)/gi);
+    take(".git-credentials", /^[a-z][a-z0-9+.-]*:\/\/[^:\s/]+:([^@\s]+)@/gim);
+    take(".docker/config.json", /"(?:auth|identitytoken)"\s*:\s*"([^"]+)"/gi);
+    take(".npmrc", /_(?:authToken|auth|password)\s*=\s*(\S+)/gi);
+    return out;
+}
+const squash = (t) => t.replace(/[^A-Za-z0-9+/]/g, "");
+function decodedRuns(text) {
+    const out = [];
+    const flat = text.replace(/\s+/g, "");
+    for (const m of flat.matchAll(/(?:[0-9a-fA-F]{2}){12,}/g)) {
+        if (out.length > 50)
+            break;
+        out.push(Buffer.from(m[0], "hex").toString("latin1"));
+    }
+    for (const m of flat.matchAll(/[A-Za-z0-9+/_-]{16,}={0,2}/g)) {
+        if (out.length > 100)
+            break;
+        try {
+            out.push(Buffer.from(m[0].replace(/[-_]/g, (c) => (c === "-" ? "+" : "/")), "base64").toString("latin1"));
+        }
+        catch { }
+    }
+    return out;
+}
+export function secretGuard(own, home = homedir()) {
+    const exact = [];
+    if (own.privateKey && own.privateKey.length >= MIN_EXACT)
+        exact.push({ value: own.privateKey, kind: "this machine's private key" });
+    for (const t of own.tokens ?? [])
+        if (t && t.length >= MIN_EXACT && !exact.some((e) => e.value === t))
+            exact.push({ value: t, kind: "a team token this machine holds" });
+    let files = [];
+    let readAt = 0;
+    return {
+        check(text) {
+            if (!text)
+                return null;
+            for (const e of exact)
+                if (text.includes(e.value))
+                    return { kind: e.kind };
+            if (exact.length) {
+                const flat = squash(text);
+                const decoded = decodedRuns(text);
+                for (const e of exact) {
+                    const v = squash(e.value);
+                    if (v.length >= MIN_EXACT && (flat.includes(v) || decoded.some((d) => d.includes(e.value) || squash(d).includes(v))))
+                        return { kind: e.kind };
+                }
+            }
+            if (PEM.test(text))
+                return { kind: "a private key (a PEM block)" };
+            for (const s of TOKEN_SHAPES)
+                if (s.re.test(text))
+                    return { kind: s.kind };
+            for (const m of text.matchAll(/[A-Za-z0-9+/_-]{60,}={0,2}/g))
+                if (derPrivateKey(m[0]))
+                    return { kind: "something shaped like a private key (base64 key material)" };
+            if (Date.now() - readAt > 60_000) {
+                files = secretFileValues(home);
+                readAt = Date.now();
+            }
+            for (const f of files)
+                if (text.includes(f.value))
+                    return { kind: `a secret from ${f.file}` };
+            return null;
+        },
+    };
+}
+export function refuseSecrets(guard, fields) {
+    for (const [name, v] of Object.entries(fields)) {
+        for (const s of Array.isArray(v) ? v : [v]) {
+            if (typeof s !== "string")
+                continue;
+            const hit = guard.check(s);
+            if (hit) {
+                return `pantheon: NOT sent — the ${name} contains ${hit.kind}. Secrets never go on the ledger: every act is stored on the relay and shown to the whole team. ` +
+                    `Take it out and send again. If a teammate asked for it, say that you cannot share it and that their human should ask yours directly.`;
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=secret-guard.js.map

package/dist/service.js

@@ -2,7 +2,7 @@ import { writeFileSync, mkdirSync, existsSync, unlinkSync, readFileSync } from "
 import { execFileSync } from "node:child_process";
 import { homedir, platform, userInfo } from "node:os";
 import { which } from "./which.js";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { launcher } from "./install.js";
 import { CONFIG_DIR } from "./config.js";
@@ -57,8 +57,44 @@ export function servicesUnavailable(plat = platform()) {
 export function plistPath(kind = "worker") {
     return join(homedir(), "Library", "LaunchAgents", `${LABEL(kind)}.plist`);
 }
-export function unitPath(kind) {
-    return join(homedir(), ".config", "systemd", "user", `pantheon-${kind}.service`);
+export function parseSystemdEnvironment(out) {
+    const env = {};
+    for (const line of out.split(/\r?\n/)) {
+        const m = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+        if (!m)
+            continue;
+        let v = m[2];
+        if (v.startsWith("$'") && v.endsWith("'"))
+            v = v.slice(2, -1).replace(/\\(.)/g, (_, c) => (c === "n" ? "\n" : c === "t" ? "\t" : c));
+        env[m[1]] = v;
+    }
+    return env;
+}
+const sdEnvCache = new WeakMap();
+export function systemdUserEnv(sys = realSys()) {
+    if (sys.platform !== "linux" || (sys.borrowed ?? borrowedHome)())
+        return {};
+    const home = homedir();
+    const hit = sdEnvCache.get(sys.exec);
+    if (hit && hit.home === home)
+        return hit.env;
+    let env = {};
+    try {
+        env = parseSystemdEnvironment(sys.exec("systemctl", ["--user", "show-environment"]));
+    }
+    catch { }
+    sdEnvCache.set(sys.exec, { home, env });
+    return env;
+}
+export function unitPath(kind, env = systemdUserEnv()) {
+    const xdg = env.XDG_CONFIG_HOME && isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : join(homedir(), ".config");
+    return join(xdg, "systemd", "user", `pantheon-${kind}.service`);
+}
+export function unitPaths(kind, env = systemdUserEnv(), shellEnv = process.env) {
+    return [...new Set([unitPath(kind, env), unitPath(kind, {}), unitPath(kind, shellEnv)])];
+}
+export function existingUnitPath(kind, env = systemdUserEnv(), shellEnv = process.env) {
+    return unitPaths(kind, env, shellEnv).find((p) => existsSync(p)) ?? null;
 }
 function xml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -70,16 +106,13 @@ function argvFor(kind, args) {
     const abs = whichPantheon();
     return abs ? [abs, kind, ...args] : [process.execPath, resolve(HERE, "cli.js"), kind, ...args];
 }
-export function whichPantheon() {
-    if (platform() === "win32")
-        return which("pantheon");
-    try {
-        const p = execFileSync("/usr/bin/which", ["pantheon"], { encoding: "utf8" }).trim();
-        return p.startsWith("/") && existsSync(p) ? p : null;
-    }
-    catch {
+export function whichPantheon(find = which) {
+    const p = find("pantheon");
+    if (!p)
         return null;
-    }
+    if (platform() === "win32")
+        return p;
+    return p.startsWith("/") && existsSync(p) ? p : null;
 }
 export function servicePlist(kind, cwd, logDir, args) {
     const argv = argvFor(kind, args);
@@ -107,9 +140,15 @@ ${argv.map((a) => `    <string>${xml(a)}</string>`).join("\n")}
 `;
 }
 export function systemdQuote(arg) {
-    return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/%/g, "%%").replace(/\$/g, "$$$$")}"`;
+    return `"${cEscape(arg).replace(/%/g, "%%").replace(/\$/g, "$$$$")}"`;
 }
-const systemdValue = (v) => v.replace(/%/g, "%%");
+const cEscape = (s) => s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+export const systemdEnvQuote = (assignment) => `"${cEscape(assignment).replace(/%/g, "%%")}"`;
+const systemdValue = (v) => {
+    if (/[\r\n]/.test(v))
+        throw new Error(`a path with a line break in it cannot be written into a systemd unit: ${JSON.stringify(v)}`);
+    return v.replace(/%/g, "%%");
+};
 export function systemdUnit(kind, cwd, args, path = servicePath()) {
     const description = kind === "relay"
         ? "pantheon relay — the coordination plane for a space"
@@ -124,7 +163,7 @@ After=network-online.target
 Type=simple
 WorkingDirectory=${systemdValue(cwd)}
 ExecStart=${argvFor(kind, args).map(systemdQuote).join(" ")}
-Environment=${systemdQuote(`PATH=${path}`)}
+Environment=${systemdEnvQuote(`PATH=${path}`)}
 Restart=always
 RestartSec=30
 
@@ -147,6 +186,9 @@ export function installService(kind, cwd, args, sys = realSys()) {
     if (noServices)
         throw new Error(noServices.replace(/^not available — /, ""));
     const out = [];
+    let loaded = true;
+    let reason;
+    const done = () => Object.assign(out, { loaded, ...(reason ? { reason } : {}) });
     const abs = resolve(cwd);
     const logDir = serviceLogDir();
     if (sys.platform === "darwin") {
@@ -168,8 +210,16 @@ export function installService(kind, cwd, args, sys = realSys()) {
             out.push(`  loaded — the ${kind} now starts at login and restarts if it dies`);
         }
         catch (e) {
-            out.push(`  could not load it: ${e.message.split("\n")[0]}`);
-            out.push(`  load it yourself with:  launchctl load -w ${p}`);
+            const why = e.message.split("\n")[0];
+            loaded = false;
+            reason = why;
+            out.push(`  could not load it: ${why}`);
+            if ((sys.borrowed ?? borrowedHome)()) {
+                reason = `HOME (${homedir()}) is not your own home, so launchd was not touched`;
+                out.push(`  left unloaded — ${reason}; your own services are unchanged`);
+            }
+            else
+                out.push(`  load it yourself with:  launchctl load -w ${p}`);
         }
         out.push(`  logs:   ${join(logDir, `${kind}.log`)}`);
         out.push(`  stop:   pantheon service uninstall ${kind}`);
@@ -178,8 +228,8 @@ export function installService(kind, cwd, args, sys = realSys()) {
         if (kind === "menubar" || kind === "notifier") {
             throw new Error(`${kind === "menubar" ? "the menu bar" : "desktop alerts"} run on macOS only, and this machine reports ${sys.platform}`);
         }
-        const unit = unitPath(kind);
-        mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });
+        const unit = unitPath(kind, systemdUserEnv(sys));
+        mkdirSync(dirname(unit), { recursive: true });
         writeFileSync(unit, systemdUnit(kind, abs, args));
         out.push(`  wrote ${unit}`);
         try {
@@ -196,17 +246,15 @@ export function installService(kind, cwd, args, sys = realSys()) {
             out.push(`  ! the ${kind} stops when you log out (closing an SSH session counts). To keep it running:  loginctl enable-linger ${sys.user || "$USER"}`);
         }
     }
-    return out;
+    return done();
 }
 export function uninstallService(kind, sys = realSys()) {
     const out = [];
     if (sys.platform === "win32") {
-        const stray = unitPath(kind);
-        if (existsSync(stray)) {
-            unlinkSync(stray);
-            return [`  removed ${stray}`];
-        }
-        return [`  no ${kind} service installed`];
+        const strays = unitPaths(kind, {}).filter((u) => existsSync(u));
+        for (const u of strays)
+            unlinkSync(u);
+        return strays.length ? strays.map((u) => `  removed ${u}`) : [`  no ${kind} service installed`];
     }
     if (sys.platform === "darwin") {
         const p = plistPath(kind);
@@ -228,8 +276,8 @@ export function uninstallService(kind, sys = realSys()) {
         out.push(`  removed ${p}`);
     }
     else {
-        const unit = unitPath(kind);
-        if (!existsSync(unit))
+        const units = unitPaths(kind, systemdUserEnv(sys)).filter((u) => existsSync(u));
+        if (!units.length)
             return [`  no ${kind} service installed`];
         try {
             sys.exec("systemctl", ["--user", "disable", "--now", `pantheon-${kind}`]);
@@ -238,12 +286,14 @@ export function uninstallService(kind, sys = realSys()) {
         catch {
             out.push(`  could not reach systemd --user — if it runs elsewhere:  systemctl --user disable --now pantheon-${kind}`);
         }
-        unlinkSync(unit);
+        for (const u of units)
+            unlinkSync(u);
         try {
             sys.exec("systemctl", ["--user", "daemon-reload"]);
         }
         catch { }
-        out.push(`  removed ${unit}`);
+        for (const u of units)
+            out.push(`  removed ${u}`);
     }
     return out;
 }
@@ -272,7 +322,8 @@ export function serviceState(kind, exec = realExec, plat = platform(), uid = pro
         const dis = outOf(exec, "launchctl", ["print-disabled", `gui/${uid}`]).out;
         const disabled = new RegExp(`"${LABEL(kind).replace(/\./g, "\\.")}"\\s*=>\\s*(disabled|true)`).test(dis);
         const pr = outOf(exec, "launchctl", ["print", `gui/${uid}/${LABEL(kind)}`]);
-        return { disabled, loaded: pr.ok, running: pr.ok && /^\s*state = running/m.test(pr.out) };
+        const from = pr.ok ? /^\s*path = (.+)$/m.exec(pr.out)?.[1]?.trim() : undefined;
+        return { disabled, loaded: pr.ok, running: pr.ok && /^\s*state = running/m.test(pr.out), ...(from ? { from } : {}) };
     }
     const en = outOf(exec, "systemctl", ["--user", "is-enabled", `pantheon-${kind}`]).out.trim();
     const act = outOf(exec, "systemctl", ["--user", "is-active", `pantheon-${kind}`]).out.trim();
@@ -288,6 +339,11 @@ export function restartService(kind, exec = realExec, opts = {}) {
         return [`  ${kind}: left stopped (you stopped it) — start it again: pantheon service install ${kind}`];
     try {
         if (plat === "darwin") {
+            if (st.loaded && st.from && resolve(st.from) !== resolve(plistPath(kind)) && existsSync(plistPath(kind))) {
+                exec("launchctl", ["bootout", `gui/${uid}/${LABEL(kind)}`]);
+                exec("launchctl", ["bootstrap", `gui/${uid}`, plistPath(kind)]);
+                return [`  ${kind}: was running from ${st.from}, not this machine's own definition — reloaded from ${plistPath(kind)} on the new code`];
+            }
             if (st.loaded && !st.running)
                 return [`  ${kind}: not running — left as it is (launchd starts it again on its own schedule)`];
             if (!st.loaded) {
@@ -335,11 +391,11 @@ export function refreshServiceDefinition(kind, plat = platform()) {
         }
         if (plat === "win32")
             return { changed: false };
-        const u = unitPath(kind);
-        if (!existsSync(u))
+        const u = existingUnitPath(kind);
+        if (!u)
             return { changed: false };
         const unit = readFileSync(u, "utf8");
-        if (/^Environment="PATH=/m.test(unit))
+        if (/^Environment="PATH=/m.test(unit) && !/^Environment="PATH=.*\$\$/m.test(unit))
             return { changed: false };
         const exec = /^ExecStart=(.*)$/m.exec(unit)?.[1] ?? "";
         const words = exec.startsWith('"') ? [...exec.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1].replace(/\\(.)/g, "$1").replace(/%%/g, "%").replace(/\$\$/g, "$")) : exec.split(/\s+/);
@@ -359,7 +415,7 @@ export function serviceInstalled(kind, plat = platform()) {
     try {
         if (plat === "win32")
             return false;
-        return existsSync(plat === "darwin" ? plistPath(kind) : unitPath(kind));
+        return plat === "darwin" ? existsSync(plistPath(kind)) : existingUnitPath(kind) !== null;
     }
     catch {
         return false;