@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/setup-guide.js

@@ -3,10 +3,11 @@ import { approvalSummary, installForUser } from "./install.js";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { applyProfileInit, loadProfile, profilePath, saveProfile } from "./profile.js";
+import { applyProfileInit, loadProfile, profilePath, saveProfile, wakeMode } from "./profile.js";
 import { installService as realInstall, uninstallService as realUninstall, serviceInstalled as realInstalled } from "./service.js";
 import { personaDir } from "./persona.js";
 import { hudBinaryPath } from "./notifier.js";
+import { grant, inWokenRun, loadPolicy, revoke, savePolicy, unsandboxedAllowed } from "./worker-policy.js";
 export const DECISION_AREAS = [
     { id: "product", label: "Product — what we build, for whom, and what goes in a release" },
     { id: "engineering", label: "Engineering — architecture, and changes that cross team lines" },
@@ -19,8 +20,8 @@ export const DECISION_AREAS = [
 ];
 export const TITLE_OPTIONS = ["Founder", "Engineer", "Designer", "Product", "Operations", "Something else"];
 export const WAKE_OPTIONS = [
-    { id: "anyone", label: "Yes — anyone on my teams (recommended). Invites you send grant it; you can revoke a person any time." },
-    { id: "approved", label: "Only people I approve one by one — invites do not grant it; I run `pantheon admit <name> --may-wake` per person." },
+    { id: "anyone", label: "Yes — anyone on my teams (the default). Invites you send grant it; to stop one person later, switch to \"only people I approve\" and pantheon wake deny <name>." },
+    { id: "approved", label: "Only people I approve — I am asked the first time each one's request needs this machine, or approve ahead with pantheon wake allow <name>; invites never grant it." },
     { id: "no", label: "No — this machine only works while I am at it." },
 ];
 export const ALERT_OPTIONS = [
@@ -32,7 +33,7 @@ export const ALERT_OPTIONS = [
 export function guideDefaults(profile, cfg) {
     const n = profile.notifications ?? { decisions: true, deliveries: false, worker_done: false };
     return {
-        wake: profile.agent.wake_default ?? "anyone",
+        wake: wakeMode(profile),
         commands: profile.agent.allow_bash ?? false,
         approval: profile.agent.approval ?? "approve",
         name: profile.human.display_name || cfg.display || cfg.member,
@@ -42,6 +43,7 @@ export function guideDefaults(profile, cfg) {
         persona: false,
     };
 }
+const andList = (xs) => xs.length < 2 ? xs.join("") : `${xs.slice(0, -1).join(", ")} and ${xs[xs.length - 1]}`;
 export function optOutsFrom(argv) {
     return { worker: argv.includes("--no-worker"), notifications: argv.includes("--no-notifications") };
 }
@@ -67,10 +69,11 @@ export function questionnaire() {
         "Ask your human in plain words, then pass the answers as flags — to `pantheon setup --yes`, or straight to",
         "`pantheon start` / `pantheon join`, which apply them the moment the team exists.",
         "",
-        "Only 3 and 4 need the person every time. Ask 2 whenever there is a repo (it is the one default people are",
-        "surprised by). The rest have defaults you may take and say out loud:",
-        "  --wake anyone --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
-        "Without a repo, --wake, --commands, --playbook and --base do nothing yet: skip them and say so.",
+        "Only 3 and 4 need the person. The rest have defaults you may take and say out loud:",
+        "  --wake anyone --commands yes --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
+        "--wake anyone (the default) means any teammate the team lets wake workers can start a run here while they are away; --commands yes (the default in a repo) means that run may run tests, commit and push to its own branch.",
+        "Codex, Cursor and Copilot answer those requests too, so teammates are never kept waiting; --unsandboxed no makes them wait for the person instead.",
+        "--commands, --playbook and --base are about a repo: skip them where nothing bound here is one (a docs folder), and say so.",
         "",
         "1. While they're away, may teammates hand work to this machine? (their agent runs here on its own,",
         "   in a separate copy of the repo, and delivers on a branch for review)",
@@ -98,7 +101,7 @@ export function questionnaire() {
         "   These are switches: pass --approve-all or --ask-before-sending with no value. Either way the install",
         "   output prints the exact line written to ~/.codex/config.toml, and pantheon leave removes it.",
         "",
-        "Example:  pantheon setup --yes --wake anyone --commands yes --name \"Praneet Sinha\" --title Founder \\",
+        "Example:  pantheon setup --yes --wake approved --commands yes --name \"Praneet Sinha\" --title Founder \\",
         "            --decides deployment --alerts decisions --playbook yes --base main",
     ].join("\n");
 }
@@ -120,6 +123,9 @@ export function parseSetupFlags(argv) {
     const commands = yn("commands");
     if (commands !== undefined)
         preset.commands = commands;
+    const unsandboxed = yn("unsandboxed");
+    if (unsandboxed !== undefined)
+        preset.unsandboxed = unsandboxed;
     const name = val("name");
     if (name !== undefined)
         preset.name = name.trim();
@@ -158,6 +164,7 @@ export function parseSetupFlags(argv) {
 }
 export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const optOut = ctx.optOut ?? {};
+    const serves = ctx.project ? { path: ctx.project, repos: true } : ctx.serves ?? null;
     const os = deps.platform ?? process.platform;
     const mac = os === "darwin";
     const install = deps.installService ?? realInstall;
@@ -166,29 +173,27 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const file = deps.profileFile ?? profilePath();
     const profile = loadProfile(ctx.cfg, file);
     const d = { ...guideDefaults(profile, ctx.cfg), ...preset };
+    if (profile.agent.allow_bash === undefined && preset.commands === undefined && serves?.repos)
+        d.commands = true;
     const a = { ...d };
     if (a.wake === "no") {
         a.commands = false;
         a.persona = false;
     }
     const applied = [], warnings = [];
+    const awayAgents = deps.unsandboxedAgents?.() ?? [];
     if (io) {
-        io.say("Three questions, then one screen of defaults. Enter keeps the suggested answer.\n");
+        io.say("A few questions, then one screen of defaults. Enter keeps the suggested answer.\n");
         a.name = (await io.ask("Your name, as teammates will see it", d.name)).trim() || d.name;
         const known = TITLE_OPTIONS.findIndex((t) => t.toLowerCase() === d.title.toLowerCase());
-        const t = await io.choose("Your role, in a word — it goes on the team directory", TITLE_OPTIONS, known >= 0 ? known : d.title ? TITLE_OPTIONS.length - 1 : 0);
+        const t = await io.choose("Your role, in a word — it goes on the team directory", TITLE_OPTIONS, known >= 0 ? known : d.title || !ctx.founder ? TITLE_OPTIONS.length - 1 : 0);
         a.title = t === TITLE_OPTIONS.length - 1 ? (await io.ask("Your role", d.title)).trim() || d.title || "Member" : TITLE_OPTIONS[t];
         const askCommands = async () => {
             const undecided = profile.agent.allow_bash === undefined && preset.commands === undefined;
-            const c = await io.choose("Teammates can hand work to this machine while you're away. It runs in a separate copy of the repo and delivers on a branch you review. May a run also execute commands?", ["Yes — run tests, commit, and push work for review (recommended)",
+            const c = await io.choose("Teammates can hand work to this machine while you're away. It runs in a separate copy of the repo and delivers on a branch you review. May a run also run your tests, commit and push, so the work arrives ready to review?", ["Yes — run tests, commit, and push work for review (recommended)",
                 "No — edit files and answer only; it cannot run tests, commit, or push"], undecided || a.commands ? 0 : 1);
             a.commands = c === 0;
         };
-        let commandsAsked = false;
-        if (a.wake !== "no" && ctx.project) {
-            await askCommands();
-            commandsAsked = true;
-        }
         const detected = ctx.project && deps.setRepoBase ? detectBaseBranch(ctx.project) : null;
         const suggestedBase = detected ? (preset.base ?? detected) : undefined;
         if (a.wake !== "no" && ctx.project)
@@ -196,9 +201,18 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         const shortAlert = (id) => ALERT_OPTIONS.find((o) => o.id === id).label.split(" — ")[0].replace(/ \(recommended\)/, "");
         io.say("\nThe rest has defaults. Change them now, or any time with `pantheon setup`:");
         io.say(`  • Wake: ${a.wake === "no" ? "off — this machine only works while you are at it"
-            : !ctx.project ? "on once this machine has a repo (run pantheon setup from your project's repo)"
-                : a.wake === "anyone" ? "teammates may hand work to this machine while you're away; invites you send grant it, and you can revoke anyone (pantheon admit <name> --revoke)"
-                    : "only people you approve by hand (pantheon admit <name> --may-wake)"}`);
+            : serves && !serves.repos ? (a.wake === "anyone"
+                ? "teammates can ask your worker about this folder while you're away — it reads it, never changes it"
+                : "teammates you approve can ask your worker about this folder while you're away — it reads it, never changes it; you are asked the first time each one needs it")
+                : !serves ? "nothing is bound to this team on this machine yet, so there is nothing to serve — bind a repo or a docs folder: pantheon use <team> --here"
+                    : a.wake === "anyone" ? "your teammates can hand work to this machine while you're away, so nothing waits on you (to approve each one first: pantheon setup --wake approved)"
+                        : "only people you approve — you are asked the first time a teammate's request needs this machine (Always / Just this once / No)"}`);
+        if (a.wake !== "no" && serves?.repos) {
+            io.say(`  • Commands: ${a.commands ? "work runs your tests, commits, and pushes to its own branch, so it arrives ready for your review" : "edits and answers only — turn commands on to have work arrive tested and ready to review"}`);
+            if (awayAgents.length && unsandboxedAllowed(loadPolicy(deps.policyHome))) {
+                io.say(`  • Agent: ${andList(awayAgents)} ${awayAgents.length === 1 ? "answers" : "answer"} teammates' requests while you're away, so nobody waits on you`);
+            }
+        }
         io.say(`  • Alerts: ${shortAlert(a.notifications).toLowerCase()}`);
         io.say(`  • Approval: ${a.approval === "approve"
             ? "your agent sends to teammates in your name without asking each time (Claude Code, Cursor, Codex, and Kiro's IDE and pantheon agent; Copilot asks once per tool per folder)"
@@ -220,9 +234,10 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
                 a.commands = false;
                 a.persona = false;
             }
-            else if (ctx.project && !commandsAsked) {
+            else if (serves?.repos) {
                 await askCommands();
-                a.persona = preset.persona ?? true;
+                if (ctx.project)
+                    a.persona = preset.persona ?? true;
             }
             const picks = await io.chooseMany("Which of these do you decide personally? Agents — yours and your teammates' — will stop and ask you before acting on them. Pick any number, or none.", DECISION_AREAS.map((x) => x.label), a.decides.map((id) => DECISION_AREAS.findIndex((x) => x.id === id)).filter((i) => i >= 0));
             a.decides = [...new Set(picks.map((i) => DECISION_AREAS[i].id))];
@@ -305,22 +320,50 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         else
             applied.push("worker stays off");
     }
-    else if (ctx.project) {
+    else if (serves) {
         try {
-            install("worker", ctx.project, a.commands ? ["--allow-bash"] : []);
-            applied.push(a.commands
-                ? "worker on — a woken run may run tests and commit and push to its own branch"
-                : "worker on — a woken run edits files and answers; it cannot commit or push (deliveries will need you)");
+            install("worker", serves.path, a.commands ? ["--allow-bash"] : []);
+            applied.push(!serves.repos
+                ? "worker on — a teammate's question is answered from your folder, which a run reads and never changes; anything it writes is a draft for you"
+                : a.commands
+                    ? "worker on — a woken run may run tests and commit and push to its own branch"
+                    : "worker on — a woken run edits files and answers; it cannot commit or push (deliveries will need you)");
         }
         catch (e) {
             warnings.push(`the worker service did not install: ${e.message}`);
         }
         applied.push(a.wake === "anyone"
-            ? "wake permission: invites you send grant it (revoke one person: pantheon admit <name> --revoke)"
-            : "wake permission: only people you grant by hand (pantheon admit <name> --may-wake)");
+            ? "wake permission: your teammates can hand you work while you're away, and invites you send include it (to approve each one first: pantheon setup --wake approved)"
+            : "wake permission: only people you approve on this machine — you are asked the first time each one needs it (approve ahead: pantheon wake allow <name>)");
     }
     else {
-        applied.push("worker: run this again from your project's repo to switch it on there");
+        applied.push(`worker: nothing is bound to "${ctx.cfg.space}" on this machine yet — from the folder you work in (a repo, or a folder of docs): pantheon use ${ctx.cfg.space} --here, then pantheon setup`);
+    }
+    const names = awayAgents.length ? andList(awayAgents) : "Codex, Cursor and Copilot";
+    const one = awayAgents.length === 1;
+    if (a.unsandboxed !== undefined && !(a.unsandboxed && a.wake === "no")) {
+        if (inWokenRun())
+            warnings.push("a woken run cannot change what runs on this machine — a person has to answer this here");
+        else {
+            try {
+                const pol = loadPolicy(deps.policyHome);
+                if (a.unsandboxed)
+                    grant(pol, "unsandboxed_runs", "always", "setup-answer");
+                else
+                    revoke(pol, "unsandboxed_runs");
+                savePolicy(pol, deps.policyHome);
+                applied.push(a.unsandboxed
+                    ? `${names} ${one ? "answers" : "answer"} teammates' requests while you're away, so nobody waits on you — to have them wait for you instead: pantheon setup --unsandboxed no`
+                    : `${names} ${one ? "leaves" : "leave"} teammates' requests for you to pick up when you're back — to have ${names} answer them while you're away: pantheon setup --unsandboxed yes`);
+            }
+            catch (e) {
+                warnings.push(`could not save whether ${names} may take requests while you're away: ${e.message}`);
+            }
+        }
+    }
+    else if (awayAgents.length && a.wake !== "no" && serves?.repos) {
+        if (unsandboxedAllowed(loadPolicy(deps.policyHome)))
+            applied.push(`${names} ${one ? "answers" : "answer"} teammates' requests while you're away, so nobody waits on you — to have them wait for you instead: pantheon setup --unsandboxed no`);
     }
     const waitIn = mac ? "pantheon status, approvals, and the menu bar" : "pantheon status and pantheon approvals";
     const chosenAlerts = ALERT_OPTIONS.find((o) => o.id === a.notifications).label.split(" — ")[0].replace(/ \(recommended\)/, "");
@@ -403,8 +446,25 @@ ${never.map((n) => `- ${n}`).join("\n")}
 When in doubt, ask the teammate who woke you rather than ${who}; if only ${who} can answer, ESCALATE and finish.
 `;
 }
+export function questionOrNull(rl, q) {
+    return new Promise((res) => {
+        let done = false;
+        const onClose = () => { if (!done) {
+            done = true;
+            res(null);
+        } };
+        rl.once?.("close", onClose);
+        try {
+            rl.question(q, (a) => { if (done)
+                return; done = true; rl.off?.("close", onClose); res(a.trim()); });
+        }
+        catch {
+            onClose();
+        }
+    });
+}
 export function terminalIO(rl, out) {
-    const ask = (q) => new Promise((res) => rl.question(q, (x) => res(x.trim())));
+    const ask = async (q) => (await questionOrNull(rl, q)) ?? "";
     return {
         say: out,
         async ask(question, def) {

package/dist/spend.js

@@ -31,9 +31,13 @@ export function since(ms, home) {
         byPeer[r.triggeredBy] = (byPeer[r.triggeredBy] ?? 0) + 1;
     return { runs: runs.length, failed: runs.filter((r) => !r.ok).length, byPeer };
 }
-export function recentRuns(ms, home, limit = 12) {
+export function recentRuns(ms, home, limit = 12, only) {
     const from = Date.now() - ms;
-    return read(home).runs.filter((r) => r.at > from).sort((a, b) => b.at - a.at).slice(0, limit);
+    const teams = (only?.teams ?? []).filter((t) => !!t);
+    return read(home).runs
+        .filter((r) => r.at > from)
+        .filter((r) => !only || (!!r.space && teams.includes(r.space) && (!r.member || r.member === only.member)))
+        .sort((a, b) => b.at - a.at).slice(0, limit);
 }
 export function allowed(caps, home) {
     const hour = since(3_600_000, home).runs;

package/dist/store.js

@@ -1,22 +1,86 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync, renameSync, openSync, writeSync, fsyncSync, closeSync, chmodSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { emptyRefusals } from "./admin-stats.js";
+export function ensurePrivateDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(dir, 0o700);
+    }
+    catch { }
+}
+export function writeFileAtomic(file, data, mode = 0o600) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp`;
+    const fd = openSync(tmp, "w", mode);
+    try {
+        writeSync(fd, typeof data === "string" ? Buffer.from(data) : data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    renameRetrying(tmp, file);
+    fsyncDir(dirname(file));
+}
+const sleepSync = (ms) => { try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+catch { } };
+export function renameRetrying(from, to, o = {}) {
+    const platform = o.platform ?? process.platform;
+    const rename = o.rename ?? renameSync;
+    for (let i = 0;; i++) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (e) {
+            if (platform !== "win32" || i >= 20 || !["EPERM", "EACCES", "EBUSY"].includes(e.code ?? ""))
+                throw e;
+            sleepSync(o.waitMs ?? 10);
+        }
+    }
+}
+export function fsyncDir(dir) {
+    let fd = null;
+    try {
+        fd = openSync(dir, "r");
+        fsyncSync(fd);
+    }
+    catch { }
+    finally {
+        if (fd !== null)
+            try {
+                closeSync(fd);
+            }
+            catch { }
+    }
+}
 export class StateStore {
     file;
     timer = null;
     dirty = false;
     refusals = emptyRefusals();
+    headOf;
+    rebuilt = null;
+    extra = {};
     constructor(dir, space) {
         this.file = join(dir, `${space}.state.json`);
     }
-    load() {
+    load(opts = {}) {
         const goals = new Map();
         const obligations = new Map();
         const profiles = new Map();
-        if (!existsSync(this.file))
-            return { goals, obligations, profiles };
+        if (!existsSync(this.file)) {
+            return { goals, obligations, profiles, unclean: opts.expectHistory ? "the state snapshot is missing but the ledger has history" : null };
+        }
         try {
             const snap = JSON.parse(readFileSync(this.file, "utf8"));
+            if (!snap || typeof snap !== "object" || Array.isArray(snap)
+                || (snap.goals !== undefined && !Array.isArray(snap.goals))
+                || (snap.obligations !== undefined && !Array.isArray(snap.obligations))) {
+                throw new Error("not a state snapshot");
+            }
             for (const g of snap.goals ?? [])
                 goals.set(g.id, g);
             for (const o of snap.obligations ?? []) {
@@ -24,12 +88,32 @@ export class StateStore {
             }
             for (const p of snap.profiles ?? [])
                 profiles.set(p.member, p);
+            const known = new Set(["v", "goals", "obligations", "profiles", "refusals", "ledger_head", "rebuilt", "saved_at"]);
+            this.extra = {};
+            for (const [k, v] of Object.entries(snap))
+                if (!known.has(k))
+                    this.extra[k] = v;
             if (snap.refusals)
                 this.refusals = { total: snap.refusals.total ?? 0, by_code: snap.refusals.by_code ?? {}, recent: snap.refusals.recent ?? [], stamps: snap.refusals.stamps ?? [] };
+            return {
+                goals, obligations, profiles, unclean: null,
+                ...(typeof snap.ledger_head === "number" && Number.isFinite(snap.ledger_head) ? { ledgerHead: snap.ledger_head } : {}),
+                ...(typeof snap.rebuilt === "string" && snap.rebuilt ? { rebuilt: snap.rebuilt } : {}),
+            };
         }
-        catch {
+        catch (e) {
+            const why = `the state snapshot could not be read (${e.message})`;
+            let quarantined;
+            if (opts.quarantine) {
+                const aside = `${this.file}.corrupt-${Date.now()}`;
+                try {
+                    renameSync(this.file, aside);
+                    quarantined = aside;
+                }
+                catch { }
+            }
+            return { goals: new Map(), obligations: new Map(), profiles: new Map(), unclean: why, ...(quarantined ? { quarantined } : {}) };
         }
-        return { goals, obligations, profiles };
     }
     save(goals, obligations, profiles) {
         this.dirty = true;
@@ -52,17 +136,17 @@ export class StateStore {
     onError;
     flush(goals, obligations, profiles) {
         const snap = {
+            ...this.extra,
             v: 2,
             goals: [...goals.values()],
             obligations: [...obligations.values()],
             profiles: [...profiles.values()],
             ...(this.refusals.total ? { refusals: this.refusals } : {}),
+            ...(this.headOf ? { ledger_head: this.headOf() } : {}),
+            ...(this.rebuilt ? { rebuilt: this.rebuilt } : {}),
             saved_at: Date.now(),
         };
-        mkdirSync(dirname(this.file), { recursive: true });
-        const tmp = `${this.file}.tmp`;
-        writeFileSync(tmp, JSON.stringify(snap, null, 2) + "\n", { mode: 0o600 });
-        renameSync(tmp, this.file);
+        writeFileAtomic(this.file, JSON.stringify(snap, null, 2) + "\n");
     }
     close(goals, obligations, profiles) {
         if (this.timer) {

package/dist/text-file.js

@@ -0,0 +1,74 @@
+export const stripBom = (text) => (text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+export const parseJsonText = (text) => JSON.parse(stripBom(text));
+export function stripJsonc(text) {
+    let out = "";
+    let i = 0;
+    const n = text.length;
+    while (i < n) {
+        const ch = text[i];
+        if (ch === '"') {
+            let j = i + 1;
+            while (j < n && text[j] !== '"')
+                j += text[j] === "\\" ? 2 : 1;
+            out += text.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (ch === "/" && text[i + 1] === "/") {
+            while (i < n && text[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (ch === "/" && text[i + 1] === "*") {
+            const end = text.indexOf("*/", i + 2);
+            i = end < 0 ? n : end + 2;
+            continue;
+        }
+        if (ch === ",") {
+            let j = i + 1;
+            for (;;) {
+                while (j < n && /\s/.test(text[j]))
+                    j++;
+                if (text[j] === "/" && text[j + 1] === "/") {
+                    while (j < n && text[j] !== "\n")
+                        j++;
+                    continue;
+                }
+                if (text[j] === "/" && text[j + 1] === "*") {
+                    const e = text.indexOf("*/", j + 2);
+                    j = e < 0 ? n : e + 2;
+                    continue;
+                }
+                break;
+            }
+            if (text[j] === "}" || text[j] === "]") {
+                i++;
+                continue;
+            }
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+export function isJsonc(text) {
+    const t = stripBom(text);
+    try {
+        JSON.parse(t);
+        return false;
+    }
+    catch { }
+    try {
+        JSON.parse(stripJsonc(t));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function eolOf(text) {
+    const i = text.indexOf("\n");
+    return i > 0 && text[i - 1] === "\r" ? "\r\n" : "\n";
+}
+export const withEol = (text, eol) => eol === "\n" ? text : text.replace(/\r?\n/g, "\r\n");
+//# sourceMappingURL=text-file.js.map

package/dist/tray.js

@@ -1,3 +1,4 @@
+import { loadPolicy } from "./worker-policy.js";
 import { execFileSync } from "node:child_process";
 import { helperStale, recordHelperBuild } from "./helpers-build.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -11,6 +12,7 @@ import { requireDeveloperTools } from "./notifier.js";
 import { plistPath, serviceInstalled, whichPantheon } from "./service.js";
 import { VERSION } from "./version.js";
 import { LIMITS } from "./protocol.js";
+import { signedRead } from "./reads.js";
 import { allDecisionsPrompt, decisionPrompt, decisionTitle, owedPrompt, stripCeremony, waitingPrompt, workerSummary } from "./decision-ui.js";
 import { loadProfile, SURFACE_BUNDLE_IDS } from "./profile.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -50,6 +52,16 @@ export function writeTrayCommands(home = CONFIG_DIR) {
     }
     return out;
 }
+export function localChoices(ref) {
+    if (!ref)
+        return null;
+    const pol = loadPolicy();
+    if (pol.wakeAsks?.[ref])
+        return [{ label: "Always", answer: "allow always" }, { label: "Just this once", answer: "allow once" }, { label: "No", answer: "deny" }];
+    if (Object.values(pol.asks).some((a) => a?.act === ref))
+        return [{ label: "Allow always", answer: "allow always" }, { label: "Allow once", answer: "allow once" }, { label: "Don't allow", answer: "deny" }];
+    return null;
+}
 function workerState(home = CONFIG_DIR) {
     try {
         const raw = JSON.parse(readFileSync(join(home, "worker-state.json"), "utf8"));
@@ -75,6 +87,15 @@ async function getJson(url) {
         clearTimeout(t);
     }
 }
+async function signedObligations(cfg) {
+    try {
+        const res = await signedRead(cfg, "/obligations", {}, { timeoutMs: LIMITS.pendingTimeoutMs });
+        return res.ok ? await res.json() : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function trayStatus(cfg = load(), f = loadAll()) {
     const ms = Object.values(f?.spaces ?? {});
     if (f && ms.length > 1) {
@@ -105,10 +126,9 @@ async function trayStatusOne(cfg) {
     if (!cfg)
         return { configured: false, version: VERSION };
     const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
-    const q = `space=${encodeURIComponent(cfg.space)}&token=${encodeURIComponent(cfg.token)}`;
     const [health, obligations] = await Promise.all([
         getJson(`${base}/health?space=${encodeURIComponent(cfg.space)}`),
-        getJson(`${base}/obligations?${q}`),
+        signedObligations(cfg),
     ]);
     const space = health
         ?.spaces?.find((s) => s.name === cfg.space);
@@ -131,7 +151,8 @@ async function trayStatusOne(cfg) {
     const items = [
         ...mineHuman.map((o) => {
             const from = senderOf(o);
-            return { ...row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body))), decider: cfg.member };
+            const choices = localChoices(o.ref);
+            return { ...row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body))), decider: cfg.member, ...(choices ? { choices } : {}) };
         }),
         ...owed.map((o) => row(o, "owed", "you", owedPrompt(decisionTitle(o.body), o.goal))),
         ...waiting.map((o) => {

package/dist/untrusted.js

@@ -1,16 +1,35 @@
+const SECRET_NOUN = String.raw `(?:passwords?|passphrases?|pass ?codes?|pins?|secrets?|secret\s*keys?|(?:signing|webhook|client|app|master|root|encryption) (?:secrets?|keys?)|key_secret|secret_key|client_secret|access tokens?|personal access tokens?|session (?:cookies?|ids?|tokens?)|cookies?|dsns?|a-?p-?i[_ -]?keys?|private[_ -]?keys?|ssh[_ -]?keys?|deploy keys?|keys? for [\w.-]+|credentials?|creds|tokens?|otps?|one[- ]time (?:codes?|passwords?)|seed phrases?|recovery codes?|2fa codes?|clave(?: api)?|contraseñas?|passwort|mot de passe|senha)`;
+const VALUE = String.raw `(?:\b(?:your|the|our|my|its|this|that|their|his|her|apna|apni)\s+(?:[\w'-]+\s+){0,3}${SECRET_NOUN}\b|\b[A-Z][A-Z0-9_]*_(?:KEY|SECRET|TOKEN|PASSWORD|PASS|CREDENTIALS?|URL|DSN|URI)\b|\b(?:TOKEN|SECRET|PASSWORD|API_KEY)\b|\$[A-Z_]{3,}|process\.env\.\w+|~\/\.(?:aws|ssh|config|netrc|npmrc|pantheon|docker|kube)\b|\.env\b|id_[er]sa|\.pem\b|\bcredentials file\b)`;
+const HAND_OVER = String.raw `(?:bhej(?:o| do| dena)?|de do|dedo|batao|bata do|dikhao|paste karo|share karo|what(?:'s| is| are)|tell(?: me)?|let (?:me|us) know|give(?: me)?|send(?: me| over| it)?|share|paste|reveal|print|show|dump|echo|cat|read(?: out)?|include|put|drop|post|copy|grab|fetch|get|commit|push|upload|e-?mail|dm|reply with|respond with|need|type|enter|use|using|provide|leak|export)`;
+const SECRET_ACTION = new RegExp(String.raw `\b${HAND_OVER}\b[^\n.?!]{0,60}${VALUE}|${VALUE}[^\n.?!]{0,40}\b(?:in|into|to|should go in|goes in|belongs in)\b[^\n.?!]{0,12}\b(?:reply|answer|message|response|output|commit|branch|repo|file|pr|pull request|issue|thread|description|chat|comment|gist|paste)\b|\b(?:its|the) value\b|\bvalue of (?:the |your )?${SECRET_NOUN}|${VALUE}[^\n?!]{0,40}\b(?:send(?: it)? over|send it|share it|paste it|give it|need it|let me know|bhej(?:o| do)?|de do|batao|dikhao|karo|kar do)\b|${SECRET_NOUN}[\s\S]{0,200}\b(?:print|paste|send|share|show|dump|echo|reveal|include|post|email|bhej(?:o| do)?)\s+(?:it|them|that|this|those)\b|\b(?:create|generate|make|set up|register|mint|issue)\b\s+(?:(?:a|an|the|your|new|brand-new|fresh|another)\s+)*(?:[\w-]+\s+){0,4}${SECRET_NOUN}\b(?!\s+(?:field|flow|screen|page|form|meter|policy|reset|rotation|storage|validation|check|rule|input|button|endpoint|api|feature|generator|manager|strength|expiry|hashing|column|table|model|schema|test|tests|ui|modal))`, "i");
+const SIGNIN_ACTION = /(^|[.!?:;]\s*|\n\s*|\b(?:please|you|can you|could you|would you|go and|go|then|and|now|first|also)\s+)(sign in|sign into|log ?in(?:to)?|authenticate|create an account|join .{0,20}hub)(?:\s+(?:to|into|at|here|there|as|against|on)\b|\s*[.!]|$)|\b(?:visit|open|go to)\b[^\n]{0,40}https?:\/\/|\b(?:with|using) (?:the|our|my|your|an?|this) [\w -]{0,20}(?:account|login|creds|credentials|password)\b|\b(?:gh|npm|docker|aws|gcloud|az|vercel|railway|heroku|firebase) (?:auth )?login\b|(?:^|[.!?:;]\s*|\n\s*)(?:log ?into|sign into|log in to|sign in to)\b(?![^\n.?!]{0,50}\b(?:fails?|failing|broken|error|doesn'?t|not work|is slow))/im;
+const ABOUT_PRODUCT = /\?|\b(?:why|how come|does|do|did|is|are|was|were|where|when|which)\b[^\n]{0,80}\b(?:fail\w*|break\w*|broken|work\w*|return\w*|call\w*|read\w*|stor\w*|handl\w*|show\w*|happen\w*|arriv\w*|expire\w*)|\b(?:fails?|failing|failed|broken|bug|error|errors|issue|crash\w*|doesn'?t work|not working|never arrives?|stopped working|is slow|can'?t|cannot|unable to|won'?t|isn'?t|aren'?t|expires? too|too early|too soon|times? out|timed out)\b/i;
+const WORK_ON_PRODUCT = /(^|[.!?:;]\s*|\n\s*|\b(?:please|can you|could you|let's|we need to|we should)\s+)(?:add|implement|build|create|design|refactor|migrate|move|document|support|fix|update|improve|remove|rename|review|explain|describe|test|write tests for|validate|hash|encrypt|rotate|mask|hide|redact|make)\b/im;
+const NOT_ENGLISH = /[^\x00-\x7F‐-‟… -ÿ]|\b(?:envíame|dame|mándame|schick|envoie|donne-moi|manda)\b/i;
+function secretStops(body) {
+    if (SECRET_ACTION.test(body) || SIGNIN_ACTION.test(body))
+        return true;
+    if (NOT_ENGLISH.test(body) && new RegExp(SECRET_NOUN, "i").test(body))
+        return true;
+    return !(ABOUT_PRODUCT.test(body) || WORK_ON_PRODUCT.test(body));
+}
 const PATTERNS = [
     { kind: "install", why: "asks you to install software", re: /\b(npm|pnpm|yarn)\s+(i|install|add)\s+(-g|--global)/i },
     { kind: "install", why: "asks you to install software", re: /\b(brew|apt-get|apt|pip3?|gem)\s+install\b/i },
     { kind: "pipe-to-shell", why: "pipes a download straight into a shell", re: /\bcurl\b[^\n|]*\|\s*(ba)?sh\b/i },
     { kind: "pipe-to-shell", why: "pipes a download straight into a shell", re: /\bwget\b[^\n|]*\|\s*(ba)?sh\b/i },
-    { kind: "credential", why: "asks for a password, token or key", re: /\b(password|passphrase|secret\s*key|api[_ -]?key|private[_ -]?key|credential)s?\b/i },
-    { kind: "credential", why: "names an env var that usually holds a secret", re: /\b[A-Z_]*(TOKEN|SECRET|PASSWORD|API_KEY)\b/ },
+    { kind: "credential", why: "asks for a password, token or key", re: new RegExp(String.raw `\b(?:password|passphrase|secret\s*key|signing secret|api[_ -]?key|a-p-i key|private[_ -]?key|ssh[_ -]?key|credential|creds|otp|seed phrase|recovery code|clave|contraseña|passwort|mot de passe|secret|token|cookie|dsn|(?:signing|webhook|client|app|master|root|encryption) key|key_secret|secret_key|client_secret)s?\b|process\.env\.\w+|\.env\b|~\/\.aws\b|\bthe (?:\w+ )?(?:secret|token|key for \w+)\b`, "i"), stopWhen: secretStops },
+    { kind: "credential", why: "names an env var that usually holds a secret", re: /\b[A-Z][A-Z0-9_]*(TOKEN|SECRET|PASSWORD|API_KEY|_KEY|_PASS|_CREDENTIALS?)\b|\b(TOKEN|SECRET|PASSWORD|API_KEY)\b/, stopWhen: secretStops },
     { kind: "exfiltration", why: "asks you to send file contents somewhere", re: /\b(cat|base64)\b[^\n]{0,40}\b(curl|POST|upload|send)\b/i },
     { kind: "exfiltration", why: "asks you to reveal the contents of a sensitive file",
-        re: /\b(paste|show|print|read|send|share|output|dump)\b[^\n]{0,60}(~\/\.\w+|\.env\b|config\.json|id_[er]sa|\.ssh\/|credentials?\b|\.pem\b)/i },
+        re: /\b(paste|show|print|read|send|share|output|dump)\b[^\n]{0,60}(~\/\.\w+|\.env\b|config\.json|id_[er]sa|\.ssh\/|\/credentials?\b|credentials? file|\.pem\b)/i },
+    { kind: "exfiltration", why: "asks you to read out a file that holds secrets",
+        re: /\b(cat|type|less|more|head|tail|open|read|print|dump|include|paste|show|copy|send|upload|grep|base64)\b[^\n]{0,40}(~\/\.(aws|ssh|config|netrc|npmrc|docker|kube|pantheon|gnupg)\b|\.env\b|id_[er]sa|\.pem\b|\/credentials\b|\.git-credentials|google-services\.json|GoogleService-Info\.plist|service-account[\w.-]*\.json|\.p12\b|\.keystore\b|\.jks\b)/i },
+    { kind: "exfiltration", why: "asks you to dump the environment", re: /\b(printenv|env\s*\||export -p|set\s*\|)|`env`|\bprocess\.env\b[^\n]{0,20}\b(print|log|dump|send|paste|json)/i },
+    { kind: "exfiltration", why: "asks you to send something to an outside address", re: /\b(e-?mail|send|upload|post|forward|share|mail)\b[^\n]{0,80}\b(to|at)\s+(?:[\w.+-]+@[\w-]+\.[\w.-]+|https?:\/\/)/i },
     { kind: "exfiltration", why: "names a file that usually holds secrets",
         re: /(~\/\.pantheon\/config\.json|~\/\.ssh\/|\.env\.(local|production)|id_rsa\b)/i },
-    { kind: "identity", why: "asks you to sign in or create an account", re: /\b(sign in|log ?in|authenticate|create an account|join .{0,20}hub)\b/i },
+    { kind: "identity", why: "asks you to sign in or create an account", re: /\b(sign in|sign into|log ?in(?:to)?|authenticate|create an account|join .{0,20}hub|auth login)\b/i, stopWhen: secretStops },
     { kind: "override", why: "tries to override the instructions you were given", re: /\b(ignore|disregard|forget)\b[^\n]{0,30}\b(previous|prior|earlier|above|your)\b[^\n]{0,20}\b(instruction|prompt|rule|direction)s?\b/i },
     { kind: "override", why: "claims a new operator or system directive", re: /\b(system|operator|admin)\s*(:|message|override|instruction)/i },
 ];
@@ -34,7 +53,7 @@ export function assess(body) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        out.push({ kind: p.kind, why: p.why, evidence: hit[0].slice(0, 80) });
+        out.push({ kind: p.kind, why: p.why, evidence: hit[0].slice(0, 80), stop: p.stopWhen ? p.stopWhen(body) : true });
     }
     return out;
 }

package/dist/update-check.js

@@ -20,6 +20,8 @@ export function updateStatus(deps) {
     if (cache && deps.now() - cache.checkedAt < deps.throttleMs) {
         return { behind: cache.behind, refreshed: false, latest: cache.latest };
     }
+    if (process.env["PANTHEON_NO_UPDATE_CHECK"])
+        return { behind: cache?.behind ?? 0, refreshed: false, latest: cache?.latest };
     if (deps.isGit()) {
         try {
             const behind = deps.fetchBehind();