@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/upgrade.js

@@ -70,7 +70,7 @@ export function defaultDeps() {
             catch { }
             return up;
         },
-        npmUpgrade: () => npm(["install", "-g", `${PKG_NAME}@latest`, "--no-audit", "--no-fund"], { stdio: ["ignore", "pipe", "pipe"] }),
+        npmUpgrade: (version) => npm(["install", "-g", `${PKG_NAME}@${version ?? "latest"}`, "--no-audit", "--no-fund"], { stdio: ["ignore", "pipe", "pipe"] }),
         npmLatest: () => {
             try {
                 return npm(["view", `${PKG_NAME}`, "version"], { stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim() || null;
@@ -81,18 +81,22 @@ export function defaultDeps() {
         },
     };
 }
-export function upgrade(deps = defaultDeps()) {
+export function upgrade(deps = defaultDeps(), opts = {}) {
+    const spec = opts.version && /^\d+\.\d+\.\d+$/.test(opts.version) ? opts.version : "latest";
     const { root } = deps;
     const from = deps.version(root);
     const steps = [];
     const stop = (name, detail) => ({ root, from, to: from, steps: [...steps, { name, ok: false, detail }], ok: false, alreadyCurrent: false, restart: [] });
     if (!deps.isGit(root)) {
         try {
-            deps.npmUpgrade();
-            steps.push({ name: "npm", ok: true, detail: `installed ${PKG_NAME}@latest` });
+            deps.npmUpgrade(spec === "latest" ? undefined : spec);
+            steps.push({ name: "npm", ok: true, detail: `installed ${PKG_NAME}@${spec}` });
         }
         catch (e) {
-            return stop("npm", `\`npm install -g ${PKG_NAME}@latest\` failed: ${e.message.split("\n")[0]}. ` +
+            if (spec !== "latest" && /ETARGET|No matching version|notarget/i.test(String(e.stderr ?? "") + e.message)) {
+                return { root, from, to: from, steps: [...steps, { name: "npm", ok: true, detail: `${PKG_NAME}@${spec} is not on npm yet` }], ok: true, alreadyCurrent: true, restart: [] };
+            }
+            return stop("npm", `\`npm install -g ${PKG_NAME}@${spec}\` failed: ${e.message.split("\n")[0]}. ` +
                 `You may need to re-run it with the right permissions (or your Node version manager's global scope).`);
         }
         let wired = [];

package/dist/verify-act.js

@@ -0,0 +1,102 @@
+import { actPayload, canonicalJson, canonicalKey, fingerprint, goalPayload, verifyBytes, verifyDelegate } from "./identity.js";
+export const RELAY_META_KEYS = new Set(["from_repo", "authority", "unverified_domains", "defers_to", "affects"]);
+export function relayComposed(rec) {
+    if (rec.from === "relay" || rec.from === "pantheon")
+        return true;
+    if (rec.act === "JOIN" || rec.act === "LEAVE")
+        return true;
+    const m = rec.meta ?? {};
+    if (rec.act === "NOTE" && ("goal_members" in m || "organization_profile" in m || "notice" in m))
+        return true;
+    if (rec.act === "NOTE" && typeof rec.body === "string" && rec.body.startsWith("repo registered with this space: "))
+        return true;
+    return false;
+}
+const same = (a, b) => canonicalJson(a ?? null) === canonicalJson(b ?? null);
+const teamList = (t) => [...new Set((typeof t === "string" ? [t] : t).filter((x) => !!x))];
+export function verifyAct(rec, teams, pinnedFp, memberKey, at = Date.now()) {
+    const sig = rec.sig;
+    if (!sig)
+        return relayComposed(rec) ? { trust: "relay", why: "recorded by the relay" } : { trust: "unsigned", why: `not signed — sent by a Pantheon before 0.31, or the signature was dropped on the way` };
+    if (sig.v !== 1 || typeof sig.s !== "string" || typeof sig.pub !== "string")
+        return { trust: "invalid", why: "a signature in a form this version does not know" };
+    if (!canonicalKey(sig.pub))
+        return { trust: "invalid", why: "signed with a key that is not a plain ed25519 key" };
+    if (typeof sig.ts !== "number" || sig.ts > Date.now() + 86_400_000)
+        return { trust: "invalid", why: "signed with a date more than a day ahead" };
+    const senderMeta = (sig.meta ?? {});
+    const meta = (rec.meta ?? {});
+    for (const [k, v] of Object.entries(senderMeta))
+        if (!same(meta[k], v))
+            return { trust: "invalid", why: `meta.${k} is not what the sender wrote` };
+    for (const k of Object.keys(meta))
+        if (!(k in senderMeta) && !RELAY_META_KEYS.has(k))
+            return { trust: "invalid", why: `meta.${k} was added on the way` };
+    if (typeof meta.from_repo === "string" && meta.from_repo !== (sig.repo ?? null))
+        return { trust: "invalid", why: "from_repo is not the repo the sender signed" };
+    const list = teamList(teams);
+    const team = list.find((t) => verifyBytes(sig.pub, actPayload({
+        id: rec.id, team: t, member: rec.from, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        act: rec.act, goal: rec.goal ?? null, ref: rec.ref ?? null, to: rec.to ?? null,
+        defers_to: typeof meta.defers_to === "string" ? meta.defers_to : null,
+        affects: Array.isArray(meta.affects) ? meta.affects : null,
+        repo: sig.repo ?? null,
+        summary: rec.summary ?? null, body: rec.body, meta: senderMeta,
+    }), sig.s));
+    if (!team)
+        return { trust: "invalid", why: "the signature does not match what arrived — altered on the way, or not written by its sender" };
+    return signer(sig, team, rec.from, pinnedFp, memberKey, Math.max(sig.ts, rec.ts || 0), "act");
+}
+function signer(sig, team, member, pinnedFp, memberKey, at, what) {
+    if (!pinnedFp)
+        return { trust: "unknown-key", why: `no key for ${member} is known on this machine yet` };
+    const pinnedKey = memberKey && canonicalKey(memberKey) && fingerprint(memberKey) === pinnedFp ? memberKey : undefined;
+    if (sig.role === "member") {
+        const same = pinnedKey ? sig.pub === pinnedKey : fingerprint(sig.pub) === pinnedFp;
+        if (!same)
+            return { trust: "key-changed", why: `signed by a key that is not the one this machine knows for ${member} (${fingerprint(sig.pub)}; known: ${pinnedFp})` };
+        return { trust: "verified", why: `signed by ${member}` };
+    }
+    const cert = sig.cert;
+    if (!cert)
+        return { trust: "invalid", why: `a run's ${what} with no certificate` };
+    if (cert.pub !== sig.pub)
+        return { trust: "invalid", why: "the run key is not the one its certificate names" };
+    if (!pinnedKey)
+        return { trust: "unknown-key", why: `${member}'s own key is needed to check their run's certificate, and this machine does not have it yet` };
+    const memberKey2 = pinnedKey;
+    if (!verifyDelegate(memberKey2, team, member, cert, at)) {
+        return { trust: "invalid", why: `the run certificate does not verify for ${member} in this team, or it had expired` };
+    }
+    if (sig.ts > cert.expires + 10 * 60_000)
+        return { trust: "invalid", why: "signed after its run certificate expired" };
+    return { trust: "verified-run", why: `signed by ${member}'s unattended run` };
+}
+export function verifyGoal(g, teams, pinnedFp, memberKey, at = Date.now()) {
+    const sig = g.sig;
+    if (!sig)
+        return { trust: "unsigned", why: "the goal was opened by a Pantheon before 0.31, or its signature was dropped" };
+    if (!canonicalKey(sig.pub))
+        return { trust: "invalid", why: "signed with a key that is not a plain ed25519 key" };
+    if (typeof sig.ts !== "number" || sig.ts > Date.now() + 86_400_000)
+        return { trust: "invalid", why: "signed with a date more than a day ahead" };
+    const team = teamList(teams).find((t) => verifyBytes(sig.pub, goalPayload({
+        id: g.id, team: t, member: g.opened_by, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        title: g.title, acceptance: g.acceptance, invite: sig.invite,
+        budget: sig.budget ?? null, deadline: sig.deadline ?? null, kind: sig.kind ?? null,
+    }), sig.s));
+    if (!team)
+        return { trust: "invalid", why: "the goal's title, acceptance or invitations are not what its opener wrote" };
+    at = Math.max(sig.ts, g.opened_at || 0);
+    return signer(sig, team, g.opened_by, pinnedFp, memberKey, at, "goal");
+}
+export const trusted = (t) => t === "verified" || t === "verified-run";
+export function trustLabel(r, from) {
+    switch (r.trust) {
+        case "verified": return `signed by ${from}`;
+        case "verified-run": return `signed by ${from}'s unattended run`;
+        case "relay": return from === "relay" || from === "pantheon" ? "written by the relay" : `written by the relay, not signed by ${from} — NOT VERIFIED as theirs`;
+        default: return `NOT VERIFIED — ${r.why}`;
+    }
+}
+//# sourceMappingURL=verify-act.js.map

package/dist/which.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve, win32 } from "node:path";
 import { platform } from "node:os";
@@ -40,35 +41,82 @@ export function whichWindows(name, env = process.env, exists = runnable) {
     }
     return null;
 }
-export function which(name, os = platform(), env = process.env) {
+export function which(name, os = platform(), env = process.env, opts = {}) {
     if (isWindows(os))
         return whichWindows(name, env);
-    return loginShellWhich(name) ?? posixOnPath(name, env);
+    const ok = opts.runnable ?? runnable;
+    const wsl = os === "linux" && (opts.wsl ?? onWsl(env));
+    const usable = (p) => ok(p) && !(wsl && isWslWindowsShim(p));
+    const login = (opts.login ?? loginShellLookup)(name);
+    if (login?.found && usable(login.found))
+        return login.found;
+    if (login?.found && login.path) {
+        const hit = posixOnPath(name, { PATH: login.path }, usable);
+        if (hit)
+            return hit;
+    }
+    return posixOnPath(name, env, usable);
 }
-function posixOnPath(name, env) {
+export const isWslWindowsShim = (p) => /^\/mnt\/[a-z]\//i.test(p) && !/\.exe$/i.test(p);
+function onWsl(env) {
+    if (env.WSL_DISTRO_NAME || env.WSL_INTEROP)
+        return true;
+    try {
+        return /microsoft/i.test(readFileSync("/proc/version", "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+function posixOnPath(name, env, ok = runnable) {
     if (!name)
         return null;
     if (name.includes("/"))
-        return runnable(name) ? name : null;
+        return ok(name) ? name : null;
     for (const dir of (env.PATH ?? "").split(":")) {
         if (!dir)
             continue;
         const full = posix.join(dir, name);
-        if (runnable(full))
+        if (ok(full))
             return full;
     }
     return null;
 }
-function loginShellWhich(name) {
+export function loginShellLookup(name, run = runLoginShell) {
+    if (!name)
+        return null;
+    const mark = `__pantheon_which_${randomBytes(6).toString("hex")}__`;
+    let out;
     try {
-        const out = execFileSync("sh", ["-lc", `command -v ${name}`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-        if (!out)
-            return null;
-        return out.startsWith("/") && !runnable(out) ? null : out;
+        out = run(`printf '\\n%s\\n' "$1"; command -v "$2"; printf '\\n%s\\n' "$1"; printf '%s' "$PATH"`, [mark, name]);
     }
     catch {
         return null;
     }
+    return parseLoginAnswer(out, mark);
+}
+export function parseLoginAnswer(out, mark) {
+    const open = `\n${mark}\n`;
+    const first = out.indexOf(open);
+    if (first < 0)
+        return null;
+    const rest = out.slice(first + open.length);
+    const second = rest.indexOf(open);
+    const said = (second < 0 ? rest : rest.slice(0, second)).split("\n").map((l) => l.trim()).filter(Boolean);
+    const path = second < 0 ? null : rest.slice(second + open.length);
+    const found = said.length === 1 && said[0].startsWith("/") ? said[0] : null;
+    return { found, path };
+}
+function runLoginShell(script, args) {
+    try {
+        return execFileSync("sh", ["-lc", script, "sh", ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15_000 });
+    }
+    catch (e) {
+        const out = e.stdout;
+        if (typeof out === "string" && out)
+            return out;
+        throw e;
+    }
 }
 export const onPathNamed = (name, os = platform(), env = process.env) => which(name, os, env) !== null;
 export function spawnShape(binary, os = platform()) {
@@ -112,8 +160,11 @@ catch {
     const dir = dirname(shim);
     const re = /"%(?:~dp0|dp0%)\\?([^"%\r\n]+)"[ \t]*%\*[ \t]*\)?[ \t]*\r?$/gm;
     let rel = null;
-    for (let m = re.exec(text); m; m = re.exec(text))
+    let before = "";
+    for (let m = re.exec(text); m; m = re.exec(text)) {
         rel = m[1];
+        before = text.slice(text.lastIndexOf("\n", m.index) + 1, m.index);
+    }
     if (!rel)
         return { why: "was read but not recognised as a package manager's shim" };
     const parts = rel.split(/[\\/]+/).filter(Boolean);
@@ -134,7 +185,13 @@ catch {
         return { why: `was read, but it runs ${target}, which is not something Pantheon can start without cmd.exe` };
     }
     const localNode = join(dir, "node.exe");
-    return { command: exists(localNode) ? localNode : process.execPath, args: [target] };
+    return { command: exists(localNode) ? localNode : process.execPath, args: [...shimNodeFlags(before), target] };
+}
+export function shimNodeFlags(linePrefix) {
+    const m = /(?:"%_prog%"|"%~?dp0%?\\?node\.exe"|(?:^|[\s&|(])node(?:\.exe)?)((?:[ \t]+-[^\s"%]+)*)[ \t]*$/i.exec(linePrefix);
+    if (!m || !m[1])
+        return [];
+    return m[1].trim().split(/[ \t]+/).filter((f) => /^--?[A-Za-z0-9][\w.-]*(?:=[^\s"%^&|<>!]*)?$/.test(f));
 }
 export function resolveCmdShim(shim, read, exists) {
     const r = inspectCmdShim(shim, read, exists);

package/dist/worker-fleet.js

@@ -1,9 +1,11 @@
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
+import { holdsRepo } from "./repo-find.js";
 import { CONFIG_DIR, configFor, loadAll, repoInfo } from "./config.js";
-import { Worker } from "./worker.js";
+import { Worker, workspaceOf } from "./worker.js";
 export class WorkerFleet {
     opts;
+    dupSaid = new Set();
     slots = new Map();
     stopped = false;
     constructor(opts) {
@@ -18,14 +20,23 @@ export class WorkerFleet {
         const wanted = new Map();
         if (f) {
             const several = Object.keys(f.spaces ?? {}).length > 1;
-            for (const b of Object.values(f.bindings ?? {})) {
-                const m = f.spaces?.[b.space];
-                if (!m || !existsSync(join(b.path, ".git")))
+            const idCount = new Map();
+            for (const m of Object.values(f.spaces ?? {}))
+                idCount.set(m.id, (idCount.get(m.id) ?? 0) + 1);
+            for (const m of Object.values(f.spaces ?? {})) {
+                if ((idCount.get(m.id) ?? 0) > 1) {
+                    if (!this.dupSaid.has(m.id)) {
+                        this.dupSaid.add(m.id);
+                        this.opts.log(`fleet: two entries in config.json claim team ${m.id} — serving neither until one is removed (pantheon spaces)`);
+                    }
                     continue;
-                if (wanted.has(m.id))
+                }
+                const ws = teamWorkspaces(f, m.id);
+                const home = ws.find((w) => w.kind === "repo") ?? ws[0];
+                if (!home)
                     continue;
-                const repo = repoInfo(b.path);
-                wanted.set(m.id, { path: b.path, cfg: configFor(f, m, repo) });
+                const repo = home.kind === "repo" ? repoInfo(home.path) : null;
+                wanted.set(m.id, { path: home.path, cfg: configFor(f, m, repo) });
                 void several;
             }
             for (const [id, w] of wanted) {
@@ -36,6 +47,7 @@ export class WorkerFleet {
                 const wopts = {
                     ...rest,
                     project: w.path,
+                    workspaces: () => teamWorkspaces((this.opts.readConfig ?? loadAll)(), id),
                     scratch: join(home, "worktrees", encodeURIComponent(id)),
                     home,
                     requirePersonaSpaces: several,
@@ -66,7 +78,7 @@ export class WorkerFleet {
             for (const s of stopped)
                 this.opts.log(`fleet: worker for "${s}" stopped — binding gone`);
             if (!this.slots.size && !started.length)
-                this.opts.log(`fleet: no bound repos on this machine — bind one with \`pantheon use <team> --here\` from its checkout`);
+                this.opts.log(`fleet: nothing bound on this machine — bind a repo or a docs folder with \`pantheon use <team> --here\` from inside it`);
             await new Promise((r) => setTimeout(r, poll));
             if (this.opts.once && this.slots.size === 0)
                 break;
@@ -81,4 +93,13 @@ export class WorkerFleet {
             s.worker.stop();
     }
 }
+export function teamWorkspaces(f, spaceId) {
+    const bound = Object.entries(f?.bindings ?? {}).filter(([, b]) => b.space === spaceId && existsSync(b.path));
+    const repos = bound.filter(([k, b]) => !k.startsWith("d_") && existsSync(join(b.path, ".git"))).map(([, b]) => workspaceOf(b.path));
+    const all = Object.values(f?.bindings ?? {}).map((b) => resolve(b.path));
+    const folders = bound.filter(([k]) => k.startsWith("d_")).map(([, b]) => workspaceOf(b.path))
+        .filter((w) => w.kind === "folder" && !all.some((p) => p !== resolve(w.path) && p.startsWith(`${resolve(w.path)}${sep}`)) && !holdsRepo(w.path));
+    const seen = new Set();
+    return [...repos, ...folders].filter((w) => (seen.has(w.path) ? false : (seen.add(w.path), true)));
+}
 //# sourceMappingURL=worker-fleet.js.map

package/dist/worker-policy.js

@@ -1,6 +1,37 @@
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CONFIG_PATH } from "./config.js";
+import { trustWrite } from "./home-guard.js";
+import { parseJsonText } from "./text-file.js";
+export const WAKE_NO_MS = 30 * 24 * 60 * 60 * 1_000;
+export const wakeKey = (team, member) => `${team}|${member}`;
+export function mayAskWake(p, teams, member, now = Date.now()) {
+    const ts = teams.filter((t) => !!t);
+    if (isApprovedWaker(p, ts, member))
+        return false;
+    if (ts.some((t) => (p.wakeNo?.[wakeKey(t, member)] ?? 0) > now - WAKE_NO_MS))
+        return false;
+    return !Object.values(p.wakeAsks ?? {}).some((a) => ts.includes(a.team) && a.member === member && now - a.at < ASK_EXPIRY_MS);
+}
+export function takeWakeOnce(p, teams, member) {
+    for (const t of teams) {
+        if (!t)
+            continue;
+        const k = wakeKey(t, member);
+        const n = p.wakeOnce?.[k] ?? 0;
+        if (n > 0) {
+            if (n > 1)
+                p.wakeOnce[k] = n - 1;
+            else
+                delete p.wakeOnce[k];
+            return true;
+        }
+    }
+    return false;
+}
+export function hasWakeOnce(p, teams, member) {
+    return teams.some((t) => !!t && (p.wakeOnce?.[wakeKey(t, member)] ?? 0) > 0);
+}
 export const ASK_COOLDOWN_MS = 24 * 60 * 60 * 1_000;
 export const ASK_EXPIRY_MS = 14 * 24 * 60 * 60 * 1_000;
 export function policyHome(home) {
@@ -9,19 +40,150 @@ export function policyHome(home) {
 export function policyPath(home) {
     return join(policyHome(home), "worker-policy.json");
 }
+const isRecord = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+function readWakers(x) {
+    if (!isRecord(x))
+        return undefined;
+    const out = {};
+    for (const [team, v] of Object.entries(x)) {
+        if (!Array.isArray(v))
+            continue;
+        const ids = v.filter((m) => typeof m === "string" && m.length > 0);
+        if (ids.length)
+            out[team] = ids;
+    }
+    return out;
+}
 export function loadPolicy(home) {
     try {
-        const raw = JSON.parse(readFileSync(policyPath(home), "utf8"));
-        return { grants: raw.grants ?? {}, asks: raw.asks ?? {}, denied: raw.denied ?? {}, attempts: raw.attempts ?? {} };
+        const raw = parseJsonText(readFileSync(policyPath(home), "utf8"));
+        const obj = (v) => (isRecord(v) ? v : {});
+        const wakers = readWakers(raw.wakers);
+        return {
+            grants: obj(raw.grants), asks: obj(raw.asks), denied: obj(raw.denied), attempts: obj(raw.attempts),
+            ...(wakers ? { wakers } : {}),
+            ...(isRecord(raw.wakersCarried) ? { wakersCarried: raw.wakersCarried } : {}),
+            ...(isRecord(raw.wakersDeferred) ? { wakersDeferred: raw.wakersDeferred } : {}),
+            ...(isRecord(raw.wakeAsks) ? { wakeAsks: Object.fromEntries(Object.entries(raw.wakeAsks).filter(([, v]) => isRecord(v) && typeof v.team === "string" && typeof v.member === "string" && typeof v.at === "number")) } : {}),
+            ...(isRecord(raw.wakeOnce) ? { wakeOnce: Object.fromEntries(Object.entries(raw.wakeOnce).filter(([, v]) => typeof v === "number" && v > 0 && v < 100)) } : {}),
+            ...(isRecord(raw.wakeNo) ? { wakeNo: Object.fromEntries(Object.entries(raw.wakeNo).filter(([, v]) => typeof v === "number")) } : {}),
+            ...(isRecord(raw.wakeTeamFlag) ? { wakeTeamFlag: Object.fromEntries(Object.entries(raw.wakeTeamFlag).filter(([, v]) => typeof v === "number")) } : {}),
+        };
     }
     catch {
         return { grants: {}, asks: {}, denied: {}, attempts: {} };
     }
 }
+export function setWaker(p, team, member, approved) {
+    const w = (p.wakers ??= {});
+    const cur = new Set(w[team] ?? []);
+    if (approved)
+        cur.add(member);
+    else
+        cur.delete(member);
+    if (cur.size)
+        w[team] = [...cur].sort();
+    else
+        delete w[team];
+}
+export const CARRY_REASON = {
+    "you-admitted": "you approved them",
+    anyone: "you had chosen that anyone may wake this machine",
+    "old-default": "wake was never chosen here, and before 0.30 that meant anyone the team lets",
+    founder: "the team's founder, and wake was never restricted here",
+};
+export function carryOverWakers(p, team, me, members, choice, now = Date.now()) {
+    if (!team || p.wakersCarried?.[team])
+        return null;
+    const all = members.filter((m) => m.admitted);
+    const others = all.filter((m) => m.member !== me);
+    const anyone = choice === "anyone" || choice === "unset-before-0.30";
+    if (!relayKnowsAdmitters(members, me) && !anyone)
+        return "deferred";
+    const founder = (all.find((m) => m.founder) ?? all.find((m) => m.admitted_by === m.member))?.member;
+    const carried = [];
+    for (const m of others) {
+        if (!m.may_wake)
+            continue;
+        const why = m.admitted_by === me ? "you-admitted"
+            : choice === "anyone" ? "anyone"
+                : choice === "unset-before-0.30" ? "old-default"
+                    : choice === undefined && m.member === founder ? "founder"
+                        : null;
+        if (why)
+            carried.push({ member: m.member, why });
+    }
+    carried.sort((a, b) => a.member.localeCompare(b.member));
+    for (const c of carried)
+        setWaker(p, team, c.member, true);
+    (p.wakersCarried ??= {})[team] = now;
+    if (p.wakersDeferred) {
+        delete p.wakersDeferred[team];
+        if (!Object.keys(p.wakersDeferred).length)
+            delete p.wakersDeferred;
+    }
+    return carried;
+}
+export const V030_AT = Date.parse("2026-09-25T06:00:00Z");
+export const OLD_RELAY_WAKE = "this relay is older than 0.30, so who may wake this machine is still decided by the team (may_wake) — until it upgrades; then the approvals you had are carried over, and anyone else needs: pantheon wake allow <name>";
+export function relayKnowsAdmitters(members, me) {
+    const all = members.filter((m) => m.admitted);
+    return !all.some((m) => m.member !== me) || all.some((m) => m.admitted_by !== undefined);
+}
+export function setLocalWaker(teams, member, approved, home, env = process.env) {
+    if (inWokenRun(env))
+        return { ok: false, why: "a woken run cannot change who may wake this machine — a person has to run this here" };
+    const keys = [...new Set(teams.filter((t) => !!t))];
+    if (!keys.length || !member)
+        return { ok: false, why: "no team to record it under" };
+    const p = loadPolicy(home);
+    const was = isApprovedWaker(p, keys, member);
+    if (approved) {
+        if (!was)
+            setWaker(p, keys[0], member, true);
+    }
+    else
+        for (const k of keys)
+            setWaker(p, k, member, false);
+    if (was === approved)
+        return { ok: true, changed: false };
+    savePolicy(p, home);
+    return { ok: true, changed: true };
+}
+export function markTeamFlagOnYes(team, member, home, env = process.env) {
+    if (inWokenRun(env))
+        return;
+    const p = loadPolicy(home);
+    const k = wakeKey(team, member);
+    (p.wakeTeamFlag ??= {})[k] = Date.now();
+    savePolicy(p, home);
+}
+export function takeTeamFlagOnYes(p, teams, member) {
+    for (const t of teams) {
+        if (!t)
+            continue;
+        const k = wakeKey(t, member);
+        const at = p.wakeTeamFlag?.[k];
+        if (at !== undefined) {
+            delete p.wakeTeamFlag[k];
+            return Date.now() - at < 7 * 24 * 3600_000;
+        }
+    }
+    return false;
+}
+export function isApprovedWaker(p, teams, member) {
+    return teams.some((t) => { const list = t ? p.wakers?.[t] : undefined; return Array.isArray(list) && list.includes(member); });
+}
 export function savePolicy(p, home) {
     const file = policyPath(home);
     mkdirSync(dirname(file), { recursive: true });
+    let prev = null;
+    try {
+        prev = readFileSync(file);
+    }
+    catch { }
     writeFileSync(file, JSON.stringify(p, null, 2) + "\n", { mode: 0o600 });
+    trustWrite(file, prev);
 }
 export function useGrant(p, cap) {
     const g = p.grants[cap];
@@ -38,6 +200,11 @@ export function grant(p, cap, mode, by) {
 }
 export function revoke(p, cap) {
     delete p.grants[cap];
+    if (cap === "unsandboxed_runs")
+        p.denied[cap] = Date.now();
+}
+export function unsandboxedAllowed(p) {
+    return !!p.grants.unsandboxed_runs || p.denied.unsandboxed_runs === undefined;
 }
 export function mayAsk(p, cap, now = Date.now()) {
     if (p.grants[cap])
@@ -52,15 +219,66 @@ export function recordAsk(p, cap, escalateActId) {
     p.asks[cap] = { act: escalateActId, at: Date.now() };
 }
 export function parseGrantAnswer(body) {
-    const t = body.trim().toLowerCase();
-    if (/^(allow[\s-]?always|always[\s-]?allow|yes[\s-]?always)\b/.test(t))
+    const t = body.trim().toLowerCase().replace(/[.!]+$/, "").replace(/\s+/g, " ").replace(/’/g, "'");
+    if (/^(always|yes always|yes, always|always allow)$/.test(t) || /^(allow[\s-]always)\b/.test(t))
         return "allow-always";
-    if (/^(allow([\s-]?once)?|yes([\s-]?once)?|approve[d]?)\b/.test(t))
+    if (/^(once|just this once|this once|yes once|yes, once|yes|allow|approve|approved)$/.test(t) || /^(allow[\s-](it[\s-])?once)\b/.test(t))
         return "allow-once";
-    if (/^(deny|no|reject(ed)?|don'?t|do not)\b/.test(t))
+    if (/^(deny|denied|no|reject|rejected|don't allow|do not allow|don't|do not|never)\b/.test(t))
         return "deny";
     return null;
 }
+export const WOKEN_RUN_ENV = "PANTHEON_WOKEN_RUN";
+export const inWokenRun = (env = process.env) => !!env[WOKEN_RUN_ENV];
+export const CAPABILITY_ARGS = { self_upgrade: "self-upgrade", run_commands: "run-commands", unsandboxed_runs: "unsandboxed-runs" };
+export function applyLocalAnswer(refActId, body, home, env = process.env) {
+    if (!refActId)
+        return null;
+    const p = loadPolicy(home);
+    const wa = p.wakeAsks?.[refActId];
+    if (wa) {
+        if (inWokenRun(env))
+            return { applied: false, why: "a woken run cannot let anyone wake this machine — a person has to answer it here" };
+        const verdict = parseGrantAnswer(body);
+        if (!verdict)
+            return null;
+        const k = wakeKey(wa.team, wa.member);
+        if (verdict === "allow-always")
+            setWaker(p, wa.team, wa.member, true);
+        else if (verdict === "allow-once")
+            (p.wakeOnce ??= {})[k] = Math.min(99, (p.wakeOnce[k] ?? 0) + 1);
+        else
+            (p.wakeNo ??= {})[k] = Date.now();
+        if (verdict !== "deny" && wa.teamBlocked)
+            (p.wakeTeamFlag ??= {})[k] = Date.now();
+        delete p.wakeAsks[refActId];
+        savePolicy(p, home);
+        return { applied: true, wake: { team: wa.team, member: wa.member }, verdict };
+    }
+    if (!Object.values(p.asks).some((a) => a?.act === refActId))
+        return null;
+    if (inWokenRun(env))
+        return { applied: false, why: "a woken run cannot grant this machine anything — a person has to answer it here" };
+    const r = applyAnswer(p, refActId, body);
+    if (!r)
+        return null;
+    savePolicy(p, home);
+    return { applied: true, ...r };
+}
+export function describeLocalAnswer(g) {
+    if (!g.applied)
+        return `not granted: ${g.why}`;
+    if ("wake" in g) {
+        const who = g.wake.member;
+        return g.verdict === "allow-always" ? `${who} may start work on this machine from now on — undo: pantheon wake deny ${who}`
+            : g.verdict === "allow-once" ? `${who} may start work on this machine this once — their request runs now`
+                : `${who} will not start work on this machine; their requests wait for you (not asked again for a month; pantheon wake allow ${who} to change it)`;
+    }
+    const name = CAPABILITY_ARGS[g.cap];
+    if (g.verdict === "deny")
+        return `denied ${name} on this machine — the worker will not ask again for a day`;
+    return `granted ${name} on this machine${g.verdict === "allow-once" ? " for its next use" : ""} — revoke: pantheon policy revoke ${name}`;
+}
 export function applyAnswer(p, refActId, body) {
     const entry = Object.entries(p.asks).find(([, a]) => a.act === refActId);
     if (!entry)
@@ -73,9 +291,15 @@ export function applyAnswer(p, refActId, body) {
     if (verdict === "deny")
         p.denied[cap] = Date.now();
     else
-        grant(p, cap, verdict === "allow-always" ? "always" : "once", "answered-request");
+        grant(p, cap, verdict === "allow-always" ? "always" : "once", "answered-here");
     return { cap, verdict };
 }
+export function dropLedgerGrants(p) {
+    const gone = Object.keys(p.grants).filter((c) => p.grants[c]?.by === "answered-request");
+    for (const c of gone)
+        delete p.grants[c];
+    return gone;
+}
 export const UPGRADE_RETRY_MS = 60 * 60 * 1_000;
 export function needsSelfUpgrade(localPkg, relayPkg, lastAttempt, now = Date.now()) {
     if (!relayPkg || relayPkg === localPkg)