@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/client.js

@@ -1,5 +1,13 @@
 import WebSocket from "ws";
-import { signChallenge } from "./identity.js";
+import { adoptSpaceId, rememberTeamRepos, updateMembershipToken } from "./config.js";
+import { markContinued } from "./continued.js";
+import { markAnswered, nonceOf } from "./nonces.js";
+import { signedRead } from "./reads.js";
+import { repoName } from "./repo-route.js";
+import { signChallenge, signBytes, actPayload, goalPayload, newActId, newActNonce, canonicalJson } from "./identity.js";
+import { expectsSigs, joinedSigning, loadPins, markMemberSigns, markSigs, memberSigns, observeMembers, pinFor, pinScope, teamPinId, updatePins } from "./pins.js";
+export { joinedSigning } from "./pins.js";
+import { trusted, verifyAct, verifyGoal } from "./verify-act.js";
 import { newId } from "./protocol.js";
 import { VERSION } from "./version.js";
 import { describeNetError, explainNetError, noteRelayAnswered, settleSystemFallback, systemFallbackPending, trySystemFallback, wsOptions } from "./network.js";
@@ -23,6 +31,11 @@ export class PantheonClient {
         return !this.connected && !this.closed && this.everConnected;
     }
     cid = 0;
+    static REFUSED_RETRY_MS = 5 * 60_000;
+    static REFUSED_GRACE_MS = 2 * 60_000;
+    get refused() { return this.connected ? null : this.refusedCode; }
+    refusedCode = null;
+    refusedSince = 0;
     seq = 0;
     readSeq = 0;
     head = 0;
@@ -46,13 +59,33 @@ export class PantheonClient {
     enroll = null;
     inviteUrl = null;
     invitesList = null;
+    persistToken;
     constructor(cfg, onEvent, opts) {
         this.cfg = cfg;
         this.onEvent = onEvent;
+        this.pinTeam = teamPinId(cfg);
+        if (opts?.fromSeq && opts.fromSeq > 0)
+            this.seq = opts.fromSeq;
+        this.persistToken = opts?.persistToken ?? ((space, oldToken, newToken) => { updateMembershipToken(space, oldToken, newToken); });
         this.enroll = opts?.enroll ?? null;
         this.session = opts?.session ?? newId("s");
         this.role = opts?.role ?? "interactive";
     }
+    keepRepos() {
+        try {
+            rememberTeamRepos({ spaceId: this.cfg.spaceId ?? this.spaceId, space: this.cfg.space, relay: this.cfg.relay }, this.repos);
+        }
+        catch { }
+    }
+    adoptToken(token) {
+        const old = this.cfg.token;
+        if (!token || token === old)
+            return;
+        try {
+            this.persistToken(this.cfg.space, old, token);
+        }
+        catch { }
+    }
     async loopbackFallback() {
         let u;
         try {
@@ -181,14 +214,15 @@ export class PantheonClient {
                             ...(this.enroll && !this.enrolledToken ? { enroll: this.enroll } : { token: this.cfg.token }),
                             pubkey: this.cfg.publicKey,
                             nonce: msg.nonce,
-                            sig: signChallenge(this.cfg.privateKey, this.cfg.space, this.cfg.member, msg.nonce),
+                            sig: signChallenge(this.cfg.delegate?.privateKey ?? this.cfg.privateKey, this.cfg.space, this.cfg.member, msg.nonce),
+                            ...(this.cfg.delegate ? { delegate: this.cfg.delegate.cert } : {}),
                             session: this.session,
                             role: this.role,
                             display: this.cfg.display ?? this.cfg.member,
                             agent: this.cfg.agent ?? "unknown",
                             pkg: VERSION,
                             ...(this.seq > 0 ? { from_seq: this.seq } : {}),
-                            ...(this.cfg.repo ? { repo: this.cfg.repo, ...(this.cfg.repoOrigin ? { repo_origin: this.cfg.repoOrigin } : {}) } : {}),
+                            ...(this.cfg.repo ? { repo: this.cfg.repo, ...(this.cfg.repoOrigin ? { repo_origin: repoName(this.cfg.repoOrigin) } : {}) } : {}),
                         }));
                         break;
                     case "pending":
@@ -202,6 +236,7 @@ export class PantheonClient {
                         break;
                     case "members":
                         this.members = msg.members;
+                        this.observePins();
                         break;
                     case "profiles":
                         this.profiles = new Map((msg.profiles ?? []).map((p) => [p.member, p]));
@@ -215,8 +250,19 @@ export class PantheonClient {
                         this.inviteUrl = { url: msg.url, expires_at: msg.expires_at };
                         break;
                     case "welcome":
+                        if (this.cfg.spaceId && msg.space_id && msg.space_id !== this.cfg.spaceId) {
+                            this.lastError = `SPACE_MISMATCH: the relay answered for team ${msg.space_id}, not the ${this.cfg.spaceId} this machine joined — not connecting (pantheon spaces; rejoin with a fresh invite if the team was recreated)`;
+                            this.closed = true;
+                            ws.close();
+                            if (!settled) {
+                                settled = true;
+                                reject(new Error(this.lastError));
+                            }
+                            break;
+                        }
                         this.connected = true;
                         this.pending = null;
+                        this.refusedCode = null;
                         this.session = msg.session;
                         this.everConnected = true;
                         this.head = msg.seq;
@@ -228,20 +274,45 @@ export class PantheonClient {
                             this.readSeq = msg.seq;
                         this.everReadMarked = true;
                         if (msg.token) {
-                            this.enrolledToken = msg.token;
+                            if (this.enroll)
+                                this.enrolledToken = msg.token;
+                            else
+                                this.adoptToken(msg.token);
                             this.cfg.token = msg.token;
                         }
                         if (msg.space_id) {
+                            if (!this.cfg.spaceId) {
+                                let adopted = false;
+                                try {
+                                    adopted = adoptSpaceId(this.cfg.relay, this.cfg.space, msg.space_id);
+                                }
+                                catch { }
+                                if (adopted === "conflict") {
+                                    this.lastError = `SPACE_MISMATCH: the relay says "${this.cfg.space}" is team ${msg.space_id}, which is another team this machine is in — not connecting`;
+                                    this.closed = true;
+                                    ws.close();
+                                    if (!settled) {
+                                        settled = true;
+                                        reject(new Error(this.lastError));
+                                    }
+                                    break;
+                                }
+                            }
+                            if (!this.cfg.spaceId)
+                                this.cfg.pinTeam ??= this.pinTeam;
                             this.spaceId = msg.space_id;
                             this.cfg.spaceId = msg.space_id;
                         }
                         this.repos = msg.repos ?? [];
+                        this.keepRepos();
                         this.plan = msg.plan ?? null;
                         this.adoptKnownRepo();
                         this.backoff = 500;
                         this.roster = msg.roster;
                         this.obligations = msg.obligations;
                         this.members = msg.members;
+                        this.features = msg.features ?? [];
+                        this.observePins();
                         this.profiles = new Map((msg.profiles ?? []).map((p) => [p.member, p]));
                         for (const g of msg.goals)
                             this.goals.set(g.id, g);
@@ -250,16 +321,33 @@ export class PantheonClient {
                             resolve();
                         }
                         break;
+                    case "token":
+                        if (typeof msg.token === "string" && msg.token) {
+                            this.adoptToken(msg.token);
+                            this.cfg.token = msg.token;
+                        }
+                        break;
                     case "repos":
                         this.repos = msg.repos;
+                        this.keepRepos();
                         this.adoptKnownRepo();
                         break;
                     case "act":
+                        if (msg.act.sig && !this.sigsSeen) {
+                            try {
+                                this.trustOf(msg.act);
+                            }
+                            catch { }
+                        }
                         if (msg.act.seq > this.seq)
                             this.seq = msg.act.seq;
                         if (msg.act.seq > this.head)
                             this.head = msg.act.seq;
-                        this.seen.set(msg.act.id, msg.act);
+                        {
+                            const had = this.seen.get(msg.act.id);
+                            if (!had || canonicalJson(had) === canonicalJson(msg.act))
+                                this.seen.set(msg.act.id, msg.act);
+                        }
                         if (this.seen.size > 500)
                             this.seen.delete(this.seen.keys().next().value);
                         if (msg.act.from !== this.cfg.member && msg.act.act !== "JOIN" && msg.act.act !== "LEAVE") {
@@ -285,6 +373,12 @@ export class PantheonClient {
                     }
                     case "error": {
                         this.lastError = `${msg.code}: ${msg.message}`;
+                        if (!msg.cid) {
+                            const code = ["REVOKED", "KEY_MISMATCH", "BAD_TOKEN"].includes(msg.code) ? msg.code : null;
+                            if (code && !this.refusedCode)
+                                this.refusedSince = Date.now();
+                            this.refusedCode = code;
+                        }
                         if (msg.code === "SPACE_DELETED")
                             this.closed = true;
                         const fn = msg.cid ? this.acks.get(msg.cid) : undefined;
@@ -325,8 +419,10 @@ export class PantheonClient {
                     }
                     reject(new Error(this.lastError ?? "relay connection failed"));
                 }
+                const slow = !!this.refused && Date.now() - this.refusedSince >= PantheonClient.REFUSED_GRACE_MS;
+                const wait = slow ? PantheonClient.REFUSED_RETRY_MS : Math.round(this.backoff * (0.5 + Math.random()));
                 setTimeout(() => { if (!this.closed)
-                    this.connect().catch(() => { }); }, Math.round(this.backoff * (0.5 + Math.random())));
+                    this.connect().catch(() => { }); }, wait);
                 this.backoff = Math.min(this.backoff * 2, 15_000);
             };
             ws.on("close", down);
@@ -414,7 +510,48 @@ export class PantheonClient {
     async send(a) {
         const repo = this.cfg.repo;
         const meta = a.act === "DELIVERED" && repo && !(a.meta && "repo" in a.meta) ? { ...(a.meta ?? {}), repo } : a.meta;
-        const r = await this.rpc({ t: "act", ...a, ...(meta ? { meta } : {}), ...(repo ? { repo } : {}) });
+        const id = newActId();
+        const sig = this.signAct(id, { ...a, ...(meta ? { meta } : {}) }, repo);
+        let unrecorded = false, unsignedRef = false;
+        if (a.ref && this.ws?.readyState === WebSocket.OPEN && (a.act === "ANSWER" || a.act === "ACCEPT" || a.act === "OBJECT" || a.act === "DELIVERED")) {
+            try {
+                markContinued(this.pinTeam, `handled:${a.ref}`);
+            }
+            catch { }
+            const noted = await this.noteAnswered(a.ref).catch(() => false);
+            unrecorded = noted === false && this.signaturesExpected();
+            unsignedRef = noted === "unsigned";
+        }
+        const r = await this.rpc({ t: "act", id, ...a, ...(meta ? { meta } : {}), ...(repo ? { repo } : {}), sig });
+        let sentId = r.id === id ? id : null;
+        if (r.id !== id && this.features.includes("act-sig")) {
+            let prior = this.seen.get(r.id) ?? null;
+            if (!prior) {
+                try {
+                    const res = await signedRead(this.cfg, "/act", { id: r.id }, { timeoutMs: 3000 });
+                    prior = res.ok ? (await res.json()).act ?? null : null;
+                }
+                catch { }
+            }
+            const retry = !!prior && prior.id === r.id && prior.from === this.cfg.member && prior.act === a.act && prior.body === a.body
+                && (prior.goal ?? null) === (a.goal ?? null) && (prior.ref ?? null) === (a.ref ?? null) && !!prior.sig && trusted(this.trustOf(prior).trust);
+            if (retry)
+                sentId = r.id;
+            else {
+                r.id = id;
+                sentId = id;
+            }
+        }
+        if (unrecorded)
+            r.unrecorded = true;
+        else if (unsignedRef && this.signaturesExpected())
+            r.unrecorded = "unsigned";
+        if (sentId) {
+            try {
+                markContinued(`${this.pinKey()} sent`, sentId);
+            }
+            catch { }
+        }
         if (a.ref) {
             for (const [id, o] of this.claimedByMe)
                 if (o.ref === a.ref)
@@ -428,7 +565,150 @@ export class PantheonClient {
         return r;
     }
     openGoal(g) {
-        return this.rpc({ t: "open_goal", acceptance: "", ...g });
+        const k = this.signingKey();
+        const nonce = newActNonce(), ts = Date.now();
+        const id = `g_${ts.toString(36)}${Buffer.from(nonce, "base64url").toString("hex").slice(0, 12)}`;
+        const invite = g.invite ? [...new Set(g.invite)] : null;
+        const sig = {
+            v: 1, role: k.role, nonce, ts, pub: k.pub, invite,
+            budget: g.budget ?? null, deadline: g.deadline ?? null, kind: g.kind ?? null,
+            ...(k.cert ? { cert: k.cert } : {}),
+            s: signBytes(k.priv, goalPayload({
+                id, team: this.teamKey(), member: this.cfg.member, keyRole: k.role, nonce, ts,
+                title: g.title, acceptance: g.acceptance ?? "", invite,
+                budget: g.budget ?? null, deadline: g.deadline ?? null, kind: g.kind ?? null,
+            })),
+        };
+        return this.rpc({ t: "open_goal", id, acceptance: "", ...g, ...(invite ? { invite } : {}), sig });
+    }
+    features = [];
+    pinChanges = [];
+    pinsCache = null;
+    observePins() {
+        try {
+            const team = this.pinKey();
+            let changes = [];
+            const p = updatePins((p) => {
+                if (p.corrupt)
+                    return false;
+                const before = JSON.stringify(p);
+                changes = observeMembers(p, team, this.members, { member: this.cfg.member, publicKey: this.cfg.publicKey });
+                if (this.features.includes("act-sig"))
+                    markSigs(p, team);
+                return JSON.stringify(p) !== before;
+            });
+            this.pinsCache = p;
+            this.pinChanges.push(...changes);
+            if (this.pinChanges.length > 50)
+                this.pinChanges.splice(0, this.pinChanges.length - 50);
+        }
+        catch { }
+    }
+    pins() {
+        try {
+            this.pinsCache = loadPins();
+        }
+        catch {
+            this.pinsCache ??= { v: 1, teams: {} };
+        }
+        return this.pinsCache;
+    }
+    trustOf(rec) {
+        let pin = pinFor(this.pins(), this.pinKey(), rec.from);
+        if (!pin || (rec.sig?.role === "run" && !pin.key)) {
+            this.pinsCache = null;
+            this.observePins();
+            pin = pinFor(this.pins(), this.pinKey(), rec.from);
+        }
+        const r = verifyAct(rec, [this.cfg.spaceId, this.spaceId, this.cfg.space], pin?.fp, pin?.key);
+        if (trusted(r.trust) && rec.sig && !this.verifiedIds.has(rec.id)) {
+            this.verifiedIds.set(rec.id, { member: rec.from, nonce: rec.sig.nonce });
+            if (this.verifiedIds.size > 5000)
+                this.verifiedIds.delete(this.verifiedIds.keys().next().value);
+        }
+        if ((r.trust === "verified" || r.trust === "verified-run") && !this.sigsSeen)
+            this.noteSigsSeen();
+        if ((r.trust === "verified" || r.trust === "verified-run") && !this.signersSeen.has(rec.from)) {
+            this.signersSeen.add(rec.from);
+            try {
+                updatePins((p) => !p.corrupt && markMemberSigns(p, this.pinKey(), rec.from));
+            }
+            catch { }
+        }
+        return r;
+    }
+    signersSeen = new Set();
+    memberSigns(member) { return memberSigns(this.pins(), this.pinKey(), member); }
+    sigsSeen = false;
+    noteSigsSeen() {
+        this.sigsSeen = true;
+        try {
+            updatePins((p) => !p.corrupt && markSigs(p, this.pinKey()));
+        }
+        catch { }
+    }
+    goalTrust(g) {
+        const pin = pinFor(this.pins(), this.pinKey(), g.opened_by);
+        return verifyGoal(g, [this.cfg.spaceId, this.spaceId, this.cfg.space], pin?.fp, pin?.key);
+    }
+    signaturesExpected() {
+        return this.features.includes("act-sig") || expectsSigs(this.pins(), this.pinKey()) || joinedSigning(this.cfg.joinedWith);
+    }
+    signingSince() {
+        return this.pins().teams[this.pinKey()]?.sigs ?? null;
+    }
+    async noteAnswered(ref) {
+        const known = this.verifiedIds.get(ref);
+        if (known) {
+            markAnswered(this.pinTeam, known.member, known.nonce, ref);
+            return true;
+        }
+        let r = this.seen.get(ref) ?? null;
+        if (!r) {
+            try {
+                const res = await signedRead(this.cfg, "/act", { id: ref }, { timeoutMs: 3000 });
+                r = res.ok ? (await res.json()).act ?? null : null;
+            }
+            catch {
+                r = null;
+            }
+        }
+        if (!r) {
+            const local = nonceOf(this.pinTeam, ref);
+            if (local)
+                markAnswered(this.pinTeam, local.member, local.nonce, ref);
+            return false;
+        }
+        if (r && r.id === ref && !r.sig && this.trustOf(r).trust === "unsigned" && !this.memberSigns(r.from))
+            return "unsigned";
+        if (!r || r.id !== ref || !r.sig || !trusted(this.trustOf(r).trust))
+            return false;
+        markAnswered(this.pinTeam, r.from, r.sig.nonce, r.id, undefined, r.sig.s);
+        return true;
+    }
+    verifiedIds = new Map();
+    pinKey() { return pinScope(this.pinTeam, this.cfg.member); }
+    pinTeam;
+    teamKey() { return this.cfg.spaceId ?? this.spaceId ?? this.cfg.space; }
+    signingKey() {
+        const d = this.cfg.delegate;
+        return d ? { role: "run", priv: d.privateKey, pub: d.cert.pub, cert: d.cert } : { role: "member", priv: this.cfg.privateKey, pub: this.cfg.publicKey };
+    }
+    signAct(id, a, repo) {
+        const k = this.signingKey();
+        const nonce = newActNonce(), ts = Date.now();
+        return {
+            v: 1, role: k.role, nonce, ts, pub: k.pub,
+            ...(a.meta ? { meta: a.meta } : {}),
+            ...(repo ? { repo } : {}),
+            ...(k.cert ? { cert: k.cert } : {}),
+            s: signBytes(k.priv, actPayload({
+                id, team: this.teamKey(), member: this.cfg.member, keyRole: k.role, nonce, ts,
+                act: a.act, goal: a.goal ?? null, ref: a.ref ?? null, to: a.to ?? null,
+                defers_to: a.defers_to ?? null, affects: a.affects ?? null, repo: repo ?? null,
+                summary: a.summary ?? null, body: a.body, meta: a.meta ?? {},
+            })),
+        };
     }
     claimedByMe = new Map();
     async claim(obligation) {
@@ -453,6 +733,9 @@ export class PantheonClient {
     admit(member, mayWake = false, revoke = false, forget = false) {
         return this.rpc({ t: "admit", member, may_wake: mayWake, revoke, forget });
     }
+    setMayWake(member, mayWake) {
+        return this.rpc({ t: "admit", member, may_wake: mayWake, wake_only: true });
+    }
     publishProfile(profile) {
         return this.rpc({ t: "publish_profile", profile });
     }
@@ -478,7 +761,7 @@ export class PantheonClient {
     bindRepo(fingerprint = this.cfg.repo, origin = this.cfg.repoOrigin ?? null, base = null) {
         if (!fingerprint)
             return Promise.reject(new Error("not inside a git repo — run this from the team's checkout"));
-        return this.rpc({ t: "bind_repo", repo: fingerprint, origin, ...(base ? { base } : {}) });
+        return this.rpc({ t: "bind_repo", repo: fingerprint, origin: origin ? repoName(origin) : origin, ...(base ? { base } : {}) });
     }
     makeInvite(mayWake = true, ttlMinutes = 60) {
         return new Promise((res, rej) => {
@@ -549,7 +832,8 @@ export class PantheonClient {
     }
     recent(id) {
         const r = this.seen.get(id);
-        return r ? `${r.act} from ${r.from}${r.goal ? ` (goal ${r.goal})` : ""} id=${r.id}\n${r.body}` : null;
+        const plain = (s) => (typeof s === "string" && /^[A-Za-z0-9_][A-Za-z0-9_:.\-]{0,119}$/.test(s) ? s : "(an id not printed)");
+        return r ? `${plain(r.act)} from ${plain(r.from)}${r.goal ? ` (goal ${plain(r.goal)})` : ""} id=${plain(r.id)}\n${r.body}` : null;
     }
     recentFrom(id) {
         return this.seen.get(id)?.from ?? null;

package/dist/command-state.js

@@ -0,0 +1,102 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { platform } from "node:os";
+import { chooseAgent, claudeSandboxable, NOT_FOR_UNATTENDED_RUNS, parseRepoCommands, REPO_COMMANDS_FILE, SANDBOXED_FOR_UNATTENDED } from "./agents.js";
+import { detectClaudeFeatures } from "./claude-confine.js";
+import { loadPersonas } from "./persona.js";
+import { plistPath, existingUnitPath } from "./service.js";
+import { loadPolicy, unsandboxedAllowed } from "./worker-policy.js";
+export function workerServiceAllowsBash(plat = platform()) {
+    try {
+        if (plat === "darwin") {
+            const p = plistPath("worker");
+            if (!existsSync(p))
+                return null;
+            const xml = readFileSync(p, "utf8");
+            const args = [...(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(xml)?.[1] ?? "").matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
+            return args.includes("--allow-bash");
+        }
+        if (plat === "win32")
+            return null;
+        const u = existingUnitPath("worker");
+        if (!u)
+            return null;
+        const exec = /^ExecStart=(.*)$/m.exec(readFileSync(u, "utf8"))?.[1] ?? "";
+        return /(^|\s|")--allow-bash("|\s|$)/.test(exec);
+    }
+    catch {
+        return null;
+    }
+}
+export function commandState(o = {}) {
+    const allowBash = o.allowBash ?? workerServiceAllowsBash(o.plat) ?? false;
+    let grant = null;
+    try {
+        grant = loadPolicy(o.home).grants.run_commands ?? null;
+    }
+    catch { }
+    let personasOff = [];
+    try {
+        personasOff = loadPersonas(o.project ?? process.cwd(), o.home).filter((p) => p.allowBash === false).map((p) => p.name);
+    }
+    catch { }
+    const level = allowBash || grant?.mode === "always" ? "always" : grant ? "once" : "off";
+    const except = personasOff.length ? `, except runs handled by ${personasOff.length === 1 ? "persona" : "personas"} ${personasOff.join(", ")} (allow_bash: false)` : "";
+    const summary = level === "off"
+        ? "off — woken runs edit files only; a run that needs more asks here (pantheon policy grant run-commands)"
+        : allowBash
+            ? `on — the worker runs with --allow-bash${grant ? ", and run-commands is granted here too" : ""}${except}`
+            : grant.mode === "always"
+                ? `on — run-commands granted on this machine (${grant.by}, ${new Date(grant.at).toLocaleDateString()})${except}`
+                : `on for the next run only — run-commands granted once on this machine${except}`;
+    return { level, allowBash, grant, personasOff, summary };
+}
+export function repoCommandsAtBase(project, base) {
+    const git = (...a) => execFileSync("git", ["-C", project, ...a], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000 }).trim();
+    const exists = (ref) => { try {
+        git("rev-parse", "--verify", "--quiet", `${ref}^{commit}`);
+        return true;
+    }
+    catch {
+        return false;
+    } };
+    let remoteHead = null;
+    try {
+        remoteHead = git("symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD") || null;
+    }
+    catch { }
+    const ref = [base ? `origin/${base}` : null, base ?? null, remoteHead, "HEAD"].filter((r) => !!r).find(exists) ?? null;
+    if (!ref)
+        return { ref: null, ok: [], refused: [] };
+    let text = "";
+    try {
+        text = git("show", `${ref}:${REPO_COMMANDS_FILE}`);
+    }
+    catch {
+        return { ref, ok: [], refused: [] };
+    }
+    return { ref, ...parseRepoCommands(text) };
+}
+export function commandCaveat(o = {}) {
+    try {
+        const unsandboxedOk = unsandboxedAllowed(loadPolicy(o.home));
+        const c = (o.choose ?? chooseAgent)("auto", { check: null, unsandboxedOk });
+        if (NOT_FOR_UNATTENDED_RUNS.has(c.backend.id))
+            return `${c.backend.label}, the only agent here, answers in your live sessions — for runs while you're away, install Claude Code, Codex, Cursor or Copilot`;
+        if (unsandboxedOk)
+            return "";
+        if (!SANDBOXED_FOR_UNATTENDED.has(c.backend.id))
+            return `${c.backend.label}, the agent here, is set to leave teammates' requests for your next session (to have it answer them: pantheon policy grant unsandboxed-runs)`;
+        const f = (o.features ?? detectClaudeFeatures)(c.binary);
+        const plat = o.plat ?? process.platform;
+        if (f.unknown && plat !== "win32")
+            return `but \`${c.binary} --help\` did not answer in time, so this Claude Code's sandbox could not be confirmed and a woken run gets no commands until it does (it is asked again at each run)`;
+        if (!claudeSandboxable(f, plat))
+            return `this Claude Code (${f.version ?? "version unknown"}${plat === "win32" ? ", Windows" : ""}) is set to keep runs while you're away to edits — for commands, update it to 2.1.83+ on macOS or Linux, or: pantheon policy grant unsandboxed-runs`;
+        return "";
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=command-state.js.map