@join-pantheon/cli 0.30.0 → 0.31.0

package/dist/client.js

@@ -1,6 +1,13 @@
 import WebSocket from "ws";
-import { updateMembershipToken } from "./config.js";
-import { signChallenge } from "./identity.js";
+import { adoptSpaceId, rememberTeamRepos, updateMembershipToken } from "./config.js";
+import { markContinued } from "./continued.js";
+import { markAnswered, nonceOf } from "./nonces.js";
+import { signedRead } from "./reads.js";
+import { repoName } from "./repo-route.js";
+import { signChallenge, signBytes, actPayload, goalPayload, newActId, newActNonce, canonicalJson } from "./identity.js";
+import { expectsSigs, joinedSigning, loadPins, markMemberSigns, markSigs, memberSigns, observeMembers, pinFor, pinScope, teamPinId, updatePins } from "./pins.js";
+export { joinedSigning } from "./pins.js";
+import { trusted, verifyAct, verifyGoal } from "./verify-act.js";
 import { newId } from "./protocol.js";
 import { VERSION } from "./version.js";
 import { describeNetError, explainNetError, noteRelayAnswered, settleSystemFallback, systemFallbackPending, trySystemFallback, wsOptions } from "./network.js";
@@ -56,11 +63,20 @@ export class PantheonClient {
     constructor(cfg, onEvent, opts) {
         this.cfg = cfg;
         this.onEvent = onEvent;
+        this.pinTeam = teamPinId(cfg);
+        if (opts?.fromSeq && opts.fromSeq > 0)
+            this.seq = opts.fromSeq;
         this.persistToken = opts?.persistToken ?? ((space, oldToken, newToken) => { updateMembershipToken(space, oldToken, newToken); });
         this.enroll = opts?.enroll ?? null;
         this.session = opts?.session ?? newId("s");
         this.role = opts?.role ?? "interactive";
     }
+    keepRepos() {
+        try {
+            rememberTeamRepos({ spaceId: this.cfg.spaceId ?? this.spaceId, space: this.cfg.space, relay: this.cfg.relay }, this.repos);
+        }
+        catch { }
+    }
     adoptToken(token) {
         const old = this.cfg.token;
         if (!token || token === old)
@@ -198,14 +214,15 @@ export class PantheonClient {
                             ...(this.enroll && !this.enrolledToken ? { enroll: this.enroll } : { token: this.cfg.token }),
                             pubkey: this.cfg.publicKey,
                             nonce: msg.nonce,
-                            sig: signChallenge(this.cfg.privateKey, this.cfg.space, this.cfg.member, msg.nonce),
+                            sig: signChallenge(this.cfg.delegate?.privateKey ?? this.cfg.privateKey, this.cfg.space, this.cfg.member, msg.nonce),
+                            ...(this.cfg.delegate ? { delegate: this.cfg.delegate.cert } : {}),
                             session: this.session,
                             role: this.role,
                             display: this.cfg.display ?? this.cfg.member,
                             agent: this.cfg.agent ?? "unknown",
                             pkg: VERSION,
                             ...(this.seq > 0 ? { from_seq: this.seq } : {}),
-                            ...(this.cfg.repo ? { repo: this.cfg.repo, ...(this.cfg.repoOrigin ? { repo_origin: this.cfg.repoOrigin } : {}) } : {}),
+                            ...(this.cfg.repo ? { repo: this.cfg.repo, ...(this.cfg.repoOrigin ? { repo_origin: repoName(this.cfg.repoOrigin) } : {}) } : {}),
                         }));
                         break;
                     case "pending":
@@ -219,6 +236,7 @@ export class PantheonClient {
                         break;
                     case "members":
                         this.members = msg.members;
+                        this.observePins();
                         break;
                     case "profiles":
                         this.profiles = new Map((msg.profiles ?? []).map((p) => [p.member, p]));
@@ -232,6 +250,16 @@ export class PantheonClient {
                         this.inviteUrl = { url: msg.url, expires_at: msg.expires_at };
                         break;
                     case "welcome":
+                        if (this.cfg.spaceId && msg.space_id && msg.space_id !== this.cfg.spaceId) {
+                            this.lastError = `SPACE_MISMATCH: the relay answered for team ${msg.space_id}, not the ${this.cfg.spaceId} this machine joined — not connecting (pantheon spaces; rejoin with a fresh invite if the team was recreated)`;
+                            this.closed = true;
+                            ws.close();
+                            if (!settled) {
+                                settled = true;
+                                reject(new Error(this.lastError));
+                            }
+                            break;
+                        }
                         this.connected = true;
                         this.pending = null;
                         this.refusedCode = null;
@@ -253,16 +281,38 @@ export class PantheonClient {
                             this.cfg.token = msg.token;
                         }
                         if (msg.space_id) {
+                            if (!this.cfg.spaceId) {
+                                let adopted = false;
+                                try {
+                                    adopted = adoptSpaceId(this.cfg.relay, this.cfg.space, msg.space_id);
+                                }
+                                catch { }
+                                if (adopted === "conflict") {
+                                    this.lastError = `SPACE_MISMATCH: the relay says "${this.cfg.space}" is team ${msg.space_id}, which is another team this machine is in — not connecting`;
+                                    this.closed = true;
+                                    ws.close();
+                                    if (!settled) {
+                                        settled = true;
+                                        reject(new Error(this.lastError));
+                                    }
+                                    break;
+                                }
+                            }
+                            if (!this.cfg.spaceId)
+                                this.cfg.pinTeam ??= this.pinTeam;
                             this.spaceId = msg.space_id;
                             this.cfg.spaceId = msg.space_id;
                         }
                         this.repos = msg.repos ?? [];
+                        this.keepRepos();
                         this.plan = msg.plan ?? null;
                         this.adoptKnownRepo();
                         this.backoff = 500;
                         this.roster = msg.roster;
                         this.obligations = msg.obligations;
                         this.members = msg.members;
+                        this.features = msg.features ?? [];
+                        this.observePins();
                         this.profiles = new Map((msg.profiles ?? []).map((p) => [p.member, p]));
                         for (const g of msg.goals)
                             this.goals.set(g.id, g);
@@ -279,14 +329,25 @@ export class PantheonClient {
                         break;
                     case "repos":
                         this.repos = msg.repos;
+                        this.keepRepos();
                         this.adoptKnownRepo();
                         break;
                     case "act":
+                        if (msg.act.sig && !this.sigsSeen) {
+                            try {
+                                this.trustOf(msg.act);
+                            }
+                            catch { }
+                        }
                         if (msg.act.seq > this.seq)
                             this.seq = msg.act.seq;
                         if (msg.act.seq > this.head)
                             this.head = msg.act.seq;
-                        this.seen.set(msg.act.id, msg.act);
+                        {
+                            const had = this.seen.get(msg.act.id);
+                            if (!had || canonicalJson(had) === canonicalJson(msg.act))
+                                this.seen.set(msg.act.id, msg.act);
+                        }
                         if (this.seen.size > 500)
                             this.seen.delete(this.seen.keys().next().value);
                         if (msg.act.from !== this.cfg.member && msg.act.act !== "JOIN" && msg.act.act !== "LEAVE") {
@@ -449,7 +510,48 @@ export class PantheonClient {
     async send(a) {
         const repo = this.cfg.repo;
         const meta = a.act === "DELIVERED" && repo && !(a.meta && "repo" in a.meta) ? { ...(a.meta ?? {}), repo } : a.meta;
-        const r = await this.rpc({ t: "act", ...a, ...(meta ? { meta } : {}), ...(repo ? { repo } : {}) });
+        const id = newActId();
+        const sig = this.signAct(id, { ...a, ...(meta ? { meta } : {}) }, repo);
+        let unrecorded = false, unsignedRef = false;
+        if (a.ref && this.ws?.readyState === WebSocket.OPEN && (a.act === "ANSWER" || a.act === "ACCEPT" || a.act === "OBJECT" || a.act === "DELIVERED")) {
+            try {
+                markContinued(this.pinTeam, `handled:${a.ref}`);
+            }
+            catch { }
+            const noted = await this.noteAnswered(a.ref).catch(() => false);
+            unrecorded = noted === false && this.signaturesExpected();
+            unsignedRef = noted === "unsigned";
+        }
+        const r = await this.rpc({ t: "act", id, ...a, ...(meta ? { meta } : {}), ...(repo ? { repo } : {}), sig });
+        let sentId = r.id === id ? id : null;
+        if (r.id !== id && this.features.includes("act-sig")) {
+            let prior = this.seen.get(r.id) ?? null;
+            if (!prior) {
+                try {
+                    const res = await signedRead(this.cfg, "/act", { id: r.id }, { timeoutMs: 3000 });
+                    prior = res.ok ? (await res.json()).act ?? null : null;
+                }
+                catch { }
+            }
+            const retry = !!prior && prior.id === r.id && prior.from === this.cfg.member && prior.act === a.act && prior.body === a.body
+                && (prior.goal ?? null) === (a.goal ?? null) && (prior.ref ?? null) === (a.ref ?? null) && !!prior.sig && trusted(this.trustOf(prior).trust);
+            if (retry)
+                sentId = r.id;
+            else {
+                r.id = id;
+                sentId = id;
+            }
+        }
+        if (unrecorded)
+            r.unrecorded = true;
+        else if (unsignedRef && this.signaturesExpected())
+            r.unrecorded = "unsigned";
+        if (sentId) {
+            try {
+                markContinued(`${this.pinKey()} sent`, sentId);
+            }
+            catch { }
+        }
         if (a.ref) {
             for (const [id, o] of this.claimedByMe)
                 if (o.ref === a.ref)
@@ -463,7 +565,150 @@ export class PantheonClient {
         return r;
     }
     openGoal(g) {
-        return this.rpc({ t: "open_goal", acceptance: "", ...g });
+        const k = this.signingKey();
+        const nonce = newActNonce(), ts = Date.now();
+        const id = `g_${ts.toString(36)}${Buffer.from(nonce, "base64url").toString("hex").slice(0, 12)}`;
+        const invite = g.invite ? [...new Set(g.invite)] : null;
+        const sig = {
+            v: 1, role: k.role, nonce, ts, pub: k.pub, invite,
+            budget: g.budget ?? null, deadline: g.deadline ?? null, kind: g.kind ?? null,
+            ...(k.cert ? { cert: k.cert } : {}),
+            s: signBytes(k.priv, goalPayload({
+                id, team: this.teamKey(), member: this.cfg.member, keyRole: k.role, nonce, ts,
+                title: g.title, acceptance: g.acceptance ?? "", invite,
+                budget: g.budget ?? null, deadline: g.deadline ?? null, kind: g.kind ?? null,
+            })),
+        };
+        return this.rpc({ t: "open_goal", id, acceptance: "", ...g, ...(invite ? { invite } : {}), sig });
+    }
+    features = [];
+    pinChanges = [];
+    pinsCache = null;
+    observePins() {
+        try {
+            const team = this.pinKey();
+            let changes = [];
+            const p = updatePins((p) => {
+                if (p.corrupt)
+                    return false;
+                const before = JSON.stringify(p);
+                changes = observeMembers(p, team, this.members, { member: this.cfg.member, publicKey: this.cfg.publicKey });
+                if (this.features.includes("act-sig"))
+                    markSigs(p, team);
+                return JSON.stringify(p) !== before;
+            });
+            this.pinsCache = p;
+            this.pinChanges.push(...changes);
+            if (this.pinChanges.length > 50)
+                this.pinChanges.splice(0, this.pinChanges.length - 50);
+        }
+        catch { }
+    }
+    pins() {
+        try {
+            this.pinsCache = loadPins();
+        }
+        catch {
+            this.pinsCache ??= { v: 1, teams: {} };
+        }
+        return this.pinsCache;
+    }
+    trustOf(rec) {
+        let pin = pinFor(this.pins(), this.pinKey(), rec.from);
+        if (!pin || (rec.sig?.role === "run" && !pin.key)) {
+            this.pinsCache = null;
+            this.observePins();
+            pin = pinFor(this.pins(), this.pinKey(), rec.from);
+        }
+        const r = verifyAct(rec, [this.cfg.spaceId, this.spaceId, this.cfg.space], pin?.fp, pin?.key);
+        if (trusted(r.trust) && rec.sig && !this.verifiedIds.has(rec.id)) {
+            this.verifiedIds.set(rec.id, { member: rec.from, nonce: rec.sig.nonce });
+            if (this.verifiedIds.size > 5000)
+                this.verifiedIds.delete(this.verifiedIds.keys().next().value);
+        }
+        if ((r.trust === "verified" || r.trust === "verified-run") && !this.sigsSeen)
+            this.noteSigsSeen();
+        if ((r.trust === "verified" || r.trust === "verified-run") && !this.signersSeen.has(rec.from)) {
+            this.signersSeen.add(rec.from);
+            try {
+                updatePins((p) => !p.corrupt && markMemberSigns(p, this.pinKey(), rec.from));
+            }
+            catch { }
+        }
+        return r;
+    }
+    signersSeen = new Set();
+    memberSigns(member) { return memberSigns(this.pins(), this.pinKey(), member); }
+    sigsSeen = false;
+    noteSigsSeen() {
+        this.sigsSeen = true;
+        try {
+            updatePins((p) => !p.corrupt && markSigs(p, this.pinKey()));
+        }
+        catch { }
+    }
+    goalTrust(g) {
+        const pin = pinFor(this.pins(), this.pinKey(), g.opened_by);
+        return verifyGoal(g, [this.cfg.spaceId, this.spaceId, this.cfg.space], pin?.fp, pin?.key);
+    }
+    signaturesExpected() {
+        return this.features.includes("act-sig") || expectsSigs(this.pins(), this.pinKey()) || joinedSigning(this.cfg.joinedWith);
+    }
+    signingSince() {
+        return this.pins().teams[this.pinKey()]?.sigs ?? null;
+    }
+    async noteAnswered(ref) {
+        const known = this.verifiedIds.get(ref);
+        if (known) {
+            markAnswered(this.pinTeam, known.member, known.nonce, ref);
+            return true;
+        }
+        let r = this.seen.get(ref) ?? null;
+        if (!r) {
+            try {
+                const res = await signedRead(this.cfg, "/act", { id: ref }, { timeoutMs: 3000 });
+                r = res.ok ? (await res.json()).act ?? null : null;
+            }
+            catch {
+                r = null;
+            }
+        }
+        if (!r) {
+            const local = nonceOf(this.pinTeam, ref);
+            if (local)
+                markAnswered(this.pinTeam, local.member, local.nonce, ref);
+            return false;
+        }
+        if (r && r.id === ref && !r.sig && this.trustOf(r).trust === "unsigned" && !this.memberSigns(r.from))
+            return "unsigned";
+        if (!r || r.id !== ref || !r.sig || !trusted(this.trustOf(r).trust))
+            return false;
+        markAnswered(this.pinTeam, r.from, r.sig.nonce, r.id, undefined, r.sig.s);
+        return true;
+    }
+    verifiedIds = new Map();
+    pinKey() { return pinScope(this.pinTeam, this.cfg.member); }
+    pinTeam;
+    teamKey() { return this.cfg.spaceId ?? this.spaceId ?? this.cfg.space; }
+    signingKey() {
+        const d = this.cfg.delegate;
+        return d ? { role: "run", priv: d.privateKey, pub: d.cert.pub, cert: d.cert } : { role: "member", priv: this.cfg.privateKey, pub: this.cfg.publicKey };
+    }
+    signAct(id, a, repo) {
+        const k = this.signingKey();
+        const nonce = newActNonce(), ts = Date.now();
+        return {
+            v: 1, role: k.role, nonce, ts, pub: k.pub,
+            ...(a.meta ? { meta: a.meta } : {}),
+            ...(repo ? { repo } : {}),
+            ...(k.cert ? { cert: k.cert } : {}),
+            s: signBytes(k.priv, actPayload({
+                id, team: this.teamKey(), member: this.cfg.member, keyRole: k.role, nonce, ts,
+                act: a.act, goal: a.goal ?? null, ref: a.ref ?? null, to: a.to ?? null,
+                defers_to: a.defers_to ?? null, affects: a.affects ?? null, repo: repo ?? null,
+                summary: a.summary ?? null, body: a.body, meta: a.meta ?? {},
+            })),
+        };
     }
     claimedByMe = new Map();
     async claim(obligation) {
@@ -488,6 +733,9 @@ export class PantheonClient {
     admit(member, mayWake = false, revoke = false, forget = false) {
         return this.rpc({ t: "admit", member, may_wake: mayWake, revoke, forget });
     }
+    setMayWake(member, mayWake) {
+        return this.rpc({ t: "admit", member, may_wake: mayWake, wake_only: true });
+    }
     publishProfile(profile) {
         return this.rpc({ t: "publish_profile", profile });
     }
@@ -513,7 +761,7 @@ export class PantheonClient {
     bindRepo(fingerprint = this.cfg.repo, origin = this.cfg.repoOrigin ?? null, base = null) {
         if (!fingerprint)
             return Promise.reject(new Error("not inside a git repo — run this from the team's checkout"));
-        return this.rpc({ t: "bind_repo", repo: fingerprint, origin, ...(base ? { base } : {}) });
+        return this.rpc({ t: "bind_repo", repo: fingerprint, origin: origin ? repoName(origin) : origin, ...(base ? { base } : {}) });
     }
     makeInvite(mayWake = true, ttlMinutes = 60) {
         return new Promise((res, rej) => {
@@ -584,7 +832,8 @@ export class PantheonClient {
     }
     recent(id) {
         const r = this.seen.get(id);
-        return r ? `${r.act} from ${r.from}${r.goal ? ` (goal ${r.goal})` : ""} id=${r.id}\n${r.body}` : null;
+        const plain = (s) => (typeof s === "string" && /^[A-Za-z0-9_][A-Za-z0-9_:.\-]{0,119}$/.test(s) ? s : "(an id not printed)");
+        return r ? `${plain(r.act)} from ${plain(r.from)}${r.goal ? ` (goal ${plain(r.goal)})` : ""} id=${plain(r.id)}\n${r.body}` : null;
     }
     recentFrom(id) {
         return this.seen.get(id)?.from ?? null;

package/dist/command-state.js

@@ -1,10 +1,11 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { platform } from "node:os";
-import { parseRepoCommands, REPO_COMMANDS_FILE } from "./agents.js";
+import { chooseAgent, claudeSandboxable, NOT_FOR_UNATTENDED_RUNS, parseRepoCommands, REPO_COMMANDS_FILE, SANDBOXED_FOR_UNATTENDED } from "./agents.js";
+import { detectClaudeFeatures } from "./claude-confine.js";
 import { loadPersonas } from "./persona.js";
 import { plistPath, existingUnitPath } from "./service.js";
-import { loadPolicy } from "./worker-policy.js";
+import { loadPolicy, unsandboxedAllowed } from "./worker-policy.js";
 export function workerServiceAllowsBash(plat = platform()) {
     try {
         if (plat === "darwin") {
@@ -76,4 +77,26 @@ export function repoCommandsAtBase(project, base) {
     }
     return { ref, ...parseRepoCommands(text) };
 }
+export function commandCaveat(o = {}) {
+    try {
+        const unsandboxedOk = unsandboxedAllowed(loadPolicy(o.home));
+        const c = (o.choose ?? chooseAgent)("auto", { check: null, unsandboxedOk });
+        if (NOT_FOR_UNATTENDED_RUNS.has(c.backend.id))
+            return `${c.backend.label}, the only agent here, answers in your live sessions — for runs while you're away, install Claude Code, Codex, Cursor or Copilot`;
+        if (unsandboxedOk)
+            return "";
+        if (!SANDBOXED_FOR_UNATTENDED.has(c.backend.id))
+            return `${c.backend.label}, the agent here, is set to leave teammates' requests for your next session (to have it answer them: pantheon policy grant unsandboxed-runs)`;
+        const f = (o.features ?? detectClaudeFeatures)(c.binary);
+        const plat = o.plat ?? process.platform;
+        if (f.unknown && plat !== "win32")
+            return `but \`${c.binary} --help\` did not answer in time, so this Claude Code's sandbox could not be confirmed and a woken run gets no commands until it does (it is asked again at each run)`;
+        if (!claudeSandboxable(f, plat))
+            return `this Claude Code (${f.version ?? "version unknown"}${plat === "win32" ? ", Windows" : ""}) is set to keep runs while you're away to edits — for commands, update it to 2.1.83+ on macOS or Linux, or: pantheon policy grant unsandboxed-runs`;
+        return "";
+    }
+    catch {
+        return "";
+    }
+}
 //# sourceMappingURL=command-state.js.map

package/dist/config.js

@@ -4,6 +4,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { VERSION } from "./version.js";
+import { repoName } from "./repo-route.js";
 export const CONFIG_DIR = process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
 export const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 export const DEFAULT_RELAY = process.env.PANTHEON_DEFAULT_RELAY
@@ -112,7 +113,10 @@ export function migrate(raw) {
     f.bindings ??= {};
     if (!raw.version && f.space && f.token && !Object.values(f.spaces).some((m) => m.name === f.space && m.relay === f.relay)) {
         const id = legacySpaceId(f.relay, f.space);
-        f.spaces[id] = { id, name: f.space, relay: f.relay, token: f.token, joined_at: Date.now() };
+        f.spaces[id] = {
+            id, name: f.space, relay: f.relay, token: f.token, joined_at: Date.now(),
+            ...(raw.pinTeam ? { pin_team: raw.pinTeam } : {}), ...(raw.joinedWith ? { since: raw.joinedWith } : {}),
+        };
         f.default_space ??= id;
     }
     if (f.default_space && !f.spaces[f.default_space])
@@ -125,6 +129,8 @@ export function migrate(raw) {
 export function loadAll() {
     if (!existsSync(CONFIG_PATH))
         return null;
+    if (!statSync(CONFIG_PATH).isFile())
+        throw new Error(`${CONFIG_PATH} is not a plain file — remove it and set up again (pantheon doctor)`);
     return migrate(JSON.parse(readFileSync(CONFIG_PATH, "utf8").replace(/^\uFEFF/, "")));
 }
 export function saveAll(f) {
@@ -250,7 +256,10 @@ function view(f, m, repo) {
         publicKey: f.publicKey, privateKey: f.privateKey,
         ...(f.display ? { display: f.display } : {}), ...(f.agent ? { agent: f.agent } : {}),
         ...(f.account ? { account: f.account } : {}), ...(f.pendingAuth ? { pendingAuth: f.pendingAuth } : {}),
-        ...(m.id.startsWith("legacy:") ? {} : { spaceId: m.id }),
+        ...(f.delegate ? { delegate: f.delegate } : {}),
+        ...(m.since ? { joinedWith: m.since } : {}),
+        ...(m.pin_team ? { pinTeam: m.pin_team } : {}),
+        ...(m.id.startsWith("legacy:") ? (f.spaceId ? { spaceId: f.spaceId } : {}) : { spaceId: m.id }),
         ...(repo ? { repo: repo.fingerprint, ...(repo.origin ? { repoOrigin: repo.origin } : {}) } : {}),
     };
 }
@@ -261,18 +270,23 @@ function envView(onDisk) {
     const e = process.env;
     if (!(e.PANTHEON_RELAY && e.PANTHEON_SPACE && e.PANTHEON_MEMBER))
         return null;
-    const token = e.PANTHEON_TOKEN ?? (onDisk?.member === e.PANTHEON_MEMBER
-        ? Object.values(onDisk.spaces ?? {}).find((m) => (e.PANTHEON_SPACE_ID && m.id === e.PANTHEON_SPACE_ID) || (m.relay === e.PANTHEON_RELAY && m.name === e.PANTHEON_SPACE))?.token
-        : undefined);
+    const mine = onDisk?.member === e.PANTHEON_MEMBER
+        ? Object.values(onDisk.spaces ?? {}).find((m) => (e.PANTHEON_SPACE_ID && m.id === e.PANTHEON_SPACE_ID) || (m.relay === e.PANTHEON_RELAY && m.name === e.PANTHEON_SPACE))
+        : undefined;
+    const token = e.PANTHEON_TOKEN ?? mine?.token;
     if (!token)
         return null;
     const pub = e.PANTHEON_PUBKEY ?? onDisk?.publicKey;
     const priv = e.PANTHEON_PRIVKEY ?? onDisk?.privateKey;
-    if (!pub || !priv)
+    const delegate = onDisk?.member === e.PANTHEON_MEMBER ? onDisk?.delegate : undefined;
+    if (!pub || (!priv && !delegate))
         return null;
     return {
         relay: e.PANTHEON_RELAY, space: e.PANTHEON_SPACE, token, member: e.PANTHEON_MEMBER,
-        publicKey: pub, privateKey: priv, display: e.PANTHEON_DISPLAY, agent: e.PANTHEON_AGENT,
+        publicKey: pub, privateKey: priv ?? "", display: e.PANTHEON_DISPLAY, agent: e.PANTHEON_AGENT,
+        ...(delegate ? { delegate } : {}),
+        ...(mine?.pin_team ? { pinTeam: mine.pin_team } : {}),
+        ...(mine?.since ? { joinedWith: mine.since } : {}),
         ...(e.PANTHEON_SPACE_ID ? { spaceId: e.PANTHEON_SPACE_ID } : {}),
         ...(e.PANTHEON_REPO ? { repo: e.PANTHEON_REPO } : {}),
     };
@@ -295,6 +309,14 @@ export function resolveFor(cwd = process.cwd(), opts = {}) {
                 return { cfg: applyAgentEnv(view(f, m, repo)), reason: "binding", memberships: n, binding: { ...b, fingerprint: repo.fingerprint }, repo };
             return { cfg: null, reason: "stale", memberships: n, binding: { ...b, fingerprint: repo.fingerprint }, repo };
         }
+        const owners = f.unbound?.includes(repo.fingerprint) ? [] : Object.values(spaces).filter((m) => m.repos?.some((r) => r.fp === repo.fingerprint));
+        if (owners.length === 1) {
+            const m = owners[0];
+            const binding = { space: m.id, path: repo.root, origin: repo.origin, bound_at: 0, fingerprint: repo.fingerprint };
+            return { cfg: applyAgentEnv(view(f, m, repo)), reason: "binding", memberships: n, binding, repo, autoBound: true };
+        }
+        if (owners.length > 1)
+            return { cfg: null, reason: "unbound", memberships: n, repo, claimedBy: owners.map((m) => m.name) };
     }
     if (!repo) {
         const fb = folderBinding(f, cwd);
@@ -402,6 +424,34 @@ export function save(cfg) {
     }
     return saveAll(f);
 }
+export function rememberTeamRepos(team, repos) {
+    if (!existsSync(CONFIG_PATH))
+        return false;
+    const next = repos.map((r) => ({ fp: r.fingerprint, name: r.origin ? teamRepoName(r.origin) : r.fingerprint })).sort((a, b) => a.fp.localeCompare(b.fp));
+    try {
+        return withConfigLock(() => {
+            let f;
+            try {
+                f = loadAll();
+            }
+            catch {
+                return false;
+            }
+            const m = f && Object.values(f.spaces ?? {}).find((x) => (team.spaceId && x.id === team.spaceId) || (x.name === team.space && x.relay === team.relay));
+            if (!f || !m)
+                return false;
+            if (JSON.stringify(m.repos ?? []) === JSON.stringify(next))
+                return false;
+            m.repos = next;
+            saveAll(f);
+            return true;
+        });
+    }
+    catch {
+        return false;
+    }
+}
+export const teamRepoName = (origin) => repoName(origin);
 export function updateMembershipToken(space, oldToken, newToken) {
     if (!space || !oldToken || !newToken || oldToken === newToken)
         return false;
@@ -430,6 +480,24 @@ export function updateMembershipToken(space, oldToken, newToken) {
         return true;
     });
 }
+export function adoptSpaceId(relay, name, id) {
+    if (!/^[A-Za-z0-9_:.-]{1,64}$/.test(id) || !existsSync(CONFIG_PATH))
+        return false;
+    const f = loadAll();
+    if (!f?.spaces)
+        return false;
+    const legacy = legacySpaceId(relay, name);
+    const m = f.spaces[legacy];
+    if (!m)
+        return false;
+    if (f.spaces[id])
+        return "conflict";
+    delete f.spaces[legacy];
+    f.spaces[id] = { ...m, id, pin_team: m.pin_team ?? `${name}@${relay}` };
+    adoptId(f, legacy, id);
+    saveAll(f);
+    return true;
+}
 function adoptId(f, oldId, newId) {
     for (const b of Object.values(f.bindings ?? {}))
         if (b.space === oldId)
@@ -476,6 +544,8 @@ export function bindRepo(repo, spaceId) {
     f.bindings ??= {};
     const prev = f.bindings[repo.fingerprint] ?? null;
     f.bindings[repo.fingerprint] = { space: spaceId, path: repo.root, origin: repo.origin, bound_at: Date.now() };
+    if (f.unbound?.includes(repo.fingerprint))
+        f.unbound = f.unbound.filter((x) => x !== repo.fingerprint);
     saveAll(f);
     return { replaced: prev && prev.space !== spaceId ? prev : null };
 }
@@ -484,6 +554,8 @@ export function unbindRepo(fingerprint) {
     if (!f?.bindings?.[fingerprint])
         return false;
     delete f.bindings[fingerprint];
+    if (/^[rl]_/.test(fingerprint))
+        f.unbound = [...new Set([...(f.unbound ?? []), fingerprint])].slice(-200);
     saveAll(f);
     return true;
 }

package/dist/continued.js

@@ -1,16 +1,18 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CONFIG_DIR } from "./config.js";
+import { readStateFile, withFileLock } from "./file-lock.js";
+import { writeWhole } from "./pins.js";
 const KEEP = 500;
 export function continuedPath(home) {
     return join(home ?? CONFIG_DIR, "continued.json");
 }
 function readAll(home) {
     try {
-        const p = continuedPath(home);
-        if (!existsSync(p))
+        const t = readStateFile(continuedPath(home));
+        if (t === null)
             return {};
-        const v = JSON.parse(readFileSync(p, "utf8"));
+        const v = JSON.parse(t);
         return v && typeof v === "object" ? v : {};
     }
     catch {
@@ -20,15 +22,45 @@ function readAll(home) {
 export function loadContinued(space, home) {
     return new Set(readAll(home)[space] ?? []);
 }
+export function handledIn(h) {
+    return [...new Set(Object.values(readAll(h)).flatMap((l) => (Array.isArray(l) ? l : [])).filter((x) => typeof x === "string" && x.startsWith("handled:")))];
+}
 export function markContinued(space, id, home) {
     try {
-        const all = readAll(home);
-        const list = (all[space] ?? []).filter((x) => x !== id);
-        list.push(id);
-        all[space] = list.slice(-KEEP);
         const p = continuedPath(home);
-        mkdirSync(dirname(p), { recursive: true });
-        writeFileSync(p, JSON.stringify(all));
+        const write = () => {
+            const all = readAll(home);
+            const list = (all[space] ?? []).filter((x) => x !== id);
+            list.push(id);
+            all[space] = list.slice(-KEEP);
+            mkdirSync(dirname(p), { recursive: true });
+            writeWhole(p, JSON.stringify(all));
+        };
+        try {
+            withFileLock(p, write);
+        }
+        catch {
+            write();
+        }
+    }
+    catch { }
+}
+export function unmarkContinued(space, id, home) {
+    try {
+        const p = continuedPath(home);
+        const write = () => {
+            const all = readAll(home);
+            if (!(all[space] ?? []).includes(id))
+                return;
+            all[space] = (all[space] ?? []).filter((x) => x !== id);
+            writeWhole(p, JSON.stringify(all));
+        };
+        try {
+            withFileLock(p, write);
+        }
+        catch {
+            write();
+        }
     }
     catch { }
 }