@join-pantheon/cli 0.30.0 → 0.31.0

package/dist/home-guard.js

@@ -1,15 +1,21 @@
 import { createHash } from "node:crypto";
-import { readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { parseJsonText } from "./text-file.js";
+import { withFileLock } from "./file-lock.js";
+import { writeWhole } from "./pins.js";
 export const POLICY_FILE = "worker-policy.json";
 export const PROFILE_FILE = "profile.json";
 export const HUD_FILE = join("bin", ".hud-action.json");
 export const CONFIG_FILE = "config.json";
-export const GUARDED_FILES = [POLICY_FILE, CONFIG_FILE, PROFILE_FILE, HUD_FILE];
+export const CONTINUED_FILE = "continued.json";
+export const CURSOR_FILE = "worker-cursor.json";
+export const PINS_FILE = "keys.json";
+export const NONCES_FILE = "nonces.json";
+export const GUARDED_FILES = [POLICY_FILE, CONFIG_FILE, PROFILE_FILE, HUD_FILE, CONTINUED_FILE, CURSOR_FILE, PINS_FILE, NONCES_FILE];
 const sha = (b) => createHash("sha256").update(b).digest("hex");
 const read = (f) => { try {
-    return readFileSync(f);
+    return statSync(f).isFile() ? readFileSync(f) : null;
 }
 catch {
     return null;
@@ -24,9 +30,15 @@ const parse = (b) => {
     }
 };
 const trusted = new Map();
-export function trustWrite(file) {
-    const b = read(file);
+const runBaseline = new Map();
+export function trustWrite(file, prev) {
     const k = resolve(file);
+    if (prev !== undefined && runBaseline.has(k)) {
+        const ph = prev ? sha(prev) : null;
+        if (ph !== runBaseline.get(k) && !trusted.get(k)?.has(ph ?? "absent"))
+            return;
+    }
+    const b = read(file);
     const set = trusted.get(k) ?? new Set();
     set.add(b ? sha(b) : "absent");
     if (set.size > 50)
@@ -34,7 +46,10 @@ export function trustWrite(file) {
     trusted.set(k, set);
 }
 export function snapshotHome(home, files = GUARDED_FILES) {
-    return { home, files: files.map((rel) => { const b = read(join(home, rel)); return { rel, bytes: b, hash: b ? sha(b) : null }; }) };
+    const s = { home, at: Date.now(), files: files.map((rel) => { const b = read(join(home, rel)); return { rel, bytes: b, hash: b ? sha(b) : null }; }) };
+    for (const f of s.files)
+        runBaseline.set(resolve(join(home, f.rel)), f.hash);
+    return s;
 }
 export function changedKeys(a, b, prefix = "", depth = 0) {
     const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
@@ -54,7 +69,8 @@ export function changedKeys(a, b, prefix = "", depth = 0) {
 }
 const obj = (x) => (x && typeof x === "object" && !Array.isArray(x) ? x : {});
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-export function narrowPolicy(before, now) {
+export const askedHere = new Set();
+export function narrowPolicy(before, now, keepAsks = askedHere) {
     const b = obj(before);
     const keys = [];
     const out = { ...now };
@@ -94,6 +110,91 @@ export function narrowPolicy(before, now) {
             keys.push(`denied.${cap} removed`);
         }
     out.denied = denied;
+    const bk = obj(b.asks), nk = obj(now.asks);
+    const pending = {};
+    for (const [cap, q] of Object.entries(nk)) {
+        if (!(cap in bk)) {
+            keys.push(`asks.${cap} added`);
+            continue;
+        }
+        if (!same(bk[cap], q)) {
+            keys.push(`asks.${cap} changed`);
+            pending[cap] = bk[cap];
+            continue;
+        }
+        pending[cap] = q;
+    }
+    if ("asks" in now || Object.keys(pending).length)
+        out.asks = pending;
+    const bo = obj(b.wakeOnce), no = obj(now.wakeOnce);
+    const once = {};
+    for (const [k, n] of Object.entries(no)) {
+        const was = typeof bo[k] === "number" ? bo[k] : 0;
+        if (typeof n === "number" && n > was) {
+            keys.push(`wakeOnce.${k} raised`);
+            if (was > 0)
+                once[k] = was;
+            continue;
+        }
+        once[k] = n;
+    }
+    if ("wakeOnce" in now || Object.keys(once).length)
+        out.wakeOnce = once;
+    const bn = obj(b.wakeNo), nn = obj(now.wakeNo);
+    const wakeNo = { ...nn };
+    for (const [k, at] of Object.entries(bn)) {
+        if (!(k in nn) || (typeof at === "number" && typeof nn[k] === "number" && nn[k] < at)) {
+            wakeNo[k] = at;
+            keys.push(`wakeNo.${k} lifted`);
+        }
+    }
+    const ba = obj(b.wakeAsks), na = obj(now.wakeAsks);
+    const asks = {};
+    for (const [id, q] of Object.entries(na)) {
+        if (!(id in ba)) {
+            if (keepAsks.has(id)) {
+                asks[id] = q;
+                continue;
+            }
+            keys.push(`wakeAsks.${id} added`);
+            continue;
+        }
+        if (!same(ba[id], q)) {
+            keys.push(`wakeAsks.${id} changed`);
+            asks[id] = ba[id];
+            continue;
+        }
+        asks[id] = q;
+    }
+    if ("wakeAsks" in now || Object.keys(asks).length)
+        out.wakeAsks = asks;
+    for (const f of ["wakersCarried", "wakersDeferred"]) {
+        const bf = obj(b[f]), nf = obj(now[f]);
+        const merged = { ...nf };
+        let lost = 0;
+        for (const [k, v] of Object.entries(bf))
+            if (!(k in nf) || !same(nf[k], v)) {
+                merged[k] = v;
+                lost++;
+            }
+        if (lost) {
+            out[f] = merged;
+            keys.push(`${f}: ${lost} removed`);
+        }
+    }
+    const bt = obj(b.wakeTeamFlag), nt = obj(now.wakeTeamFlag);
+    const flags = {};
+    for (const [k, v] of Object.entries(nt)) {
+        if (!(k in bt)) {
+            keys.push(`wakeTeamFlag.${k} added`);
+            continue;
+        }
+        flags[k] = v;
+    }
+    if ("wakeTeamFlag" in now)
+        out.wakeTeamFlag = flags;
+    if ("wakeNo" in now || Object.keys(wakeNo).length)
+        out.wakeNo = wakeNo;
     return { policy: out, keys };
 }
 export function narrowConfig(before, now) {
@@ -112,32 +213,205 @@ export function narrowConfig(before, now) {
             keys.push(`spaces.${id}.relay changed`);
         }
     }
+    for (const [id, was] of Object.entries(bs)) {
+        const w = obj(was), m = obj(spaces[id]);
+        if (id in spaces && w.since !== undefined && m.since !== w.since) {
+            spaces[id] = { ...m, since: w.since };
+            keys.push(`spaces.${id}.since changed`);
+        }
+    }
+    const ids = new Set(Object.values(bs).map((m) => obj(m).id).filter((x) => typeof x === "string"));
+    for (const id of Object.keys(spaces))
+        if (!(id in bs)) {
+            delete spaces[id];
+            keys.push(`spaces.${id} added${ids.has(obj(ns[id]).id) ? " (a second entry for an existing team)" : ""}`);
+        }
+    for (const [id, m] of Object.entries(spaces)) {
+        const w = obj(bs[id]);
+        if (w.id !== undefined && obj(m).id !== w.id) {
+            spaces[id] = { ...obj(m), id: w.id };
+            keys.push(`spaces.${id}.id changed`);
+        }
+        if (w.name !== undefined && obj(spaces[id]).name !== w.name) {
+            spaces[id] = { ...obj(spaces[id]), name: w.name };
+            keys.push(`spaces.${id}.name changed`);
+        }
+    }
     if ("spaces" in now)
         out.spaces = spaces;
+    if (now.default_space !== before.default_space) {
+        out.default_space = before.default_space;
+        keys.push("default_space changed");
+    }
+    if (!same(obj(now.network).proxy, obj(before.network).proxy)) {
+        out.network = { ...obj(now.network), proxy: obj(before.network).proxy };
+        if (obj(before.network).proxy === undefined)
+            delete out.network.proxy;
+        keys.push("network.proxy changed");
+    }
+    const bb = obj(before.bindings), nb = obj(now.bindings);
+    const bindings = {};
+    for (const [k, v] of Object.entries(nb)) {
+        if (!(k in bb)) {
+            keys.push(`bindings.${k} added`);
+            continue;
+        }
+        if (!same(bb[k], v)) {
+            keys.push(`bindings.${k} changed`);
+            bindings[k] = bb[k];
+            continue;
+        }
+        bindings[k] = v;
+    }
+    if ("bindings" in now || Object.keys(bindings).length)
+        out.bindings = bindings;
+    const bu = Array.isArray(before.unbound) ? before.unbound : [];
+    const nu = Array.isArray(now.unbound) ? now.unbound : [];
+    const lifted = bu.filter((x) => !nu.includes(x));
+    if (lifted.length) {
+        out.unbound = [...nu, ...lifted];
+        keys.push(`unbound: ${lifted.length} taken off`);
+    }
     return { config: out, keys };
 }
+export function narrowPins(before, now) {
+    const b = obj(before), n = obj(now);
+    const keys = [];
+    const bt = obj(b.teams), nt = obj(n.teams);
+    const teams = {};
+    for (const id of new Set([...Object.keys(bt), ...Object.keys(nt)])) {
+        const was = obj(bt[id]), is = obj(nt[id]);
+        const wm = obj(was.members), im = obj(is.members);
+        const members = {};
+        for (const [m, pin] of Object.entries(im)) {
+            if (!(m in wm)) {
+                keys.push(`${id}.${m} pinned during the run`);
+                continue;
+            }
+            const w = obj(wm[m]), p = obj(pin);
+            const pendingOk = same(p.pending ?? null, w.pending ?? null);
+            if (p.fp !== w.fp || p.key !== w.key) {
+                members[m] = { ...w };
+                keys.push(`${id}.${m} key changed`);
+                continue;
+            }
+            if (!pendingOk) {
+                const { pending: _p, ...rest } = obj(pin);
+                members[m] = { ...rest, ...(w.pending ? { pending: w.pending } : {}) };
+                keys.push(`${id}.${m} held-back key changed during the run`);
+                continue;
+            }
+            if (w.signs && !p.signs) {
+                members[m] = { ...p, signs: w.signs };
+                keys.push(`${id}.${m} signing forgotten`);
+                continue;
+            }
+            members[m] = pin;
+        }
+        for (const [m, pin] of Object.entries(wm))
+            if (!(m in im)) {
+                members[m] = pin;
+                keys.push(`${id}.${m} unpinned`);
+            }
+        const t = { ...is, members };
+        if (was.sigs && !is.sigs) {
+            t.sigs = was.sigs;
+            keys.push(`${id}: signatures turned off`);
+        }
+        if (is.spaceId !== was.spaceId) {
+            if (was.spaceId === undefined)
+                delete t.spaceId;
+            else
+                t.spaceId = was.spaceId;
+            keys.push(`${id}: team id changed`);
+        }
+        teams[id] = t;
+    }
+    return { value: { ...n, v: 1, teams }, keys };
+}
+export function narrowNonces(before, now) {
+    const b = obj(before), n = obj(now);
+    const out = { ...n };
+    let lost = 0;
+    for (const [team, entries] of Object.entries(b)) {
+        const cur = { ...obj(n[team]) };
+        const forward = (c, w) => same(c, w) || (Array.isArray(c) && Array.isArray(w) && c[0] === w[0] && c[1] === w[1]
+            && (c[2] ?? null) === (w[2] ?? null) && typeof c[3] === "number" && (w[3] === undefined || w[3] === c[3]));
+        for (const [k, v] of Object.entries(obj(entries)))
+            if (!(k in cur) || !forward(cur[k], v)) {
+                cur[k] = v;
+                lost++;
+            }
+        out[team] = cur;
+    }
+    return { value: out, keys: lost ? [`${lost} seen request${lost === 1 ? "" : "s"} forgotten`] : [] };
+}
 const WAKE_ORDER = { no: 0, approved: 1, anyone: 2 };
 export function narrowProfile(before, now) {
     const bw = obj(obj(before).agent).wake_default, nw = obj(now.agent).wake_default;
-    const rank = (v) => (typeof v === "string" && v in WAKE_ORDER ? WAKE_ORDER[v] : WAKE_ORDER.approved);
-    if (rank(nw) <= rank(bw))
-        return { profile: now, keys: [] };
+    const rank = (v) => (typeof v === "string" && v in WAKE_ORDER ? WAKE_ORDER[v] : WAKE_ORDER.anyone);
     const agent = { ...obj(now.agent) };
-    if (bw === undefined)
-        delete agent.wake_default;
-    else
+    const keys = [];
+    const ba = obj(obj(before).agent);
+    if (bw !== undefined && nw === undefined) {
         agent.wake_default = bw;
-    return { profile: { ...now, agent }, keys: [`agent.wake_default loosened to ${String(nw)}`] };
+        keys.push("agent.wake_default removed");
+    }
+    else if (rank(nw) > rank(bw)) {
+        if (bw === undefined)
+            delete agent.wake_default;
+        else
+            agent.wake_default = bw;
+        keys.push(`agent.wake_default loosened to ${String(nw)}`);
+    }
+    if (agent.allow_bash === true && ba.allow_bash !== true) {
+        if (ba.allow_bash === undefined)
+            delete agent.allow_bash;
+        else
+            agent.allow_bash = ba.allow_bash;
+        keys.push("agent.allow_bash turned on");
+    }
+    else if (ba.allow_bash === false && agent.allow_bash !== false) {
+        agent.allow_bash = false;
+        keys.push("agent.allow_bash no removed");
+    }
+    if (agent.wake_enabled === true && ba.wake_enabled === false) {
+        agent.wake_enabled = false;
+        keys.push("agent.wake_enabled turned on");
+    }
+    if (!same(agent.primary_surface, ba.primary_surface) && ba.primary_surface !== undefined) {
+        agent.primary_surface = ba.primary_surface;
+        keys.push("agent.primary_surface changed");
+    }
+    return keys.length ? { profile: { ...now, agent }, keys } : { profile: now, keys: [] };
 }
 export function restoreHome(s) {
     const out = [];
+    const takesFiles = () => { const p = join(s.home, `.write-check.${process.pid}.${Date.now()}`); try {
+        writeFileSync(p, "", { flag: "wx", mode: 0o600 });
+        rmSync(p, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    } };
+    if (!takesFiles()) {
+        try {
+            chmodSync(s.home, 0o700);
+        }
+        catch { }
+        out.push(takesFiles() ? { rel: "the Pantheon folder", what: "reverted", keys: ["made read-only"] } : { rel: "the Pantheon folder", what: "reported", keys: ["cannot take new files — fix its permissions"] });
+    }
+    for (const f of s.files)
+        runBaseline.delete(resolve(join(s.home, f.rel)));
     for (const f of s.files) {
         const file = join(s.home, f.rel);
         const now = read(file);
         const hashNow = now ? sha(now) : null;
         if (hashNow === f.hash)
             continue;
-        if (trusted.get(resolve(file))?.has(hashNow ?? "absent"))
+        const alwaysNarrow = f.rel === POLICY_FILE || f.rel === PROFILE_FILE || f.rel === CONFIG_FILE || f.rel === CONTINUED_FILE || f.rel === CURSOR_FILE || f.rel === PINS_FILE || f.rel === NONCES_FILE;
+        if (!alwaysNarrow && trusted.get(resolve(file))?.has(hashNow ?? "absent"))
             continue;
         try {
             if (f.rel === HUD_FILE) {
@@ -147,6 +421,11 @@ export function restoreHome(s) {
                 }
                 continue;
             }
+            try {
+                if (!statSync(file).isFile())
+                    rmSync(file, { recursive: true, force: true });
+            }
+            catch { }
             const a = parse(f.bytes), b = parse(now);
             if (f.rel === POLICY_FILE) {
                 if (!b) {
@@ -164,6 +443,82 @@ export function restoreHome(s) {
                 }
                 continue;
             }
+            const locked = (fn) => {
+                if (!(f.rel === PINS_FILE || f.rel === NONCES_FILE || f.rel === CONTINUED_FILE))
+                    return fn();
+                let ran = false;
+                try {
+                    withFileLock(file, () => { ran = true; fn(); });
+                }
+                catch (e) {
+                    if (ran)
+                        throw e;
+                    fn();
+                }
+            };
+            const put = (text) => { try {
+                writeWhole(file, text);
+            }
+            catch {
+                writeFileSync(file, text, { mode: 0o600 });
+            } };
+            if (f.rel === PINS_FILE || f.rel === NONCES_FILE) {
+                locked(() => {
+                    const cur = parse(read(file));
+                    const n = f.rel === PINS_FILE ? narrowPins(a, cur) : narrowNonces(a, cur);
+                    if (n.keys.length) {
+                        put(JSON.stringify(n.value, null, 2) + "\n");
+                        trustWrite(file);
+                        out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                    }
+                });
+                continue;
+            }
+            if (f.rel === CONTINUED_FILE || f.rel === CURSOR_FILE)
+                locked(() => {
+                    const before = obj(a), now = obj(parse(read(file)));
+                    const merged = { ...now };
+                    let lost = 0;
+                    for (const [k, v] of Object.entries(before)) {
+                        if (f.rel === CURSOR_FILE) {
+                            if (typeof v === "number" && !(typeof now[k] === "number" && now[k] >= v)) {
+                                merged[k] = v;
+                                lost++;
+                            }
+                        }
+                        else if (Array.isArray(v)) {
+                            const cur = Array.isArray(now[k]) ? now[k] : [];
+                            const back = v.filter((x) => !cur.includes(x));
+                            if (back.length) {
+                                merged[k] = [...back, ...cur];
+                                lost += back.length;
+                            }
+                        }
+                    }
+                    let sentDropped = 0;
+                    if (f.rel === CONTINUED_FILE)
+                        for (const [k, v] of Object.entries(merged)) {
+                            if (!k.endsWith(" sent") || !Array.isArray(v))
+                                continue;
+                            const was = Array.isArray(before[k]) ? before[k] : [];
+                            const kept = v.filter((x) => was.includes(x));
+                            if (kept.length !== v.length) {
+                                merged[k] = kept;
+                                sentDropped += v.length - kept.length;
+                            }
+                        }
+                    if (sentDropped && !lost) {
+                        put(JSON.stringify(merged) + "\n");
+                        trustWrite(file);
+                    }
+                    if (lost) {
+                        put(JSON.stringify(merged) + "\n");
+                        trustWrite(file);
+                        out.push({ rel: f.rel, what: "reverted", keys: [f.rel === CURSOR_FILE ? "read position moved back" : `${lost} handled request${lost === 1 ? "" : "s"} unmarked`] });
+                    }
+                });
+            if (f.rel === CONTINUED_FILE || f.rel === CURSOR_FILE)
+                continue;
             if (f.rel === PROFILE_FILE) {
                 if (!b)
                     continue;
@@ -182,7 +537,7 @@ export function restoreHome(s) {
                     trustWrite(file);
                     out.push({ rel: f.rel, what: "reverted", keys: n.keys });
                 }
-                const rest = changedKeys(a, n.config).filter((k) => !/privateKey|token/i.test(k)).slice(0, 20);
+                const rest = changedKeys(a, n.config).filter((k) => !/privateKey|token/i.test(k) && !/^spaces\.[^.]+\.repos\b/.test(k)).slice(0, 20);
                 if (rest.length)
                     out.push({ rel: f.rel, what: "reported", keys: rest });
             }
@@ -205,6 +560,6 @@ export function describeChange(c) {
         return `${c.rel} was written while the run could write it — removed, not acted on`;
     if (c.what === "reported")
         return `${c.rel} changed while the run was going${c.keys.length ? ` (${c.keys.join(", ")})` : ""} — left as it is; if you did not change it, check it`;
-    return `${c.rel}: what the run widened was taken back (${c.keys.join(", ")}) — if you did that yourself during the run, do it again`;
+    return `${c.rel}: what was widened while the run was going was taken back (${c.keys.join(", ")}) — if you did that yourself, do it again`;
 }
 //# sourceMappingURL=home-guard.js.map

package/dist/identity.js

@@ -1,4 +1,4 @@
-import { generateKeyPairSync, sign, verify, createPublicKey, randomBytes } from "node:crypto";
+import { generateKeyPairSync, sign, verify, createPublicKey, randomBytes, createHash } from "node:crypto";
 export function newKeypair() {
     const { publicKey, privateKey } = generateKeyPairSync("ed25519");
     return {
@@ -88,8 +88,84 @@ export function verifyRead(publicKeyB64, method, path, params, signatureB64) {
         return false;
     }
 }
+export function canonicalKey(publicKeyB64) {
+    if (typeof publicKeyB64 !== "string" || publicKeyB64.length > 200)
+        return null;
+    try {
+        const raw = Buffer.from(publicKeyB64, "base64");
+        if (raw.length !== 44 || raw.toString("base64") !== publicKeyB64)
+            return null;
+        const k = createPublicKey({ key: raw, format: "der", type: "spki" });
+        if (k.asymmetricKeyType !== "ed25519")
+            return null;
+        const again = k.export({ type: "spki", format: "der" });
+        return again.equals(raw) ? publicKeyB64 : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function fingerprint(publicKeyB64) {
     const raw = Buffer.from(publicKeyB64, "base64").subarray(-16).toString("hex");
     return (raw.match(/.{4}/g) ?? []).join("-");
 }
+const sha256hex = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+export function canonicalJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v ?? null);
+    if (Array.isArray(v))
+        return `[${v.map(canonicalJson).join(",")}]`;
+    const o = v;
+    return `{${Object.keys(o).filter((k) => o[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+}
+export function newActId() { return `a_${Date.now().toString(36)}${randomBytes(9).toString("hex")}`; }
+export function actPayload(f) {
+    const list = (a, none) => (a && a.length ? [...a].sort().join(",") : none);
+    return Buffer.from([
+        "pantheon-act/1", f.id, f.team, f.member, f.keyRole, f.nonce, String(f.ts),
+        f.act, f.goal ?? "-", f.ref ?? "-", f.to === null ? "*" : list(f.to, "*"),
+        f.defers_to ?? "-", list(f.affects, "-"), f.repo ?? "-",
+        f.summary ? sha256hex(f.summary) : "-",
+        sha256hex(f.body),
+        sha256hex(canonicalJson(f.meta ?? {})),
+    ].join("\n"), "utf8");
+}
+export function goalPayload(f) {
+    return Buffer.from([
+        "pantheon-goal/1", f.id, f.team, f.member, f.keyRole, f.nonce, String(f.ts),
+        sha256hex(f.title), sha256hex(f.acceptance), f.invite === null ? "*" : [...new Set(f.invite)].sort().join(",") || "-",
+        f.budget == null ? "-" : String(f.budget), f.deadline == null ? "-" : String(f.deadline), f.kind ?? "-",
+    ].join("\n"), "utf8");
+}
+export function delegatePayload(team, member, subFp, run, expires) {
+    return Buffer.from(`pantheon-delegate/1\n${team}\n${member}\nrun\n${subFp}\n${run}\n${expires}`, "utf8");
+}
+function privKey(b64) { return { key: Buffer.from(b64, "base64"), format: "der", type: "pkcs8" }; }
+function pubKey(b64) { return createPublicKey({ key: Buffer.from(b64, "base64"), format: "der", type: "spki" }); }
+export function signBytes(privateKeyB64, payload) {
+    return sign(null, payload, privKey(privateKeyB64)).toString("base64");
+}
+export function verifyBytes(publicKeyB64, payload, signatureB64) {
+    try {
+        return verify(null, payload, pubKey(publicKeyB64), Buffer.from(signatureB64, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+export function signDelegate(memberPrivateKeyB64, team, member, subPub, run, expires) {
+    return { pub: subPub, run, expires, sig: signBytes(memberPrivateKeyB64, delegatePayload(team, member, fingerprint(subPub), run, expires)) };
+}
+export function verifyDelegate(memberPublicKeyB64, team, member, cert, at = Date.now(), skewMs = 10 * 60_000) {
+    if (!cert || typeof cert.pub !== "string" || typeof cert.sig !== "string" || typeof cert.run !== "string" || !Number.isFinite(cert.expires))
+        return false;
+    if (!canonicalKey(cert.pub) || !canonicalKey(memberPublicKeyB64))
+        return false;
+    if (at > cert.expires + skewMs)
+        return false;
+    return verifyBytes(memberPublicKeyB64, delegatePayload(team, member, fingerprint(cert.pub), cert.run, cert.expires), cert.sig);
+}
+export function newActNonce() {
+    return randomBytes(16).toString("base64url");
+}
 //# sourceMappingURL=identity.js.map

package/dist/mcp-supervisor.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONFIG_DIR } from "./config.js";
@@ -78,7 +79,9 @@ export async function superviseMcp() {
                 pid: process.pid, child_pid: current?.proc.pid, cwd: process.cwd(), started: STARTED,
                 supervisor: VERSION, child_version: current?.version ?? "unknown", agent: process.env.PANTHEON_AGENT,
             };
-            writeFileSync(stateFile, JSON.stringify(s));
+            const tmp = `${stateFile}.${randomBytes(8).toString("hex")}.tmp`;
+            writeFileSync(tmp, JSON.stringify(s), { flag: "wx" });
+            renameSync(tmp, stateFile);
         }
         catch { }
     };