@join-pantheon/cli 0.30.0 → 0.31.0

package/dist/repo-route.js

@@ -0,0 +1,70 @@
+import { basename } from "node:path";
+export function repoName(originOrPath) {
+    const s = originOrPath.trim().replace(/[\\/]+$/, "").replace(/\.git$/i, "");
+    return safeName(basename(s.replace(/^.*[:/]([^:/]+)$/, "$1")) || s);
+}
+export function safeName(n) {
+    return n.normalize("NFKC").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|-+$/g, "").slice(0, 64) || "repo";
+}
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+export function names(text, name, origin, strict = false) {
+    if (!name)
+        return false;
+    const t = text.toLowerCase();
+    const n = name.toLowerCase();
+    if (origin) {
+        const slug = origin.toLowerCase().replace(/\.git$/, "").replace(/^.*?[:/]([^:/]+\/[^:/]+)$/, "$1");
+        if (slug.includes("/") && t.includes(slug))
+            return true;
+    }
+    const word = `(?<![\\w./-])${esc(n)}(?![\\w-])`;
+    if (n.length >= 5 && !strict && new RegExp(word, "i").test(t))
+        return true;
+    return new RegExp(`\`${esc(n)}\`|${word}\\s+(?:repo|repository|codebase|app|service|project)\\b|\\b(?:repo|repository|codebase)\\s+${esc(n)}(?![\\w-])|${word}/[\\w.-]`, "i").test(t);
+}
+export function explicitlyNames(text, name) {
+    if (!name)
+        return false;
+    const n = esc(name.toLowerCase());
+    const word = `(?<![\\w./-])${n}(?![\\w-])`;
+    return new RegExp(`${word}\\s+(?:repo|repository)\\b|\\b(?:repo|repository)\\s+${n}(?![\\w-])`, "i").test(text.toLowerCase());
+}
+export function routeRequest(i) {
+    const ws = i.workspaces;
+    if (!ws.length)
+        return { kind: "none", why: "no folder on this machine is bound to this team" };
+    const byFp = (fp) => (fp ? ws.find((w) => w.fp === fp) : undefined);
+    const teamName = (fp) => i.teamRepos.find((r) => r.fp === fp)?.name ?? fp;
+    const here = ws.map((w) => w.name);
+    const localFps = new Set(ws.map((w) => w.fp).filter(Boolean));
+    const notHere = i.teamRepos.filter((r) => !localFps.has(r.fp)).map((r) => r.name);
+    const max = i.maxContext ?? 2;
+    const activity = i.activity ?? (() => 0);
+    const withContext = (primary, why, prefer = []) => {
+        const others = ws.filter((w) => w !== primary && w.kind === "repo");
+        const ordered = [...prefer.filter((w) => w !== primary), ...others.filter((w) => !prefer.includes(w)).sort((a, b) => activity(b) - activity(a))];
+        return { kind: "run", primary, context: ordered.filter((w) => w.kind === "repo").slice(0, max), why, notHere };
+    };
+    const strict = (n) => !!i.teamName && n.toLowerCase() === i.teamName.toLowerCase();
+    const namedLocal = ws.filter((w) => names(i.text, w.name, w.origin, strict(w.name))).sort((a, b) => b.name.length - a.name.length);
+    const namedTeam = i.teamRepos.filter((r) => !localFps.has(r.fp) && explicitlyNames(i.ask ?? i.text, r.name)).sort((a, b) => b.name.length - a.name.length);
+    if (namedLocal.length) {
+        return withContext(namedLocal[0], `the request names ${namedLocal.map((w) => w.name).join(" and ")}`, namedLocal.slice(1));
+    }
+    if (namedTeam.length) {
+        return { kind: "missing", name: namedTeam[0].name, why: `the request is about ${namedTeam[0].name}, which is not on this machine`, here };
+    }
+    const delivered = byFp(i.deliveredRepo);
+    if (delivered)
+        return withContext(delivered, `this goal's work was delivered in ${delivered.name}`);
+    const sender = byFp(i.senderRepo);
+    if (sender)
+        return withContext(sender, `the request was sent from ${sender.name}`);
+    if (ws.length === 1) {
+        const note = i.senderRepo && !sender ? ` (it was sent from ${teamName(i.senderRepo)}, which is not on this machine)` : "";
+        return { kind: "run", primary: ws[0], context: [], why: `the only folder on this machine bound to this team${note}`, notHere };
+    }
+    const primary = [...ws].sort((a, b) => activity(b) - activity(a))[0];
+    return withContext(primary, `nothing in the request says which, so the most recently active (${primary.name}), with the others open to read`);
+}
+//# sourceMappingURL=repo-route.js.map

package/dist/roster-file.js

@@ -230,8 +230,9 @@ export class Allowlist {
         if (Date.now() > inv.expires_at)
             return { ok: false, why: "that invite has expired — ask for a fresh one" };
         const existing = this.entries.get(member);
-        if (existing?.revoked_at && inv.created_at <= existing.revoked_at) {
-            return { ok: false, why: `"${member}" was removed from this team${existing.revoked_by ? ` by ${existing.revoked_by}` : ""}, so an invite from before that cannot bring them back — ask the founder for a new one` };
+        const removedAt = this.removedWhen(member);
+        if (removedAt !== null && (inv.created_at <= removedAt || (this.founderName && inv.created_by !== this.founderName))) {
+            return { ok: false, why: `"${member}" was removed from this team${existing?.revoked_by ? ` by ${existing.revoked_by}` : ""}, so only an invite from the founder${this.founderName ? ` (${this.founderName})` : ""}, made since, can bring them back` };
         }
         if (existing && existing.publicKey !== publicKey) {
             return {
@@ -251,6 +252,7 @@ export class Allowlist {
         };
         this.entries.set(member, entry);
         inv.used_by = member;
+        this.clearForgotten(member);
         inv.used_at = Date.now();
         this.flush();
         return { ok: true, entry };
@@ -346,6 +348,7 @@ export class Allowlist {
         if (!e.admitted || e.admitted_by === undefined)
             e.admitted_by = by;
         e.admitted = true;
+        this.clearForgotten(member);
         e.may_wake = mayWake;
         delete e.revoked_at;
         delete e.revoked_by;
@@ -361,8 +364,24 @@ export class Allowlist {
             if (i.created_by === member && !i.used_by)
                 this.invites.delete(t);
     }
+    removedWhen(member) {
+        const e = this.entries.get(member);
+        if (e?.revoked_at && !e.admitted)
+            return e.revoked_at;
+        const f = this.extra["forgotten"]?.[member];
+        return typeof f === "number" ? f : null;
+    }
+    clearForgotten(member) {
+        const f = this.extra["forgotten"];
+        if (f && member in f)
+            delete f[member];
+    }
     forget(member) {
         const gone = this.entries.delete(member);
+        if (gone) {
+            const f = (this.extra["forgotten"] ??= {});
+            f[member] = Date.now();
+        }
         this.cancelInvitesBy(member);
         if (gone) {
             this.removedAt = Date.now();

package/dist/run-failure.js

@@ -76,6 +76,8 @@ export function diagnoseRun(f, probe = gitProbe) {
             lines: [`cat ${shq(f.runLog)}`],
         };
     }
+    if (!f.branch && f.folder)
+        return silent(f);
     if (!f.branch) {
         return {
             cause: "not_a_repo",
@@ -85,6 +87,20 @@ export function diagnoseRun(f, probe = gitProbe) {
     }
     if (!f.allowBash && !(f.needsCommands || BLOCKED_RE.test(f.transcript ?? f.detail) || BLOCKED_RE.test(f.detail)))
         return silent(f);
+    if (!f.allowBash && f.commandsNeedSandbox === "agent-cmd") {
+        return {
+            cause: "no_sandbox_commands",
+            says: "Commands are on here, and this machine is set to keep runs of the agent the worker was started with (--agent-cmd) to edits, so the run edited files only.",
+            fix: "To have it run tests, commit and push too: pantheon policy grant unsandboxed-runs — or start the worker without --agent-cmd so Claude Code runs them in its sandbox.",
+        };
+    }
+    if (!f.allowBash && f.commandsNeedSandbox) {
+        return {
+            cause: "no_sandbox_commands",
+            says: "Commands are on here, and this machine is set to keep runs of this Claude Code (Windows, or older than 2.1.83) to edits, so the run edited files only.",
+            fix: "To have it run tests, commit and push too: pantheon policy grant unsandboxed-runs — or update Claude Code to 2.1.83 or later on macOS or Linux, which runs them in its sandbox.",
+        };
+    }
     if (!f.allowBash) {
         return {
             cause: "no_commands",

package/dist/service.js

@@ -322,7 +322,8 @@ export function serviceState(kind, exec = realExec, plat = platform(), uid = pro
         const dis = outOf(exec, "launchctl", ["print-disabled", `gui/${uid}`]).out;
         const disabled = new RegExp(`"${LABEL(kind).replace(/\./g, "\\.")}"\\s*=>\\s*(disabled|true)`).test(dis);
         const pr = outOf(exec, "launchctl", ["print", `gui/${uid}/${LABEL(kind)}`]);
-        return { disabled, loaded: pr.ok, running: pr.ok && /^\s*state = running/m.test(pr.out) };
+        const from = pr.ok ? /^\s*path = (.+)$/m.exec(pr.out)?.[1]?.trim() : undefined;
+        return { disabled, loaded: pr.ok, running: pr.ok && /^\s*state = running/m.test(pr.out), ...(from ? { from } : {}) };
     }
     const en = outOf(exec, "systemctl", ["--user", "is-enabled", `pantheon-${kind}`]).out.trim();
     const act = outOf(exec, "systemctl", ["--user", "is-active", `pantheon-${kind}`]).out.trim();
@@ -338,6 +339,11 @@ export function restartService(kind, exec = realExec, opts = {}) {
         return [`  ${kind}: left stopped (you stopped it) — start it again: pantheon service install ${kind}`];
     try {
         if (plat === "darwin") {
+            if (st.loaded && st.from && resolve(st.from) !== resolve(plistPath(kind)) && existsSync(plistPath(kind))) {
+                exec("launchctl", ["bootout", `gui/${uid}/${LABEL(kind)}`]);
+                exec("launchctl", ["bootstrap", `gui/${uid}`, plistPath(kind)]);
+                return [`  ${kind}: was running from ${st.from}, not this machine's own definition — reloaded from ${plistPath(kind)} on the new code`];
+            }
             if (st.loaded && !st.running)
                 return [`  ${kind}: not running — left as it is (launchd starts it again on its own schedule)`];
             if (!st.loaded) {

package/dist/setup-guide.js

@@ -7,6 +7,7 @@ import { applyProfileInit, loadProfile, profilePath, saveProfile, wakeMode } fro
 import { installService as realInstall, uninstallService as realUninstall, serviceInstalled as realInstalled } from "./service.js";
 import { personaDir } from "./persona.js";
 import { hudBinaryPath } from "./notifier.js";
+import { grant, inWokenRun, loadPolicy, revoke, savePolicy, unsandboxedAllowed } from "./worker-policy.js";
 export const DECISION_AREAS = [
     { id: "product", label: "Product — what we build, for whom, and what goes in a release" },
     { id: "engineering", label: "Engineering — architecture, and changes that cross team lines" },
@@ -19,8 +20,8 @@ export const DECISION_AREAS = [
 ];
 export const TITLE_OPTIONS = ["Founder", "Engineer", "Designer", "Product", "Operations", "Something else"];
 export const WAKE_OPTIONS = [
-    { id: "anyone", label: "Yes — anyone on my teams. Invites you send grant it; you can revoke a person any time." },
-    { id: "approved", label: "Only people I approve one by one (the default) — invites do not grant it; I run `pantheon wake allow <name>` per person, on this machine." },
+    { id: "anyone", label: "Yes — anyone on my teams (the default). Invites you send grant it; to stop one person later, switch to \"only people I approve\" and pantheon wake deny <name>." },
+    { id: "approved", label: "Only people I approve — I am asked the first time each one's request needs this machine, or approve ahead with pantheon wake allow <name>; invites never grant it." },
     { id: "no", label: "No — this machine only works while I am at it." },
 ];
 export const ALERT_OPTIONS = [
@@ -42,6 +43,7 @@ export function guideDefaults(profile, cfg) {
         persona: false,
     };
 }
+const andList = (xs) => xs.length < 2 ? xs.join("") : `${xs.slice(0, -1).join(", ")} and ${xs[xs.length - 1]}`;
 export function optOutsFrom(argv) {
     return { worker: argv.includes("--no-worker"), notifications: argv.includes("--no-notifications") };
 }
@@ -67,12 +69,11 @@ export function questionnaire() {
         "Ask your human in plain words, then pass the answers as flags — to `pantheon setup --yes`, or straight to",
         "`pantheon start` / `pantheon join`, which apply them the moment the team exists.",
         "",
-        "Only 3 and 4 need the person every time. Ask 2 whenever there is a repo (it is the one default people are",
-        "surprised by). The rest have defaults you may take and say out loud:",
-        "  --wake approved --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
-        "--wake approved (the default) means nobody wakes this machine until they approve a person with `pantheon wake allow <name>`.",
-        "Never pick --wake anyone for them: it is their call, and only if they say so.",
-        "Without a repo, --wake, --commands, --playbook and --base do nothing yet: skip them and say so.",
+        "Only 3 and 4 need the person. The rest have defaults you may take and say out loud:",
+        "  --wake anyone --commands yes --decides none --alerts decisions --playbook yes --base <what origin calls its default> --approve-all",
+        "--wake anyone (the default) means any teammate the team lets wake workers can start a run here while they are away; --commands yes (the default in a repo) means that run may run tests, commit and push to its own branch.",
+        "Codex, Cursor and Copilot answer those requests too, so teammates are never kept waiting; --unsandboxed no makes them wait for the person instead.",
+        "--commands, --playbook and --base are about a repo: skip them where nothing bound here is one (a docs folder), and say so.",
         "",
         "1. While they're away, may teammates hand work to this machine? (their agent runs here on its own,",
         "   in a separate copy of the repo, and delivers on a branch for review)",
@@ -122,6 +123,9 @@ export function parseSetupFlags(argv) {
     const commands = yn("commands");
     if (commands !== undefined)
         preset.commands = commands;
+    const unsandboxed = yn("unsandboxed");
+    if (unsandboxed !== undefined)
+        preset.unsandboxed = unsandboxed;
     const name = val("name");
     if (name !== undefined)
         preset.name = name.trim();
@@ -160,6 +164,7 @@ export function parseSetupFlags(argv) {
 }
 export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const optOut = ctx.optOut ?? {};
+    const serves = ctx.project ? { path: ctx.project, repos: true } : ctx.serves ?? null;
     const os = deps.platform ?? process.platform;
     const mac = os === "darwin";
     const install = deps.installService ?? realInstall;
@@ -168,29 +173,27 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const file = deps.profileFile ?? profilePath();
     const profile = loadProfile(ctx.cfg, file);
     const d = { ...guideDefaults(profile, ctx.cfg), ...preset };
+    if (profile.agent.allow_bash === undefined && preset.commands === undefined && serves?.repos)
+        d.commands = true;
     const a = { ...d };
     if (a.wake === "no") {
         a.commands = false;
         a.persona = false;
     }
     const applied = [], warnings = [];
+    const awayAgents = deps.unsandboxedAgents?.() ?? [];
     if (io) {
-        io.say("Three questions, then one screen of defaults. Enter keeps the suggested answer.\n");
+        io.say("A few questions, then one screen of defaults. Enter keeps the suggested answer.\n");
         a.name = (await io.ask("Your name, as teammates will see it", d.name)).trim() || d.name;
         const known = TITLE_OPTIONS.findIndex((t) => t.toLowerCase() === d.title.toLowerCase());
-        const t = await io.choose("Your role, in a word — it goes on the team directory", TITLE_OPTIONS, known >= 0 ? known : d.title ? TITLE_OPTIONS.length - 1 : 0);
+        const t = await io.choose("Your role, in a word — it goes on the team directory", TITLE_OPTIONS, known >= 0 ? known : d.title || !ctx.founder ? TITLE_OPTIONS.length - 1 : 0);
         a.title = t === TITLE_OPTIONS.length - 1 ? (await io.ask("Your role", d.title)).trim() || d.title || "Member" : TITLE_OPTIONS[t];
         const askCommands = async () => {
             const undecided = profile.agent.allow_bash === undefined && preset.commands === undefined;
-            const c = await io.choose("Teammates can hand work to this machine while you're away. It runs in a separate copy of the repo and delivers on a branch you review. May a run also execute commands?", ["Yes — run tests, commit, and push work for review (recommended)",
+            const c = await io.choose("Teammates can hand work to this machine while you're away. It runs in a separate copy of the repo and delivers on a branch you review. May a run also run your tests, commit and push, so the work arrives ready to review?", ["Yes — run tests, commit, and push work for review (recommended)",
                 "No — edit files and answer only; it cannot run tests, commit, or push"], undecided || a.commands ? 0 : 1);
             a.commands = c === 0;
         };
-        let commandsAsked = false;
-        if (a.wake !== "no" && ctx.project) {
-            await askCommands();
-            commandsAsked = true;
-        }
         const detected = ctx.project && deps.setRepoBase ? detectBaseBranch(ctx.project) : null;
         const suggestedBase = detected ? (preset.base ?? detected) : undefined;
         if (a.wake !== "no" && ctx.project)
@@ -198,9 +201,18 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         const shortAlert = (id) => ALERT_OPTIONS.find((o) => o.id === id).label.split(" — ")[0].replace(/ \(recommended\)/, "");
         io.say("\nThe rest has defaults. Change them now, or any time with `pantheon setup`:");
         io.say(`  • Wake: ${a.wake === "no" ? "off — this machine only works while you are at it"
-            : !ctx.project ? "on once this machine has a repo (run pantheon setup from your project's repo)"
-                : a.wake === "anyone" ? "teammates may hand work to this machine while you're away; invites you send grant it, and you can revoke anyone (pantheon admit <name> --revoke)"
-                    : "only people you approve by hand, on this machine (pantheon wake allow <name>)"}`);
+            : serves && !serves.repos ? (a.wake === "anyone"
+                ? "teammates can ask your worker about this folder while you're away — it reads it, never changes it"
+                : "teammates you approve can ask your worker about this folder while you're away — it reads it, never changes it; you are asked the first time each one needs it")
+                : !serves ? "nothing is bound to this team on this machine yet, so there is nothing to serve — bind a repo or a docs folder: pantheon use <team> --here"
+                    : a.wake === "anyone" ? "your teammates can hand work to this machine while you're away, so nothing waits on you (to approve each one first: pantheon setup --wake approved)"
+                        : "only people you approve — you are asked the first time a teammate's request needs this machine (Always / Just this once / No)"}`);
+        if (a.wake !== "no" && serves?.repos) {
+            io.say(`  • Commands: ${a.commands ? "work runs your tests, commits, and pushes to its own branch, so it arrives ready for your review" : "edits and answers only — turn commands on to have work arrive tested and ready to review"}`);
+            if (awayAgents.length && unsandboxedAllowed(loadPolicy(deps.policyHome))) {
+                io.say(`  • Agent: ${andList(awayAgents)} ${awayAgents.length === 1 ? "answers" : "answer"} teammates' requests while you're away, so nobody waits on you`);
+            }
+        }
         io.say(`  • Alerts: ${shortAlert(a.notifications).toLowerCase()}`);
         io.say(`  • Approval: ${a.approval === "approve"
             ? "your agent sends to teammates in your name without asking each time (Claude Code, Cursor, Codex, and Kiro's IDE and pantheon agent; Copilot asks once per tool per folder)"
@@ -222,9 +234,10 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
                 a.commands = false;
                 a.persona = false;
             }
-            else if (ctx.project && !commandsAsked) {
+            else if (serves?.repos) {
                 await askCommands();
-                a.persona = preset.persona ?? true;
+                if (ctx.project)
+                    a.persona = preset.persona ?? true;
             }
             const picks = await io.chooseMany("Which of these do you decide personally? Agents — yours and your teammates' — will stop and ask you before acting on them. Pick any number, or none.", DECISION_AREAS.map((x) => x.label), a.decides.map((id) => DECISION_AREAS.findIndex((x) => x.id === id)).filter((i) => i >= 0));
             a.decides = [...new Set(picks.map((i) => DECISION_AREAS[i].id))];
@@ -307,22 +320,50 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         else
             applied.push("worker stays off");
     }
-    else if (ctx.project) {
+    else if (serves) {
         try {
-            install("worker", ctx.project, a.commands ? ["--allow-bash"] : []);
-            applied.push(a.commands
-                ? "worker on — a woken run may run tests and commit and push to its own branch"
-                : "worker on — a woken run edits files and answers; it cannot commit or push (deliveries will need you)");
+            install("worker", serves.path, a.commands ? ["--allow-bash"] : []);
+            applied.push(!serves.repos
+                ? "worker on — a teammate's question is answered from your folder, which a run reads and never changes; anything it writes is a draft for you"
+                : a.commands
+                    ? "worker on — a woken run may run tests and commit and push to its own branch"
+                    : "worker on — a woken run edits files and answers; it cannot commit or push (deliveries will need you)");
         }
         catch (e) {
             warnings.push(`the worker service did not install: ${e.message}`);
         }
         applied.push(a.wake === "anyone"
-            ? "wake permission: invites you send grant it (revoke one person: pantheon admit <name> --revoke)"
-            : "wake permission: only people you approve on this machine (pantheon wake allow <name>)");
+            ? "wake permission: your teammates can hand you work while you're away, and invites you send include it (to approve each one first: pantheon setup --wake approved)"
+            : "wake permission: only people you approve on this machine — you are asked the first time each one needs it (approve ahead: pantheon wake allow <name>)");
     }
     else {
-        applied.push("worker: run this again from your project's repo to switch it on there");
+        applied.push(`worker: nothing is bound to "${ctx.cfg.space}" on this machine yet — from the folder you work in (a repo, or a folder of docs): pantheon use ${ctx.cfg.space} --here, then pantheon setup`);
+    }
+    const names = awayAgents.length ? andList(awayAgents) : "Codex, Cursor and Copilot";
+    const one = awayAgents.length === 1;
+    if (a.unsandboxed !== undefined && !(a.unsandboxed && a.wake === "no")) {
+        if (inWokenRun())
+            warnings.push("a woken run cannot change what runs on this machine — a person has to answer this here");
+        else {
+            try {
+                const pol = loadPolicy(deps.policyHome);
+                if (a.unsandboxed)
+                    grant(pol, "unsandboxed_runs", "always", "setup-answer");
+                else
+                    revoke(pol, "unsandboxed_runs");
+                savePolicy(pol, deps.policyHome);
+                applied.push(a.unsandboxed
+                    ? `${names} ${one ? "answers" : "answer"} teammates' requests while you're away, so nobody waits on you — to have them wait for you instead: pantheon setup --unsandboxed no`
+                    : `${names} ${one ? "leaves" : "leave"} teammates' requests for you to pick up when you're back — to have ${names} answer them while you're away: pantheon setup --unsandboxed yes`);
+            }
+            catch (e) {
+                warnings.push(`could not save whether ${names} may take requests while you're away: ${e.message}`);
+            }
+        }
+    }
+    else if (awayAgents.length && a.wake !== "no" && serves?.repos) {
+        if (unsandboxedAllowed(loadPolicy(deps.policyHome)))
+            applied.push(`${names} ${one ? "answers" : "answer"} teammates' requests while you're away, so nobody waits on you — to have them wait for you instead: pantheon setup --unsandboxed no`);
     }
     const waitIn = mac ? "pantheon status, approvals, and the menu bar" : "pantheon status and pantheon approvals";
     const chosenAlerts = ALERT_OPTIONS.find((o) => o.id === a.notifications).label.split(" — ")[0].replace(/ \(recommended\)/, "");

package/dist/tray.js

@@ -1,3 +1,4 @@
+import { loadPolicy } from "./worker-policy.js";
 import { execFileSync } from "node:child_process";
 import { helperStale, recordHelperBuild } from "./helpers-build.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -51,6 +52,16 @@ export function writeTrayCommands(home = CONFIG_DIR) {
     }
     return out;
 }
+export function localChoices(ref) {
+    if (!ref)
+        return null;
+    const pol = loadPolicy();
+    if (pol.wakeAsks?.[ref])
+        return [{ label: "Always", answer: "allow always" }, { label: "Just this once", answer: "allow once" }, { label: "No", answer: "deny" }];
+    if (Object.values(pol.asks).some((a) => a?.act === ref))
+        return [{ label: "Allow always", answer: "allow always" }, { label: "Allow once", answer: "allow once" }, { label: "Don't allow", answer: "deny" }];
+    return null;
+}
 function workerState(home = CONFIG_DIR) {
     try {
         const raw = JSON.parse(readFileSync(join(home, "worker-state.json"), "utf8"));
@@ -140,7 +151,8 @@ async function trayStatusOne(cfg) {
     const items = [
         ...mineHuman.map((o) => {
             const from = senderOf(o);
-            return { ...row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body))), decider: cfg.member };
+            const choices = localChoices(o.ref);
+            return { ...row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body))), decider: cfg.member, ...(choices ? { choices } : {}) };
         }),
         ...owed.map((o) => row(o, "owed", "you", owedPrompt(decisionTitle(o.body), o.goal))),
         ...waiting.map((o) => {

package/dist/untrusted.js

@@ -1,16 +1,35 @@
+const SECRET_NOUN = String.raw `(?:passwords?|passphrases?|pass ?codes?|pins?|secrets?|secret\s*keys?|(?:signing|webhook|client|app|master|root|encryption) (?:secrets?|keys?)|key_secret|secret_key|client_secret|access tokens?|personal access tokens?|session (?:cookies?|ids?|tokens?)|cookies?|dsns?|a-?p-?i[_ -]?keys?|private[_ -]?keys?|ssh[_ -]?keys?|deploy keys?|keys? for [\w.-]+|credentials?|creds|tokens?|otps?|one[- ]time (?:codes?|passwords?)|seed phrases?|recovery codes?|2fa codes?|clave(?: api)?|contraseñas?|passwort|mot de passe|senha)`;
+const VALUE = String.raw `(?:\b(?:your|the|our|my|its|this|that|their|his|her|apna|apni)\s+(?:[\w'-]+\s+){0,3}${SECRET_NOUN}\b|\b[A-Z][A-Z0-9_]*_(?:KEY|SECRET|TOKEN|PASSWORD|PASS|CREDENTIALS?|URL|DSN|URI)\b|\b(?:TOKEN|SECRET|PASSWORD|API_KEY)\b|\$[A-Z_]{3,}|process\.env\.\w+|~\/\.(?:aws|ssh|config|netrc|npmrc|pantheon|docker|kube)\b|\.env\b|id_[er]sa|\.pem\b|\bcredentials file\b)`;
+const HAND_OVER = String.raw `(?:bhej(?:o| do| dena)?|de do|dedo|batao|bata do|dikhao|paste karo|share karo|what(?:'s| is| are)|tell(?: me)?|let (?:me|us) know|give(?: me)?|send(?: me| over| it)?|share|paste|reveal|print|show|dump|echo|cat|read(?: out)?|include|put|drop|post|copy|grab|fetch|get|commit|push|upload|e-?mail|dm|reply with|respond with|need|type|enter|use|using|provide|leak|export)`;
+const SECRET_ACTION = new RegExp(String.raw `\b${HAND_OVER}\b[^\n.?!]{0,60}${VALUE}|${VALUE}[^\n.?!]{0,40}\b(?:in|into|to|should go in|goes in|belongs in)\b[^\n.?!]{0,12}\b(?:reply|answer|message|response|output|commit|branch|repo|file|pr|pull request|issue|thread|description|chat|comment|gist|paste)\b|\b(?:its|the) value\b|\bvalue of (?:the |your )?${SECRET_NOUN}|${VALUE}[^\n?!]{0,40}\b(?:send(?: it)? over|send it|share it|paste it|give it|need it|let me know|bhej(?:o| do)?|de do|batao|dikhao|karo|kar do)\b|${SECRET_NOUN}[\s\S]{0,200}\b(?:print|paste|send|share|show|dump|echo|reveal|include|post|email|bhej(?:o| do)?)\s+(?:it|them|that|this|those)\b|\b(?:create|generate|make|set up|register|mint|issue)\b\s+(?:(?:a|an|the|your|new|brand-new|fresh|another)\s+)*(?:[\w-]+\s+){0,4}${SECRET_NOUN}\b(?!\s+(?:field|flow|screen|page|form|meter|policy|reset|rotation|storage|validation|check|rule|input|button|endpoint|api|feature|generator|manager|strength|expiry|hashing|column|table|model|schema|test|tests|ui|modal))`, "i");
+const SIGNIN_ACTION = /(^|[.!?:;]\s*|\n\s*|\b(?:please|you|can you|could you|would you|go and|go|then|and|now|first|also)\s+)(sign in|sign into|log ?in(?:to)?|authenticate|create an account|join .{0,20}hub)(?:\s+(?:to|into|at|here|there|as|against|on)\b|\s*[.!]|$)|\b(?:visit|open|go to)\b[^\n]{0,40}https?:\/\/|\b(?:with|using) (?:the|our|my|your|an?|this) [\w -]{0,20}(?:account|login|creds|credentials|password)\b|\b(?:gh|npm|docker|aws|gcloud|az|vercel|railway|heroku|firebase) (?:auth )?login\b|(?:^|[.!?:;]\s*|\n\s*)(?:log ?into|sign into|log in to|sign in to)\b(?![^\n.?!]{0,50}\b(?:fails?|failing|broken|error|doesn'?t|not work|is slow))/im;
+const ABOUT_PRODUCT = /\?|\b(?:why|how come|does|do|did|is|are|was|were|where|when|which)\b[^\n]{0,80}\b(?:fail\w*|break\w*|broken|work\w*|return\w*|call\w*|read\w*|stor\w*|handl\w*|show\w*|happen\w*|arriv\w*|expire\w*)|\b(?:fails?|failing|failed|broken|bug|error|errors|issue|crash\w*|doesn'?t work|not working|never arrives?|stopped working|is slow|can'?t|cannot|unable to|won'?t|isn'?t|aren'?t|expires? too|too early|too soon|times? out|timed out)\b/i;
+const WORK_ON_PRODUCT = /(^|[.!?:;]\s*|\n\s*|\b(?:please|can you|could you|let's|we need to|we should)\s+)(?:add|implement|build|create|design|refactor|migrate|move|document|support|fix|update|improve|remove|rename|review|explain|describe|test|write tests for|validate|hash|encrypt|rotate|mask|hide|redact|make)\b/im;
+const NOT_ENGLISH = /[^\x00-\x7F‐-‟… -ÿ]|\b(?:envíame|dame|mándame|schick|envoie|donne-moi|manda)\b/i;
+function secretStops(body) {
+    if (SECRET_ACTION.test(body) || SIGNIN_ACTION.test(body))
+        return true;
+    if (NOT_ENGLISH.test(body) && new RegExp(SECRET_NOUN, "i").test(body))
+        return true;
+    return !(ABOUT_PRODUCT.test(body) || WORK_ON_PRODUCT.test(body));
+}
 const PATTERNS = [
     { kind: "install", why: "asks you to install software", re: /\b(npm|pnpm|yarn)\s+(i|install|add)\s+(-g|--global)/i },
     { kind: "install", why: "asks you to install software", re: /\b(brew|apt-get|apt|pip3?|gem)\s+install\b/i },
     { kind: "pipe-to-shell", why: "pipes a download straight into a shell", re: /\bcurl\b[^\n|]*\|\s*(ba)?sh\b/i },
     { kind: "pipe-to-shell", why: "pipes a download straight into a shell", re: /\bwget\b[^\n|]*\|\s*(ba)?sh\b/i },
-    { kind: "credential", why: "asks for a password, token or key", re: /\b(password|passphrase|secret\s*key|api[_ -]?key|private[_ -]?key|credential)s?\b/i },
-    { kind: "credential", why: "names an env var that usually holds a secret", re: /\b[A-Z_]*(TOKEN|SECRET|PASSWORD|API_KEY)\b/ },
+    { kind: "credential", why: "asks for a password, token or key", re: new RegExp(String.raw `\b(?:password|passphrase|secret\s*key|signing secret|api[_ -]?key|a-p-i key|private[_ -]?key|ssh[_ -]?key|credential|creds|otp|seed phrase|recovery code|clave|contraseña|passwort|mot de passe|secret|token|cookie|dsn|(?:signing|webhook|client|app|master|root|encryption) key|key_secret|secret_key|client_secret)s?\b|process\.env\.\w+|\.env\b|~\/\.aws\b|\bthe (?:\w+ )?(?:secret|token|key for \w+)\b`, "i"), stopWhen: secretStops },
+    { kind: "credential", why: "names an env var that usually holds a secret", re: /\b[A-Z][A-Z0-9_]*(TOKEN|SECRET|PASSWORD|API_KEY|_KEY|_PASS|_CREDENTIALS?)\b|\b(TOKEN|SECRET|PASSWORD|API_KEY)\b/, stopWhen: secretStops },
     { kind: "exfiltration", why: "asks you to send file contents somewhere", re: /\b(cat|base64)\b[^\n]{0,40}\b(curl|POST|upload|send)\b/i },
     { kind: "exfiltration", why: "asks you to reveal the contents of a sensitive file",
-        re: /\b(paste|show|print|read|send|share|output|dump)\b[^\n]{0,60}(~\/\.\w+|\.env\b|config\.json|id_[er]sa|\.ssh\/|credentials?\b|\.pem\b)/i },
+        re: /\b(paste|show|print|read|send|share|output|dump)\b[^\n]{0,60}(~\/\.\w+|\.env\b|config\.json|id_[er]sa|\.ssh\/|\/credentials?\b|credentials? file|\.pem\b)/i },
+    { kind: "exfiltration", why: "asks you to read out a file that holds secrets",
+        re: /\b(cat|type|less|more|head|tail|open|read|print|dump|include|paste|show|copy|send|upload|grep|base64)\b[^\n]{0,40}(~\/\.(aws|ssh|config|netrc|npmrc|docker|kube|pantheon|gnupg)\b|\.env\b|id_[er]sa|\.pem\b|\/credentials\b|\.git-credentials|google-services\.json|GoogleService-Info\.plist|service-account[\w.-]*\.json|\.p12\b|\.keystore\b|\.jks\b)/i },
+    { kind: "exfiltration", why: "asks you to dump the environment", re: /\b(printenv|env\s*\||export -p|set\s*\|)|`env`|\bprocess\.env\b[^\n]{0,20}\b(print|log|dump|send|paste|json)/i },
+    { kind: "exfiltration", why: "asks you to send something to an outside address", re: /\b(e-?mail|send|upload|post|forward|share|mail)\b[^\n]{0,80}\b(to|at)\s+(?:[\w.+-]+@[\w-]+\.[\w.-]+|https?:\/\/)/i },
     { kind: "exfiltration", why: "names a file that usually holds secrets",
         re: /(~\/\.pantheon\/config\.json|~\/\.ssh\/|\.env\.(local|production)|id_rsa\b)/i },
-    { kind: "identity", why: "asks you to sign in or create an account", re: /\b(sign in|log ?in|authenticate|create an account|join .{0,20}hub)\b/i },
+    { kind: "identity", why: "asks you to sign in or create an account", re: /\b(sign in|sign into|log ?in(?:to)?|authenticate|create an account|join .{0,20}hub|auth login)\b/i, stopWhen: secretStops },
     { kind: "override", why: "tries to override the instructions you were given", re: /\b(ignore|disregard|forget)\b[^\n]{0,30}\b(previous|prior|earlier|above|your)\b[^\n]{0,20}\b(instruction|prompt|rule|direction)s?\b/i },
     { kind: "override", why: "claims a new operator or system directive", re: /\b(system|operator|admin)\s*(:|message|override|instruction)/i },
 ];
@@ -34,7 +53,7 @@ export function assess(body) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        out.push({ kind: p.kind, why: p.why, evidence: hit[0].slice(0, 80) });
+        out.push({ kind: p.kind, why: p.why, evidence: hit[0].slice(0, 80), stop: p.stopWhen ? p.stopWhen(body) : true });
     }
     return out;
 }

package/dist/upgrade.js

@@ -70,7 +70,7 @@ export function defaultDeps() {
             catch { }
             return up;
         },
-        npmUpgrade: () => npm(["install", "-g", `${PKG_NAME}@latest`, "--no-audit", "--no-fund"], { stdio: ["ignore", "pipe", "pipe"] }),
+        npmUpgrade: (version) => npm(["install", "-g", `${PKG_NAME}@${version ?? "latest"}`, "--no-audit", "--no-fund"], { stdio: ["ignore", "pipe", "pipe"] }),
         npmLatest: () => {
             try {
                 return npm(["view", `${PKG_NAME}`, "version"], { stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim() || null;
@@ -81,18 +81,22 @@ export function defaultDeps() {
         },
     };
 }
-export function upgrade(deps = defaultDeps()) {
+export function upgrade(deps = defaultDeps(), opts = {}) {
+    const spec = opts.version && /^\d+\.\d+\.\d+$/.test(opts.version) ? opts.version : "latest";
     const { root } = deps;
     const from = deps.version(root);
     const steps = [];
     const stop = (name, detail) => ({ root, from, to: from, steps: [...steps, { name, ok: false, detail }], ok: false, alreadyCurrent: false, restart: [] });
     if (!deps.isGit(root)) {
         try {
-            deps.npmUpgrade();
-            steps.push({ name: "npm", ok: true, detail: `installed ${PKG_NAME}@latest` });
+            deps.npmUpgrade(spec === "latest" ? undefined : spec);
+            steps.push({ name: "npm", ok: true, detail: `installed ${PKG_NAME}@${spec}` });
         }
         catch (e) {
-            return stop("npm", `\`npm install -g ${PKG_NAME}@latest\` failed: ${e.message.split("\n")[0]}. ` +
+            if (spec !== "latest" && /ETARGET|No matching version|notarget/i.test(String(e.stderr ?? "") + e.message)) {
+                return { root, from, to: from, steps: [...steps, { name: "npm", ok: true, detail: `${PKG_NAME}@${spec} is not on npm yet` }], ok: true, alreadyCurrent: true, restart: [] };
+            }
+            return stop("npm", `\`npm install -g ${PKG_NAME}@${spec}\` failed: ${e.message.split("\n")[0]}. ` +
                 `You may need to re-run it with the right permissions (or your Node version manager's global scope).`);
         }
         let wired = [];

package/dist/verify-act.js

@@ -0,0 +1,102 @@
+import { actPayload, canonicalJson, canonicalKey, fingerprint, goalPayload, verifyBytes, verifyDelegate } from "./identity.js";
+export const RELAY_META_KEYS = new Set(["from_repo", "authority", "unverified_domains", "defers_to", "affects"]);
+export function relayComposed(rec) {
+    if (rec.from === "relay" || rec.from === "pantheon")
+        return true;
+    if (rec.act === "JOIN" || rec.act === "LEAVE")
+        return true;
+    const m = rec.meta ?? {};
+    if (rec.act === "NOTE" && ("goal_members" in m || "organization_profile" in m || "notice" in m))
+        return true;
+    if (rec.act === "NOTE" && typeof rec.body === "string" && rec.body.startsWith("repo registered with this space: "))
+        return true;
+    return false;
+}
+const same = (a, b) => canonicalJson(a ?? null) === canonicalJson(b ?? null);
+const teamList = (t) => [...new Set((typeof t === "string" ? [t] : t).filter((x) => !!x))];
+export function verifyAct(rec, teams, pinnedFp, memberKey, at = Date.now()) {
+    const sig = rec.sig;
+    if (!sig)
+        return relayComposed(rec) ? { trust: "relay", why: "recorded by the relay" } : { trust: "unsigned", why: `not signed — sent by a Pantheon before 0.31, or the signature was dropped on the way` };
+    if (sig.v !== 1 || typeof sig.s !== "string" || typeof sig.pub !== "string")
+        return { trust: "invalid", why: "a signature in a form this version does not know" };
+    if (!canonicalKey(sig.pub))
+        return { trust: "invalid", why: "signed with a key that is not a plain ed25519 key" };
+    if (typeof sig.ts !== "number" || sig.ts > Date.now() + 86_400_000)
+        return { trust: "invalid", why: "signed with a date more than a day ahead" };
+    const senderMeta = (sig.meta ?? {});
+    const meta = (rec.meta ?? {});
+    for (const [k, v] of Object.entries(senderMeta))
+        if (!same(meta[k], v))
+            return { trust: "invalid", why: `meta.${k} is not what the sender wrote` };
+    for (const k of Object.keys(meta))
+        if (!(k in senderMeta) && !RELAY_META_KEYS.has(k))
+            return { trust: "invalid", why: `meta.${k} was added on the way` };
+    if (typeof meta.from_repo === "string" && meta.from_repo !== (sig.repo ?? null))
+        return { trust: "invalid", why: "from_repo is not the repo the sender signed" };
+    const list = teamList(teams);
+    const team = list.find((t) => verifyBytes(sig.pub, actPayload({
+        id: rec.id, team: t, member: rec.from, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        act: rec.act, goal: rec.goal ?? null, ref: rec.ref ?? null, to: rec.to ?? null,
+        defers_to: typeof meta.defers_to === "string" ? meta.defers_to : null,
+        affects: Array.isArray(meta.affects) ? meta.affects : null,
+        repo: sig.repo ?? null,
+        summary: rec.summary ?? null, body: rec.body, meta: senderMeta,
+    }), sig.s));
+    if (!team)
+        return { trust: "invalid", why: "the signature does not match what arrived — altered on the way, or not written by its sender" };
+    return signer(sig, team, rec.from, pinnedFp, memberKey, Math.max(sig.ts, rec.ts || 0), "act");
+}
+function signer(sig, team, member, pinnedFp, memberKey, at, what) {
+    if (!pinnedFp)
+        return { trust: "unknown-key", why: `no key for ${member} is known on this machine yet` };
+    const pinnedKey = memberKey && canonicalKey(memberKey) && fingerprint(memberKey) === pinnedFp ? memberKey : undefined;
+    if (sig.role === "member") {
+        const same = pinnedKey ? sig.pub === pinnedKey : fingerprint(sig.pub) === pinnedFp;
+        if (!same)
+            return { trust: "key-changed", why: `signed by a key that is not the one this machine knows for ${member} (${fingerprint(sig.pub)}; known: ${pinnedFp})` };
+        return { trust: "verified", why: `signed by ${member}` };
+    }
+    const cert = sig.cert;
+    if (!cert)
+        return { trust: "invalid", why: `a run's ${what} with no certificate` };
+    if (cert.pub !== sig.pub)
+        return { trust: "invalid", why: "the run key is not the one its certificate names" };
+    if (!pinnedKey)
+        return { trust: "unknown-key", why: `${member}'s own key is needed to check their run's certificate, and this machine does not have it yet` };
+    const memberKey2 = pinnedKey;
+    if (!verifyDelegate(memberKey2, team, member, cert, at)) {
+        return { trust: "invalid", why: `the run certificate does not verify for ${member} in this team, or it had expired` };
+    }
+    if (sig.ts > cert.expires + 10 * 60_000)
+        return { trust: "invalid", why: "signed after its run certificate expired" };
+    return { trust: "verified-run", why: `signed by ${member}'s unattended run` };
+}
+export function verifyGoal(g, teams, pinnedFp, memberKey, at = Date.now()) {
+    const sig = g.sig;
+    if (!sig)
+        return { trust: "unsigned", why: "the goal was opened by a Pantheon before 0.31, or its signature was dropped" };
+    if (!canonicalKey(sig.pub))
+        return { trust: "invalid", why: "signed with a key that is not a plain ed25519 key" };
+    if (typeof sig.ts !== "number" || sig.ts > Date.now() + 86_400_000)
+        return { trust: "invalid", why: "signed with a date more than a day ahead" };
+    const team = teamList(teams).find((t) => verifyBytes(sig.pub, goalPayload({
+        id: g.id, team: t, member: g.opened_by, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        title: g.title, acceptance: g.acceptance, invite: sig.invite,
+        budget: sig.budget ?? null, deadline: sig.deadline ?? null, kind: sig.kind ?? null,
+    }), sig.s));
+    if (!team)
+        return { trust: "invalid", why: "the goal's title, acceptance or invitations are not what its opener wrote" };
+    at = Math.max(sig.ts, g.opened_at || 0);
+    return signer(sig, team, g.opened_by, pinnedFp, memberKey, at, "goal");
+}
+export const trusted = (t) => t === "verified" || t === "verified-run";
+export function trustLabel(r, from) {
+    switch (r.trust) {
+        case "verified": return `signed by ${from}`;
+        case "verified-run": return `signed by ${from}'s unattended run`;
+        case "relay": return from === "relay" || from === "pantheon" ? "written by the relay" : `written by the relay, not signed by ${from} — NOT VERIFIED as theirs`;
+        default: return `NOT VERIFIED — ${r.why}`;
+    }
+}
+//# sourceMappingURL=verify-act.js.map