@join-pantheon/cli 0.30.0 → 0.31.1

package/dist/verify-act.js

@@ -0,0 +1,102 @@
+import { actPayload, canonicalJson, canonicalKey, fingerprint, goalPayload, verifyBytes, verifyDelegate } from "./identity.js";
+export const RELAY_META_KEYS = new Set(["from_repo", "authority", "unverified_domains", "defers_to", "affects"]);
+export function relayComposed(rec) {
+    if (rec.from === "relay" || rec.from === "pantheon")
+        return true;
+    if (rec.act === "JOIN" || rec.act === "LEAVE")
+        return true;
+    const m = rec.meta ?? {};
+    if (rec.act === "NOTE" && ("goal_members" in m || "organization_profile" in m || "notice" in m))
+        return true;
+    if (rec.act === "NOTE" && typeof rec.body === "string" && rec.body.startsWith("repo registered with this space: "))
+        return true;
+    return false;
+}
+const same = (a, b) => canonicalJson(a ?? null) === canonicalJson(b ?? null);
+const teamList = (t) => [...new Set((typeof t === "string" ? [t] : t).filter((x) => !!x))];
+export function verifyAct(rec, teams, pinnedFp, memberKey, at = Date.now()) {
+    const sig = rec.sig;
+    if (!sig)
+        return relayComposed(rec) ? { trust: "relay", why: "recorded by the relay" } : { trust: "unsigned", why: `not signed — sent by a Pantheon before 0.31, or the signature was dropped on the way` };
+    if (sig.v !== 1 || typeof sig.s !== "string" || typeof sig.pub !== "string")
+        return { trust: "invalid", why: "a signature in a form this version does not know" };
+    if (!canonicalKey(sig.pub))
+        return { trust: "invalid", why: "signed with a key that is not a plain ed25519 key" };
+    if (typeof sig.ts !== "number" || sig.ts > Date.now() + 86_400_000)
+        return { trust: "invalid", why: "signed with a date more than a day ahead" };
+    const senderMeta = (sig.meta ?? {});
+    const meta = (rec.meta ?? {});
+    for (const [k, v] of Object.entries(senderMeta))
+        if (!same(meta[k], v))
+            return { trust: "invalid", why: `meta.${k} is not what the sender wrote` };
+    for (const k of Object.keys(meta))
+        if (!(k in senderMeta) && !RELAY_META_KEYS.has(k))
+            return { trust: "invalid", why: `meta.${k} was added on the way` };
+    if (typeof meta.from_repo === "string" && meta.from_repo !== (sig.repo ?? null))
+        return { trust: "invalid", why: "from_repo is not the repo the sender signed" };
+    const list = teamList(teams);
+    const team = list.find((t) => verifyBytes(sig.pub, actPayload({
+        id: rec.id, team: t, member: rec.from, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        act: rec.act, goal: rec.goal ?? null, ref: rec.ref ?? null, to: rec.to ?? null,
+        defers_to: typeof meta.defers_to === "string" ? meta.defers_to : null,
+        affects: Array.isArray(meta.affects) ? meta.affects : null,
+        repo: sig.repo ?? null,
+        summary: rec.summary ?? null, body: rec.body, meta: senderMeta,
+    }), sig.s));
+    if (!team)
+        return { trust: "invalid", why: "the signature does not match what arrived — altered on the way, or not written by its sender" };
+    return signer(sig, team, rec.from, pinnedFp, memberKey, Math.max(sig.ts, rec.ts || 0), "act");
+}
+function signer(sig, team, member, pinnedFp, memberKey, at, what) {
+    if (!pinnedFp)
+        return { trust: "unknown-key", why: `no key for ${member} is known on this machine yet` };
+    const pinnedKey = memberKey && canonicalKey(memberKey) && fingerprint(memberKey) === pinnedFp ? memberKey : undefined;
+    if (sig.role === "member") {
+        const same = pinnedKey ? sig.pub === pinnedKey : fingerprint(sig.pub) === pinnedFp;
+        if (!same)
+            return { trust: "key-changed", why: `signed by a key that is not the one this machine knows for ${member} (${fingerprint(sig.pub)}; known: ${pinnedFp})` };
+        return { trust: "verified", why: `signed by ${member}` };
+    }
+    const cert = sig.cert;
+    if (!cert)
+        return { trust: "invalid", why: `a run's ${what} with no certificate` };
+    if (cert.pub !== sig.pub)
+        return { trust: "invalid", why: "the run key is not the one its certificate names" };
+    if (!pinnedKey)
+        return { trust: "unknown-key", why: `${member}'s own key is needed to check their run's certificate, and this machine does not have it yet` };
+    const memberKey2 = pinnedKey;
+    if (!verifyDelegate(memberKey2, team, member, cert, at)) {
+        return { trust: "invalid", why: `the run certificate does not verify for ${member} in this team, or it had expired` };
+    }
+    if (sig.ts > cert.expires + 10 * 60_000)
+        return { trust: "invalid", why: "signed after its run certificate expired" };
+    return { trust: "verified-run", why: `signed by ${member}'s unattended run` };
+}
+export function verifyGoal(g, teams, pinnedFp, memberKey, at = Date.now()) {
+    const sig = g.sig;
+    if (!sig)
+        return { trust: "unsigned", why: "the goal was opened by a Pantheon before 0.31, or its signature was dropped" };
+    if (!canonicalKey(sig.pub))
+        return { trust: "invalid", why: "signed with a key that is not a plain ed25519 key" };
+    if (typeof sig.ts !== "number" || sig.ts > Date.now() + 86_400_000)
+        return { trust: "invalid", why: "signed with a date more than a day ahead" };
+    const team = teamList(teams).find((t) => verifyBytes(sig.pub, goalPayload({
+        id: g.id, team: t, member: g.opened_by, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        title: g.title, acceptance: g.acceptance, invite: sig.invite,
+        budget: sig.budget ?? null, deadline: sig.deadline ?? null, kind: sig.kind ?? null,
+    }), sig.s));
+    if (!team)
+        return { trust: "invalid", why: "the goal's title, acceptance or invitations are not what its opener wrote" };
+    at = Math.max(sig.ts, g.opened_at || 0);
+    return signer(sig, team, g.opened_by, pinnedFp, memberKey, at, "goal");
+}
+export const trusted = (t) => t === "verified" || t === "verified-run";
+export function trustLabel(r, from) {
+    switch (r.trust) {
+        case "verified": return `signed by ${from}`;
+        case "verified-run": return `signed by ${from}'s unattended run`;
+        case "relay": return from === "relay" || from === "pantheon" ? "written by the relay" : `written by the relay, not signed by ${from} — NOT VERIFIED as theirs`;
+        default: return `NOT VERIFIED — ${r.why}`;
+    }
+}
+//# sourceMappingURL=verify-act.js.map

package/dist/worker-fleet.js

@@ -1,9 +1,11 @@
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
+import { holdsRepo } from "./repo-find.js";
 import { CONFIG_DIR, configFor, loadAll, repoInfo } from "./config.js";
-import { Worker } from "./worker.js";
+import { Worker, workspaceOf } from "./worker.js";
 export class WorkerFleet {
     opts;
+    dupSaid = new Set();
     slots = new Map();
     stopped = false;
     constructor(opts) {
@@ -18,14 +20,23 @@ export class WorkerFleet {
         const wanted = new Map();
         if (f) {
             const several = Object.keys(f.spaces ?? {}).length > 1;
-            for (const b of Object.values(f.bindings ?? {})) {
-                const m = f.spaces?.[b.space];
-                if (!m || !existsSync(join(b.path, ".git")))
+            const idCount = new Map();
+            for (const m of Object.values(f.spaces ?? {}))
+                idCount.set(m.id, (idCount.get(m.id) ?? 0) + 1);
+            for (const m of Object.values(f.spaces ?? {})) {
+                if ((idCount.get(m.id) ?? 0) > 1) {
+                    if (!this.dupSaid.has(m.id)) {
+                        this.dupSaid.add(m.id);
+                        this.opts.log(`fleet: two entries in config.json claim team ${m.id} — serving neither until one is removed (pantheon spaces)`);
+                    }
                     continue;
-                if (wanted.has(m.id))
+                }
+                const ws = teamWorkspaces(f, m.id);
+                const home = ws.find((w) => w.kind === "repo") ?? ws[0];
+                if (!home)
                     continue;
-                const repo = repoInfo(b.path);
-                wanted.set(m.id, { path: b.path, cfg: configFor(f, m, repo) });
+                const repo = home.kind === "repo" ? repoInfo(home.path) : null;
+                wanted.set(m.id, { path: home.path, cfg: configFor(f, m, repo) });
                 void several;
             }
             for (const [id, w] of wanted) {
@@ -36,6 +47,7 @@ export class WorkerFleet {
                 const wopts = {
                     ...rest,
                     project: w.path,
+                    workspaces: () => teamWorkspaces((this.opts.readConfig ?? loadAll)(), id),
                     scratch: join(home, "worktrees", encodeURIComponent(id)),
                     home,
                     requirePersonaSpaces: several,
@@ -66,7 +78,7 @@ export class WorkerFleet {
             for (const s of stopped)
                 this.opts.log(`fleet: worker for "${s}" stopped — binding gone`);
             if (!this.slots.size && !started.length)
-                this.opts.log(`fleet: no bound repos on this machine — bind one with \`pantheon use <team> --here\` from its checkout`);
+                this.opts.log(`fleet: nothing bound on this machine — bind a repo or a docs folder with \`pantheon use <team> --here\` from inside it`);
             await new Promise((r) => setTimeout(r, poll));
             if (this.opts.once && this.slots.size === 0)
                 break;
@@ -81,4 +93,13 @@ export class WorkerFleet {
             s.worker.stop();
     }
 }
+export function teamWorkspaces(f, spaceId) {
+    const bound = Object.entries(f?.bindings ?? {}).filter(([, b]) => b.space === spaceId && existsSync(b.path));
+    const repos = bound.filter(([k, b]) => !k.startsWith("d_") && existsSync(join(b.path, ".git"))).map(([, b]) => workspaceOf(b.path));
+    const all = Object.values(f?.bindings ?? {}).map((b) => resolve(b.path));
+    const folders = bound.filter(([k]) => k.startsWith("d_")).map(([, b]) => workspaceOf(b.path))
+        .filter((w) => w.kind === "folder" && !all.some((p) => p !== resolve(w.path) && p.startsWith(`${resolve(w.path)}${sep}`)) && !holdsRepo(w.path));
+    const seen = new Set();
+    return [...repos, ...folders].filter((w) => (seen.has(w.path) ? false : (seen.add(w.path), true)));
+}
 //# sourceMappingURL=worker-fleet.js.map

package/dist/worker-policy.js

@@ -3,6 +3,35 @@ import { dirname, join } from "node:path";
 import { CONFIG_PATH } from "./config.js";
 import { trustWrite } from "./home-guard.js";
 import { parseJsonText } from "./text-file.js";
+export const WAKE_NO_MS = 30 * 24 * 60 * 60 * 1_000;
+export const wakeKey = (team, member) => `${team}|${member}`;
+export function mayAskWake(p, teams, member, now = Date.now()) {
+    const ts = teams.filter((t) => !!t);
+    if (isApprovedWaker(p, ts, member))
+        return false;
+    if (ts.some((t) => (p.wakeNo?.[wakeKey(t, member)] ?? 0) > now - WAKE_NO_MS))
+        return false;
+    return !Object.values(p.wakeAsks ?? {}).some((a) => ts.includes(a.team) && a.member === member && now - a.at < ASK_EXPIRY_MS);
+}
+export function takeWakeOnce(p, teams, member) {
+    for (const t of teams) {
+        if (!t)
+            continue;
+        const k = wakeKey(t, member);
+        const n = p.wakeOnce?.[k] ?? 0;
+        if (n > 0) {
+            if (n > 1)
+                p.wakeOnce[k] = n - 1;
+            else
+                delete p.wakeOnce[k];
+            return true;
+        }
+    }
+    return false;
+}
+export function hasWakeOnce(p, teams, member) {
+    return teams.some((t) => !!t && (p.wakeOnce?.[wakeKey(t, member)] ?? 0) > 0);
+}
 export const ASK_COOLDOWN_MS = 24 * 60 * 60 * 1_000;
 export const ASK_EXPIRY_MS = 14 * 24 * 60 * 60 * 1_000;
 export function policyHome(home) {
@@ -35,6 +64,10 @@ export function loadPolicy(home) {
             ...(wakers ? { wakers } : {}),
             ...(isRecord(raw.wakersCarried) ? { wakersCarried: raw.wakersCarried } : {}),
             ...(isRecord(raw.wakersDeferred) ? { wakersDeferred: raw.wakersDeferred } : {}),
+            ...(isRecord(raw.wakeAsks) ? { wakeAsks: Object.fromEntries(Object.entries(raw.wakeAsks).filter(([, v]) => isRecord(v) && typeof v.team === "string" && typeof v.member === "string" && typeof v.at === "number")) } : {}),
+            ...(isRecord(raw.wakeOnce) ? { wakeOnce: Object.fromEntries(Object.entries(raw.wakeOnce).filter(([, v]) => typeof v === "number" && v > 0 && v < 100)) } : {}),
+            ...(isRecord(raw.wakeNo) ? { wakeNo: Object.fromEntries(Object.entries(raw.wakeNo).filter(([, v]) => typeof v === "number")) } : {}),
+            ...(isRecord(raw.wakeTeamFlag) ? { wakeTeamFlag: Object.fromEntries(Object.entries(raw.wakeTeamFlag).filter(([, v]) => typeof v === "number")) } : {}),
         };
     }
     catch {
@@ -117,14 +150,40 @@ export function setLocalWaker(teams, member, approved, home, env = process.env)
     savePolicy(p, home);
     return { ok: true, changed: true };
 }
+export function markTeamFlagOnYes(team, member, home, env = process.env) {
+    if (inWokenRun(env))
+        return;
+    const p = loadPolicy(home);
+    const k = wakeKey(team, member);
+    (p.wakeTeamFlag ??= {})[k] = Date.now();
+    savePolicy(p, home);
+}
+export function takeTeamFlagOnYes(p, teams, member) {
+    for (const t of teams) {
+        if (!t)
+            continue;
+        const k = wakeKey(t, member);
+        const at = p.wakeTeamFlag?.[k];
+        if (at !== undefined) {
+            delete p.wakeTeamFlag[k];
+            return Date.now() - at < 7 * 24 * 3600_000;
+        }
+    }
+    return false;
+}
 export function isApprovedWaker(p, teams, member) {
     return teams.some((t) => { const list = t ? p.wakers?.[t] : undefined; return Array.isArray(list) && list.includes(member); });
 }
 export function savePolicy(p, home) {
     const file = policyPath(home);
     mkdirSync(dirname(file), { recursive: true });
+    let prev = null;
+    try {
+        prev = readFileSync(file);
+    }
+    catch { }
     writeFileSync(file, JSON.stringify(p, null, 2) + "\n", { mode: 0o600 });
-    trustWrite(file);
+    trustWrite(file, prev);
 }
 export function useGrant(p, cap) {
     const g = p.grants[cap];
@@ -141,6 +200,11 @@ export function grant(p, cap, mode, by) {
 }
 export function revoke(p, cap) {
     delete p.grants[cap];
+    if (cap === "unsandboxed_runs")
+        p.denied[cap] = Date.now();
+}
+export function unsandboxedAllowed(p) {
+    return !!p.grants.unsandboxed_runs || p.denied.unsandboxed_runs === undefined;
 }
 export function mayAsk(p, cap, now = Date.now()) {
     if (p.grants[cap])
@@ -155,22 +219,42 @@ export function recordAsk(p, cap, escalateActId) {
     p.asks[cap] = { act: escalateActId, at: Date.now() };
 }
 export function parseGrantAnswer(body) {
-    const t = body.trim().toLowerCase();
-    if (/^(allow[\s-]?always|always[\s-]?allow|yes[\s-]?always)\b/.test(t))
+    const t = body.trim().toLowerCase().replace(/[.!]+$/, "").replace(/\s+/g, " ").replace(/’/g, "'");
+    if (/^(always|yes always|yes, always|always allow)$/.test(t) || /^(allow[\s-]always)\b/.test(t))
         return "allow-always";
-    if (/^(allow([\s-]?once)?|yes([\s-]?once)?|approve[d]?)\b/.test(t))
+    if (/^(once|just this once|this once|yes once|yes, once|yes|allow|approve|approved)$/.test(t) || /^(allow[\s-](it[\s-])?once)\b/.test(t))
         return "allow-once";
-    if (/^(deny|no|reject(ed)?|don'?t|do not)\b/.test(t))
+    if (/^(deny|denied|no|reject|rejected|don't allow|do not allow|don't|do not|never)\b/.test(t))
         return "deny";
     return null;
 }
 export const WOKEN_RUN_ENV = "PANTHEON_WOKEN_RUN";
 export const inWokenRun = (env = process.env) => !!env[WOKEN_RUN_ENV];
-export const CAPABILITY_ARGS = { self_upgrade: "self-upgrade", run_commands: "run-commands" };
+export const CAPABILITY_ARGS = { self_upgrade: "self-upgrade", run_commands: "run-commands", unsandboxed_runs: "unsandboxed-runs" };
 export function applyLocalAnswer(refActId, body, home, env = process.env) {
     if (!refActId)
         return null;
     const p = loadPolicy(home);
+    const wa = p.wakeAsks?.[refActId];
+    if (wa) {
+        if (inWokenRun(env))
+            return { applied: false, why: "a woken run cannot let anyone wake this machine — a person has to answer it here" };
+        const verdict = parseGrantAnswer(body);
+        if (!verdict)
+            return null;
+        const k = wakeKey(wa.team, wa.member);
+        if (verdict === "allow-always")
+            setWaker(p, wa.team, wa.member, true);
+        else if (verdict === "allow-once")
+            (p.wakeOnce ??= {})[k] = Math.min(99, (p.wakeOnce[k] ?? 0) + 1);
+        else
+            (p.wakeNo ??= {})[k] = Date.now();
+        if (verdict !== "deny" && wa.teamBlocked)
+            (p.wakeTeamFlag ??= {})[k] = Date.now();
+        delete p.wakeAsks[refActId];
+        savePolicy(p, home);
+        return { applied: true, wake: { team: wa.team, member: wa.member }, verdict };
+    }
     if (!Object.values(p.asks).some((a) => a?.act === refActId))
         return null;
     if (inWokenRun(env))
@@ -184,6 +268,12 @@ export function applyLocalAnswer(refActId, body, home, env = process.env) {
 export function describeLocalAnswer(g) {
     if (!g.applied)
         return `not granted: ${g.why}`;
+    if ("wake" in g) {
+        const who = g.wake.member;
+        return g.verdict === "allow-always" ? `${who} may start work on this machine from now on — undo: pantheon wake deny ${who}`
+            : g.verdict === "allow-once" ? `${who} may start work on this machine this once — their request runs now`
+                : `${who} will not start work on this machine; their requests wait for you (not asked again for a month; pantheon wake allow ${who} to change it)`;
+    }
     const name = CAPABILITY_ARGS[g.cap];
     if (g.verdict === "deny")
         return `denied ${name} on this machine — the worker will not ask again for a day`;