@join-pantheon/cli 0.30.0 → 0.31.1

package/dist/relay.js

@@ -4,10 +4,10 @@ import { rmSync, readdirSync, readFileSync, statSync, existsSync, writeFileSync,
 import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { WebSocketServer } from "ws";
-import { badRemote, Inbound, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, SENDABLE, shouldDeferToHuman, } from "./protocol.js";
+import { badRemote, Inbound, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, RELAY_FEATURES, SENDABLE, shouldDeferToHuman, } from "./protocol.js";
 import { VERSION } from "./version.js";
 import { Ledger, SpaceFull } from "./ledger.js";
-import { fingerprint, newNonce, verifyChallenge, verifyActivity, verifyAccount, verifyRead } from "./identity.js";
+import { fingerprint, newNonce, verifyChallenge, verifyActivity, verifyAccount, verifyRead, actPayload, goalPayload, verifyBytes, verifyDelegate, canonicalJson } from "./identity.js";
 import { Accounts, normalizeUsername, validEmail, validUsername } from "./accounts.js";
 import { emailSenderFromEnv } from "./email.js";
 import { Allowlist, RosterUnreadable } from "./roster-file.js";
@@ -208,6 +208,12 @@ function firstLedgerName(file) {
 }
 const GOAL_OPENED = /^goal opened: ([^\n]*)\nacceptance: ([\s\S]*?)(?:\ndeadline: (\S+))?(?:\nkind: (\w+)[\s\S]*)?$/;
 const LIMITS_GOAL_READ = 1000;
+function repoLabelSafe(v) {
+    if (!v)
+        return null;
+    const s = v.normalize("NFKC").replace(/[^A-Za-z0-9._@:/+~-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 100);
+    return s || null;
+}
 const LIMITS_SPACE = { metaBytes: 8192, openGoals: 500, repos: 100, openInvites: 50 };
 const SPACE_MAX_BYTES_DEFAULT = 50 * 1024 * 1024;
 const SPACE_HARD_SLACK = 1024 * 1024;
@@ -287,6 +293,76 @@ export function netOf(ip) {
     }
     return h;
 }
+function idIsFresh(id) {
+    const body = /^a_([a-z0-9]+)[0-9a-f]{18}$/.exec(id)?.[1];
+    const t = body ? parseInt(body, 36) : NaN;
+    return Number.isFinite(t) && Math.abs(Date.now() - t) < DAY;
+}
+function actSigProblem(m, member, memberPub, teams, delegated) {
+    const sig = m.sig;
+    if (!sig)
+        return "a woken run's session must sign every act";
+    if (canonicalJson(sig.meta ?? {}) !== canonicalJson(m.meta ?? {}))
+        return "the signed meta is not the meta sent";
+    if ((sig.repo ?? null) !== (m.repo ?? null))
+        return "the signed repo is not the repo sent";
+    const keyOk = sigKeyProblem(sig, member, memberPub, teams, delegated);
+    if (keyOk)
+        return keyOk;
+    if (!m.id)
+        return "a signed act names its own id";
+    if (Math.abs(Date.now() - sig.ts) > DAY)
+        return "signed at a time more than a day from now — check this machine's clock";
+    const ok = teams.filter((t) => !!t).some((team) => verifyBytes(sig.pub, actPayload({
+        id: m.id, team, member, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        act: m.act, goal: m.goal ?? null, ref: m.ref ?? null, to: m.to ?? null,
+        defers_to: m.defers_to ?? null, affects: m.affects ?? null, repo: m.repo ?? null,
+        summary: m.summary ?? null, body: m.body, meta: m.meta ?? {},
+    }), sig.s));
+    return ok ? null : "the signature does not match this act";
+}
+function goalSigProblem(m, member, memberPub, teams, delegated) {
+    const sig = m.sig;
+    if (!sig)
+        return "a woken run's session must sign the goals it opens";
+    const inviteSent = m.invite ? [...new Set(m.invite)].sort().join(",") : null;
+    const inviteSigned = sig.invite === null ? null : [...new Set(sig.invite)].sort().join(",");
+    if (inviteSent !== inviteSigned)
+        return "the signed invitations are not the ones sent";
+    if ((sig.budget ?? null) !== (m.budget ?? null) || (sig.deadline ?? null) !== (m.deadline ?? null) || (sig.kind ?? null) !== (m.kind ?? null))
+        return "the signed budget, deadline or kind is not what was sent";
+    const keyOk = sigKeyProblem(sig, member, memberPub, teams, delegated);
+    if (keyOk)
+        return keyOk;
+    if (!m.id)
+        return "a signed goal names its own id";
+    if (Math.abs(Date.now() - sig.ts) > DAY)
+        return "signed at a time more than a day from now — check this machine's clock";
+    const ok = teams.filter((t) => !!t).some((team) => verifyBytes(sig.pub, goalPayload({
+        id: m.id, team, member, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        title: m.title, acceptance: m.acceptance ?? "", invite: sig.invite,
+        budget: sig.budget ?? null, deadline: sig.deadline ?? null, kind: sig.kind ?? null,
+    }), sig.s));
+    return ok ? null : "the signature does not match this goal";
+}
+function sigKeyProblem(sig, member, memberPub, teams, delegated) {
+    if (delegated) {
+        if (sig.role !== "run" || sig.pub !== delegated.pub || sig.cert?.pub !== delegated.pub)
+            return "a woken run signs with the key its session was opened with";
+    }
+    if (sig.role === "member")
+        return sig.pub === memberPub ? null : `signed with a key that is not ${member}'s`;
+    if (!sig.cert || sig.cert.pub !== sig.pub)
+        return "a run's signature needs its certificate";
+    const c = sig.cert;
+    return teams.filter((t) => !!t).some((t) => verifyDelegate(memberPub, t, member, c)) ? null : `that run key is not vouched for by ${member}, or it has expired`;
+}
+function withoutFromRepo(meta) {
+    if (!meta || typeof meta !== "object")
+        return {};
+    const { from_repo: _f, ...rest } = meta;
+    return rest;
+}
 export class Relay {
     opts;
     spaces = new Map();
@@ -357,6 +433,7 @@ export class Relay {
     authEpoch = 0;
     rotateOnRemove;
     backupTimer;
+    get features() { return this.opts.features ?? RELAY_FEATURES; }
     constructor(opts = {}) {
         this.opts = opts;
         this.dataDir = opts.dataDir ?? "./pantheon-data";
@@ -566,12 +643,12 @@ export class Relay {
             const now = Date.now();
             const owed = [...space.obligations.values()]
                 .filter((o) => (member ? o.owner === member : true))
-                .map((o) => ({ ...o, claimed: !!o.claimed_by && now - o.claimed_by.at < LIMITS.claimTtlMs }));
+                .map((o) => ({ ...o, claimed: !!o.claimed_by && this.claimHolds(space, o.claimed_by, now) }));
             const closed = [...space.goals.values()].filter((g) => g.state === "CLOSED").map((g) => g.id);
             const worker_online = member
                 ? [...(space.members.get(member)?.sessions.values() ?? [])].some((s) => s.role === "worker")
                 : false;
-            return this.json(res, 200, { obligations: owed, closed_goals: closed, seq: space.ledger.head, worker_online });
+            return this.json(res, 200, { obligations: owed, closed_goals: closed, seq: space.ledger.head, worker_online, space_id: space.allow.spaceId(), members: this.members(space) });
         }
         if (url.pathname === "/activity") {
             if (req.method !== "POST")
@@ -613,7 +690,10 @@ export class Relay {
                 if (oldest)
                     member.activity.delete(oldest[0]);
             }
-            member.activity.set(session, { busy: state === "busy", at: Date.now() });
+            const prev = member.activity.get(session);
+            if (prev?.ts !== undefined && ts < prev.ts)
+                return this.json(res, 409, { error: "an activity report older than the last one from this session — ignored" });
+            member.activity.set(session, { busy: state === "busy", at: Date.now(), ts });
             const seen = Number(url.searchParams.get("seen"));
             if (Number.isFinite(seen) && seen > (member.seen_seq ?? 0))
                 member.seen_seq = seen;
@@ -1621,7 +1701,14 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         if (!pub || !Number.isFinite(ts) || Math.abs(Date.now() - ts) >= LIMITS.activityFreshMs)
             return refused;
         const { sig, ...signed } = params;
-        if (!verifyRead(pub, req.method ?? "GET", url.pathname, signed, sig))
+        let signer = pub;
+        if (signed.dpub) {
+            const cert = { pub: signed.dpub, run: signed.drun ?? "", expires: Number(signed.dexp), sig: signed.dcert ?? "" };
+            if (![target.allow.spaceId(), name].some((t) => t && verifyDelegate(pub, t, reader, cert)))
+                return refused;
+            signer = signed.dpub;
+        }
+        if (!verifyRead(signer, req.method ?? "GET", url.pathname, signed, sig))
             return refused;
         if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
             const auth = this.accounts.authorize(pub, reader);
@@ -2235,6 +2322,7 @@ pantheon signup --email you@work.com --username you</code></pre>
         let sessionId = "";
         let role = "interactive";
         let myPubkey = "";
+        let delegated = null;
         let authEpoch = -1, authOk = true;
         let lastMsg = "";
         let alive = true;
@@ -2300,7 +2388,7 @@ pantheon signup --email you@work.com --username you</code></pre>
             helloTimer = null;
         } };
         ws.on("close", clearHelloTimer);
-        this.send(ws, { t: "challenge", nonce, v: PROTOCOL_VERSION });
+        this.send(ws, { t: "challenge", nonce, v: PROTOCOL_VERSION, features: [...this.features] });
         ws.on("message", (raw) => {
             if (refusedOut)
                 return;
@@ -2333,7 +2421,11 @@ pantheon signup --email you@work.com --username you</code></pre>
                         return reject("BAD_NONCE", "challenge mismatch — reconnect");
                     if (!m.token && !m.enroll)
                         return reject("NO_CREDENTIAL", "present either a space token or an invite");
-                    if (!verifyChallenge(m.pubkey, m.space, m.member, m.nonce, m.sig)) {
+                    if (m.delegate && !this.features.includes("delegate"))
+                        return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
+                    if (m.delegate && m.enroll)
+                        return reject("BAD_DELEGATE", "a woken run cannot redeem an invite");
+                    if (!verifyChallenge(m.delegate ? m.delegate.pub : m.pubkey, m.space, m.member, m.nonce, m.sig)) {
                         return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
                     }
                     const gated = this.requireAccounts && !!this.accounts && !this.localTrusted(ip);
@@ -2481,17 +2573,24 @@ pantheon signup --email you@work.com --username you</code></pre>
                             newRepo = m.repo;
                         else {
                             const known = sp.allow.repoList().map((r) => r.origin ?? r.fingerprint).join(", ");
-                            this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${m.repo_origin ?? m.repo} not bound to this space`);
+                            this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${repoLabelSafe(m.repo_origin) ?? m.repo} not bound to this space`);
                             return reject("REPO_MISMATCH", `this checkout (${m.repo_origin ?? "no origin"}) is not one of the repos "${sp.name}" works from (${known || "none yet"}). ` +
                                 `Open your agent in the team's repo, or if this repo really belongs to the team: pantheon repo add`);
                         }
                     }
+                    if (m.delegate) {
+                        const teamIds = [sp.allow.spaceId(), sp.name];
+                        if (!teamIds.some((t) => verifyDelegate(m.pubkey, t, m.member, m.delegate))) {
+                            return reject("BAD_DELEGATE", `that run key is not vouched for by ${m.member}'s key for "${sp.name}", or its certificate has expired`);
+                        }
+                        delegated = { pub: m.delegate.pub, run: m.delegate.run, expires: m.delegate.expires };
+                    }
                     space = sp;
                     myPubkey = m.pubkey;
                     clearHelloTimer();
                     sessionId = acctSession ?? this.mintSession();
-                    role = m.role;
-                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, m.role, ws, m.pkg);
+                    role = delegated ? "worker" : m.role;
+                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, role, ws, m.pkg);
                     const firstSession = me.sessions.size === 1;
                     const prior = typeof m.session === "string" ? m.session : "";
                     const stale = prior && prior !== sessionId ? me.sessions.get(prior) : undefined;
@@ -2519,16 +2618,17 @@ pantheon signup --email you@work.com --username you</code></pre>
                             this.pushObligations(sp);
                     }
                     sp.lastTouch = Date.now();
-                    if (newRepo && sp.allow.addRepo(newRepo, m.repo_origin ?? null, me.id)) {
-                        this.log(`[${sp.name}] + repo ${m.repo_origin ?? newRepo} registered by ${me.id}`);
-                        this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.repo_origin ?? newRepo}`, meta: { repo: newRepo, repo_origin: m.repo_origin ?? null } });
+                    if (newRepo && sp.allow.addRepo(newRepo, repoLabelSafe(m.repo_origin), me.id)) {
+                        const label = repoLabelSafe(m.repo_origin);
+                        this.log(`[${sp.name}] + repo ${label ?? newRepo} registered by ${me.id}`);
+                        this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${label ?? newRepo}`, meta: { repo: newRepo, repo_origin: label ?? null } });
                         this.broadcast(sp, { t: "repos", repos: sp.allow.repoList() });
                     }
                     this.send(ws, {
                         t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
                         roster: this.roster(sp), goals: [...sp.goals.values()],
                         obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
-                        space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
+                        space_id: sp.allow.spaceId(), repos: sp.allow.repoList(), features: [...this.features],
                         ...(acct ? { plan: this.planView(acct, sp) } : {}),
                         ...(enrolled ? { token: enrolled } : staleToken && this.knownToken(sp) ? { token: sp.token } : {}),
                     });
@@ -2565,6 +2665,14 @@ pantheon signup --email you@work.com --username you</code></pre>
                         this.hangUp(ws, "REVOKED");
                     return;
                 }
+                if (delegated && Date.now() > delegated.expires + 10 * 60_000) {
+                    if (ws.readyState === 1)
+                        this.hangUp(ws, "REVOKED");
+                    return;
+                }
+                if (delegated && m.t !== "act" && m.t !== "open_goal" && m.t !== "claim" && m.t !== "worker_state") {
+                    return fail("NOT_FOR_A_RUN", `an unattended run cannot ${m.t.replace(/_/g, " ")} — its member does that from their own session`, m.cid);
+                }
                 if (m.t === "publish_profile") {
                     if (m.profile.member !== me.id) {
                         return fail("PROFILE_NOT_YOURS", `you may publish only the profile for ${me.id}`, m.cid);
@@ -2597,6 +2705,13 @@ pantheon signup --email you@work.com --username you</code></pre>
                     const target = space.allow.get(m.member);
                     if (!target)
                         return fail("NO_SUCH_MEMBER", `"${m.member}" has never connected, so there is no key to admit`, m.cid);
+                    if (!m.revoke && !m.forget && !m.wake_only && !target.admitted && space.allow.removedWhen(m.member) !== null) {
+                        const founder = space.allow.founder();
+                        if (founder && me.id !== founder)
+                            return fail("FOUNDER_ONLY", `${m.member} was removed from "${space.name}"; only ${founder}, who founded it, can bring them back`, m.cid);
+                    }
+                    if (m.wake_only && (m.revoke || m.forget || !target.admitted))
+                        return fail("NOT_ADMITTED", `"${m.member}" is not in "${space.name}" now, so there is no wake permission to change`, m.cid);
                     if (!m.revoke && !m.forget) {
                         const plan = this.spacePlan(space.name);
                         if (plan && m.may_wake && !plan.limits.wake)
@@ -2727,14 +2842,14 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (existing && m.base && existing.added_by !== me.id && space.allow.founder() !== me.id) {
                         return fail("NOT_YOURS", `only ${existing.added_by} (who registered this repo) or the team's founder can change which branch its runs start from`, m.cid);
                     }
-                    const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id, m.base ?? null);
+                    const added = space.allow.addRepo(m.repo, repoLabelSafe(m.origin), me.id, m.base ?? null);
                     if (!added && m.base && space.allow.setRepoBase(m.repo, m.base)) {
-                        this.log(`[${space.name}] ~ repo ${m.origin ?? m.repo} base branch → ${m.base} (by ${me.id})`);
+                        this.log(`[${space.name}] ~ repo ${repoLabelSafe(m.origin) ?? m.repo} base branch → ${m.base} (by ${me.id})`);
                         this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
                     }
                     if (added) {
-                        this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
-                        this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
+                        this.log(`[${space.name}] + repo ${repoLabelSafe(m.origin) ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
+                        this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${repoLabelSafe(m.origin) ?? m.repo}`, meta: { repo: m.repo, repo_origin: repoLabelSafe(m.origin) ?? null } });
                         this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
                     }
                     this.send(ws, { t: "ack", cid: m.cid, id: m.repo, seq: space.ledger.head });
@@ -2770,11 +2885,11 @@ pantheon signup --email you@work.com --username you</code></pre>
                             }
                         }
                         const held = space.contLocks.get(m.obligation);
-                        if (held && held.session !== sessionId && Date.now() - held.at < LIMITS.claimTtlMs) {
+                        if (held && held.session !== sessionId && this.claimHolds(space, held)) {
                             return fail("CLAIMED", `another of your sessions (${held.session}) is handling this`, m.cid);
                         }
                         for (const [k, v] of space.contLocks) {
-                            if (Date.now() - v.at > LIMITS.claimTtlMs)
+                            if (!this.claimHolds(space, v))
                                 space.contLocks.delete(k);
                         }
                         space.contLocks.set(m.obligation, { session: sessionId, member: me.id, at: Date.now() });
@@ -2787,7 +2902,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (o.owner !== me.id)
                         return fail("NOT_YOURS", `${o.owner} owes that, not you`, m.cid);
                     if (o.claimed_by && o.claimed_by.session !== sessionId) {
-                        if (Date.now() - o.claimed_by.at < LIMITS.claimTtlMs) {
+                        if (this.claimHolds(space, o.claimed_by)) {
                             const holder = o.claimed_by;
                             const live = [...me.sessions.keys()].includes(holder.session);
                             const left = Math.ceil((LIMITS.claimTtlMs - (Date.now() - holder.at)) / 60_000);
@@ -2826,12 +2941,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                         if (!space.members.has(id) && !space.allow.get(id)?.admitted)
                             return fail("NO_SUCH_MEMBER", `nobody here is called "${id}"`, m.cid);
                     }
+                    if (!this.features.includes("act-sig"))
+                        delete m.sig;
+                    if (m.sig || delegated) {
+                        const why = goalSigProblem(m, me.id, myPubkey, [space.allow.spaceId(), space.name], delegated);
+                        if (why)
+                            return fail("BAD_GOAL_SIGNATURE", why, m.cid);
+                    }
                     const invited = (m.invite ?? [...space.members.keys()]).filter((x) => x !== me.id);
                     if (m.deadline !== undefined && m.deadline <= Date.now()) {
                         return fail("DEADLINE_PAST", `deadline ${new Date(m.deadline).toISOString()} is already in the past`, m.cid);
                     }
                     const goal = {
-                        id: newId("g"),
+                        id: m.id && !space.goals.has(m.id) ? m.id : newId("g"),
                         title: m.title,
                         acceptance: m.acceptance,
                         members: [me.id, ...new Set(invited)],
@@ -2842,6 +2964,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                         opened_at: Date.now(),
                         ...(m.deadline !== undefined ? { deadline: m.deadline } : {}),
                         ...(m.kind !== undefined ? { kind: m.kind } : {}),
+                        ...(m.sig ? { sig: m.sig } : {}),
                     };
                     space.goals.set(goal.id, goal);
                     space.store.flush(space.goals, space.obligations, space.profiles);
@@ -2851,13 +2974,27 @@ pantheon signup --email you@work.com --username you</code></pre>
                         body: `goal opened: ${goal.title}\nacceptance: ${goal.acceptance || "(none stated)"}` +
                             (goal.deadline ? `\ndeadline: ${new Date(goal.deadline).toISOString()}` : "") +
                             (goal.kind === "worklist" ? `\nkind: worklist — ${me.id}'s own list; peers may read it, nobody owes anything in it` : ""),
-                        meta: { goal_members: goal.members, goal_budget: goal.budget },
+                        meta: { goal_members: goal.members, goal_budget: goal.budget, ...(m.sig ? { goal_sig: m.sig, goal_text: { title: goal.title, acceptance: goal.acceptance } } : {}) },
                     });
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: goal.id, seq: rec.seq });
                     return;
                 }
-                const storedMeta = m.meta || m.defers_to || m.affects
-                    ? { ...(m.meta ?? {}), ...(m.defers_to ? { defers_to: m.defers_to } : {}), ...(m.affects ? { affects: m.affects } : {}) }
+                if (!this.features.includes("act-sig"))
+                    delete m.sig;
+                if (m.sig || delegated) {
+                    const why = actSigProblem(m, me.id, myPubkey, [space.allow.spaceId(), space.name], delegated);
+                    if (why)
+                        return fail("BAD_ACT_SIGNATURE", why, m.cid);
+                }
+                if (m.act === "NOTE" && m.meta && ("goal_members" in m.meta || "organization_profile" in m.meta || "notice" in m.meta))
+                    return fail("BAD_META", "goal_members, organization_profile and notice are written by the relay, not sent", m.cid);
+                if (m.act === "NOTE" && m.body.startsWith("repo registered with this space: "))
+                    return fail("BAD_META", "that line is written by the relay, not sent", m.cid);
+                const fromRepo = m.repo && space.allow.hasRepo(m.repo) ? m.repo : null;
+                const { from_repo: _forged, ...senderMeta } = (m.meta ?? {});
+                const hasMeta = !!m.meta && (Object.keys(senderMeta).length > 0 || _forged === undefined);
+                const storedMeta = hasMeta || m.defers_to || m.affects || fromRepo
+                    ? { ...senderMeta, ...(m.defers_to ? { defers_to: m.defers_to } : {}), ...(m.affects ? { affects: m.affects } : {}), ...(fromRepo ? { from_repo: fromRepo } : {}) }
                     : undefined;
                 const fp = actFingerprint(me.id, m.act, m.body, m.goal ?? null, m.ref ?? null, m.to ?? null, storedMeta);
                 const prior = space.recent.get(fp);
@@ -2865,6 +3002,10 @@ pantheon signup --email you@work.com --username you</code></pre>
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: prior.id, seq: prior.seq });
                     return;
                 }
+                if (m.sig && m.id && (space.ledger.find(m.id) || space.droppedIds?.has(m.id)))
+                    return fail("ID_TAKEN", `an act with id ${m.id} already exists`, m.cid);
+                if (m.sig && m.id && !idIsFresh(m.id))
+                    return fail("BAD_ACT_ID", `act id ${m.id} was not made in the last day — check this machine's clock`, m.cid);
                 if (m.after_seq !== undefined) {
                     const mine = me.id;
                     const missed = space.ledger.since(m.after_seq)
@@ -2894,13 +3035,16 @@ pantheon signup --email you@work.com --username you</code></pre>
                 if (wasFull && !this.freesRoom(space, me.id, m.act, m.ref ?? null))
                     return fail("SPACE_FULL", this.spaceFullMessage(space), m.cid);
                 const rec = this.commit(space, {
+                    ...(m.sig && m.id ? { id: m.id } : {}),
                     from: me.id, session: sessionId, role, act: m.act, body: m.body,
                     ...(m.summary ? { summary: m.summary } : {}),
+                    ...(m.sig ? { sig: m.sig } : {}),
                     to: m.to ?? null, goal: m.goal ?? null, ref: m.ref ?? null,
-                    ...(m.meta || m.defers_to || m.affects
-                        ? { meta: { ...(m.meta ?? {}),
+                    ...((m.meta && (Object.keys(withoutFromRepo(m.meta)).length > 0 || !("from_repo" in m.meta))) || m.defers_to || m.affects || fromRepo
+                        ? { meta: { ...withoutFromRepo(m.meta),
                                 ...(m.defers_to ? { defers_to: m.defers_to } : {}),
-                                ...(m.affects ? { affects: m.affects } : {}) } }
+                                ...(m.affects ? { affects: m.affects } : {}),
+                                ...(fromRepo ? { from_repo: fromRepo } : {}) } }
                         : {}),
                 });
                 if (wasFull && m.act === "CLOSE") {
@@ -3022,6 +3166,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             this.noteStorageFailure("evicting idle spaces", e);
         }
     }
+    claimHolds(sp, holder, now = Date.now()) {
+        const live = [...sp.members.values()].some((m) => m.sessions.has(holder.session));
+        return now - holder.at < (live ? LIMITS.claimLiveTtlMs : LIMITS.claimTtlMs);
+    }
     lapseClaims(sp, now) {
         const live = new Set();
         for (const m of sp.members.values())
@@ -3029,14 +3177,15 @@ pantheon signup --email you@work.com --username you</code></pre>
                 live.add(id);
         let lapsed = 0;
         for (const o of sp.obligations.values()) {
-            if (o.claimed_by && !live.has(o.claimed_by.session) && now - o.claimed_by.at >= LIMITS.claimTtlMs) {
+            if (o.claimed_by && !this.claimHolds(sp, o.claimed_by, now)) {
                 delete o.claimed_by;
                 lapsed++;
             }
         }
         for (const [k, v] of sp.contLocks)
-            if (!live.has(v.session) && now - v.at >= LIMITS.claimTtlMs)
+            if (!this.claimHolds(sp, v, now))
                 sp.contLocks.delete(k);
+        void live;
         if (lapsed)
             this.pushObligations(sp);
     }
@@ -3071,6 +3220,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             return { code: "ESCALATE_IS_LOCAL",
                 message: "ESCALATE is for your own human. Use HUMAN_REQUIRED to notify one named peer's human." };
         }
+        if (meta && ("authority" in meta || "unverified_domains" in meta)) {
+            delete meta["authority"];
+            delete meta["unverified_domains"];
+        }
         if (act === "HUMAN_REQUIRED" && (!to || to.length !== 1)) {
             return { code: "ONE_HUMAN_REQUIRED",
                 message: "HUMAN_REQUIRED must name exactly one human owner. Send separate requests when separate people must decide." };
@@ -3079,6 +3232,9 @@ pantheon signup --email you@work.com --username you</code></pre>
             const domains = Array.isArray(meta?.decision_domains)
                 ? [...new Set(meta.decision_domains.filter((x) => typeof x === "string" && x.trim().length > 0))]
                 : [];
+            if (domains.some((d) => d.length > 64 || /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(d))) {
+                return { code: "BAD_DECISION_DOMAIN", message: "decision_domains are single-line names of up to 64 characters, as profiles publish them" };
+            }
             if (!domains.length) {
                 return { code: "DECISION_DOMAINS_REQUIRED",
                     message: "HUMAN_REQUIRED must name decision_domains so the relay can verify the human owner. Call pantheon_route_decision first." };
@@ -3253,7 +3409,10 @@ pantheon signup --email you@work.com --username you</code></pre>
         if ((partial.act === "JOIN" || partial.act === "LEAVE") && this.spaceFull(sp)) {
             return { ...partial, id: newId("a"), seq: sp.ledger.head, ts: Date.now(), space: sp.name };
         }
-        const rec = sp.ledger.append({ ...partial, id: newId("a"), ts: Date.now(), space: sp.name }, this.maxLedgerBytes + SPACE_HARD_SLACK);
+        let id = partial.id ?? newId("a");
+        while (!partial.id && sp.ledger.find(id))
+            id = newId("a");
+        const rec = sp.ledger.append({ ...partial, id, ts: Date.now(), space: sp.name }, this.maxLedgerBytes + SPACE_HARD_SLACK);
         sp.lastTouch = rec.ts;
         const m = sp.members.get(rec.from);
         if (m) {
@@ -3365,6 +3524,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 break;
             case "ESCALATE":
                 this.oblige(sp, { kind: "HUMAN", owner: `human:${rec.from}`, ref: rec.id, goal: rec.goal,
+                    ...(rec.ref ? { about: rec.ref } : {}),
                     body: `${rec.from} escalated: ${first(rec.body)}` });
                 if (goal && goal.state === "OPEN") {
                     goal.state = "BLOCKED";
@@ -3400,6 +3560,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                     const alreadyLive = asked && [...sp.obligations.values()].some((o) => o.kind === "HUMAN" && o.ref === asked.id);
                     if (asked && decider === rec.from && !stillAnswered && !alreadyLive && !retracted.has(asked.id)) {
                         this.oblige(sp, { kind: "HUMAN", owner: `human:${decider}`, ref: asked.id, goal: asked.goal,
+                            ...(asked.act === "ESCALATE" && asked.ref ? { about: asked.ref } : {}),
                             body: asked.act === "ESCALATE" ? `${asked.from} escalated: ${first(asked.body)}` : `${asked.from} needs a decision: ${first(asked.body)}` });
                         const g = asked.goal ? sp.goals.get(asked.goal) : undefined;
                         if (g && g.state === "OPEN") {
@@ -3762,8 +3923,9 @@ pantheon signup --email you@work.com --username you</code></pre>
         const budget = typeof meta?.goal_budget === "number" && Number.isInteger(meta.goal_budget) && meta.goal_budget > 0 ? meta.goal_budget : LIMITS.goalBudget;
         return {
             id: r.goal,
-            title: mm[1],
-            acceptance: mm[2] !== "(none stated)" ? mm[2] : "",
+            title: typeof meta?.goal_text?.title === "string" ? meta.goal_text.title : mm[1],
+            acceptance: typeof meta?.goal_text?.acceptance === "string" ? meta.goal_text.acceptance : (mm[2] !== "(none stated)" ? mm[2] : ""),
+            ...(meta?.goal_sig && typeof meta.goal_sig === "object" ? { sig: meta.goal_sig } : {}),
             members,
             state: "OPEN",
             acts: 0,
@@ -3785,7 +3947,18 @@ pantheon signup --email you@work.com --username you</code></pre>
             return !g || g.state !== "CLOSED";
         };
         const referenced = new Set([...sp.obligations.values()].map((o) => o.ref));
+        const before = sp.ledger.all().map((r) => r.id);
         const { dropped, kept } = sp.ledger.compact({ keepRecent: this.opts.ledgerKeepRecent ?? LIMITS.ledgerKeepRecent, isLive, keep: (id) => referenced.has(id) });
+        if (dropped) {
+            const now = Date.now();
+            const d = (sp.droppedIds ??= new Map());
+            for (const [id, at] of d)
+                if (now - at > DAY)
+                    d.delete(id);
+            for (const id of before)
+                if (!sp.ledger.find(id))
+                    d.set(id, now);
+        }
         if (dropped)
             this.log(`[${sp.name}] compacted ledger — dropped ${dropped} old act(s) from closed goals, ${kept} kept`);
     }
@@ -3821,7 +3994,7 @@ pantheon signup --email you@work.com --username you</code></pre>
     members(sp) {
         return sp.allow.all().map((e) => ({
             member: e.member, admitted: e.admitted, may_wake: e.may_wake,
-            fingerprint: fingerprint(e.publicKey),
+            fingerprint: fingerprint(e.publicKey), pubkey: e.publicKey,
             ...(e.admitted_by ? { admitted_by: e.admitted_by } : {}),
             ...(e.revoked_at ? { revoked_at: e.revoked_at, ...(e.revoked_by ? { revoked_by: e.revoked_by } : {}) } : {}),
             ...(sp.allow.founder() === e.member ? { founder: true } : {}),

package/dist/repo-find.js

@@ -0,0 +1,127 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join, resolve } from "node:path";
+import { repoInfo } from "./config.js";
+const SKIP = new Set(["node_modules", "vendor", "dist", "build", "target", "out", ".next", "Pods", "DerivedData", "venv", ".venv", "__pycache__", "Library", "Applications"]);
+export function reposUnder(dir, depth = 3, budget = { left: 4000 }) {
+    const out = [];
+    const seen = new Set();
+    const walk = (d, level) => {
+        if (budget.left-- <= 0)
+            return;
+        if (existsSync(join(d, ".git"))) {
+            const r = repoInfo(d);
+            if (r && !seen.has(r.root)) {
+                seen.add(r.root);
+                out.push(r);
+            }
+            return;
+        }
+        if (level >= depth)
+            return;
+        let entries = [];
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.startsWith(".") || SKIP.has(e))
+                continue;
+            const p = join(d, e);
+            try {
+                if (!statSync(p).isDirectory())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            walk(p, level + 1);
+        }
+    };
+    walk(resolve(dir), 0);
+    return out;
+}
+export function holdsRepo(dir, budget = 20_000) {
+    let left = budget;
+    const stack = [resolve(dir)];
+    while (stack.length) {
+        const d = stack.pop();
+        if (left-- <= 0)
+            return true;
+        let entries = [];
+        try {
+            entries = readdirSync(d, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            if (e.name === ".git")
+                return true;
+            if (e.isDirectory())
+                stack.push(join(d, e.name));
+        }
+    }
+    return false;
+}
+export function commonCodeRoots(home = homedir()) {
+    return ["code", "Code", "src", "dev", "Developer", "projects", "Projects", "workspace", "work", "repos", "git", "github", "GitHub", "Documents/GitHub", "Documents/code", "Sites"]
+        .map((d) => join(home, d)).filter((d) => { try {
+        return statSync(d).isDirectory();
+    }
+    catch {
+        return false;
+    } });
+}
+export function openedFolders(home = homedir(), os = platform()) {
+    const out = new Set();
+    const add = (p) => { if (typeof p === "string" && (p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p)))
+        out.add(p); };
+    try {
+        for (const k of Object.keys(JSON.parse(readFileSync(join(home, ".claude.json"), "utf8")).projects ?? {}))
+            add(k);
+    }
+    catch { }
+    const appData = os === "darwin" ? join(home, "Library", "Application Support") : os === "win32" ? (process.env["APPDATA"] ?? join(home, "AppData", "Roaming")) : join(home, ".config");
+    for (const app of ["Code", "Cursor", "Code - Insiders", "Windsurf"]) {
+        try {
+            const text = readFileSync(join(appData, app, "User", "globalStorage", "storage.json"), "utf8");
+            for (const m of text.matchAll(/"file:\/\/([^"]+)"/g)) {
+                try {
+                    add(decodeURIComponent(m[1]).replace(/^\/([A-Za-z]:)/, "$1"));
+                }
+                catch { }
+            }
+        }
+        catch { }
+    }
+    return [...out];
+}
+export function findTeamClones(teamFps, opts = {}) {
+    const want = new Set(teamFps);
+    const found = new Map();
+    const consider = (r, how) => { if (r && want.has(r.fingerprint) && !found.has(r.fingerprint))
+        found.set(r.fingerprint, { repo: r, how }); };
+    const home = opts.home ?? homedir();
+    if (opts.recents)
+        for (const d of openedFolders(home, opts.os)) {
+            if (found.size === want.size)
+                break;
+            try {
+                if (existsSync(d))
+                    consider(repoInfo(d), "opened in your editor or agent");
+            }
+            catch { }
+        }
+    const budget = { left: 6000 };
+    for (const root of [...(opts.extra ?? []), ...commonCodeRoots(home)]) {
+        if (found.size === want.size)
+            break;
+        for (const r of reposUnder(root, 3, budget))
+            consider(r, `found in ${root.startsWith(home) ? `~${root.slice(home.length)}` : root}`);
+    }
+    return [...found.values()];
+}
+//# sourceMappingURL=repo-find.js.map