@join-pantheon/cli 0.31.0 → 0.31.2-rc.1

package/dist/relay.js

@@ -13,7 +13,8 @@ import { emailSenderFromEnv } from "./email.js";
 import { Allowlist, RosterUnreadable } from "./roster-file.js";
 import { StateStore, ensurePrivateDir } from "./store.js";
 import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, spaceHealth, fleetReport, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
-import { fmtLimit, parseLimits, planLimits, PLAN_NAME } from "./plans.js";
+import { fmtLimit, inviteLimit, parseLimits, planLimits, PLAN_NAME } from "./plans.js";
+import { FEEDBACK_ADDRESS } from "./feedback.js";
 import { routeDecision } from "./profile.js";
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
@@ -949,9 +950,12 @@ export class Relay {
         if (!pubkey || !sig || !Number.isFinite(ts) || Math.abs(Date.now() - ts) > LIMITS.accountFreshMs)
             return null;
         const params = {};
-        for (const [k, v] of url.searchParams)
+        for (const [k, v] of url.searchParams) {
+            if (Object.prototype.hasOwnProperty.call(params, k) || (k === "sig" && url.searchParams.getAll("sig").length > 1))
+                return null;
             if (k !== "sig")
                 params[k] = v;
+        }
         if (!verifyAccount(pubkey, method, path, params, ts, sig))
             return null;
         const device = A.deviceByPubkey(pubkey);
@@ -1520,15 +1524,15 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             case "set_plan_limits": {
                 if (!PLAN_NAME.test(id))
                     return this.json(res, 400, { error: "plan names are lowercase letters, digits, - and _" });
-                const lim = parseLimits({ spaces: body.spaces, members: body.members, wake: body.wake ?? "off" });
+                const lim = parseLimits({ spaces: body.spaces, members: body.members, wake: body.wake ?? "off", ...(body.invites !== undefined && body.invites !== "" ? { invites: body.invites } : {}) });
                 if (!lim)
-                    return this.json(res, 400, { error: "spaces must be 0 or more and members 1 or more" });
+                    return this.json(res, 400, { error: "spaces and invites must be 0 or more and members 1 or more" });
                 const plans = A.plans();
                 const prev = plans[id];
                 plans[id] = lim;
                 A.setPlans(plans);
                 A.audit({ event: "admin_set_plan_limits", target: id, detail: `${prev ? JSON.stringify(prev) : "(new plan)"} → ${JSON.stringify(lim)}`, ip });
-                return done(`${id} plan: ${fmtLimit(lim.spaces)} spaces · ${fmtLimit(lim.members)} people · unattended workers ${lim.wake ? "on" : "off"} — applies to the next create, invite or admit`);
+                return done(`${id} plan: ${fmtLimit(lim.spaces)} spaces · ${fmtLimit(lim.members)} people · ${fmtLimit(inviteLimit(lim, id))} open invite links · unattended workers ${lim.wake ? "on" : "off"} — applies to the next create, invite or admit`);
             }
             case "delete_plan": {
                 if (id === "free")
@@ -1820,6 +1824,34 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         const fresh = this.accounts?.accountById(acct.id) ?? acct;
         return { name: fresh.plan, limits: this.accounts.limitsFor(fresh), usage: { spaces: this.accounts.spacesOwned(fresh.id).length, members: sp.allow.admittedCount() } };
     }
+    fullNoticeSent = new Map();
+    tellOwnerTeamFull(sp, plan, joiner) {
+        const owner = plan.owner;
+        if (!owner?.email || !this.email.sendNotice)
+            return;
+        const key = `${sp.name}|${joiner}`;
+        const last = this.fullNoticeSent.get(key) ?? 0;
+        if (Date.now() - last < 24 * 3600_000)
+            return;
+        this.fullNoticeSent.set(key, Date.now());
+        if (this.fullNoticeSent.size > 5000)
+            this.fullNoticeSent.delete(this.fullNoticeSent.keys().next().value);
+        const subject = `${joiner} tried to join "${sp.name}" — your team is full`;
+        const text = [
+            `Hi ${owner.username},`,
+            ``,
+            `${joiner} just tried to join "${sp.name}" on Pantheon with your invite, but the team is full: the ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people, and it has ${sp.allow.admittedCount()}.`,
+            ``,
+            `To let them in, either:`,
+            `  - upgrade: reply to this email, or write to ${FEEDBACK_ADDRESS}`,
+            `  - or remove someone: pantheon admit <name> --revoke`,
+            ``,
+            `Their invite link still works, so they won't need a new one once there is room.`,
+            ``,
+            `— Pantheon`,
+        ].join("\n");
+        void this.email.sendNotice(owner.email, subject, text).catch(() => false);
+    }
     planRefusal(space, plan, target, msg, cid, fail, actor, ip) {
         this.accounts?.audit({ event: "plan_limit", actor_account: actor ?? plan.owner?.id ?? null, space: space.name, target, detail: `${plan.name}: ${msg.slice(0, 160)}`, ip });
         this.log(`[${space.name}] ! PLAN_LIMIT (${target}, ${plan.name} plan)`);
@@ -1983,9 +2015,9 @@ ${done ? `<div class=done role=status>${esc(done)}</div>` : ""}
 <section id=s-plans>
   <div class=sec><h2>Plans</h2><span class=count>limits the relay enforces · the owner's plan governs a space</span></div>
   <div class=wrap tabindex=0 role=region aria-label="Scrollable table"><table id=t-plans>
-    <thead><tr><th>plan</th><th class=num>accounts</th><th>spaces created</th><th>people per space</th><th>unattended workers</th><th></th></tr></thead>
-    <tbody>${rows(Object.entries(plans).map(([n, l]) => { const fid = `plan-${esc(n)}`; return `<tr><td><form id="${fid}" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits><input type=hidden name=id value="${esc(n)}"></form><code>${esc(n)}</code></td><td class=num>${planCounts[n] ?? 0}</td><td><input form="${fid}" name=spaces aria-label="Maximum spaces" type=number min=0 value="${l.spaces}"></td><td><input form="${fid}" name=members aria-label="Maximum people per space" type=number min=1 value="${l.members}"></td><td><label><input form="${fid}" type=checkbox name=wake value=on${l.wake ? " checked" : ""}> allowed</label></td><td class=actions><button form="${fid}" class=act>save</button> ${n === "free" ? "" : form("delete_plan", n, "remove", "", "danger")}</td></tr>`; }))}
-    <tr><td><form id="plan-new" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits></form><input form="plan-new" type=text name=id aria-label="New plan name" placeholder="new plan name" pattern="[a-z][a-z0-9_-]{0,23}" required style="width:150px"></td><td class="num dim">—</td><td><input form="plan-new" name=spaces aria-label="Maximum spaces" type=number min=0 value=3></td><td><input form="plan-new" name=members aria-label="Maximum people per space" type=number min=1 value=5></td><td><label><input form="plan-new" type=checkbox name=wake value=on checked> allowed</label></td><td class=actions><button form="plan-new" class=act>add plan</button></td></tr></tbody>
+    <thead><tr><th>plan</th><th class=num>accounts</th><th>spaces created</th><th>people per space</th><th>open invite links</th><th>unattended workers</th><th></th></tr></thead>
+    <tbody>${rows(Object.entries(plans).map(([n, l]) => { const fid = `plan-${esc(n)}`; return `<tr><td><form id="${fid}" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits><input type=hidden name=id value="${esc(n)}"></form><code>${esc(n)}</code></td><td class=num>${planCounts[n] ?? 0}</td><td><input form="${fid}" name=spaces aria-label="Maximum spaces" type=number min=0 value="${l.spaces}"></td><td><input form="${fid}" name=members aria-label="Maximum people per space" type=number min=1 value="${l.members}"></td><td><input form="${fid}" name=invites aria-label="Open invite links per space" type=number min=0 value="${inviteLimit(l, n)}"></td><td><label><input form="${fid}" type=checkbox name=wake value=on${l.wake ? " checked" : ""}> allowed</label></td><td class=actions><button form="${fid}" class=act>save</button> ${n === "free" ? "" : form("delete_plan", n, "remove", "", "danger")}</td></tr>`; }))}
+    <tr><td><form id="plan-new" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits></form><input form="plan-new" type=text name=id aria-label="New plan name" placeholder="new plan name" pattern="[a-z][a-z0-9_-]{0,23}" required style="width:150px"></td><td class="num dim">—</td><td><input form="plan-new" name=spaces aria-label="Maximum spaces" type=number min=0 value=3></td><td><input form="plan-new" name=members aria-label="Maximum people per space" type=number min=1 value=5></td><td><input form="plan-new" name=invites aria-label="Open invite links per space" type=number min=0 value=5></td><td><label><input form="plan-new" type=checkbox name=wake value=on checked> allowed</label></td><td class=actions><button form="plan-new" class=act>add plan</button></td></tr></tbody>
   </table></div>
   <p class=note>Edits apply immediately to the next create, invite or admit of every account on that plan. Unused invites count toward people per space, so nobody mints five at once. Every change is audited.</p>
 </section>
@@ -2514,9 +2546,11 @@ pantheon signup --email you@work.com --username you</code></pre>
                     let enrolled = null;
                     if (m.enroll) {
                         const plan = this.spacePlan(sp.name);
-                        if (plan && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
+                        const realInvite = sp.allow.openInvites().some((i) => i.token === m.enroll);
+                        if (plan && realInvite && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
                             this.accounts?.audit({ event: "plan_limit", actor_account: acct?.id ?? null, space: sp.name, target: "join", detail: `${plan.name}: ${sp.allow.admittedCount()}/${plan.limits.members} people`, ip });
-                            return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. ${plan.owner ? `Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network` : "Its owner's account was deleted; the relay operator can move it to another plan."}`);
+                            this.tellOwnerTeamFull(sp, plan, m.member);
+                            return reject("PLAN_LIMIT", `"${sp.name}" is full: its ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. ${plan.owner ? `Ask ${plan.owner.username} to upgrade, or contact ${FEEDBACK_ADDRESS}.` : `Its owner's account was deleted; contact ${FEEDBACK_ADDRESS}.`} Your invite stays valid: once there is room, run the same pantheon join again.`);
                         }
                         const r = sp.allow.redeem(m.enroll, m.member, m.pubkey);
                         if (!r.ok) {
@@ -2717,7 +2751,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                         if (plan && m.may_wake && !plan.limits.wake)
                             return this.planRefusal(space, plan, "admit", `the ${plan.name} plan does not include unattended workers — admit without --may-wake`, m.cid, fail, acct?.id ?? null, ip);
                         if (plan && !target.admitted && space.allow.admittedCount() >= plan.limits.members)
-                            return this.planRefusal(space, plan, "admit", `"${space.name}" is full for the ${plan.name} plan (${fmtLimit(plan.limits.members)} people). Upgrade at https://www.joinpantheon.network to admit more.`, m.cid, fail, acct?.id ?? null, ip);
+                            return this.planRefusal(space, plan, "admit", `"${space.name}" is full for the ${plan.name} plan (${fmtLimit(plan.limits.members)} people). Upgrade to admit more: ${FEEDBACK_ADDRESS}`, m.cid, fail, acct?.id ?? null, ip);
                     }
                     if (m.revoke || m.forget) {
                         const founder = space.allow.founder();
@@ -2784,8 +2818,9 @@ pantheon signup --email you@work.com --username you</code></pre>
                         if (m.may_wake && !plan.limits.wake)
                             return this.planRefusal(space, plan, "invite", `the ${plan.name} plan does not include unattended workers — invite without wake: pantheon invite --no-wake`, m.cid, fail, acct?.id ?? null, ip);
                         const open = space.allow.openInvites().length;
-                        if (space.allow.admittedCount() + open >= plan.limits.members) {
-                            return this.planRefusal(space, plan, "invite", `"${space.name}" is full for the ${plan.name} plan: ${fmtLimit(plan.limits.members)} people${open ? `, counting ${open} unused invite${open === 1 ? "" : "s"}` : ""}.${open ? ` An unused invite holds a seat until it expires — free them: pantheon invite --revoke all.` : ""} Upgrade at https://www.joinpantheon.network to invite more.`, m.cid, fail, acct?.id ?? null, ip);
+                        const maxOpen = inviteLimit(plan.limits, plan.name);
+                        if (open >= maxOpen) {
+                            return this.planRefusal(space, plan, "invite", `"${space.name}" already has ${open} unused invite link${open === 1 ? "" : "s"}, the most the ${plan.name} plan allows open at once. Cancel them (pantheon invite --revoke all) or wait for them to expire, or upgrade: ${FEEDBACK_ADDRESS}`, m.cid, fail, acct?.id ?? null, ip);
                         }
                     }
                     if (!this.writeOk(me))
@@ -2795,7 +2830,10 @@ pantheon signup --email you@work.com --username you</code></pre>
                     const token = randomBytes(18).toString("base64url");
                     const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token, this.ensureToken(space));
                     this.log(`[${space.name}] * invite minted by ${me.id}, valid ${m.ttl_minutes}m, single use`);
-                    this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at });
+                    const full = plan && space.allow.admittedCount() >= plan.limits.members
+                        ? `"${space.name}" already has ${space.allow.admittedCount()} of ${fmtLimit(plan.limits.members)} people on the ${plan.name} plan, so this link works only once you upgrade (${FEEDBACK_ADDRESS}) or remove someone (pantheon admit <name> --revoke).`
+                        : undefined;
+                    this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at, ...(full ? { note: full } : {}) });
                     return;
                 }
                 if (m.t === "invites") {
@@ -3516,14 +3554,20 @@ pantheon signup --email you@work.com --username you</code></pre>
                 break;
             case "CONTRACT":
             case "DELIVERED":
-                if (rec.ref)
+                if (rec.ref) {
+                    const target = sp.ledger.find(rec.ref);
+                    const proposerLocks = rec.act === "CONTRACT" && target?.act === "PROPOSE" && target.from === rec.from;
                     for (const [id, o] of sp.obligations) {
-                        if (o.ref === rec.ref && o.goal === rec.goal && o.kind !== "HUMAN")
+                        if (o.ref !== rec.ref || o.goal !== rec.goal || o.kind === "HUMAN")
+                            continue;
+                        if (o.owner === rec.from || (proposerLocks && o.kind === "ACCEPT"))
                             sp.obligations.delete(id);
                     }
+                }
                 break;
             case "ESCALATE":
                 this.oblige(sp, { kind: "HUMAN", owner: `human:${rec.from}`, ref: rec.id, goal: rec.goal,
+                    ...(rec.ref ? { about: rec.ref } : {}),
                     body: `${rec.from} escalated: ${first(rec.body)}` });
                 if (goal && goal.state === "OPEN") {
                     goal.state = "BLOCKED";
@@ -3559,6 +3603,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                     const alreadyLive = asked && [...sp.obligations.values()].some((o) => o.kind === "HUMAN" && o.ref === asked.id);
                     if (asked && decider === rec.from && !stillAnswered && !alreadyLive && !retracted.has(asked.id)) {
                         this.oblige(sp, { kind: "HUMAN", owner: `human:${decider}`, ref: asked.id, goal: asked.goal,
+                            ...(asked.act === "ESCALATE" && asked.ref ? { about: asked.ref } : {}),
                             body: asked.act === "ESCALATE" ? `${asked.from} escalated: ${first(asked.body)}` : `${asked.from} needs a decision: ${first(asked.body)}` });
                         const g = asked.goal ? sp.goals.get(asked.goal) : undefined;
                         if (g && g.state === "OPEN") {

package/dist/roster-file.js

@@ -225,6 +225,9 @@ export class Allowlist {
         const inv = this.invites.get(token);
         if (!inv)
             return { ok: false, why: "that invite is not valid for this space" };
+        const prior = this.entries.get(member);
+        if (inv.used_by && inv.used_by === member && prior?.admitted && prior.publicKey === publicKey)
+            return { ok: true, entry: prior };
         if (inv.used_by)
             return { ok: false, why: `that invite was already used by "${inv.used_by}" — ask for a fresh one` };
         if (Date.now() > inv.expires_at)

package/dist/run-failure.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { gitCallEnv, safeGitArgs } from "./git-safe.js";
 import { checkRepoCommand } from "./agents.js";
 import { bashRuleMatches, GIT_DENY_RULES } from "./claude-confine.js";
 export const AUTH_RE = /not (?:logged|signed) in|not authenticated|no (?:github )?(?:authentication|credentials?|token) (?:found|available)|login required|please (?:log|sign) in|run .*login|invalid api key|unauthori[sz]ed|authentication (?:failed|required)|\b401\b|expired (?:token|session)/i;
@@ -9,7 +10,7 @@ export const SIGN_IN_FIX = {
     copilot: "run `copilot login` (or `gh auth login` — copilot uses gh's sign-in too)",
     kiro: "run `kiro-cli login` (or set KIRO_API_KEY)",
 };
-const sh = (dir, ...args) => execFileSync("git", ["-C", dir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000 }).trim();
+const sh = (dir, ...args) => execFileSync("git", safeGitArgs(dir, ["-C", dir, ...args]), { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], env: gitCallEnv(args, process.env), timeout: 5_000 }).trim();
 export const gitProbe = {
     isRepo: (dir) => { try {
         return sh(dir, "rev-parse", "--is-inside-work-tree") === "true";

package/dist/safe-write.js

@@ -0,0 +1,55 @@
+import { lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
+function partsUnder(root, target) {
+    const rel = relative(root, target);
+    if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        throw new Error(`${target} is not inside ${root}`);
+    return rel.split(sep).filter(Boolean);
+}
+function realRoot(root) {
+    let st;
+    try {
+        st = lstatSync(root);
+    }
+    catch {
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        return;
+    }
+    if (!st.isDirectory())
+        throw new Error(`${root} is not a folder of its own (a link or a file stands there) — nothing is written through it`);
+}
+function realFolders(root, parts, mode) {
+    let p = root;
+    for (const part of parts) {
+        p = join(p, part);
+        let st;
+        try {
+            st = lstatSync(p);
+        }
+        catch {
+            st = null;
+        }
+        if (st?.isDirectory())
+            continue;
+        if (st)
+            rmSync(p, { recursive: true, force: true });
+        mkdirSync(p, { mode });
+    }
+}
+export function mkdirInside(root, dir, mode = 0o700) {
+    realRoot(root);
+    if (relative(root, dir) === "")
+        return;
+    realFolders(root, partsUnder(root, dir), mode);
+}
+export function writeInside(root, target, contents, mode = 0o600) {
+    realRoot(root);
+    const parts = partsUnder(root, target);
+    realFolders(root, parts.slice(0, -1), 0o700);
+    rmSync(target, { recursive: true, force: true });
+    writeFileSync(target, contents, { flag: "wx", mode });
+}
+export function copyInside(root, from, target, mode = 0o600) {
+    writeInside(root, target, readFileSync(from), mode);
+}
+//# sourceMappingURL=safe-write.js.map

package/dist/setup-guide.js

@@ -30,13 +30,21 @@ export const ALERT_OPTIONS = [
     { id: "worker", label: "Decisions, deliveries, and when my own worker finishes a run." },
     { id: "none", label: "None — I will look at pantheon status (and the menu bar, on a Mac)." },
 ];
+function gitUserName() {
+    try {
+        return execFileSync("git", ["config", "--get", "user.name"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 }).trim();
+    }
+    catch {
+        return "";
+    }
+}
 export function guideDefaults(profile, cfg) {
     const n = profile.notifications ?? { decisions: true, deliveries: false, worker_done: false };
     return {
         wake: wakeMode(profile),
         commands: profile.agent.allow_bash ?? false,
         approval: profile.agent.approval ?? "approve",
-        name: profile.human.display_name || cfg.display || cfg.member,
+        name: profile.human.display_name || cfg.display || gitUserName() || cfg.member,
         title: profile.human.title || "",
         decides: Object.entries(profile.authority).filter(([, m]) => m === "human_required").map(([d]) => d),
         notifications: !n.decisions ? "none" : n.worker_done ? "worker" : n.deliveries ? "deliveries" : "decisions",

package/dist/spend.js

@@ -1,28 +1,85 @@
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, renameSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { dirname, join } from "node:path";
 import { CONFIG_DIR } from "./config.js";
 function bookPath(home) {
     return join(home ?? CONFIG_DIR, "spend.json");
 }
 function read(home) {
+    let text;
     try {
-        return JSON.parse(readFileSync(bookPath(home), "utf8"));
+        text = readFileSync(bookPath(home), "utf8");
     }
-    catch {
-        return { runs: [] };
+    catch (e) {
+        if (e.code === "ENOENT")
+            return { runs: [] };
+        return { runs: [], broken: e.message.split("\n")[0] ?? "unreadable" };
     }
+    try {
+        const b = JSON.parse(text);
+        if (b && Array.isArray(b.runs))
+            return { runs: b.runs.filter((r) => !!r && typeof r === "object" && typeof r.at === "number") };
+    }
+    catch { }
+    return { runs: [], broken: "it is not a spend book (JSON with a list of runs)" };
 }
 function write(b, home) {
     const f = bookPath(home);
     mkdirSync(dirname(f), { recursive: true });
     const cutoff = Date.now() - 31 * 86_400_000;
-    writeFileSync(f, JSON.stringify({ runs: b.runs.filter((r) => r.at > cutoff) }), { mode: 0o600 });
+    const tmp = `${f}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify({ runs: b.runs.filter((r) => r.at > cutoff) }), { mode: 0o600, flag: "wx" });
+        renameSync(tmp, f);
+    }
+    catch (e) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch { }
+        throw e;
+    }
 }
 export function recordRun(r, home) {
     const b = read(home);
+    if (b.broken)
+        return;
     b.runs.push(r);
     write(b, home);
 }
+export function startRun(r, home) {
+    const id = randomBytes(8).toString("hex");
+    recordRun({ ...r, id, started: true }, home);
+    return id;
+}
+export function finishRun(id, end, home) {
+    const b = read(home);
+    if (b.broken)
+        return;
+    const i = b.runs.findIndex((r) => r.id === id);
+    if (i < 0) {
+        recordRun(end, home);
+        return;
+    }
+    const { started: _s, ...was } = b.runs[i];
+    b.runs[i] = { ...was, ...end };
+    write(b, home);
+}
+export function closeStartedRun(id, summary, fallback, home) {
+    const b = read(home);
+    if (b.broken)
+        return;
+    const i = b.runs.findIndex((r) => r.id === id);
+    if (i < 0) {
+        recordRun(fallback, home);
+        return;
+    }
+    if (!b.runs[i].started)
+        return;
+    const { started: _s, ...was } = b.runs[i];
+    b.runs[i] = { ...was, ok: false, summary };
+    write(b, home);
+}
 export function since(ms, home) {
     const from = Date.now() - ms;
     const runs = read(home).runs.filter((r) => r.at > from);
@@ -40,6 +97,9 @@ export function recentRuns(ms, home, limit = 12, only) {
         .sort((a, b) => b.at - a.at).slice(0, limit);
 }
 export function allowed(caps, home) {
+    const book = read(home);
+    if (book.broken)
+        return { ok: false, broken: true, why: `the spend book ${bookPath(home)} cannot be read (${book.broken}) — repair or delete it; unattended runs wait until then` };
     const hour = since(3_600_000, home).runs;
     if (hour >= caps.perHour) {
         return { ok: false, why: `${hour} runs in the last hour, cap is ${caps.perHour}` };

package/dist/tray.js

@@ -13,7 +13,7 @@ import { plistPath, serviceInstalled, whichPantheon } from "./service.js";
 import { VERSION } from "./version.js";
 import { LIMITS } from "./protocol.js";
 import { signedRead } from "./reads.js";
-import { allDecisionsPrompt, decisionPrompt, decisionTitle, owedPrompt, stripCeremony, waitingPrompt, workerSummary } from "./decision-ui.js";
+import { allDecisionsPrompt, decisionPrompt, decisionTitle, owedPrompt, stripCeremony, tidyIds, tidyLead, waitingPrompt, workerSummary } from "./decision-ui.js";
 import { loadProfile, SURFACE_BUNDLE_IDS } from "./profile.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const trayBinaryPath = (home = CONFIG_DIR) => join(home, "bin", "pantheon-tray");
@@ -52,6 +52,45 @@ export function writeTrayCommands(home = CONFIG_DIR) {
     }
     return out;
 }
+const WEEK_MS = 7 * 24 * 3600_000;
+const RANK = (i) => (i.kind === "decision" ? 0 : 1);
+export const boardOrder = (a, b) => RANK(a) - RANK(b) || a.when - b.when;
+export function arrangeBoard(items, o) {
+    const fallback = o.fallbackMs ?? LIMITS.workerFallbackMs;
+    const out = items.map((i) => ({ ...i }));
+    const spaceOf = (i) => i.space ?? "";
+    const asked = new Map();
+    for (const d of out)
+        if (d.kind === "decision" && d.about && (d.who === "your agent" || d.choices))
+            asked.set(`${spaceOf(d)}|${d.about}`, d);
+    for (const i of out) {
+        if (i.kind === "decision") {
+            i.lane = "now";
+            continue;
+        }
+        if (i.kind === "waiting") {
+            i.lane = "waiting";
+            continue;
+        }
+        const d = i.ref ? asked.get(`${spaceOf(i)}|${i.ref}`) : undefined;
+        if (d) {
+            d.context ??= i.headline;
+            i.lane = undefined;
+            continue;
+        }
+        const age = Math.max(0, o.now - i.when);
+        if (i.promise) {
+            i.lane = age > WEEK_MS ? "older" : "handling";
+            continue;
+        }
+        if (i.claimed || (o.workerRunning && age < fallback)) {
+            i.lane = "handling";
+            continue;
+        }
+        i.lane = age > WEEK_MS ? "older" : "now";
+    }
+    return out.filter((i) => i.lane).sort(boardOrder);
+}
 export function localChoices(ref) {
     if (!ref)
         return null;
@@ -115,7 +154,7 @@ export async function trayStatus(cfg = load(), f = loadAll()) {
             members: ok.reduce((n, p) => n + (p.members ?? 0), 0),
             decisions: ok.flatMap((p) => (p.decisions ?? []).map((d) => ({ ...d, body: `[${p.space}] ${d.body}` }))),
             decisions_prompt: allDecisionsPrompt(ok.reduce((n, p) => n + (p.decisions?.length ?? 0), 0)),
-            items: ok.flatMap((p) => (p.items ?? []).map((i) => ({ ...i, space: p.space }))),
+            items: ok.flatMap((p) => (p.items ?? []).map((i) => ({ ...i, space: p.space }))).sort(boardOrder),
             owed_count: ok.reduce((n, p) => n + (p.owed_count ?? 0), 0),
             waiting_count: ok.reduce((n, p) => n + (p.waiting_count ?? 0), 0),
         };
@@ -140,11 +179,15 @@ async function trayStatusOne(cfg) {
     const decisions = mineHuman
         .map((o) => ({ id: o.id, body: decisionTitle(o.body), detail: o.body, prompt: decisionPrompt(o.id, decisionTitle(o.body)) }));
     const senderOf = (o) => stripCeremony(o.body).from;
+    const tidy = (o, n) => tidyLead(decisionTitle(tidyIds(o.body), n), cfg.member);
     const row = (o, kind, who, prompt) => ({
-        id: o.id, kind, title: decisionTitle(o.body), headline: decisionTitle(o.body, 200), detail: o.body, prompt, who,
+        id: o.id, kind, title: tidy(o), headline: tidy(o, 200), detail: o.body, prompt, who,
         when: o.created_at ?? 0, space: cfg.space,
+        ...(o.claimed ? { claimed: true } : {}),
+        ...(o.kind === "DELIVER" ? { promise: true } : {}),
         ...(o.goal ? { goal: o.goal } : {}),
         ...(o.ref ? { ref: o.ref } : {}),
+        ...(typeof o.about === "string" && o.about ? { about: o.about } : {}),
     });
     const owed = all.filter((o) => o.owner === cfg.member);
     const waiting = all.filter((o) => o.owner !== cfg.member && o.owner !== `human:${cfg.member}`);
@@ -152,7 +195,9 @@ async function trayStatusOne(cfg) {
         ...mineHuman.map((o) => {
             const from = senderOf(o);
             const choices = localChoices(o.ref);
-            return { ...row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body))), decider: cfg.member, ...(choices ? { choices } : {}) };
+            const r = row(o, "decision", !from || from === cfg.member ? "your agent" : from, decisionPrompt(o.id, decisionTitle(o.body)));
+            const own = new RegExp(`^${cfg.member.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")} (?:escalated|needs a decision):\\s*`, "i");
+            return { ...r, detail: o.body.replace(own, ""), decider: cfg.member, ...(choices ? { choices } : {}) };
         }),
         ...owed.map((o) => row(o, "owed", "you", owedPrompt(decisionTitle(o.body), o.goal))),
         ...waiting.map((o) => {
@@ -163,6 +208,8 @@ async function trayStatusOne(cfg) {
                 : r;
         }),
     ];
+    const workerRunning = workerProc().running;
+    const board = arrangeBoard(items, { now: Date.now(), workerRunning });
     const profile = loadProfile(cfg);
     const surface = profile.agent.primary_surface;
     const surfaceName = surface === "claude-code" ? "Claude" : surface === "cursor" ? "Cursor" : surface === "copilot" ? "Copilot" : surface === "kiro" ? "Kiro" : "Codex";
@@ -179,7 +226,7 @@ async function trayStatusOne(cfg) {
         unavailable_spaces: !space || !decisionsOk ? [cfg.space] : [],
         online: space?.online ?? 0,
         members: space?.members ?? 0,
-        worker_running: workerProc().running,
+        worker_running: workerRunning,
         worker_installed: serviceInstalled("worker"),
         worker_plist: plistPath("worker"),
         notifier_running: notifierProc().running,
@@ -189,7 +236,7 @@ async function trayStatusOne(cfg) {
         surface_bundle_id: SURFACE_BUNDLE_IDS[surface],
         decisions_prompt: allDecisionsPrompt(decisions.length),
         decisions,
-        items,
+        items: board,
         owed_count: owed.length,
         waiting_count: waiting.length,
     };