@join-pantheon/cli 0.31.2 → 0.32.0-rc.1

package/dist/installer.js

@@ -0,0 +1,204 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { VERSION } from "./version.js";
+export const INSTALLER_DIR = fileURLToPath(new URL("../installer/", import.meta.url));
+export const VERSION_PLACEHOLDER = "__PANTHEON_VERSION__";
+export function renderInstaller(text, version) {
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version))
+        return null;
+    if (!text.includes(VERSION_PLACEHOLDER))
+        return null;
+    return text.split(VERSION_PLACEHOLDER).join(version);
+}
+const cache = new Map();
+export function installerScript(name, dir = INSTALLER_DIR, version = VERSION) {
+    const key = `${dir}\0${name}\0${version}`;
+    if (cache.has(key))
+        return cache.get(key);
+    let out = null;
+    try {
+        out = renderInstaller(readFileSync(join(dir, name), "utf8"), version);
+    }
+    catch {
+        out = null;
+    }
+    cache.set(key, out);
+    return out;
+}
+export const NPM_PACKAGE = "@join-pantheon/cli";
+export const NPM_PACKUMENT_URL = "https://registry.npmjs.org/@join-pantheon%2fcli";
+export const INSTALLER_MIN_CLI = "0.32.0";
+function parseVer(v) {
+    const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(v);
+    return m ? { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]), pre: m[4] ?? null } : null;
+}
+export function compareVersions(a, b) {
+    const x = parseVer(a), y = parseVer(b);
+    if (!x || !y)
+        return a < b ? -1 : a > b ? 1 : 0;
+    for (const k of ["major", "minor", "patch"])
+        if (x[k] !== y[k])
+            return x[k] - y[k];
+    if (x.pre === y.pre)
+        return 0;
+    if (x.pre === null)
+        return 1;
+    if (y.pre === null)
+        return -1;
+    const p = x.pre.split("."), q = y.pre.split(".");
+    for (let i = 0; i < Math.max(p.length, q.length); i++) {
+        if (p[i] === undefined)
+            return -1;
+        if (q[i] === undefined)
+            return 1;
+        const pn = /^\d+$/.test(p[i]), qn = /^\d+$/.test(q[i]);
+        if (pn && qn && Number(p[i]) !== Number(q[i]))
+            return Number(p[i]) - Number(q[i]);
+        if (pn !== qn)
+            return pn ? -1 : 1;
+        if (p[i] !== q[i])
+            return p[i] < q[i] ? -1 : 1;
+    }
+    return 0;
+}
+export function pickFallback(target, versions, floor = INSTALLER_MIN_CLI) {
+    const t = parseVer(target);
+    if (!t)
+        return null;
+    let best = null;
+    for (const [v, meta] of Object.entries(versions)) {
+        const p = parseVer(v);
+        if (!p || p.pre !== null)
+            continue;
+        if (meta && typeof meta === "object" && meta.deprecated)
+            continue;
+        if (compareVersions(v, target) >= 0 || compareVersions(v, floor) < 0)
+            continue;
+        if (p.major !== t.major || p.minor < t.minor - 1)
+            continue;
+        if (!best || compareVersions(v, best) > 0)
+            best = v;
+    }
+    return best;
+}
+export class InstallerGate {
+    version;
+    confirmed = false;
+    fallback = null;
+    answered = false;
+    inflight = null;
+    timer = null;
+    closed = false;
+    said = "";
+    fetchImpl;
+    url;
+    timeoutMs;
+    recheckMs;
+    mode;
+    log;
+    constructor(opts = {}) {
+        this.version = opts.version ?? VERSION;
+        this.fetchImpl = opts.fetch ?? ((url, init) => fetch(url, init));
+        this.url = opts.url ?? NPM_PACKUMENT_URL;
+        this.timeoutMs = opts.timeoutMs ?? 8_000;
+        this.recheckMs = opts.recheckMs ?? 3 * 60_000;
+        this.mode = opts.mode ?? ((process.env.PANTHEON_INSTALLER_GATE ?? "").trim().toLowerCase() === "off" ? "off" : "on");
+        this.log = opts.log ?? (() => { });
+    }
+    get passThrough() { return this.mode === "off" || !parseVer(this.version); }
+    start() { void this.check(); }
+    check() {
+        if (this.confirmed || this.closed || this.passThrough)
+            return Promise.resolve();
+        this.inflight ??= this.ask().finally(() => {
+            this.inflight = null;
+            this.answered = true;
+            this.schedule();
+        });
+        return this.inflight;
+    }
+    async choose() {
+        const base = parseVer(this.version);
+        if (base && compareVersions(`${base.major}.${base.minor}.${base.patch}`, INSTALLER_MIN_CLI) < 0) {
+            return { unavailable: `this relay runs Pantheon ${this.version}, older than the one-line installer needs (${INSTALLER_MIN_CLI}). Install with npm instead: npm install -g @join-pantheon/cli` };
+        }
+        if (this.passThrough)
+            return { version: this.version, fallback: false };
+        if (!this.confirmed && !this.answered)
+            await this.check();
+        if (this.confirmed)
+            return { version: this.version, fallback: false };
+        if (this.fallback)
+            return { version: this.fallback, fallback: true };
+        return { unavailable: `the installer for Pantheon ${this.version} is not available yet - try again in a few minutes.` };
+    }
+    close() {
+        this.closed = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+    }
+    schedule() {
+        if (this.confirmed || this.closed || this.timer)
+            return;
+        this.timer = setTimeout(() => { this.timer = null; void this.check(); }, this.recheckMs);
+        this.timer.unref?.();
+    }
+    note(line) {
+        if (line === this.said)
+            return;
+        this.said = line;
+        try {
+            this.log(line);
+        }
+        catch { }
+    }
+    async ask() {
+        const again = `asking again every ${Math.round(this.recheckMs / 1000)}s`;
+        const abort = new AbortController();
+        const timer = setTimeout(() => abort.abort(new Error(`no answer in ${this.timeoutMs}ms`)), this.timeoutMs);
+        try {
+            const res = await this.fetchImpl(this.url, {
+                headers: { accept: "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8" },
+                signal: abort.signal,
+            });
+            if (res.status === 404) {
+                try {
+                    await res.body?.cancel();
+                }
+                catch { }
+                this.fallback = null;
+                this.note(`installer: ${NPM_PACKAGE} is not on npm at all; /install.sh and /install.ps1 say it is not available and fail (${again})`);
+                return;
+            }
+            if (!res.ok) {
+                try {
+                    await res.body?.cancel();
+                }
+                catch { }
+                throw new Error(`the registry answered ${res.status}`);
+            }
+            const doc = await res.json();
+            const versions = doc && typeof doc === "object" && doc.versions && typeof doc.versions === "object" ? doc.versions : null;
+            if (!versions)
+                throw new Error("the registry's answer lists no versions");
+            if (Object.prototype.hasOwnProperty.call(versions, this.version)) {
+                this.confirmed = true;
+                this.note(`installer: ${NPM_PACKAGE}@${this.version} is on npm; /install.sh and /install.ps1 install it`);
+                return;
+            }
+            this.fallback = pickFallback(this.version, versions);
+            this.note(this.fallback
+                ? `installer: ${this.version} is not on npm yet; /install.sh and /install.ps1 install ${this.fallback} until it is (${again})`
+                : `installer: ${this.version} is not on npm yet and no compatible earlier release is; /install.sh and /install.ps1 say it is not available and fail (${again})`);
+        }
+        catch (e) {
+            this.note(`installer: could not ask npm whether ${this.version} is published (${e?.message ?? String(e)}); ${again}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=installer.js.map

package/dist/machine.js

@@ -629,7 +629,8 @@ export function removePantheonWorktrees(repos, roots, git = (repo, args) => exec
     }
     return { removed, left };
 }
-export function removeHomeLeftovers(home, keep) {
+const MANAGED_LAUNCHER = "pantheon";
+export function removeHomeLeftovers(home, keep, opts = {}) {
     const removed = [], left = [];
     const items = [
         ["worker-policy.json", "the worker's wake policy (who may wake it, and self-upgrade) — a rejoin starts from no grants"],
@@ -646,6 +647,19 @@ export function removeHomeLeftovers(home, keep) {
             left.push(`${what}, ${f} (--keep-identity)`);
             continue;
         }
+        if (name === "bin" && existsSync(join(f, MANAGED_LAUNCHER))) {
+            try {
+                const others = readdirSync(f).filter((e) => e !== MANAGED_LAUNCHER);
+                for (const e of others)
+                    rmSync(join(f, e), { recursive: true, force: true });
+                if (others.length)
+                    removed.push(`${what} (${f}${opts.uninstalling ? "" : "; the pantheon command there stays"})`);
+            }
+            catch (e) {
+                left.push(`${what}, ${f} — could not remove (${e.message.split("\n")[0]})`);
+            }
+            continue;
+        }
         try {
             rmSync(f, { recursive: true, force: true });
             removed.push(`${what} (${f})`);

package/dist/managed.js

@@ -0,0 +1,238 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { platform } from "node:os";
+import { posix, win32 } from "node:path";
+const PKG = ["@join-pantheon", "cli"];
+export function managedLayout(execPath = process.execPath, os = platform()) {
+    if (!execPath)
+        return null;
+    if (os === "win32") {
+        const p = win32.normalize(execPath);
+        const nodeDir = win32.dirname(p);
+        const runtime = win32.dirname(nodeDir);
+        const root = win32.dirname(runtime);
+        if (win32.basename(p).toLowerCase() !== "node.exe")
+            return null;
+        if (win32.basename(nodeDir).toLowerCase() !== "node" || win32.basename(runtime).toLowerCase() !== "runtime")
+            return null;
+        if (win32.basename(root).toLowerCase() !== "pantheon")
+            return null;
+        const binDir = win32.join(root, "bin");
+        const pkgDir = win32.join(nodeDir, "node_modules", ...PKG);
+        return {
+            root, nodeDir, node: p, npm: win32.join(nodeDir, "npm.cmd"), npmCli: win32.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"), binDir,
+            launcher: win32.join(binDir, "pantheon.cmd"), pkgDir,
+            entry: win32.join(pkgDir, "bin", "pantheon.js"), cli: win32.join(pkgDir, "dist", "cli.js"),
+        };
+    }
+    const p = posix.normalize(execPath);
+    const bin = posix.dirname(p);
+    const nodeDir = posix.dirname(bin);
+    const runtime = posix.dirname(nodeDir);
+    const root = posix.dirname(runtime);
+    if (posix.basename(p) !== "node" || posix.basename(bin) !== "bin")
+        return null;
+    if (posix.basename(nodeDir) !== "node" || posix.basename(runtime) !== "runtime")
+        return null;
+    if (posix.basename(root) !== ".pantheon")
+        return null;
+    const binDir = posix.join(root, "bin");
+    const pkgDir = posix.join(nodeDir, "lib", "node_modules", ...PKG);
+    return {
+        root, nodeDir, node: p, npm: posix.join(bin, "npm"), npmCli: posix.join(nodeDir, "lib", "node_modules", "npm", "bin", "npm-cli.js"), binDir,
+        launcher: posix.join(binDir, "pantheon"), pkgDir,
+        entry: posix.join(pkgDir, "bin", "pantheon.js"), cli: posix.join(pkgDir, "dist", "cli.js"),
+    };
+}
+export function childNodeFlags(execArgv = process.execArgv, layout = managedLayout()) {
+    return execArgv.includes("--use-system-ca") || layout ? ["--use-system-ca"] : [];
+}
+export function managedLauncher(layout = managedLayout(), exists = existsSync) {
+    return layout && exists(layout.launcher) ? layout.launcher : null;
+}
+export function runtimeVerdict(f) {
+    const shadowFix = (who) => `${who} comes before the managed install on PATH, so a terminal runs that one. Remove it (\`npm uninstall -g @join-pantheon/cli\` with the npm that installed it), or put ${f.layout?.binDir ?? (f.expected ? f.expected.replace(/[\\/][^\\/]+$/, "") : "the managed bin folder")} first on PATH — the installer's line in your shell profile does that in every new terminal`;
+    const other = f.firstOnPath.find((p) => !!p && !f.ours(p)) ?? null;
+    if (f.layout) {
+        const where = `Pantheon's own Node v${f.nodeVersion.replace(/^v/, "")} at ${f.layout.nodeDir}`;
+        if (other)
+            return { level: "warn", detail: `${where} — but an older pantheon, ${other}, comes first on PATH`, fix: shadowFix(other), share: "managed runtime, shadowed on PATH" };
+        if (!f.firstOnPath.some((p) => p && f.ours(p))) {
+            return { level: "warn", detail: `${where} — but ${f.layout.binDir} is not on PATH here yet`,
+                fix: "open a new terminal (the installer added it to your shell profile), or run the installer again", share: "managed runtime, not on PATH yet" };
+        }
+        return { level: "pass", detail: `${where} (the managed install; ${f.layout.launcher} comes first on PATH)`, share: `managed runtime, Node v${f.nodeVersion.replace(/^v/, "")}` };
+    }
+    if (!f.expected || !f.expectedExists)
+        return null;
+    return {
+        level: "warn",
+        detail: `the managed install is at ${f.expected}, but this pantheon runs on another Node (v${f.nodeVersion.replace(/^v/, "")})${other ? ` — ${other} comes first on PATH` : ""}`,
+        fix: shadowFix(other ?? "another pantheon"),
+        share: "managed install present, another pantheon ran",
+    };
+}
+export function expectedLauncher(home, os = platform(), env = process.env) {
+    if (os === "win32") {
+        const local = env.LOCALAPPDATA || (home ? win32.join(home, "AppData", "Local") : "");
+        return local ? win32.join(local, "Pantheon", "bin", "pantheon.cmd") : null;
+    }
+    return home ? posix.join(home, ".pantheon", "bin", "pantheon") : null;
+}
+export function runtimeNodeVersion(layout = managedLayout(), run = (node) => execFileSync(node, ["--version"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 })) {
+    if (layout) {
+        try {
+            const v = run(layout.node).trim().replace(/^v/, "");
+            if (/^\d+\.\d+\.\d+$/.test(v))
+                return v;
+        }
+        catch { }
+    }
+    return process.versions.node;
+}
+const cmp3 = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+export function nodeSatisfies(version, range) {
+    const vm = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+    if (!vm)
+        return null;
+    const v = [Number(vm[1]), Number(vm[2]), Number(vm[3])];
+    const bounds = (c) => {
+        const m = /^(>=|<=|>|<|=|\^|~)?v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(c);
+        if (!m)
+            return null;
+        const op = m[1] ?? "";
+        const parts = [m[2], m[3], m[4]].map((p) => (p === undefined || /^[xX*]$/.test(p) ? null : Number(p)));
+        const firstOpen = parts.indexOf(null);
+        const given = firstOpen < 0 ? 3 : firstOpen;
+        if (parts.slice(given).some((p) => p !== null))
+            return null;
+        const lo = [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+        const next = (n) => n === 0 ? null : n === 1 ? [lo[0] + 1, 0, 0] : n === 2 ? [lo[0], lo[1] + 1, 0] : [lo[0], lo[1], lo[2] + 1];
+        if (given === 0)
+            return op === ">" || op === "<" ? [null, [0, 0, 0]] : [null, null];
+        switch (op) {
+            case "":
+            case "=": return [lo, next(given)];
+            case ">=": return [lo, null];
+            case ">": return [next(given), null];
+            case "<": return [null, lo];
+            case "<=": return [null, next(given)];
+            case "~": return [lo, next(given >= 2 ? 2 : given)];
+            case "^": return [lo, next(lo[0] !== 0 || given === 1 ? 1 : lo[1] !== 0 || given === 2 ? 2 : 3)];
+            default: return null;
+        }
+    };
+    let readAll = true;
+    for (const alt of range.split("||").map((s) => s.trim())) {
+        if (alt === "" || alt === "*" || /^[xX]$/.test(alt))
+            return true;
+        const hy = /^(\S+)\s+-\s+(\S+)$/.exec(alt);
+        const comps = hy ? [`>=${hy[1]}`, `<=${hy[2]}`] : alt.replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/);
+        let ok = true;
+        for (const c of comps) {
+            const b = bounds(c);
+            if (!b) {
+                readAll = false;
+                ok = false;
+                break;
+            }
+            if ((b[0] && cmp3(v, b[0]) < 0) || (b[1] && cmp3(v, b[1]) >= 0))
+                ok = false;
+        }
+        if (ok)
+            return true;
+    }
+    return readAll ? false : null;
+}
+const HOSTED_INSTALLER_BASE = "https://relay.joinpantheon.network";
+export function installerBase(relay) {
+    if (!relay)
+        return HOSTED_INSTALLER_BASE;
+    try {
+        const u = new URL(relay.trim().replace(/^ws(s?):/i, "http$1:"));
+        if (u.protocol === "http:")
+            return null;
+        if (u.protocol !== "https:")
+            return HOSTED_INSTALLER_BASE;
+        return u.origin;
+    }
+    catch {
+        return HOSTED_INSTALLER_BASE;
+    }
+}
+const TRAVELS = /^[A-Za-z0-9._~:/?#@!&()*+,;=%[\]-]+$/;
+export function quotableInvite(invite) {
+    const hash = invite.indexOf("#");
+    const head = hash < 0 ? invite : invite.slice(0, hash);
+    const out = head.replace(/'/g, "%27") + (hash < 0 ? "" : invite.slice(hash));
+    return TRAVELS.test(out) ? out : null;
+}
+export function installerLine(relay, shell, args = []) {
+    const base = installerBase(relay);
+    if (!base || args.some((a) => !TRAVELS.test(a)))
+        return null;
+    if (shell === "sh") {
+        const q = (a) => (/^[A-Za-z0-9._/:=@%+-]+$/.test(a) ? a : `'${a}'`);
+        return `curl -fsSL ${base}/install.sh | sh${args.length ? ` -s -- ${args.map(q).join(" ")}` : ""}`;
+    }
+    if (shell === "ps" && !args.length)
+        return `irm ${base}/install.ps1 | iex`;
+    const set = args.length ? `Set-Item Env:PANTHEON_ARGS '${args.join(" ")}'; ` : "";
+    return `powershell -NoProfile -ExecutionPolicy Bypass -Command "${set}irm ${base}/install.ps1 | iex"`;
+}
+export function installerLineHere(relay, os = platform()) {
+    return installerLine(relay, os === "win32" ? "ps" : "sh") ?? installerLine(HOSTED_INSTALLER_BASE, os === "win32" ? "ps" : "sh");
+}
+export function nodeTooOldSentence(target, range, node, relay, os = platform()) {
+    return `${target ? `Pantheon ${target}` : "Pantheon's newest release"} needs Node ${range}, and Pantheon's own Node here is v${node.replace(/^v/, "")}, so nothing was installed — run the installer again, which brings the Node it needs and keeps your teams and settings: ${installerLineHere(relay, os)}`;
+}
+export function runtimeNodeFit(layout, node, newest, relay, os = platform()) {
+    if (!layout || !newest)
+        return null;
+    const fits = nodeSatisfies(node, newest.range);
+    if (fits === null)
+        return null;
+    const v = node.replace(/^v/, "");
+    if (fits)
+        return { level: "pass", detail: `Node v${v} runs the newest Pantheon (${newest.version} needs Node ${newest.range})`, share: "runtime Node fits the newest release" };
+    return {
+        level: "warn",
+        detail: `the newest Pantheon (${newest.version}) needs Node ${newest.range}; Pantheon's own Node here is v${v}, so \`pantheon upgrade\` will not install it`,
+        fix: `run the installer again — it brings the Node the release needs and keeps your teams and settings: ${installerLineHere(relay, os)}`,
+        share: "runtime Node too old for the newest release",
+    };
+}
+export function joinInstructions(invite, relay, installers = true) {
+    const link = quotableInvite(invite);
+    const steps = [];
+    const sh = link && installers ? installerLine(relay, "sh", ["join", link]) : null;
+    const win = link && installers ? installerLine(relay, "windows", ["join", link]) : null;
+    if (sh)
+        steps.push({ label: "Mac or Linux (Terminal):", lines: [sh] });
+    if (win)
+        steps.push({ label: "Windows (Command Prompt or PowerShell):", lines: [win] });
+    steps.push({
+        label: steps.length ? "Already have Node.js 22.13 or newer? This works too:" : "With Node.js 22.13 or newer (nodejs.org):",
+        lines: ["npm i -g @join-pantheon/cli", link ? `pantheon join '${link}'` : `pantheon join ${invite}`],
+    });
+    return {
+        intro: "You're invited to my Pantheon team. Paste the line for your computer into a terminal:",
+        steps,
+        outro: sh || win
+            ? "It installs Pantheon (with its own Node, no admin rights), asks for your email, sends you a 6-digit code, and sets up the coding agents on your computer."
+            : "`pantheon join` asks for your email, sends you a 6-digit code, and sets up the coding agents on your computer.",
+    };
+}
+export async function relayServesInstaller(relay, timeoutMs = 4000) {
+    const base = installerBase(relay);
+    if (!base)
+        return false;
+    try {
+        const r = await fetch(`${base}/install.sh`, { method: "HEAD", signal: AbortSignal.timeout(timeoutMs) });
+        return r.status === 200 && r.headers.get("x-pantheon-installs") !== null;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=managed.js.map

package/dist/mcp-supervisor.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
+import { childNodeFlags } from "./managed.js";
 import { fileURLToPath } from "node:url";
 import { CONFIG_DIR } from "./config.js";
 import { VERSION } from "./version.js";
@@ -98,7 +99,7 @@ export async function superviseMcp() {
             return null;
         let proc;
         try {
-            proc = spawn(process.execPath, [entry, "mcp", "--child"], {
+            proc = spawn(process.execPath, [...childNodeFlags(), entry, "mcp", "--child"], {
                 stdio: ["pipe", "pipe", "pipe"],
                 env: { ...process.env, PANTHEON_MCP_SUPERVISED: String(process.pid) },
             });

package/dist/measure.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
+import { childNodeFlags } from "./managed.js";
 import { fileURLToPath } from "node:url";
 import { claudeGrantedEffective, cursorGrantedEffective, claudeAllow, cursorAllow, isServerWide } from "./grants.js";
 import { codexApprovalState, copilotMcpConfigFile, kiroMcpConfigFile } from "./install.js";
@@ -29,7 +30,7 @@ export function measureMcp(opts = {}) {
             done(m);
         };
         const t0 = Date.now();
-        const proc = spawn(process.execPath, [entry, "mcp", "--child"], {
+        const proc = spawn(process.execPath, [...childNodeFlags(), entry, "mcp", "--child"], {
             cwd: opts.cwd, stdio: ["pipe", "pipe", "pipe"], env: opts.env ?? process.env,
         });
         const timer = setTimeout(() => finish({ error: `no answer to initialize within ${timeoutMs}ms` }), timeoutMs);

package/dist/notifier.js

@@ -1,6 +1,6 @@
-import { execFileSync, spawn } from "node:child_process";
-import { helperStale, recordHelperBuild } from "./helpers-build.js";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { helperStale, installHelper } from "./helpers-build.js";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -58,7 +58,8 @@ function oneLine(value, max = 220) {
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const hudBinaryPath = (home = CONFIG_DIR) => join(home, "bin", "pantheon-hud");
 export const hudSourcePath = () => resolve(HERE, "..", "helper", "macos", "main.swift");
-export function ensureNativeNotifier(home = CONFIG_DIR) {
+export const HUD_PREBUILT = "pantheon-hud";
+export function ensureNativeNotifier(home = CONFIG_DIR, deps = {}) {
     if (platform() !== "darwin")
         throw new Error("the actionable Pantheon notifier is currently macOS-only");
     const source = hudSourcePath();
@@ -66,21 +67,10 @@ export function ensureNativeNotifier(home = CONFIG_DIR) {
         throw new Error(`Pantheon notification helper source is missing: ${source}`);
     const binary = hudBinaryPath(home);
     mkdirSync(dirname(binary), { recursive: true });
-    requireDeveloperTools("notifications", "notifier");
-    execFileSync("/usr/bin/swiftc", ["-O", source, "-o", binary], { stdio: "pipe" });
-    chmodSync(binary, 0o755);
-    recordHelperBuild(binary, source);
-    return binary;
+    return installHelper({ name: HUD_PREBUILT, source, binary, what: "notifications", service: "notifier" }, deps).binary;
 }
 export function notifierStale(home = CONFIG_DIR) { return helperStale(hudBinaryPath(home), hudSourcePath()); }
-export function requireDeveloperTools(what, service) {
-    try {
-        execFileSync("/usr/bin/xcode-select", ["-p"], { stdio: "pipe" });
-    }
-    catch {
-        throw new Error(`building ${what} needs the Xcode Command Line Tools — run \`xcode-select --install\`, then \`pantheon service install ${service}\``);
-    }
-}
+export { requireDeveloperTools } from "./helpers-build.js";
 export function installedTools() {
     const seen = new Set();
     const out = [];

package/dist/notify.js

@@ -7,6 +7,7 @@ import { homedir, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { whichPantheon } from "./service.js";
+import { managedLayout } from "./managed.js";
 import { detectForHooks, agentById } from "./agents.js";
 import { codexHookState, cursorHookState, copilotHookState, kiroHookState, installCodexHooks, installCursorHooks, installCopilotHooks, installKiroHooks, removeCodexHooks, removeCursorHooks, removeCopilotHooks, removeKiroHooks, } from "./hooks-install.js";
 export const HOOK_MARKER = "pantheon hook";
@@ -14,7 +15,12 @@ export const HOOK_RE = /(?:pantheon(?:\.cmd|\.exe|\.bat)?["']?\s+hook\s|cli\.js[
 export const isOurHookCommand = (cmd) => !!cmd && (cmd.includes(HOOK_MARKER) || HOOK_RE.test(cmd));
 export const hookBin = (bin) => (/\s/.test(bin) ? `"${bin}"` : bin);
 const HERE = dirname(fileURLToPath(import.meta.url));
-export function hookLauncher(os = platform(), found = whichPantheon(), entry = resolve(HERE, "cli.js"), entryExists = existsSync) {
+export function hookLauncher(os = platform(), found = whichPantheon(), entry = resolve(HERE, "cli.js"), entryExists = existsSync, managed = managedLayout(process.execPath, os)) {
+    if (os === "win32" && managed && entryExists(managed.cli)) {
+        const node = managed.node.replace(/\\/g, "/");
+        const cmdWord = /^[A-Za-z0-9_./:~+-]+$/.test(node) ? node : `"${node}"`;
+        return `${cmdWord} --use-system-ca ${windowsHookArg(managed.cli.replace(/\\/g, "/"))}`;
+    }
     if (os !== "win32") {
         if (!found)
             return null;