@join-pantheon/cli 0.31.2 → 0.32.0-rc.2

package/README.md

@@ -325,7 +325,10 @@ pantheon service install menubar
 
 It is a thin shell: every fact comes from `pantheon tray-status` and every action runs a
 pantheon command, so it holds no state, no network of its own, and no credentials. Like the
-notification HUD it ships as Swift source and compiles locally at install.
+notification HUD it ships as Swift source plus a universal (Apple silicon and Intel), ad-hoc
+signed binary built from exactly that source at publish time, so installing it needs no Xcode
+Command Line Tools. Only if the shipped binary does not match its source, or does not run on
+this Mac, is it compiled locally — and that alone needs the Command Line Tools.
 
 Human decisions use a separate, model-free path. `ESCALATE` creates a durable
 `HUMAN` obligation; install native desktop alerts with:

package/dist/claude-confine.js

@@ -3,7 +3,8 @@ import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { writeInside } from "./safe-write.js";
 import { homedir, platform, tmpdir } from "node:os";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
+import { expectedLauncher } from "./managed.js";
 import { agentSpawn } from "./which.js";
 export const NO_CLAUDE_FEATURES = { version: null, permissionPrompts: false, settings: false, settingSources: false, disallowedTools: false };
 export function parseClaudeHelp(help, version = null) {
@@ -139,7 +140,7 @@ function userExcludedCommands(file) {
     }
 }
 const SECRET_FILE_GLOBS = [".env", ".env.*", "*.pem", "*.key", "*.p12", "*.pfx", "id_rsa*", "id_ed25519*", ".npmrc", ".netrc", "credentials*", "*.keystore", "service-account*.json"];
-const PANTHEON_HOME_ENTRIES = ["config.json", "config.json.bak", "config.json.lock", "worker-policy.json", "profile.json", "continued.json", "bin", "ops", "run-homes", "logs", "mcp", "data"];
+const PANTHEON_HOME_ENTRIES = ["config.json", "config.json.bak", "config.json.lock", "worker-policy.json", "profile.json", "continued.json", "bin", "runtime", "ops", "run-homes", "logs", "mcp", "data"];
 function aroundWorktree(top, keeps, named) {
     const keep = (typeof keeps === "string" ? [keeps] : [...keeps]).map((k) => resolve(k));
     const out = [];
@@ -167,6 +168,14 @@ function aroundWorktree(top, keeps, named) {
     walk(top, true);
     return out;
 }
+function managedTargets(home, os) {
+    const launcherAt = expectedLauncher(home, os);
+    if (!launcherAt)
+        return [];
+    const P = os === "win32" ? win32 : posix;
+    const bin = P.dirname(launcherAt);
+    return [{ abs: bin, dir: true }, { abs: P.join(P.dirname(bin), "runtime"), dir: true }];
+}
 export function claudeRunSettings(i) {
     const home = resolve(i.home ?? homedir());
     const os = i.os ?? platform();
@@ -176,6 +185,7 @@ export function claudeRunSettings(i) {
         ...SECRET_HOME_PATHS.map((p) => ({ abs: join(home, ...p.rel.split("/")), dir: p.dir })),
         { abs: resolve(i.pantheonHome), dir: true },
         { abs: resolve(i.runHome), dir: true },
+        ...managedTargets(home, os),
     ];
     const seen = new Set();
     const denied = [];

package/dist/cli.js

@@ -47,6 +47,7 @@ import { connectFailure, signInHint } from "./refusal.js";
 import * as mcpWindows from "./mcp-windows.js";
 import { updateBanner } from "./update-check.js";
 import { inWokenRun } from "./worker-policy.js";
+import { joinInstructions, managedLayout, relayServesInstaller } from "./managed.js";
 const argv = process.argv.slice(2);
 for (let i = argv.length - 1; i >= 1; i--) {
     const m = /^(--[a-z][a-z0-9-]*)=(.*)$/i.exec(argv[i]);
@@ -565,14 +566,16 @@ function windowsOverridesForBoundRepos() {
     for (const r of windowsRepoOverrides(dirs))
         console.error(`  ${D("claude code in")} ${r.dir}  ${D(r.status)}`);
 }
-function printJoinSteps(invite) {
+async function printJoinSteps(invite, relay) {
+    const j = joinInstructions(invite, relay, await relayServesInstaller(relay));
     console.error(`\n${B("For a teammate who'd rather not type commands, forward this whole block:")}\n`);
-    console.error(D(`  You're invited to my Pantheon team. Paste these two lines into a terminal`));
-    console.error(D(`  (Terminal on a Mac, Command Prompt on Windows), one at a time:`));
-    console.error(`    ${C("npm i -g @join-pantheon/cli")}`);
-    console.error(`    ${C(`pantheon join ${invite}`)}`);
-    console.error(D(`  The second line asks for your email, sends you a 6-digit code, and sets up`));
-    console.error(D(`  the coding agents on your computer. Needs Node.js 22.13 or newer: nodejs.org.`));
+    console.error(D(`  ${j.intro}`));
+    for (const s of j.steps) {
+        console.error(D(`  ${s.label}`));
+        for (const l of s.lines)
+            console.error(`    ${C(l)}`);
+    }
+    console.error(D(`  ${j.outro}`));
 }
 const HUD_ACTION_MAX_AGE_MS = 30_000;
 function unattendedProject() {
@@ -917,6 +920,7 @@ ${B("control")}
                             (auto-detects claude / codex / cursor / copilot / kiro on this machine)
   pantheon spend              woken runs on this machine, and what pantheon cannot see
   pantheon leave              remove what pantheon put on this machine
+  pantheon uninstall          leave, then remove Pantheon itself: its own Node, the pantheon command, the PATH lines
   pantheon panic              emergency stop: ends the run in flight and the worker, and switches off wake rights in every team you are in
   pantheon doctor [--share]   check this machine end to end; --share prints it without names or paths, to paste to us
   pantheon network [--proxy <url> | --direct | --clear]   how this machine reaches the relay; save a proxy for every Pantheon process here
@@ -973,6 +977,7 @@ const COMMAND_FLAGS = {
     history: "--goal <id>  --from <member>  --last <n>  --since <seq>  --short  --presence  --json",
     network: "--proxy <url> [--no-proxy <hosts>]  |  --direct  |  --clear",
     leave: "[<team>]  --yes  --keep-identity  --stop-relay  --project <dir>",
+    uninstall: "--yes  --keep-identity  --stop-relay  --project <dir>",
     stop: "[relay|worker|notifier|menubar|all]  --port <n>",
     logs: "[relay|worker|notifier|menubar]  --follow  --n <lines>",
     worker: "--agent <claude-code|codex|cursor|copilot|kiro|auto>  --persona <name>  --project <dir>  --allow-bash  --max-runs <n>  --max-runs-day <n>  --grace <s>  --once",
@@ -1074,7 +1079,7 @@ async function main() {
         if (helpAt.some((a) => a === "--help" || a === "-h")) {
             const u = usageFor(cmd, HELP_ALL);
             const flags = COMMAND_FLAGS[cmd];
-            const teamCmd = !["start", "join", "signup", "login", "verify", "whoami", "relay", "help", "version", "upgrade", "network", "ps", "stop", "service", "hook", "mcp", "pending", "tray-status"].includes(cmd);
+            const teamCmd = !["start", "join", "signup", "login", "verify", "whoami", "relay", "help", "version", "upgrade", "network", "ps", "stop", "service", "hook", "mcp", "pending", "tray-status", "uninstall"].includes(cmd);
             const shown = flags && teamCmd && !/--space/.test(flags) ? `${flags}\n  --space <team>   (the team to act on, when this folder is bound to another or none)` : flags;
             console.log(u || shown ? `${u ?? `  pantheon ${cmd}`}${shown ? `\n\n${B("flags")}\n  ${shown}` : ""}\n\n${D("nothing was run · all commands: pantheon help --all")}` : HELP);
             return;
@@ -1188,7 +1193,7 @@ async function main() {
                 console.error(r.inviteMayWake
                     ? `  ${B("It also lets them wake workers:")} ${D("their requests can start an agent run on this machine while you are away (you chose wake \"anyone\"). Take it back: pantheon admit <name> --revoke")}`
                     : D(`  It lets them join and talk to your agent. It does not let them wake this machine on its own: the first time their request needs it while you are away, you are asked (Always / Just this once / No). Approve ahead: pantheon wake allow <name>`));
-                printJoinSteps(link ?? r.invite);
+                await printJoinSteps(link ?? r.invite, r.cfg?.relay);
             }
             if (!r.reach.shareable && r.reach.hint) {
                 console.error(`\n\x1b[33m  That address only works on this machine.\x1b[0m`);
@@ -1250,7 +1255,7 @@ async function main() {
             console.error(D(`\nSingle use, expires ${new Date(inv.expires_at).toLocaleString()}.`));
             if (inv.note)
                 console.error(`\x1b[33m  ! ${inv.note}\x1b[0m`);
-            printJoinSteps(link ?? raw);
+            await printJoinSteps(link ?? raw, cfg.relay);
             client.close();
             return;
         }
@@ -1279,6 +1284,7 @@ async function main() {
                 dataDir: resolveDataDir(flag("data")).dir,
             });
             const { port, host } = await relay.listen();
+            relay.startInstallerCheck();
             console.error(`${B("pantheon relay")} listening on ${C(`ws://${host}:${port}`)}`);
             console.error(D(`ledger:     ${resolveDataDir(flag("data")).dir}`));
             console.error(D(`health:     http://localhost:${port}/health`));
@@ -1521,7 +1527,7 @@ async function main() {
             for (const s of r.steps)
                 console.error(`  ${s.ok ? C("ok") : "\x1b[31mFAIL\x1b[0m"}  ${s.name.padEnd(6)} ${s.detail}`);
             if (!r.ok) {
-                console.error(`\n${B("upgrade stopped")} — nothing was changed. Fix the above and run \`pantheon upgrade\` again.`);
+                console.error(`\n${B("upgrade stopped")} — nothing was changed.${r.needsPerson ? "" : " Fix the above and run `pantheon upgrade` again."}`);
                 process.exit(1);
             }
             if (r.alreadyCurrent) {
@@ -2394,8 +2400,17 @@ async function main() {
             console.error(`${B("deleted")} "${m.name}" — everyone in it was disconnected; its token${bound ? ` and ${bound} folder binding${bound === 1 ? "" : "s"}` : ""} left this machine`);
             return;
         }
+        case "uninstall":
         case "leave": {
-            if (argv[1] && !argv[1].startsWith("--")) {
+            const uninstalling = cmd === "uninstall";
+            const self = uninstalling ? "uninstall" : "leave";
+            if (uninstalling) {
+                if (inWokenRun())
+                    die("a woken run cannot uninstall Pantheon — a person has to run this here");
+                if (argv[1] && !argv[1].startsWith("--"))
+                    die(`pantheon uninstall takes no team. To drop just one: pantheon leave ${argv[1]}`);
+            }
+            if (!uninstalling && argv[1] && !argv[1].startsWith("--")) {
                 const all = loadAll() ?? die("not configured");
                 const m = findMembership(all, argv[1]) ?? die(`you are not in a team called "${argv[1]}". Yours: ${Object.values(all.spaces ?? {}).map((x) => x.name).join(", ") || "none"}`);
                 const bound = Object.values(all.bindings ?? {}).filter((b) => b.space === m.id).map((b) => b.origin ?? b.path);
@@ -2431,14 +2446,29 @@ async function main() {
             const stranded = [...standing].filter(([, v]) => v.founder && v.others?.length === 0).map(([k]) => k);
             if (stranded.length && !argv.includes("--yes")) {
                 die(`you founded ${stranded.map((t) => `"${t}"`).join(", ")} and nobody else is in ${stranded.length === 1 ? "it" : "them"}. Leaving keeps ${stranded.length === 1 ? "it" : "them"} on the relay — holding your plan's team slot — and takes away the only way to delete ${stranded.length === 1 ? "it" : "them"}.\n` +
-                    `  Delete first:     ${stranded.map((t) => `pantheon space delete ${t} --yes`).join("  ·  ")}\n  Leave anyway:     pantheon leave --yes`);
+                    `  Delete first:     ${stranded.map((t) => `pantheon space delete ${t} --yes`).join("  ·  ")}\n  Leave anyway:     pantheon ${self} --yes`);
             }
             const orphaned = [...standing].filter(([, v]) => v.founder && (v.others?.length ?? 0) > 0).map(([k]) => k);
             if (orphaned.length && !argv.includes("--yes")) {
                 die(`you founded ${orphaned.map((t) => `"${t}"`).join(", ")}, and others are in ${orphaned.length === 1 ? "it" : "them"}. Leaving removes this machine's key: you could not rejoin as yourself, and only a founder can remove a member or delete a team — nobody there could, ever again.\n` +
-                    `  To step out but keep the way back:  ${orphaned.map((t) => `pantheon leave ${t}`).join("  ·  ")}   (keeps your key)\n  Leave anyway:  pantheon leave --yes`);
+                    `  To step out but keep the way back:  ${orphaned.map((t) => `pantheon leave ${t}`).join("  ·  ")}   (keeps your key)\n  Leave anyway:  pantheon ${self} --yes`);
+            }
+            const { managedInstall, removeManagedInstall, NPM_UNINSTALL } = await import("./uninstall.js");
+            const install = uninstalling ? managedInstall(homedir()) : null;
+            const runningManaged = managedLayout();
+            if (uninstalling && !argv.includes("--yes")) {
+                const teams = plan.teams.length && !keepIdentity ? `leaves ${plan.teams.map((t) => `"${t.name}"`).join(", ")} (this machine's key goes), ` : "";
+                const what = `this removes Pantheon from this machine: it ${teams}uninstalls its services, hooks and agent entries` +
+                    (install?.present ? `, and deletes Pantheon's own Node in ${install.runtime}, the pantheon command and the PATH lines the installer added.` : ".");
+                if (!process.stdin.isTTY)
+                    die(`${what}\n  If you mean it:  pantheon uninstall --yes`);
+                const rl = createInterface({ input: process.stdin, output: process.stderr });
+                const answer = (await questionOrNull(rl, `${what[0].toUpperCase()}${what.slice(1)} Type "yes" to continue: `)) ?? "";
+                rl.close();
+                if (answer.toLowerCase() !== "yes")
+                    die("nothing was changed.");
             }
-            if (plan.teams.length && !keepIdentity && !argv.includes("--yes")) {
+            if (!uninstalling && plan.teams.length && !keepIdentity && !argv.includes("--yes")) {
                 const list = plan.teams.map((t) => `"${t.name}"`).join(", ");
                 const what = plan.teams.length > 1 ? `this machine is in ${plan.teams.length} teams — ${list}. Leaving removes its key, so it leaves ALL of them.` : `this removes Pantheon and this machine's key, so it leaves ${list}.`;
                 if (!process.stdin.isTTY)
@@ -2449,7 +2479,7 @@ async function main() {
                 if (answer.toLowerCase() !== "yes")
                     die(`nothing was changed.${plan.teams.length > 1 ? " Leave one team with: pantheon leave <team>" : ""}`);
             }
-            console.error(`${B("leaving pantheon")}${plan.teams.length ? D(`   — ${plan.teams.map((t) => t.name).join(", ")}`) : ""}\n`);
+            console.error(`${B(uninstalling ? "uninstalling pantheon" : "leaving pantheon")}${plan.teams.length ? D(`   — ${plan.teams.map((t) => t.name).join(", ")}`) : ""}\n`);
             const { uninstallMachine, realUninstallIo } = await import("./machine.js");
             const { removeUserMcpEntries } = await import("./install.js");
             const { killRecordedRun } = await import("./worker.js");
@@ -2529,10 +2559,19 @@ async function main() {
                     rmSync(join(CONFIG_DIR, "worktrees"), { recursive: true, force: true });
                 }
                 catch { }
-                const rest = removeHomeLeftovers(CONFIG_DIR, keepIdentity);
+                const rest = removeHomeLeftovers(CONFIG_DIR, keepIdentity, { uninstalling });
                 removed.push(...rest.removed);
                 left.push(...rest.left);
             }
+            if (uninstalling) {
+                if (install?.present) {
+                    const r = removeManagedInstall({ home: homedir(), install, running: runningManaged });
+                    removed.push(...r.removed);
+                    left.push(...r.left);
+                }
+                if (!runningManaged)
+                    left.push(`this pantheon itself (${process.argv[1] ?? "the one you ran"}), which npm installed — remove it with: ${NPM_UNINSTALL}`);
+            }
             console.error(`\n${B("Removed")}`);
             for (const r of removed)
                 console.error(`  ${C("✓")} ${r}`);

package/dist/doctor.js

@@ -8,9 +8,11 @@ import { FEEDBACK_ADDRESS } from "./feedback.js";
 import { loadProfile, profileInitialized, reservedDomains, teamProfile, wakeMode } from "./profile.js";
 import { isApprovedWaker, loadPolicy, relayKnowsAdmitters, unsandboxedAllowed } from "./worker-policy.js";
 import { commandState } from "./command-state.js";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { homedir, platform } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
+import { expectedLauncher, managedLayout, runtimeNodeFit, runtimeVerdict } from "./managed.js";
+import { PKG_NAME } from "./upgrade.js";
 import { PantheonClient } from "./client.js";
 import { load, resolveFor, loadAll, CONFIG_PATH } from "./config.js";
 import { fingerprint, signChallenge, verifyChallenge } from "./identity.js";
@@ -19,11 +21,14 @@ import { hookState, readIntent, agentHookStates } from "./notify.js";
 import { loadPersonas } from "./persona.js";
 import { workerProc, menubarProc, notifierProc } from "./machine.js";
 import { agentById, chooseAgent, describeChoice, unattendedRefusal, skippedSummary, SANDBOXED_FOR_UNATTENDED } from "./agents.js";
-import { onPathNamed } from "./which.js";
+import { loginShellLookup, npmSpawn, onPathNamed, which, whichWindows } from "./which.js";
 import { VERSION } from "./version.js";
 import { serviceInstalled, servicesUnavailable } from "./service.js";
+import { hasPrebuilt } from "./helpers-build.js";
+import { traySourcePath, TRAY_PREBUILT } from "./tray.js";
+import { hudSourcePath, HUD_PREBUILT } from "./notifier.js";
 import { hostEnv, platformName } from "./host-env.js";
-import { currentPlan, explainNetError, routeFor, redactProxy } from "./network.js";
+import { currentPlan, explainNetError, proxyEnvFor, routeFor, redactProxy } from "./network.js";
 import { refusalOf } from "./refusal.js";
 const HOSTED_RELAY = "relay.joinpantheon.network";
 const git = (args, cwd) => {
@@ -109,12 +114,64 @@ export function nodeSupported(version) {
     const [major = 0, minor = 0] = version.replace(/^v/, "").split(".").map(Number);
     return major > 23 || (major === 23 && minor >= 4) || (major === 22 && minor >= 13);
 }
+function runtimeFacts() {
+    const os = platform();
+    const layout = managedLayout(process.execPath, os);
+    const expected = expectedLauncher(homedir(), os);
+    const root = layout?.root ?? (expected ? dirname(dirname(expected)) : null);
+    const real = (p) => { try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    } };
+    const rootReal = root ? real(root) : null;
+    const ours = (p) => {
+        if (!rootReal)
+            return false;
+        const r = real(p);
+        return r === rootReal || r.startsWith(rootReal + sep);
+    };
+    const firstOnPath = os === "win32"
+        ? [whichWindows("pantheon", process.env)]
+        : [which("pantheon", os, process.env, { login: () => null }), loginShellLookup("pantheon")?.found ?? null];
+    return { layout, nodeVersion: process.versions.node, expected, expectedExists: !!expected && existsSync(expected), firstOnPath, ours };
+}
+function newestRelease() {
+    if (process.env["PANTHEON_NO_UPDATE_CHECK"])
+        return null;
+    try {
+        const s = npmSpawn(["view", PKG_NAME, "version", "engines.node", "--json"], undefined, undefined, proxyEnvFor());
+        const j = JSON.parse(execFileSync(s.command, s.args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 8000, ...s.options }));
+        return typeof j.version === "string" && typeof j["engines.node"] === "string" ? { version: j.version, range: j["engines.node"] } : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function doctor(projectDir) {
     const out = [];
     const add = (level, name, detail, fix, share) => out.push({ level, name, detail, ...(fix ? { fix } : {}), ...(share ? { share } : {}) });
     nodeSupported(process.versions.node)
         ? add("pass", "node", `v${process.versions.node}`, undefined, `v${process.versions.node}`)
         : add("fail", "node", `v${process.versions.node} is too old`, "pantheon needs Node 22.13 or newer — node:sqlite, which the relay uses, is behind a flag through 22.12 — install a current Node LTS and re-run", `v${process.versions.node}, too old`);
+    {
+        const facts = runtimeFacts();
+        const v = runtimeVerdict(facts);
+        if (v)
+            add(v.level, "runtime", v.detail, v.fix, v.share);
+        if (facts.layout) {
+            const relay = (() => { try {
+                return load()?.relay ?? null;
+            }
+            catch {
+                return null;
+            } })();
+            const fit = runtimeNodeFit(facts.layout, process.versions.node, newestRelease(), relay);
+            if (fit)
+                add(fit.level, "runtime node", fit.detail, fit.fix, fit.share);
+        }
+    }
     const host = hostEnv();
     if (host.ephemeral) {
         add("warn", "machine", `${platformName(host.platform)} in ${host.kind === "container" ? "a container" : "a cloud workspace"} — ${host.evidence.join("; ")}`, `this is not the computer you work on, which is why it reports ${platformName(host.platform)} to someone who may be sitting at a Mac. The team and your account are fine here, but the menu bar, desktop alerts and the worker belong on your own machine — run the setup from a terminal there.`, `${host.platform} in ${host.kind === "container" ? "a container" : "a cloud workspace"}`);
@@ -489,8 +546,9 @@ export async function doctor(projectDir) {
         }
     }
     if (host.desktop) {
+        const needsTools = (name, source) => hasPrebuilt(name, source) ? "" : "needs the Xcode Command Line Tools — xcode-select --install — because this build has no prebuilt helper for it; ";
         if (!serviceInstalled("menubar")) {
-            add("warn", "menu bar", "not installed on a Mac that can run it", "install it with: pantheon service install menubar (needs the Xcode Command Line Tools — xcode-select --install — and a setup that ran on this computer, not in a cloud agent). --no-menubar at setup also leaves it off; that is fine if it was your choice", "not installed");
+            add("warn", "menu bar", "not installed on a Mac that can run it", `install it with: pantheon service install menubar (${needsTools(TRAY_PREBUILT, traySourcePath())}from a setup that ran on this computer, not in a cloud agent). --no-menubar at setup also leaves it off; that is fine if it was your choice`, "not installed");
         }
         else if (!menubarProc().running) {
             add("warn", "menu bar", "installed, but not running — launchd is not holding it, so there is no icon right now", "pantheon service restart menubar   (loads it back; something unloaded it — a stop, a crash loop, or a test run on this machine)", "installed, not running");
@@ -499,7 +557,7 @@ export async function doctor(projectDir) {
             add("pass", "menu bar", "installed and running — status, pause/resume, and a badge when a decision needs you", undefined, "installed and running");
         }
         if (!serviceInstalled("notifier")) {
-            add("warn", "alerts", "not installed — no desktop notification when a teammate needs you", "pantheon service install notifier   (--no-notifications at setup also leaves it off; that is fine if it was your choice)", "not installed");
+            add("warn", "alerts", "not installed — no desktop notification when a teammate needs you", `pantheon service install notifier   (${needsTools(HUD_PREBUILT, hudSourcePath())}--no-notifications at setup also leaves it off; that is fine if it was your choice)`, "not installed");
         }
         else if (!notifierProc().running) {
             add("warn", "alerts", "installed, but not running — nothing on this Mac will show you a teammate's message", "pantheon service restart notifier   (loads it back; something unloaded it — a stop, a crash loop, or a test run on this machine)", "installed, not running");

package/dist/helpers-build.js

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 export const helperHashPath = (binary) => `${binary}.source.sha256`;
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const prebuiltDir = () => resolve(HERE, "..", "helper", "macos", "prebuilt");
 export function sourceHash(source) {
     return createHash("sha256").update(readFileSync(source)).digest("hex");
 }
@@ -20,4 +25,67 @@ export function helperStale(binary, source) {
         return true;
     }
 }
+export function findPrebuilt(name, source, dir = prebuiltDir()) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(dir, "manifest.json"), "utf8"));
+    }
+    catch {
+        return { reason: "this Pantheon build carries no prebuilt helpers" };
+    }
+    const entry = manifest?.helpers?.[name];
+    if (!entry)
+        return { reason: `no prebuilt ${name} in this build` };
+    if (entry.source_sha256 !== sourceHash(source))
+        return { reason: `the prebuilt ${name} was built from a different ${entry.source} than this release ships` };
+    const path = join(dir, name);
+    try {
+        if (createHash("sha256").update(readFileSync(path)).digest("hex") !== entry.sha256)
+            return { reason: `the prebuilt ${name} does not match its manifest` };
+    }
+    catch {
+        return { reason: `the prebuilt ${name} is missing` };
+    }
+    return { path };
+}
+export const hasPrebuilt = (name, source, dir = prebuiltDir()) => existsSync(source) && "path" in findPrebuilt(name, source, dir);
+export function requireDeveloperTools(what, service, why) {
+    try {
+        execFileSync("/usr/bin/xcode-select", ["-p"], { stdio: "pipe" });
+    }
+    catch {
+        throw new Error(`building ${what} needs the Xcode Command Line Tools${why ? ` (${why}, so it is compiled here)` : ""} — run \`xcode-select --install\`, then \`pantheon service install ${service}\``);
+    }
+}
+export function installHelper(o, deps = {}) {
+    const found = findPrebuilt(o.name, o.source, deps.prebuiltDir ?? prebuiltDir());
+    let why = "reason" in found ? found.reason : "";
+    if ("path" in found) {
+        const tmp = `${o.binary}.${process.pid}.new`;
+        try {
+            copyFileSync(found.path, tmp);
+            chmodSync(tmp, 0o755);
+            try {
+                execFileSync(deps.xattr ?? "/usr/bin/xattr", ["-d", "com.apple.quarantine", tmp], { stdio: "pipe" });
+            }
+            catch { }
+            execFileSync(tmp, ["version"], { stdio: "pipe", timeout: 10_000 });
+            renameSync(tmp, o.binary);
+            recordHelperBuild(o.binary, o.source);
+            return { binary: o.binary, via: "prebuilt" };
+        }
+        catch (e) {
+            try {
+                rmSync(tmp, { force: true });
+            }
+            catch { }
+            why = `the prebuilt ${o.name} does not run on this Mac (${e.message.split("\n")[0]})`;
+        }
+    }
+    (deps.requireTools ?? requireDeveloperTools)(o.what, o.service, why);
+    execFileSync(deps.swiftc ?? "/usr/bin/swiftc", ["-O", o.source, "-o", o.binary], { stdio: "pipe" });
+    chmodSync(o.binary, 0o755);
+    recordHelperBuild(o.binary, o.source);
+    return { binary: o.binary, via: "compiled", reason: why };
+}
 //# sourceMappingURL=helpers-build.js.map

package/dist/install.js

@@ -11,17 +11,20 @@ import { agentSpawn, onPathNamed, which } from "./which.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
 import { kiroDir, kiroAgentFile, refreshKiroAgentAllowed } from "./kiro-files.js";
 import { eolOf, isJsonc, stripBom, stripJsonc, withEol } from "./text-file.js";
+import { childNodeFlags, managedLayout, managedLauncher } from "./managed.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export function onPath() {
     return onPathNamed("pantheon");
 }
-export function launcher(force, os = platform()) {
+export function launcher(force, os = platform(), managed = managedLauncher()) {
     const portable = force === "portable" || (force !== "local" && onPath());
+    if (!portable && managed && os !== "win32")
+        return { command: managed, args: ["mcp"], portable: false };
     if (os === "win32")
-        return { command: process.execPath, args: [resolve(HERE, "cli.js"), "mcp"], portable: false };
+        return { command: process.execPath, args: [...childNodeFlags(), resolve(HERE, "cli.js"), "mcp"], portable: false };
     return portable
         ? { command: "pantheon", args: ["mcp"], portable: true }
-        : { command: process.execPath, args: [resolve(HERE, "cli.js"), "mcp"], portable: false };
+        : { command: process.execPath, args: [...childNodeFlags(), resolve(HERE, "cli.js"), "mcp"], portable: false };
 }
 function readConfigJson(file) {
     return readConfigDoc(file).doc;
@@ -200,19 +203,29 @@ export function install(projectDir, cfg, force, os = platform(), claudeLocal = c
     return out;
 }
 function localEntry() {
-    return { command: process.execPath, args: [resolve(HERE, "cli.js"), "mcp"] };
+    return { command: process.execPath, args: [...childNodeFlags(), resolve(HERE, "cli.js"), "mcp"] };
 }
-function userEntry(os = platform()) {
+const realEntryDeps = (os) => ({
+    execPath: process.execPath, cli: resolve(HERE, "cli.js"), exists: existsSync, find: (n) => which(n),
+    managed: managedLayout(process.execPath, os),
+});
+export function userEntry(os = platform(), d = realEntryDeps(os)) {
+    if (d.managed) {
+        if (os === "win32" && d.exists(d.managed.cli))
+            return { command: d.managed.node, args: ["--use-system-ca", d.managed.cli, "mcp"] };
+        if (os !== "win32" && d.exists(d.managed.launcher))
+            return { command: d.managed.launcher, args: ["mcp"] };
+    }
     if (os === "win32") {
-        const node = process.execPath;
-        const entry = resolve(HERE, "cli.js");
-        if (existsSync(entry))
+        const node = d.execPath;
+        const entry = d.cli;
+        if (d.exists(entry))
             return { command: node, args: [entry, "mcp"] };
-        const abs = which("pantheon");
+        const abs = d.find("pantheon");
         return abs ? { command: abs, args: ["mcp"] } : { command: "pantheon", args: ["mcp"] };
     }
     try {
-        const abs = which("pantheon") ?? "";
+        const abs = d.find("pantheon") ?? "";
         if (abs && !isVersionManagedPath(abs))
             return { command: abs, args: ["mcp"] };
         if (abs)
@@ -698,7 +711,8 @@ export function isOurMcpEntry(e) {
     const base = command.split(/[\\/]/).pop() ?? "";
     if (/^pantheon(\.cmd|\.exe)?$/i.test(base))
         return true;
-    return args.length >= 2 && typeof args[0] === "string" && /[\\/]cli\.js$/.test(args[0]);
+    const script = args.find((a) => !(typeof a === "string" && a.startsWith("--")));
+    return args.length >= 2 && typeof script === "string" && /[\\/]cli\.js$/.test(script);
 }
 export function removeMcpJsonEntry(file, key = "mcpServers") {
     try {