@join-pantheon/cli 0.32.1 → 0.33.0-rc.2

package/installer/install.ps1

@@ -8,13 +8,44 @@
 #     before this script can explain: there, use the `irm | iex` forms)
 #
 # In Command Prompt (cmd.exe), as one line:
-#   powershell -NoProfile -ExecutionPolicy Bypass -Command "$env:PANTHEON_ARGS='join <invite link>'; irm https://relay.joinpantheon.network/install.ps1 | iex"
+#   powershell -NoProfile -Command "$env:PANTHEON_ARGS='join <invite link>'; irm https://relay.joinpantheon.network/install.ps1 | iex"
 #
 # One line for either window (what `pantheon invite` prints): PowerShell would
 # expand the $env: above inside the outer double quotes before the inner
 # PowerShell runs, so this sets the variable without a $, and with a cmdlet
 # that Constrained Language Mode still allows:
-#   powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Item Env:PANTHEON_ARGS 'join <invite link>'; irm https://relay.joinpantheon.network/install.ps1 | iex"
+#   powershell -NoProfile -Command "Set-Item Env:PANTHEON_ARGS 'join <invite link>'; irm https://relay.joinpantheon.network/install.ps1 | iex"
+#
+# Downloaded first (what a coding agent is asked to do, so it can read it), then
+# run from the file the same way, from Git Bash, cmd.exe or PowerShell:
+#   curl.exe -fsSL https://relay.joinpantheon.network/install.ps1 -o pantheon-install.ps1
+#   powershell -NoProfile -Command "Set-Item Env:PANTHEON_ARGS 'join <invite link>'; Get-Content -Raw pantheon-install.ps1 | iex"
+#
+# None of these needs -ExecutionPolicy Bypass: the execution policy governs
+# running a script FILE (-File, .\script.ps1), and iex runs a string, which no
+# policy looks at, Restricted included. And iex, unlike [scriptblock]::Create,
+# still runs under Constrained Language Mode far enough for the check below to
+# say why the install cannot go on.
+#
+# What Pantheon is: a command-line tool (npm: @join-pantheon/cli) that lets your
+# coding agents (Claude Code, Cursor, Codex, GitHub Copilot, Kiro) hand work and
+# questions to your teammates' agents. Their messages pass through Pantheon's
+# hosted relay, relay.joinpantheon.network, which this computer connects out to
+# as a client, the way a chat app does. This computer runs no relay, opens no
+# port to the network and carries no one else's traffic. (`pantheon board`,
+# when you open it, listens on 127.0.0.1 only, for this computer's own browser.
+# Hosting a relay is a separate, explicit choice: `pantheon relay`.)
+#
+# `start` creates a team; `join` joins one. Either signs you in with a 6-digit
+# code sent to your email, adds a "pantheon" MCP server entry and a session hook
+# to the coding agents it finds. By default it also sets up, for you alone and
+# with no admin rights, one Task Scheduler task ("Pantheon") that starts a
+# hidden background host when you log on. The host runs a worker that can run
+# your own coding agent on a teammate's request while you are away (in a
+# separate copy of the repo, delivering on a branch for your review), desktop
+# alerts (Windows notifications), and a tray icon that opens `pantheon board`.
+# Leave any of it out with --no-worker or --no-notifications; remove it all with
+# pantheon uninstall.
 #
 # `irm | iex` cannot pass arguments, so the arguments for pantheon travel in
 # $env:PANTHEON_ARGS, which reads the same from PowerShell and from cmd.exe.
@@ -98,6 +129,127 @@ function Install-Pantheon {
     [IO.File]::WriteAllText($LogFile, $r.out + $r.err)
     return $r.code
   }
+  # This user's logon task: "Pantheon-<SID>" (src/win-host.ts taskNameFor), and
+  # "Pantheon", the name builds before 0.33.0 gave it.
+  function Get-PantheonTaskNames {
+    $names = @()
+    try { $names += 'Pantheon-' + [Security.Principal.WindowsIdentity]::GetCurrent().User.Value } catch { $names = @() }
+    $names += 'Pantheon'
+    return , $names
+  }
+
+  # The processes running a program from inside $Dir: what keeps Windows from
+  # renaming it. Each as @{ id; name; line } (line: its command line, when Windows says).
+  function Get-FolderHolders([string]$Dir) {
+    $prefix = $Dir.TrimEnd('\') + '\'
+    $out = @()
+    foreach ($p in @(Get-Process -ErrorAction SilentlyContinue)) {
+      $path = $null
+      try { $path = $p.Path } catch { $path = $null }
+      if (-not $path -or -not $path.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) { continue }
+      $line = ''
+      try { $line = [string](Get-CimInstance Win32_Process -Filter ('ProcessId=' + $p.Id) -ErrorAction Stop).CommandLine } catch { $line = '' }
+      $out += , @{ id = $p.Id; name = ($p.ProcessName + '.exe'); line = $line }
+    }
+    return , $out
+  }
+
+  # What holds a folder, for a person to read: "node.exe (pid 4242: ...cli.js mcp)".
+  function Format-Holders($Holders) {
+    (@($Holders) | ForEach-Object {
+      $l = [string]$_.line
+      if ($l.Length -gt 90) { $l = '...' + $l.Substring($l.Length - 87) }
+      if ($l) { '{0} (pid {1}: {2})' -f $_.name, $_.id, $l } else { '{0} (pid {1})' -f $_.name, $_.id }
+    }) -join ', '
+  }
+
+  # The woken run in flight in this Pantheon home, as src/worker.ts runInFlight
+  # reads it: the pid in worker-run.json while the record is fresh (a run lasts
+  # at most 20 minutes; 5 more of slack) and that process is alive. $null when
+  # there is none, or the record cannot be read.
+  function Get-PantheonRunInFlight([string]$RunRecord, [scriptblock]$Alive) {
+    if (-not $RunRecord -or -not (Test-Path -LiteralPath $RunRecord -PathType Leaf)) { return $null }
+    $runPid = 0; $at = 0.0
+    try {
+      $r = [IO.File]::ReadAllText($RunRecord) | ConvertFrom-Json
+      $runPid = [int]$r.pid; $at = [double]$r.at
+    } catch { return $null }
+    if ($runPid -le 0 -or $at -le 0) { return $null }
+    $now = [double][DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+    if ($at -gt $now + 60000 -or $now - $at -gt 25 * 60000) { return $null }
+    $up = $false
+    try { $up = [bool](& $Alive $runPid) } catch { $up = $false }
+    if (-not $up) { return $null }
+    return $runPid
+  }
+
+  # Is a task this user's? Its XML (schtasks /Query /TN <name> /XML) names its
+  # principal as DOMAIN\user, a bare user name, or a SID; every one of them must
+  # be this user (src/win-host.ts taskIsUsers). A task of the same name that
+  # another person on this PC registered is never ended.
+  function Test-PantheonTaskIsMine([string]$Xml, [string]$UserId, [string]$Sid) {
+    if (-not $Xml) { return $false }
+    $ids = @([regex]::Matches(($Xml -replace "`0", ''), '<UserId>([^<]*)</UserId>') | ForEach-Object { $_.Groups[1].Value.Trim().ToLowerInvariant() })
+    if ($ids.Count -eq 0) { return $false }
+    $u = ([string]$UserId).ToLowerInvariant()
+    $s = ([string]$Sid).ToLowerInvariant()
+    $bare = if ($u.Contains('\')) { $u.Substring($u.LastIndexOf('\') + 1) } else { $u }
+    foreach ($id in $ids) {
+      if ($u -and $id -eq $u) { continue }
+      if ($s -and $id -eq $s) { continue }
+      if ($bare -and -not $id.Contains('\') -and -not $id.StartsWith('s-1-') -and $id -eq $bare) { continue }
+      return $false
+    }
+    return $true
+  }
+
+  # Before the runtime folder is swapped: Pantheon's background host (the
+  # logon task) runs node.exe from it, and Windows will not rename a folder a
+  # running program came from. A teammate's request the worker is running
+  # (worker-run.json) is waited for first, up to $RunWaitSeconds, and while it
+  # still runs nothing is stopped at all: busy comes back, and the runtime stays
+  # as it is. Then the host is asked to stop the way `pantheon stop all` asks it
+  # (<home>\host\stop), given up to $WaitSeconds to let go, and only then are
+  # its tasks ended -- those whose principal is this user ($TaskIsMine), never a
+  # task of the same name someone else on this PC registered. Returns
+  # @{ restart; holders; busy; tasks }: whether a task is to be started again
+  # once the install is done (tasks: which, this user's), and what still holds
+  # the folder (an agent window's Pantheon connection, which is not ours to end).
+  function Stop-PantheonHost {
+    param([string]$NodeDir, [string]$HostDir, [string[]]$Tasks, [scriptblock]$Holders, [scriptblock]$EndTask, [int]$WaitSeconds = 15,
+      [string]$RunRecord = '', [scriptblock]$RunAlive = { param($p) $null -ne (Get-Process -Id $p -ErrorAction SilentlyContinue) },
+      [int]$RunWaitSeconds = 180, [scriptblock]$TaskIsMine = { param($t) $true }, [scriptblock]$Say = { param($m) Write-Host $m })
+    $left = @(& $Holders $NodeDir)
+    if ($left.Count -eq 0) { return @{ restart = $false; holders = @(); busy = $false; tasks = @() } }
+    if (Get-PantheonRunInFlight $RunRecord $RunAlive) {
+      & $Say "A teammate's request is running here; waiting for it to finish before updating (up to $([math]::Ceiling($RunWaitSeconds / 60)) minutes)..."
+      $until = (Get-Date).AddSeconds($RunWaitSeconds)
+      $running = $true
+      while ($running -and (Get-Date) -lt $until) {
+        Start-Sleep -Milliseconds 1000
+        $running = [bool](Get-PantheonRunInFlight $RunRecord $RunAlive)
+      }
+      if ($running) { return @{ restart = $false; holders = $left; busy = $true; tasks = @() } }
+      $left = @(& $Holders $NodeDir)
+      if ($left.Count -eq 0) { return @{ restart = $false; holders = @(); busy = $false; tasks = @() } }
+    }
+    $hostUp = Test-Path -LiteralPath (Join-Path $HostDir 'state.json')
+    if ($hostUp) {
+      try { [IO.File]::WriteAllText((Join-Path $HostDir 'stop'), (Get-Date).ToString('o')) } catch { $hostUp = $false }
+    }
+    $deadline = (Get-Date).AddSeconds($WaitSeconds)
+    while ($hostUp -and $left.Count -gt 0 -and (Get-Date) -lt $deadline) {
+      Start-Sleep -Milliseconds 500
+      $left = @(& $Holders $NodeDir)
+    }
+    $mine = @($Tasks | Where-Object { $_ } | Where-Object { $ok = $false; try { $ok = [bool](& $TaskIsMine $_) } catch { $ok = $false }; $ok })
+    if ($left.Count -gt 0) {
+      foreach ($t in $mine) { & $EndTask $t }
+      for ($i = 0; $i -lt 6 -and $left.Count -gt 0; $i++) { Start-Sleep -Milliseconds 500; $left = @(& $Holders $NodeDir) }
+    }
+    return @{ restart = $hostUp; holders = $left; busy = $false; tasks = $mine }
+  }
+
   # The same, with the output handed back instead: @{ code; out; err }.
   function Invoke-Quiet([string]$Exe, [string[]]$Items) {
     $psi = New-Object System.Diagnostics.ProcessStartInfo
@@ -170,6 +322,8 @@ function Install-Pantheon {
     $binDir = Join-Path $root 'bin'
     $launcher = Join-Path $binDir 'pantheon.cmd'
     $log = Join-Path $root 'install.log'
+    $pantheonHomeDir = if ($env:PANTHEON_HOME) { $env:PANTHEON_HOME } else { Join-Path ([Environment]::GetFolderPath('UserProfile')) '.pantheon' }
+    $hostDir = Join-Path $pantheonHomeDir 'host'
 
     $State.step = "creating $root"
     try { New-Item -ItemType Directory -Force -Path $runtime, $binDir | Out-Null }
@@ -212,6 +366,21 @@ function Install-Pantheon {
       Fail "could not download $Url ($last). Check your internet connection; behind a proxy set HTTPS_PROXY; then run this again."
     }
 
+    # The version of the CLI in the runtime, but only when it is whole: its
+    # package.json names that version AND it starts and says so. A run stopped
+    # halfway through npm can leave the first without the second; that is
+    # installed again, never called done. (Defined before step 1: a run that
+    # stops there says which version is still in place.)
+    $manifest = Join-Path $pkgDir 'package.json'
+    $installedCli = {
+      $v = ''
+      if ((Test-Path -LiteralPath $manifest) -and (Test-Path -LiteralPath $entry)) {
+        try { $v = [string](Get-Content -LiteralPath $manifest -Raw | ConvertFrom-Json).version } catch { $v = '' }
+        if ($v -and (Invoke-Quiet $nodeExe @($entry, '--version')).out.Trim() -ne $v) { $v = '' }
+      }
+      $v
+    }
+
     # ---- 1. Pantheon's own Node --------------------------------------------
 
     $haveNode = ''
@@ -278,6 +447,22 @@ function Install-Pantheon {
         $State.step = 'putting Node in place'
         $aside = $null
         if (Test-Path -LiteralPath $nodeDir) {
+          # Pantheon's background host runs from this folder: stopped first
+          # (and started again at the end), or the folder cannot be moved.
+          $State.step = "stopping Pantheon's background host"
+          $schtasks = Join-Path $env:SystemRoot 'System32\schtasks.exe'
+          $tasks = Get-PantheonTaskNames
+          $meUser = ''; $meSid = ''
+          try { $meId = [Security.Principal.WindowsIdentity]::GetCurrent(); $meUser = $meId.Name; $meSid = $meId.User.Value } catch { $meUser = $env:USERNAME }
+          $stopped = Stop-PantheonHost -NodeDir $nodeDir -HostDir $hostDir -Tasks $tasks `
+            -Holders { param($d) Get-FolderHolders $d } -EndTask { param($t) $null = Invoke-Quiet $schtasks @('/End', '/TN', $t) } `
+            -RunRecord (Join-Path $pantheonHomeDir 'worker-run.json') `
+            -TaskIsMine { param($t) Test-PantheonTaskIsMine (Invoke-Quiet $schtasks @('/Query', '/TN', $t, '/XML')).out $meUser $meSid }
+          # A teammate's run still going after the wait: nothing was stopped,
+          # and the runtime is left exactly as it is (see the catch below).
+          if ($stopped.busy) { throw 'PANTHEON_BUSY:' }
+          if ($stopped.restart) { $State.restartTasks = @($stopped.tasks); Say "Stopped Pantheon's background host while its Node is replaced; it starts again when this is done." }
+          $State.step = 'putting Node in place'
           $aside = Join-Path $tmp 'old'
           # A virus scanner looking at the new or old node.exe holds it for a
           # moment: a few tries before telling the person something is open.
@@ -285,7 +470,11 @@ function Install-Pantheon {
           for ($i = 1; $i -le 5 -and -not $moved; $i++) {
             try { Move-Item -LiteralPath $nodeDir -Destination $aside; $moved = $true } catch { Start-Sleep -Seconds 2 }
           }
-          if (-not $moved) { Fail "Pantheon's Node in $nodeDir is in use. Close your agent windows (Claude Code, Cursor, VS Code) and any pantheon command, then run this again." }
+          if (-not $moved) {
+            $held = Get-FolderHolders $nodeDir
+            $what = if (@($held).Count) { 'in use by ' + (Format-Holders $held) + '.' } else { 'in use (by a program Windows did not name; a virus scanner holds it for a moment).' }
+            Fail "Pantheon's Node in $nodeDir is $what Close your agent windows (Claude Code, Cursor, VS Code) and any pantheon command, then run this again."
+          }
         }
         $placed = $false; $lastErr = ''
         for ($i = 1; $i -le 5 -and -not $placed; $i++) {
@@ -308,20 +497,6 @@ function Install-Pantheon {
 
     # ---- 2. the Pantheon CLI, with that Node's own npm -----------------------
 
-    # The version of the CLI in the runtime, but only when it is whole: its
-    # package.json names that version AND it starts and says so. A run stopped
-    # halfway through npm can leave the first without the second; that is
-    # installed again, never called done.
-    $manifest = Join-Path $pkgDir 'package.json'
-    $installedCli = {
-      $v = ''
-      if ((Test-Path -LiteralPath $manifest) -and (Test-Path -LiteralPath $entry)) {
-        try { $v = [string](Get-Content -LiteralPath $manifest -Raw | ConvertFrom-Json).version } catch { $v = '' }
-        if ($v -and (Invoke-Quiet $nodeExe @($entry, '--version')).out.Trim() -ne $v) { $v = '' }
-      }
-      $v
-    }
-
     # What npm installs. PANTHEON_INSTALL_SPEC swaps the registry package for a
     # package file on this machine, so a release candidate goes through this
     # exact script before its version is on npm. Only a full path on a drive
@@ -387,6 +562,8 @@ function Install-Pantheon {
     $cmdText = "@echo off`r`n" +
       "rem The pantheon command, written by the Pantheon installer. It runs Pantheon's own`r`n" +
       "rem Node by absolute path, so it never depends on which node comes first on PATH.`r`n" +
+      'rem An upgrade cut off mid-swap leaves the previous version beside the runtime: put it back.' + "`r`n" +
+      'if not exist "%~dp0..\runtime\node\node_modules\@join-pantheon\cli\" if exist "%~dp0..\runtime\cli.prev\bin\pantheon.js" move "%~dp0..\runtime\cli.prev" "%~dp0..\runtime\node\node_modules\@join-pantheon\cli" >nul 2>&1' + "`r`n" +
       "`"%~dp0..\runtime\node\node.exe`" $(if ($ca.Count) { '--use-system-ca ' })`"%~dp0..\runtime\node\node_modules\@join-pantheon\cli\bin\pantheon.js`" %*`r`n"
     $current = if (Test-Path -LiteralPath $launcher) { [IO.File]::ReadAllText($launcher) } else { '' }
     if ($current -ne $cmdText) {
@@ -428,6 +605,9 @@ function Install-Pantheon {
 
     $State.lock.Dispose()
     $State.lock = $null
+    # The background host stopped for the swap starts again, on the new Node.
+    Start-PantheonTasks $State
+    $State.step = 'starting pantheon'
     if ($Arguments.Count -eq 0) {
       Say ''
       Say "Pantheon $PantheonVersion is installed. Open a new terminal, then:"
@@ -442,7 +622,10 @@ function Install-Pantheon {
     # Start-Process -NoNewWindow, so pantheon gets this console itself: a real
     # terminal for the sign-in questions, not a pipe PowerShell reads from.
     $State.step = 'starting pantheon'
-    $line = ConvertTo-ArgLine (@($entry) + $Arguments)
+    # With the same --use-system-ca as npm and pantheon.cmd: this first run is the
+    # one that signs in, and behind a TLS-inspecting proxy the relay's
+    # certificate chains only to the company root in the Windows store.
+    $line = ConvertTo-ArgLine (@($ca) + @($entry) + $Arguments)
     $noConsole = $false
     try { $noConsole = [Console]::IsInputRedirected } catch { $noConsole = $false }
     if (-not $noConsole) {
@@ -490,6 +673,16 @@ function Install-Pantheon {
     }
   } catch {
     $m = $_.Exception.Message
+    if ($m -like 'PANTHEON_BUSY:*') {
+      # Not a failure: the Pantheon already here keeps working. Only when there
+      # is none that runs is the exit code non-zero.
+      $have = ''
+      if ($installedCli) { try { $have = & $installedCli } catch { $have = '' } }
+      $kept = if ($have) { " Pantheon $have is still installed and working." } else { '' }
+      Write-Host "Pantheon was not updated because a teammate's run was in progress; run the same line again in a few minutes.$kept" -ForegroundColor Yellow
+      $State.code = if ($have) { 0 } else { 1 }
+      return
+    }
     if ($m -like 'PANTHEON_FAIL:*') { $m = $m.Substring('PANTHEON_FAIL:'.Length) }
     else { $m = "it stopped while $($State.step) ($m). Run the same command again; if it fails the same way, send this line to sid@joinpantheon.network" }
     Write-Host "pantheon install failed: $m" -ForegroundColor Red
@@ -497,7 +690,33 @@ function Install-Pantheon {
   } finally {
     # Every way out, Ctrl-C included, lets go of the install lock.
     if ($State.lock) { $State.lock.Dispose(); $State.lock = $null }
+    # And starts again a background host this install stopped (on whichever Node is in place).
+    Start-PantheonTasks $State
+  }
+}
+
+# Start again the logon task Stop-PantheonHost stopped: this user's first task
+# that starts. Once only. Its host removes the stop request when it starts.
+function Start-PantheonTasks([hashtable]$State) {
+  if (-not $State.ContainsKey('restartTasks') -or $State.restarted) { return }
+  $State.restarted = $true
+  $schtasks = Join-Path $env:SystemRoot 'System32\schtasks.exe'
+  foreach ($t in $State.restartTasks) {
+    try {
+      $psi = New-Object System.Diagnostics.ProcessStartInfo
+      $psi.FileName = $schtasks
+      $psi.Arguments = '/Run /TN "' + $t + '"'
+      $psi.UseShellExecute = $false
+      $psi.CreateNoWindow = $true
+      $psi.RedirectStandardOutput = $true
+      $psi.RedirectStandardError = $true
+      $p = [System.Diagnostics.Process]::Start($psi)
+      $null = $p.StandardOutput.ReadToEnd(); $null = $p.StandardError.ReadToEnd()
+      $p.WaitForExit()
+      if ($p.ExitCode -eq 0) { Write-Host "Started Pantheon's background host again ($t)."; return }
+    } catch { }
   }
+  Write-Host "note: Pantheon's background host did not start again by itself; it starts at your next logon, or now with: pantheon service start worker" -ForegroundColor Yellow
 }
 
 # `join '<link>'` as two arguments: whitespace splits, and single or double
@@ -548,7 +767,7 @@ $PantheonInstallCode = [int]$PantheonInstallState.code
 # result is left in $LASTEXITCODE instead.
 $PantheonOneShot = $false
 try { $PantheonOneShot = Test-PantheonOneShot ([Environment]::GetCommandLineArgs()) } catch { $PantheonOneShot = $false }
-Remove-Item Function:Install-Pantheon, Function:Split-PantheonArgs, Function:Test-PantheonOneShot -ErrorAction SilentlyContinue
+Remove-Item Function:Install-Pantheon, Function:Start-PantheonTasks, Function:Split-PantheonArgs, Function:Test-PantheonOneShot -ErrorAction SilentlyContinue
 Remove-Variable PantheonInstallArgs, PantheonInstallState -ErrorAction SilentlyContinue
 $global:LASTEXITCODE = $PantheonInstallCode
 if ($PantheonOneShot) { exit $PantheonInstallCode }

package/installer/install.sh

@@ -5,6 +5,25 @@
 #   curl -fsSL https://relay.joinpantheon.network/install.sh | sh -s -- start
 #   curl -fsSL https://relay.joinpantheon.network/install.sh | sh            (install only)
 #
+# What Pantheon is: a command-line tool (npm: @join-pantheon/cli) that lets your
+# coding agents (Claude Code, Cursor, Codex, GitHub Copilot, Kiro) hand work and
+# questions to your teammates' agents. Their messages pass through Pantheon's
+# hosted relay, relay.joinpantheon.network, which this computer connects out to
+# as a client, the way a chat app does. This computer runs no relay, opens no
+# port to the network and carries no one else's traffic. (`pantheon board`,
+# when you open it, listens on 127.0.0.1 only, for this computer's own browser.
+# Hosting a relay is a separate, explicit choice: `pantheon relay`.)
+#
+# `start` creates a team; `join` joins one. Either signs you in with a 6-digit
+# code sent to your email, adds a "pantheon" MCP server entry and a session hook
+# to the coding agents it finds, and by default sets up background helpers, each
+# of which can be left out (--no-worker, --no-menubar, --no-notifications): a
+# worker that can run your own coding agent on a teammate's request while you
+# are away, in a separate copy of the repo, delivering on a branch for your
+# review; desktop alerts (on macOS, and on a Linux desktop through its own
+# notifications); and the menu bar on macOS. On Linux, `pantheon board` shows
+# the same in a browser tab.
+#
 # What it does, and nothing else:
 #   1. downloads one pinned Node release from nodejs.org, checks its sha256
 #      against the sha256 pinned in this file (nodejs.org's own), and unpacks it into
@@ -428,6 +447,8 @@ STEP="writing $LAUNCHER"
   printf '# The pantheon command, written by the Pantheon installer. It runs\n'
   printf "# Pantheon's own Node by absolute path, so it never depends on which\n"
   printf '# node comes first on PATH. Running the installer again rewrites it.\n'
+  printf '# An upgrade cut off mid-swap leaves the previous version beside the runtime: put it back.\n'
+  printf '[ -e %s ] || { [ -f %s ] && mv %s %s 2>/dev/null; }\n' "$(shq "$PKG_DIR")" "$(shq "$RUNTIME/cli.prev/bin/pantheon.js")" "$(shq "$RUNTIME/cli.prev")" "$(shq "$PKG_DIR")"
   printf 'exec %s %s%s "$@"\n' "$(shq "$NODE")" "${ca:+$ca }" "$(shq "$PKG_DIR/bin/pantheon.js")"
 } >"$TMP_DIR/launcher" || fail "could not write the pantheon command. Check free disk space, then run this again."
 chmod 755 "$TMP_DIR/launcher"
@@ -487,6 +508,17 @@ add_block() {
     note "the pantheon block in $f has a marker line without its pair, so $f was left as it is; put $BIN_DIR at the front of PATH there yourself"
     return 0
   fi
+  # One of each, but the end before the begin (edited by hand): the rewrite
+  # below would skip from the begin marker to the end of the file and drop
+  # everything after it, so the file is not touched either.
+  if [ "${begins:-0}" -eq 1 ]; then
+    bline=$(grep -nxF "$BEGIN_MARK" "$f" | head -n 1 | cut -d: -f1)
+    eline=$(grep -nxF "$END_MARK" "$f" | head -n 1 | cut -d: -f1)
+    if [ "${bline:-0}" -gt "${eline:-0}" ]; then
+      note "the pantheon block in $f has its end marker before its begin marker, so $f was left as it is; put $BIN_DIR at the front of PATH there yourself"
+      return 0
+    fi
+  fi
   if [ "${begins:-0}" -eq 1 ]; then
     awk -v b="$BEGIN_MARK" -v e="$END_MARK" '$0 == b { keep = 1 } keep { print } $0 == e { keep = 0 }' "$f" >"$TMP_DIR/old"
     same "$TMP_DIR/old" "$TMP_DIR/block" && return 0
@@ -510,10 +542,13 @@ add_block() {
 }
 
 login_shell=$(basename "${SHELL:-sh}")
-# ~/.profile: read by sh and dash logins, by bash when it has no .bash_profile,
+# ~/.profile: read by sh and dash logins, by bash when it has no .bash_profile or .bash_login,
 # and by the `sh -lc` Pantheon itself uses to find programs.
 add_block "$HOME/.profile"
 [ -f "$HOME/.bash_profile" ] && add_block "$HOME/.bash_profile"
+# bash logins read the first of .bash_profile, .bash_login and .profile: with
+# no .bash_profile, an existing .bash_login is the one read, not .profile.
+[ -f "$HOME/.bash_login" ] && add_block "$HOME/.bash_login"
 { [ -f "$HOME/.bashrc" ] || [ "$login_shell" = bash ]; } && add_block "$HOME/.bashrc"
 { [ -f "$HOME/.zshrc" ] || [ "$login_shell" = zsh ]; } && add_block "$HOME/.zshrc"
 [ -f "$HOME/.zprofile" ] && add_block "$HOME/.zprofile"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.32.1",
+  "version": "0.33.0-rc.2",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {
@@ -13,7 +13,7 @@
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p .",
     "dev": "tsc -p . --watch",
     "relay": "node dist/cli.js relay",
-    "test": "PANTHEON_HOME=\"$(mktemp -d)\" HOME=\"$(mktemp -d)\" node --test --test-force-exit dist/test/*.test.js",
+    "test": "PANTHEON_HOME=\"$(mktemp -d)\" HOME=\"$(mktemp -d)\" node --test --test-force-exit --import ./scripts/test-isolate.mjs dist/test/*.test.js",
     "prepare": "npm run build",
     "build:helpers": "node scripts/build-helpers.mjs",
     "release:check": "node scripts/release-check.mjs",