@join-pantheon/cli 0.33.0-rc.1 → 0.33.0-rc.3

package/dist/board-peer.js

@@ -0,0 +1,136 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { win32 } from "node:path";
+const isPort = (n) => Number.isInteger(n) && n > 0 && n <= 65535;
+export const lsofArgs = (clientPort) => ["-nP", "-w", `-iTCP@127.0.0.1:${clientPort}`, "-sTCP:ESTABLISHED", "-a", "-Fpun"];
+export function parseLsofPeers(out, clientPort, boardPort) {
+    const want = `127.0.0.1:${clientPort}->127.0.0.1:${boardPort}`;
+    const found = [];
+    let pid = NaN, uid = NaN;
+    for (const line of out.split("\n")) {
+        const k = line[0], v = line.slice(1).trim();
+        if (k === "p") {
+            pid = Number(v);
+            uid = NaN;
+        }
+        else if (k === "u")
+            uid = Number(v);
+        else if (k === "n" && v === want && Number.isInteger(pid) && Number.isInteger(uid))
+            found.push({ pid, uid });
+    }
+    return found;
+}
+function runLsof(args) {
+    const exe = existsSync("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+    return new Promise((done) => {
+        execFile(exe, args, { encoding: "utf8", timeout: 5_000, maxBuffer: 1024 * 1024 }, (err, out) => {
+            if (err && typeof err.code !== "number") {
+                done(null);
+                return;
+            }
+            done(out ?? "");
+        });
+    });
+}
+const LSOF_AT_ONCE = 4;
+let lsofRunning = 0;
+const lsofWaiting = [];
+async function lsofSlot(fn) {
+    while (lsofRunning >= LSOF_AT_ONCE)
+        await new Promise((r) => lsofWaiting.push(r));
+    lsofRunning++;
+    try {
+        return await fn();
+    }
+    finally {
+        lsofRunning--;
+        lsofWaiting.shift()?.();
+    }
+}
+export async function macPeer(clientPort, boardPort, me, run = (a) => lsofSlot(() => runLsof(a))) {
+    if (me === null || !isPort(clientPort) || !isPort(boardPort))
+        return "unknown";
+    const out = await run(lsofArgs(clientPort)).catch(() => null);
+    if (out === null)
+        return "unknown";
+    const owners = parseLsofPeers(out, clientPort, boardPort);
+    if (!owners.length)
+        return "unknown";
+    return owners.every((o) => o.uid === me) ? "same" : "other";
+}
+export function windowsPeerScript(boardPort) {
+    if (!isPort(boardPort))
+        throw new Error("not a port");
+    return [
+        "[Console]::OutputEncoding = [Text.Encoding]::UTF8",
+        "$me = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
+        "'ME ' + $me",
+        `foreach ($c in @(Get-NetTCPConnection -RemotePort ${boardPort} -State Established -ErrorAction SilentlyContinue)) {`,
+        "  if (@('127.0.0.1', '::ffff:127.0.0.1') -notcontains $c.LocalAddress -or @('127.0.0.1', '::ffff:127.0.0.1') -notcontains $c.RemoteAddress) { continue }",
+        "  $sid = ''",
+        "  try { $p = Get-CimInstance Win32_Process -Filter ('ProcessId=' + $c.OwningProcess); if ($p) { $o = Invoke-CimMethod -InputObject $p -MethodName GetOwnerSid; if ($o.ReturnValue -eq 0) { $sid = [string]$o.Sid } } } catch { $sid = '' }",
+        "  'C ' + $c.LocalPort + ' ' + $c.OwningProcess + ' ' + $sid",
+        "}",
+    ].join("\n");
+}
+export function parseWindowsPeers(out) {
+    let me = null;
+    const ports = new Map();
+    for (const raw of out.split(/\r?\n/)) {
+        const line = raw.trim();
+        const m = /^ME (S-1-[0-9-]+)$/.exec(line);
+        if (m) {
+            me = m[1];
+            continue;
+        }
+        const c = /^C (\d{1,5}) (\d+)(?: (\S*))?$/.exec(line);
+        if (!c)
+            continue;
+        const sid = /^S-1-[0-9-]+$/.test(c[3] ?? "") ? c[3] : "";
+        ports.set(Number(c[1]), [...(ports.get(Number(c[1])) ?? []), sid]);
+    }
+    return { me, ports };
+}
+export function windowsVerdict(parsed, clientPort) {
+    const owners = parsed.ports.get(clientPort);
+    if (!parsed.me || !owners?.length)
+        return "unknown";
+    if (owners.every((s) => s === parsed.me))
+        return "same";
+    return owners.some((s) => s && s !== parsed.me) ? "other" : "unknown";
+}
+function runWindowsPowerShell(script) {
+    const exe = win32.join(process.env.SystemRoot || process.env.windir || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    return new Promise((done) => {
+        execFile(exe, ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", timeout: 15_000, windowsHide: true, maxBuffer: 1024 * 1024 }, (err, out) => {
+            done(err && !out ? null : (out ?? null));
+        });
+    });
+}
+export function windowsPeerCheck(run = runWindowsPowerShell) {
+    const waiting = new Map();
+    const busy = new Set();
+    const go = (boardPort) => {
+        const batch = waiting.get(boardPort) ?? [];
+        waiting.delete(boardPort);
+        if (!batch.length)
+            return;
+        busy.add(boardPort);
+        run(windowsPeerScript(boardPort)).catch(() => null).then((out) => {
+            const parsed = out === null ? null : parseWindowsPeers(out);
+            for (const w of batch)
+                w.done(parsed ? windowsVerdict(parsed, w.port) : "unknown");
+        }).finally(() => { busy.delete(boardPort); go(boardPort); });
+    };
+    return (clientPort, boardPort) => new Promise((done) => {
+        if (!isPort(clientPort) || !isPort(boardPort)) {
+            done("unknown");
+            return;
+        }
+        waiting.set(boardPort, [...(waiting.get(boardPort) ?? []), { port: clientPort, done }]);
+        if (!busy.has(boardPort))
+            setImmediate(() => { if (!busy.has(boardPort))
+                go(boardPort); });
+    });
+}
+//# sourceMappingURL=board-peer.js.map

package/dist/board.js

@@ -1,11 +1,12 @@
 import { createServer } from "node:http";
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { spawn } from "node:child_process";
-import { chmodSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONFIG_DIR } from "./config.js";
+import { macPeer, windowsPeerCheck } from "./board-peer.js";
 import { LIMITS } from "./protocol.js";
 import { childNodeFlags } from "./managed.js";
 import { which } from "./which.js";
@@ -61,9 +62,23 @@ export function defaultBoardDeps(home = CONFIG_DIR) {
         actionFile: join(home, "bin", ".hud-action.json"),
         openTerminal: (actionId) => openExplainTerminal(home, actionId),
         now: Date.now,
-        peerUid: (c, b) => loopbackPeerUid(c, b),
+        peer: defaultPeerCheck(),
     };
 }
+export function defaultPeerCheck(os = platform()) {
+    const me = typeof process.getuid === "function" ? process.getuid() : null;
+    if (os === "linux") {
+        return async (c, b) => {
+            const uid = loopbackPeerUid(c, b);
+            return uid === null || me === null ? "unknown" : uid === me ? "same" : "other";
+        };
+    }
+    if (os === "darwin")
+        return (c, b) => macPeer(c, b, me);
+    if (os === "win32")
+        return windowsPeerCheck();
+    return async () => "unknown";
+}
 export function loopbackPeerUid(clientPort, boardPort, read = (p) => readFileSync(p, "utf8"), os = platform()) {
     if (os !== "linux")
         return null;
@@ -290,15 +305,13 @@ export async function startBoardServer(o = {}) {
         const known = peerChecked.get(sock);
         if (known !== undefined)
             return known;
-        const me = typeof process.getuid === "function" ? process.getuid() : null;
         const addr = sock.remoteAddress ?? "";
-        let ok = addr === "127.0.0.1" || addr === "::ffff:127.0.0.1";
-        if (ok && me !== null && sock.remotePort) {
-            const uid = deps.peerUid(sock.remotePort, port);
-            ok = uid === null || uid === me;
-        }
-        peerChecked.set(sock, ok);
-        return ok;
+        const local = addr === "127.0.0.1" || addr === "::ffff:127.0.0.1";
+        const check = local && sock.remotePort
+            ? deps.peer(sock.remotePort, port).then((v) => v === "same", () => false)
+            : Promise.resolve(false);
+        peerChecked.set(sock, check);
+        return check;
     };
     const status = async () => {
         const s = await deps.status();
@@ -370,10 +383,6 @@ export async function startBoardServer(o = {}) {
             sendJson(res, 403, { ok: false, error: "wrong host" });
             return;
         }
-        if (!samePerson(req)) {
-            sendJson(res, 403, { ok: false, error: "this board belongs to another user on this computer" });
-            return;
-        }
         const site = req.headers["sec-fetch-site"];
         if (typeof site === "string" && site !== "same-origin" && site !== "none") {
             sendJson(res, 403, { ok: false, error: "cross-site request" });
@@ -410,6 +419,10 @@ export async function startBoardServer(o = {}) {
         if (method === "POST" && url.pathname === "/api/session") {
             const nonce = bearerOf(req);
             const body = strictObject(await readBody(req), []);
+            if (!(await samePerson(req))) {
+                sendJson(res, 403, { ok: false, error: "this board belongs to another user on this computer — or this computer could not show that this connection is yours" });
+                return;
+            }
             if (!nonce || !useLink(nonce)) {
                 sendJson(res, 401, { ok: false, error: "this board link has expired or was already used — run pantheon board for a fresh one" });
                 return;
@@ -565,7 +578,8 @@ export async function startBoardServer(o = {}) {
         }
         catch { } });
     });
-    server.headersTimeout = 15_000;
+    server.keepAliveTimeout = 30_000;
+    server.headersTimeout = 35_000;
     server.requestTimeout = 60_000;
     await new Promise((ok, fail) => { server.once("error", fail); server.listen(0, "127.0.0.1", () => { server.off("error", fail); ok(); }); });
     port = server.address().port;
@@ -620,31 +634,6 @@ export function browserCommand(url, os = platform(), find = (n) => which(n), o =
     const scoped = o.scope ? scopeArgv([x, url], find) : null;
     return scoped ? { cmd: scoped[0], args: scoped.slice(1), opts } : { cmd: x, args: [url], opts };
 }
-export function redirectPage(url, dir, now = Date.now()) {
-    if (!LINK_RE.test(url))
-        throw new Error("not a board link");
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    for (const f of readdirSync(dir)) {
-        if (!/^board-open-[0-9a-f]{16}\.html$/.test(f))
-            continue;
-        try {
-            if (now - statSync(join(dir, f)).mtimeMs > 60_000)
-                rmSync(join(dir, f), { force: true });
-        }
-        catch { }
-    }
-    const file = join(dir, `board-open-${randomBytes(8).toString("hex")}.html`);
-    writeFileSync(file, `<!doctype html><meta charset="utf-8"><meta name="referrer" content="no-referrer"><meta http-equiv="refresh" content="0;url=${url}"><title>Pantheon</title><script>location.replace(${JSON.stringify(url)})</script>\n`, { mode: 0o600 });
-    return file;
-}
-export function fileOpenCommand(file, os = platform()) {
-    const opts = { detached: true, stdio: "ignore", windowsHide: true };
-    if (os === "darwin")
-        return { cmd: "open", args: [file], opts };
-    if (os === "win32")
-        return { cmd: "explorer.exe", args: [file], opts };
-    return null;
-}
 export async function openBrowser(url, d = {}) {
     if (!LINK_RE.test(url))
         throw new Error("not a board link");
@@ -655,11 +644,6 @@ export async function openBrowser(url, d = {}) {
         if (await portal(url).catch(() => false))
             return "portal";
     }
-    if (os === "darwin" || os === "win32") {
-        const page = redirectPage(url, d.pageDir ?? join(CONFIG_DIR, "bin"));
-        const how = fileOpenCommand(page, os);
-        return (await (d.launch ?? launch)(how)) ? "direct" : false;
-    }
     const scope = os === "linux" && (d.inService ?? (() => inServiceCgroup()))();
     const how = browserCommand(url, os, find, { scope });
     if (!how)
@@ -721,7 +705,7 @@ async function openExplainTerminal(home, actionId) {
         return { ok: false, why: `${t.error} — copy the question into your agent instead` };
     return (await launch(t)) ? { ok: true } : { ok: false, why: "the terminal could not be started — copy the question into your agent instead" };
 }
-export async function ping(s, timeoutMs = 1500) {
+export async function ping(s, timeoutMs = 3000) {
     const challenge = randomBytes(16).toString("hex");
     try {
         const res = await fetch(`http://127.0.0.1:${s.port}/api/ping?challenge=${challenge}`, { signal: AbortSignal.timeout(timeoutMs), redirect: "error" });

package/dist/cli.js

@@ -914,7 +914,8 @@ ${B("control")}
                             (auto-detects claude / codex / cursor / copilot / kiro on this machine)
   pantheon spend              woken runs on this machine, and what pantheon cannot see
   pantheon leave              remove what pantheon put on this machine
-  pantheon uninstall          leave, then remove Pantheon itself: its own Node, the pantheon command, the PATH lines
+  pantheon uninstall          leave, then remove Pantheon itself: its own Node, the pantheon command, the PATH lines,
+                            and all it keeps in ~/.pantheon (files of yours there stay)
   pantheon panic              emergency stop: ends the run in flight and the worker, and switches off wake rights in every team you are in
   pantheon doctor [--share]   check this machine end to end; --share prints it without names or paths, to paste to us
   pantheon network [--proxy <url> | --direct | --clear]   how this machine reaches the relay; save a proxy for every Pantheon process here
@@ -1038,7 +1039,7 @@ async function teamStanding(all, m) {
         return { others: null, founder: false };
     }
     finally {
-        c.close();
+        c.dispose();
     }
 }
 function slipDistance(a, b) {
@@ -1080,7 +1081,7 @@ async function main() {
         await installNetwork();
     }
     catch { }
-    if (!QUIET.has(cmd)) {
+    if (!QUIET.has(cmd) && cmd !== "uninstall") {
         try {
             console.error(D(updateBanner(VERSION)));
         }
@@ -2507,7 +2508,8 @@ async function main() {
             if (uninstalling && !argv.includes("--yes")) {
                 const teams = plan.teams.length && !keepIdentity ? `leaves ${plan.teams.map((t) => `"${t.name}"`).join(", ")} (this machine's key goes), ` : "";
                 const what = `this removes Pantheon from this machine: it ${teams}uninstalls its services, hooks and agent entries` +
-                    (install?.present ? `, and deletes Pantheon's own Node in ${install.runtime}, the pantheon command and the PATH lines the installer added.` : ".");
+                    (install?.present ? `, and deletes Pantheon's own Node in ${install.runtime}, the pantheon command and the PATH lines the installer added` : "") +
+                    `. Everything Pantheon keeps in ${CONFIG_DIR} goes${keepIdentity ? " (but your identity, --keep-identity)" : ""}; files of your own there stay.`;
                 if (!process.stdin.isTTY)
                     die(`${what}\n  If you mean it:  pantheon uninstall --yes`);
                 const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -2528,6 +2530,8 @@ async function main() {
                     die(`nothing was changed.${plan.teams.length > 1 ? " Leave one team with: pantheon leave <team>" : ""}`);
             }
             console.error(`${B(uninstalling ? "uninstalling pantheon" : "leaving pantheon")}${plan.teams.length ? D(`   — ${plan.teams.map((t) => t.name).join(", ")}`) : ""}\n`);
+            const { pantheonHomeRefusal, refusedHomeLine } = await import("./home-safety.js");
+            const homeRefusal = pantheonHomeRefusal(CONFIG_DIR);
             const { uninstallMachine, realUninstallIo } = await import("./machine.js");
             const { removeUserMcpEntries } = await import("./install.js");
             const { killRecordedRun } = await import("./worker.js");
@@ -2537,6 +2541,7 @@ async function main() {
                 hasIntent: () => readIntent() !== null,
                 clearIntent: () => clearIntent(),
                 killRun: () => killRecordedRun(dirname(CONFIG_PATH)),
+                homeRefusal,
             }));
             for (const l of done.lines)
                 console.error(`  ${l}`);
@@ -2557,66 +2562,75 @@ async function main() {
                 left.push(...u.left);
             }
             const { unlinkSync, existsSync: exists, rmSync, readdirSync } = await import("node:fs");
-            if (all && exists(CONFIG_PATH)) {
-                if (keepIdentity) {
-                    left.push(`your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} (--keep-identity)`);
-                }
-                else {
+            const spare = [];
+            const hasConfig = !!all && exists(CONFIG_PATH);
+            if (homeRefusal) {
+                left.push(refusedHomeLine(CONFIG_DIR, homeRefusal));
+            }
+            else if (hasConfig && keepIdentity) {
+                left.push(`your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} (--keep-identity)`);
+            }
+            else if (!keepIdentity && (hasConfig || uninstalling)) {
+                if (hasConfig) {
                     unlinkSync(CONFIG_PATH);
                     removed.push(`${CONFIG_PATH} — your key and ${plan.teams.length ? `the token${plan.teams.length === 1 ? "" : "s"} for ${plan.teams.map((t) => `"${t.name}"`).join(", ")}` : "account"}; rejoining means a new invite`);
-                    const runHomes = join(CONFIG_PATH, "..", "run-homes");
-                    const { restorePendingQuarantines, pendingQuarantines } = await import("./agents.js");
-                    const put = restorePendingQuarantines(runHomes);
-                    if (put.length)
-                        removed.push(`nothing of your repos' — what interrupted runs had held aside: ${put.join("; ")}`);
-                    const still = pendingQuarantines(runHomes);
-                    const keptAside = (dir) => { try {
-                        return readdirSync(join(dir, "quarantine-kept")).length > 0;
-                    }
-                    catch {
-                        return false;
-                    } };
-                    let homes = [];
+                }
+                const runHomes = join(CONFIG_PATH, "..", "run-homes");
+                const { restorePendingQuarantines, pendingQuarantines } = await import("./agents.js");
+                const put = restorePendingQuarantines(runHomes);
+                if (put.length)
+                    removed.push(`nothing of your repos' — what interrupted runs had held aside: ${put.join("; ")}`);
+                const still = pendingQuarantines(runHomes);
+                const keptAside = (dir) => { try {
+                    return readdirSync(join(dir, "quarantine-kept")).length > 0;
+                }
+                catch {
+                    return false;
+                } };
+                let homes = [];
+                try {
+                    homes = readdirSync(runHomes);
+                }
+                catch { }
+                const keep = new Set([...still.map((x) => x.runHome), ...homes.map((h) => join(runHomes, h)).filter(keptAside)]);
+                for (const h of homes) {
+                    const dir = join(runHomes, h);
+                    if (keep.has(dir))
+                        continue;
                     try {
-                        homes = readdirSync(runHomes);
+                        rmSync(dir, { recursive: true, force: true });
                     }
                     catch { }
-                    const keep = new Set([...still.map((x) => x.runHome), ...homes.map((h) => join(runHomes, h)).filter(keptAside)]);
-                    for (const h of homes) {
-                        const dir = join(runHomes, h);
-                        if (keep.has(dir))
-                            continue;
-                        try {
-                            rmSync(dir, { recursive: true, force: true });
-                        }
-                        catch { }
-                    }
-                    if (!keep.size) {
-                        try {
-                            rmSync(runHomes, { recursive: true, force: true });
-                        }
-                        catch { }
+                }
+                if (!keep.size) {
+                    try {
+                        rmSync(runHomes, { recursive: true, force: true });
                     }
-                    for (const x of still)
-                        left.push(`${x.runHome} — it still holds ${x.paths.join(", ")} from ${x.worktree}, which could not be put back safely; compare and move them back by hand, then delete the folder`);
-                    for (const dir of keep)
-                        if (keptAside(dir) && !still.some((x) => x.runHome === dir))
-                            left.push(`${join(dir, "quarantine-kept")} — agent config an interrupted run held, set aside because the repo had moved on; check it, then delete the folder`);
+                    catch { }
                 }
+                else
+                    spare.push(runHomes);
+                for (const x of still)
+                    left.push(`${x.runHome} — it still holds ${x.paths.join(", ")} from ${x.worktree}, which could not be put back safely; compare and move them back by hand, then delete the folder`);
+                for (const dir of keep)
+                    if (keptAside(dir) && !still.some((x) => x.runHome === dir))
+                        left.push(`${join(dir, "quarantine-kept")} — agent config an interrupted run held, set aside because the repo had moved on; check it, then delete the folder`);
             }
             {
                 const { removePantheonWorktrees, removeHomeLeftovers } = await import("./machine.js");
                 const repos = [project, ...Object.values(all?.bindings ?? {}).map((b) => b.path).filter((p) => !!p)];
-                const trees = removePantheonWorktrees(repos, [join(CONFIG_DIR, "worktrees"), ...repos.map((r) => join(r, ".pantheon", "worktrees"))]);
+                const trees = removePantheonWorktrees(repos, [...(homeRefusal ? [] : [join(CONFIG_DIR, "worktrees")]), ...repos.map((r) => join(r, ".pantheon", "worktrees"))]);
                 removed.push(...trees.removed);
                 left.push(...trees.left);
-                try {
-                    rmSync(join(CONFIG_DIR, "worktrees"), { recursive: true, force: true });
+                if (!homeRefusal) {
+                    try {
+                        rmSync(join(CONFIG_DIR, "worktrees"), { recursive: true, force: true });
+                    }
+                    catch { }
+                    const rest = removeHomeLeftovers(CONFIG_DIR, keepIdentity, { uninstalling, refusal: null });
+                    removed.push(...rest.removed);
+                    left.push(...rest.left);
                 }
-                catch { }
-                const rest = removeHomeLeftovers(CONFIG_DIR, keepIdentity, { uninstalling });
-                removed.push(...rest.removed);
-                left.push(...rest.left);
             }
             if (uninstalling) {
                 if (install?.present) {
@@ -2626,6 +2640,12 @@ async function main() {
                 }
                 if (!runningManaged)
                     left.push(`this pantheon itself (${process.argv[1] ?? "the one you ran"}), which npm installed — remove it with: ${NPM_UNINSTALL}`);
+                const { sweepPantheonHome } = await import("./machine.js");
+                if (!homeRefusal) {
+                    const swept = sweepPantheonHome(CONFIG_DIR, { keepIdentity, spare, refusal: null });
+                    removed.push(...swept.removed);
+                    left.push(...swept.left);
+                }
             }
             console.error(`\n${B("Removed")}`);
             for (const r of removed)
@@ -3554,6 +3574,25 @@ async function main() {
                     st = null;
                     raw = null;
                 }
+                if (raw !== null) {
+                    let nonce;
+                    try {
+                        nonce = JSON.parse(raw).nonce;
+                    }
+                    catch {
+                        nonce = undefined;
+                    }
+                    const stale = st !== null && Date.now() - st.mtimeMs > HUD_ACTION_MAX_AGE_MS;
+                    if (stale && typeof nonce === "string" && nonce !== want) {
+                        try {
+                            rmSync(f, { force: true });
+                        }
+                        catch { }
+                        st = null;
+                        raw = null;
+                        nonce = undefined;
+                    }
+                }
                 if (raw !== null) {
                     let nonce;
                     try {

package/dist/client.js

@@ -21,6 +21,7 @@ export class PantheonClient {
     seen = new Map();
     backoff = 500;
     closed = false;
+    disposed = false;
     everConnected = false;
     localOverride = null;
     usingLoopback = false;
@@ -170,6 +171,11 @@ export class PantheonClient {
     }
     attempt(address) {
         return new Promise((resolve, reject) => {
+            if (this.disposed) {
+                this.closed = true;
+                reject(new Error("this client was disposed"));
+                return;
+            }
             let settled = false;
             let heard = false;
             const fail = reject;
@@ -195,6 +201,8 @@ export class PantheonClient {
             this.watchdog.unref?.();
             ws.on("open", () => { });
             ws.on("message", (raw) => {
+                if (this.disposed)
+                    return;
                 this.lastInbound = Date.now();
                 let msg;
                 try {
@@ -438,6 +446,14 @@ export class PantheonClient {
         this.waiters = [];
         this.ws?.close(4000, "handover");
     }
+    dispose() {
+        this.disposed = true;
+        this.close();
+        if (this.watchdog) {
+            clearInterval(this.watchdog);
+            this.watchdog = null;
+        }
+    }
     close() {
         this.closed = true;
         for (const w of this.waiters) {

package/dist/config.js

@@ -5,6 +5,7 @@ import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { VERSION } from "./version.js";
 import { repoName } from "./repo-route.js";
+import { markPantheonHome } from "./home-safety.js";
 export const CONFIG_DIR = process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
 export const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 export const DEFAULT_RELAY = process.env.PANTHEON_DEFAULT_RELAY
@@ -146,7 +147,7 @@ export function saveAll(f) {
     return CONFIG_PATH;
 }
 function privateDir() {
-    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    ensurePantheonHome();
     if (process.platform === "win32")
         return;
     try {
@@ -202,6 +203,11 @@ function writeConfigAtomic(data) {
             catch { }
     }
 }
+export function ensurePantheonHome() {
+    const made = !existsSync(CONFIG_DIR);
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    markPantheonHome(CONFIG_DIR, made);
+}
 const CONFIG_LOCK_STALE_MS = 5_000;
 const CONFIG_LOCK_WAIT_MS = 15_000;
 const sleepSync = (ms) => { try {