@join-pantheon/cli 0.33.0-rc.1 → 0.33.0-rc.3

package/dist/home-safety.js

@@ -0,0 +1,195 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir, platform, userInfo } from "node:os";
+import { basename, dirname, join, posix, sep, win32 } from "node:path";
+export const HOME_MARKER = ".pantheon-home";
+export const PANTHEON_HOME_ENTRIES = [
+    { name: HOME_MARKER, what: "the mark that says this folder is Pantheon's home" },
+    { name: "config.json", what: "your key and team tokens", identity: true },
+    { name: "config.json.bak", what: "the previous config.json", identity: true },
+    { name: "keys.json", what: "the teammates' keys this machine pinned", identity: true },
+    { name: "nonces.json", what: "the signed requests this machine has seen", identity: true },
+    { name: "continued.json", what: "what this machine already handled", identity: true },
+    { name: "cursors.json", what: "where each agent session last read", identity: true },
+    { name: "worker-cursor.json", what: "where the worker last read", identity: true },
+    { name: "profile.json", what: "your profile", identity: true },
+    { name: "worker-policy.json", what: "the worker's wake policy", identity: true },
+    { name: "spend.json", what: "the spend ledger", identity: true },
+    { name: "personas", what: "the worker's personas", dir: true, identity: true },
+    { name: "worker-state.json", what: "the worker's last state" },
+    { name: "worker-run.json", what: "the worker's record of a run in flight" },
+    { name: "run-slot.json", what: "the worker's run slot" },
+    { name: "worker.pid", what: "the worker's pid file" },
+    { name: /^notifier-state(-.+)?\.json$/, sample: "notifier-state-team%2Fone.json", what: "the alerts' state" },
+    { name: "update-check.json", what: "the update check's cache" },
+    { name: "uri-key", what: "the key pantheon:// links are signed with" },
+    { name: "board.json", what: "the board's state" },
+    { name: "hook-intent.json", what: "the hook intent" },
+    { name: "hook-guard.json", what: "the hook guard" },
+    { name: /^(worker|relay|notifier|menubar)\.log(\.1)?$/, sample: "worker.log", what: "service logs an older version wrote here" },
+    { name: /^\.write-check\..+$/, sample: ".write-check.1234.5678", what: "a leftover write probe" },
+    { name: "bin", what: "the menu bar's and alerts' files", dir: true },
+    { name: "logs", what: "the service logs", dir: true },
+    { name: "host", what: "the Windows host's queue, state and markers", dir: true },
+    { name: "mcp", what: "the agent windows' server state", dir: true },
+    { name: "run-homes", what: "the woken runs' homes", dir: true },
+    { name: "worktrees", what: "the worker's worktrees", dir: true },
+    { name: "no-hooks", what: "the empty hooks folder woken runs' git uses", dir: true },
+    { name: "lfs-hooks", what: "the LFS-only hooks folder woken runs' git uses", dir: true },
+    { name: "runtime", what: "Pantheon's own Node", dir: true, kept: "managed" },
+    { name: "data", what: "the relay's ledger", dir: true, kept: "it is your team's history and may be its only copy; delete it yourself once no relay runs from it" },
+    { name: /^(\.DS_Store|Thumbs\.db|desktop\.ini)$/i, sample: ".DS_Store", what: "the file browser's folder cache" },
+];
+const LOCK_OR_TMP = /^(.+?)(\.lock|(\.[0-9a-f]+)+\.tmp)$/i;
+export function homeEntryFor(name) {
+    const direct = (n) => PANTHEON_HOME_ENTRIES.find((e) => typeof e.name === "string" ? e.name === n : e.name.test(n)) ?? null;
+    const e = direct(name);
+    if (e)
+        return e;
+    const m = LOCK_OR_TMP.exec(name);
+    const base = m ? direct(m[1]) : null;
+    return base && !base.dir ? base : null;
+}
+const realOrNull = (p) => { try {
+    return realpathSync.native(p);
+}
+catch {
+    return null;
+} };
+function gitTopOf(dir) {
+    const env = { ...process.env };
+    for (const k of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR", "GIT_CEILING_DIRECTORIES"])
+        delete env[k];
+    try {
+        const out = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: dir, env, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, windowsHide: true }).trim();
+        return out ? realOrNull(out) ?? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const realHomeCheckIo = () => ({
+    real: realOrNull,
+    exists: (p) => existsSync(p),
+    read: (p) => { try {
+        return readFileSync(p, "utf8");
+    }
+    catch {
+        return null;
+    } },
+    homes: () => {
+        const out = [homedir()];
+        try {
+            const u = userInfo().homedir;
+            if (u)
+                out.push(u);
+        }
+        catch { }
+        if (process.env.USERPROFILE)
+            out.push(process.env.USERPROFILE);
+        return out;
+    },
+    cwd: () => process.cwd(),
+    repoTop: gitTopOf,
+    os: platform(),
+});
+export function isPantheonHomeName(dir, os = platform()) {
+    const b = (os === "win32" ? win32 : posix).basename(dir);
+    return os === "win32" ? [".pantheon", "pantheon"].includes(b.toLowerCase()) : b === ".pantheon" || b === "Pantheon";
+}
+function holdsPantheonIdentity(dir, io, pj = join) {
+    if (!io.exists(pj(dir, "keys.json")))
+        return false;
+    const raw = io.read(pj(dir, "config.json"));
+    if (raw === null)
+        return false;
+    try {
+        const c = JSON.parse(raw.replace(/^/, ""));
+        return !!c && typeof c === "object" && typeof c.member === "string" && typeof c.publicKey === "string" && typeof c.privateKey === "string" && typeof c.relay === "string";
+    }
+    catch {
+        return false;
+    }
+}
+export function pantheonHomeRefusal(dir, over = {}) {
+    const io = { ...realHomeCheckIo(), ...over };
+    const r = io.real(dir);
+    if (r === null)
+        return null;
+    const win = io.os === "win32";
+    const P = win ? win32 : posix;
+    const norm = (p) => { const s = p.replace(/[\\/]+$/, "") || p; return win ? s.replace(/\//g, "\\").toLowerCase() : s; };
+    const S = win ? "\\" : sep;
+    const d = norm(r);
+    const inside = (child, parent) => child.startsWith(parent.endsWith(S) ? parent : parent + S);
+    if (P.dirname(r) === r || /^[a-z]:\\?$/i.test(d) || d === "")
+        return `${dir} is the root of a ${win ? "drive" : "filesystem"}`;
+    const homes = [...new Set(io.homes().map((h) => io.real(h) ?? h).map(norm))];
+    for (const h of homes) {
+        if (d === h)
+            return `${dir} is your home folder`;
+        if (inside(h, d))
+            return `${dir} holds your home folder (${h})`;
+    }
+    const cwd = io.real(io.cwd());
+    if (cwd && norm(cwd) === d)
+        return `${dir} is the folder this command runs in`;
+    if (io.exists(P.join(r, ".git")))
+        return `${dir} is a git repository`;
+    let walked = null;
+    for (let p = P.dirname(r), prev = r; p !== prev; prev = p, p = P.dirname(p)) {
+        if (io.exists(P.join(p, ".git"))) {
+            walked = p;
+            break;
+        }
+    }
+    const top = io.repoTop(r) ?? walked;
+    if (top) {
+        const t = norm(top);
+        const dotfiles = homes.some((h) => t === h && inside(d, h));
+        if (t === d)
+            return `${dir} is a git repository`;
+        if (!dotfiles)
+            return `${dir} is inside the git repository ${top}`;
+    }
+    if (!isPantheonHomeName(r, io.os) && !io.exists(P.join(r, HOME_MARKER)) && !holdsPantheonIdentity(r, io, P.join)) {
+        return `${dir} is not a folder Pantheon made: it is not named .pantheon, it has no ${HOME_MARKER} mark, and it holds no Pantheon identity`;
+    }
+    return null;
+}
+export function pantheonNamedFiles(dir) {
+    let names = [];
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    return names.sort().filter((n) => homeEntryFor(n)).map((n) => join(dir, n));
+}
+export function refusedHomeLine(dir, why) {
+    const files = pantheonNamedFiles(dir).filter((p) => !/^(\.DS_Store|Thumbs\.db|desktop\.ini)$/i.test(basename(p)));
+    const cwd = /the folder this command runs in$/.test(why);
+    return `nothing in ${dir} was removed: ${why}, so it may hold files of your own under the names Pantheon uses.` +
+        (cwd ? " Run the command again from another folder to have Pantheon's files there removed." : "") +
+        (files.length ? ` Pantheon's files there, if they are Pantheon's — check each, then delete it yourself: ${files.join(", ")}` : " No file there has a name Pantheon writes.");
+}
+export function markPantheonHome(dir, createdNow, over = {}) {
+    try {
+        const f = join(dir, HOME_MARKER);
+        if (existsSync(f))
+            return;
+        const io = { ...realHomeCheckIo(), ...over };
+        const r = io.real(dir);
+        if (r === null || dirname(r) === r)
+            return;
+        const homes = io.homes().map((h) => io.real(h) ?? h);
+        if (homes.some((h) => h === r || h.startsWith(r.endsWith(sep) ? r : r + sep)))
+            return;
+        if (!createdNow && readdirSync(r).some((n) => !/^(config\.json|keys\.json)(\.tmp[\w.-]*|\.lock)?$/.test(n)))
+            return;
+        writeFileSync(f, "This folder is Pantheon's home. `pantheon uninstall` removes what Pantheon wrote here, and nothing else.\n", { flag: "wx", mode: 0o600 });
+    }
+    catch { }
+}
+//# sourceMappingURL=home-safety.js.map

package/dist/machine.js

@@ -6,6 +6,7 @@ import { CONFIG_DIR } from "./config.js";
 import { borrowedHome, disableService, existingUnitPath, plistPath, serviceInstalled, serviceLogFile, stopWindowsHost, unitPath, unitPaths, uninstallService } from "./service.js";
 import { LEGACY_TASK_NAME, hostAlive, hostChildRunning, hostFiles, isHostKind, readHostState, recordedTaskName } from "./win-host.js";
 import { copilotMcpConfigFile, vsCodeUserDir, kiroMcpConfigFile, kiroDir } from "./install.js";
+import { HOME_MARKER, homeEntryFor, isPantheonHomeName, pantheonHomeRefusal, refusedHomeLine } from "./home-safety.js";
 const sh = (cmd) => {
     try {
         return execFileSync("sh", ["-lc", cmd], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -667,6 +668,9 @@ export function removePantheonWorktrees(repos, roots, git = (repo, args) => exec
 const MANAGED_LAUNCHER = "pantheon";
 export function removeHomeLeftovers(home, keep, opts = {}) {
     const removed = [], left = [];
+    const refusal = opts.refusal !== undefined ? opts.refusal : pantheonHomeRefusal(home);
+    if (refusal)
+        return { removed, left: [refusedHomeLine(home, refusal)] };
     const items = [
         ["worker-policy.json", "the worker's wake policy (who may wake it, and self-upgrade) — a rejoin starts from no grants"],
         ["profile.json", "your profile (name, title, what you decide)"],
@@ -705,6 +709,104 @@ export function removeHomeLeftovers(home, keep, opts = {}) {
     }
     return { removed, left };
 }
+export { PANTHEON_HOME_ENTRIES, homeEntryFor } from "./home-safety.js";
+const pause = (ms) => { try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+catch { } };
+const realSweepFs = {
+    list: (d) => readdirSync(d),
+    exists: (p) => existsSync(p),
+    remove: (p) => rmSync(p, { recursive: true, force: true }),
+    removeDir: (d) => rmdirSync(d),
+};
+export function sweepPantheonHome(home, o = {}) {
+    const fs = o.fs ?? realSweepFs;
+    const tries = o.tries ?? 5, waitMs = o.waitMs ?? 200;
+    const os = o.os ?? platform();
+    const removed = [], left = [];
+    if (!fs.exists(home))
+        return { removed, left, gone: true };
+    const refusal = o.refusal !== undefined ? o.refusal : o.fs ? null : pantheonHomeRefusal(home);
+    if (refusal)
+        return { removed, left: [refusedHomeLine(home, refusal)], gone: false };
+    const spare = new Set((o.spare ?? []).map((p) => resolve(p)));
+    const attempt = (p, rm) => {
+        let why = "";
+        for (let i = 0; i < tries; i++) {
+            try {
+                rm(p);
+            }
+            catch (e) {
+                why = String(e.code ?? e.message.split("\n")[0]);
+            }
+            if (!fs.exists(p))
+                return null;
+            if (i < tries - 1)
+                pause(waitMs * (i + 1));
+        }
+        return why || "still there";
+    };
+    const lockedHint = os === "win32" ? "; a Pantheon process (an agent window, the menu bar) may still have it open — close it, then delete it" : "; delete it yourself";
+    const gone = [], foreign = [], keptForIdentity = [];
+    let names = [];
+    try {
+        names = fs.list(home);
+    }
+    catch (e) {
+        return { removed, left: [`${home} — could not be read (${e.message.split("\n")[0]}), so nothing in it was removed`], gone: false };
+    }
+    for (const name of names.sort()) {
+        const p = join(home, name);
+        const e = homeEntryFor(name);
+        if (!e) {
+            foreign.push(name);
+            continue;
+        }
+        if (name === HOME_MARKER)
+            continue;
+        if (spare.has(resolve(p)))
+            continue;
+        if (e.kept === "managed")
+            continue;
+        if (e.kept) {
+            left.push(`${e.what}, ${p} — kept: ${e.kept}`);
+            continue;
+        }
+        if (o.keepIdentity && e.identity) {
+            keptForIdentity.push(name);
+            continue;
+        }
+        const why = attempt(p, fs.remove);
+        if (why === null)
+            gone.push(name);
+        else
+            left.push(`${e.what}, ${p} — could not remove (${why})${lockedHint}`);
+    }
+    if (gone.length)
+        removed.push(`Pantheon's own files in ${home}: ${gone.join(", ")}`);
+    if (keptForIdentity.length)
+        left.push(`what goes with your identity in ${home}: ${keptForIdentity.join(", ")} (--keep-identity)`);
+    let rest = [];
+    try {
+        rest = fs.list(home);
+    }
+    catch { }
+    if (rest.includes(HOME_MARKER) && (rest.length === 1 || isPantheonHomeName(home, os)) && attempt(join(home, HOME_MARKER), fs.remove) === null)
+        rest = rest.filter((n) => n !== HOME_MARKER);
+    if (!rest.length) {
+        const why = attempt(home, fs.removeDir);
+        if (why === null) {
+            removed.push(`${home} itself, now empty`);
+            return { removed, left, gone: true };
+        }
+        left.push(`${home} — empty, but could not remove it (${why})${lockedHint}`);
+        return { removed, left, gone: false };
+    }
+    if (foreign.length)
+        left.push(`${home}, for what is not Pantheon's: ${foreign.join(", ")} — Pantheon never writes ${foreign.length === 1 ? "it" : "these"}, so ${foreign.length === 1 ? "it was" : "they were"} not touched`);
+    return { removed, left, gone: false };
+}
 export const accountStillExists = (email) => `your account${email ? ` ${email}` : ""} still exists — this machine is signed out. Sign back in with: pantheon login${email ? ` --email ${email}` : ""}   (pantheon signup would fail: the email is taken). To delete the account itself: pantheon account delete, before leaving`;
 const LOG_KINDS = ["worker", "relay", "notifier", "menubar"];
 export function uninstallMachine(opts, io) {
@@ -749,20 +851,22 @@ export function uninstallMachine(opts, io) {
     if (!opts.stopRelay && (io.installed("relay") || io.proc("relay").running)) {
         left.push("the relay — others may be using it. Stop and remove it too: pantheon leave --stop-relay");
     }
-    if (io.hasIntent()) {
+    if (!io.homeRefusal && io.hasIntent()) {
         io.clearIntent();
         removed.push("the hook intent (hook-intent.json) — nothing will put the hooks back");
     }
     const mcp = io.removeMcpEntries();
     removed.push(...mcp.removed);
     left.push(...mcp.left);
-    try {
-        if (existsSync(io.logDir)) {
-            rmSync(io.logDir, { recursive: true, force: true });
-            removed.push(`service logs (${io.logDir})`);
+    if (!io.homeRefusal) {
+        try {
+            if (existsSync(io.logDir)) {
+                rmSync(io.logDir, { recursive: true, force: true });
+                removed.push(`service logs (${io.logDir})`);
+            }
         }
+        catch { }
     }
-    catch { }
     const repoDir = join(opts.project, ".pantheon");
     let repoLogs = 0;
     for (const k of LOG_KINDS) {
@@ -916,6 +1020,7 @@ export function realUninstallIo(deps) {
         hasIntent: deps.hasIntent,
         clearIntent: deps.clearIntent,
         logDir: join(CONFIG_DIR, "logs"),
+        homeRefusal: deps.homeRefusal !== undefined ? deps.homeRefusal : pantheonHomeRefusal(CONFIG_DIR),
         ownWorkerPid: () => ownWorkerPid(),
         borrowed: () => borrowedHome(),
         kill: (pid) => killPid(pid) === null,

package/dist/service.js

@@ -7,7 +7,7 @@ import { linuxGraphicalSession } from "./host-env.js";
 import { fileURLToPath } from "node:url";
 import { isVersionManagedPath, launcher } from "./install.js";
 import { childNodeFlags, managedLauncher, managedLayout } from "./managed.js";
-import { CONFIG_DIR } from "./config.js";
+import { CONFIG_DIR, ensurePantheonHome } from "./config.js";
 import { HOST_KINDS, LEGACY_TASK_NAME, clearTrayQuit, ensureHostShim, fromUtf16le, hostAlive, hostArgv, hostChildRunning, hostFiles, hostLaunch, isHostKind, launchFileText, legacyTaskIsUsers, readDefinition, readHostState, taskName, taskUserId, taskXml, utf16le, windowsPowerShell, writeDefinition, } from "./win-host.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 const LABEL = (kind) => `dev.pantheon.${kind}`;
@@ -272,6 +272,10 @@ export function installService(kind, cwd, args, sys = realSys()) {
     const noServices = servicesUnavailable(sys.platform);
     if (noServices)
         throw new Error(noServices.replace(/^not available — /, ""));
+    try {
+        ensurePantheonHome();
+    }
+    catch { }
     if (sys.platform === "win32")
         return installWindows(kind, resolve(cwd), args, sys);
     const out = [];

package/dist/uninstall.js

@@ -5,7 +5,7 @@ import { posix, win32 } from "node:path";
 import { expectedLauncher } from "./managed.js";
 export const BEGIN_MARK = "# >>> pantheon >>>";
 export const END_MARK = "# <<< pantheon <<<";
-export const PROFILES = [".profile", ".bash_profile", ".bashrc", ".zshrc", ".zprofile"];
+export const PROFILES = [".profile", ".bash_profile", ".bash_login", ".bashrc", ".zshrc", ".zprofile"];
 export const FISH_CONF = ".config/fish/conf.d/pantheon.fish";
 export function withoutPathBlock(text) {
     const lines = text.match(/[^\n]*\n|[^\n]+$/g) ?? [];

package/dist/win-host.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, linkSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join, resolve, win32 } from "node:path";
@@ -633,10 +633,12 @@ export function realHostIo(o = {}) {
         exit: (code) => process.exit(code),
     };
 }
-export function takeHostLock(home = CONFIG_DIR, pid = process.pid) {
+export const HOST_LOCK_STARTUP_GRACE_MS = 2 * 60_000;
+export function takeHostLock(home = CONFIG_DIR, pid = process.pid, now = Date.now, alive = pidAlive) {
     const f = hostFiles(home);
     mkdirSync(f.dir, { recursive: true });
-    for (let i = 0; i < 2; i++) {
+    let lastHolder = -1;
+    for (let i = 0; i < 4; i++) {
         try {
             const fd = openSync(f.lock, "wx");
             writeSync(fd, String(pid));
@@ -646,13 +648,63 @@ export function takeHostLock(home = CONFIG_DIR, pid = process.pid) {
         catch (e) {
             if (e.code !== "EEXIST")
                 throw e;
-            const held = Number(readFileSafe(f.lock));
-            if (Number.isInteger(held) && held > 0 && held !== pid && pidAlive(held) && hostAlive(readHostState(home)))
+        }
+        const judged = readFileSafe(f.lock);
+        const held = Number(judged);
+        let age = 0;
+        try {
+            age = now() - statSync(f.lock).mtimeMs;
+        }
+        catch {
+            continue;
+        }
+        if (Number.isInteger(held) && held > 0) {
+            lastHolder = held;
+            if (held === pid)
+                return null;
+            if (alive(held) && (hostAlive(readHostState(home)) || age < HOST_LOCK_STARTUP_GRACE_MS))
                 return held;
-            rmSync(f.lock, { force: true });
         }
+        else if (age < 10_000) {
+            return lastHolder;
+        }
+        const gone = `${f.lock}.stale-${pid}-${i}`;
+        try {
+            renameSync(f.lock, gone);
+        }
+        catch {
+            continue;
+        }
+        const moved = readFileSafe(gone);
+        if (moved !== judged) {
+            putBack(gone, f.lock);
+            const other = Number(moved);
+            return Number.isInteger(other) && other > 0 ? other : -1;
+        }
+        rmSync(gone, { force: true });
     }
-    return null;
+    return lastHolder;
+}
+function putBack(moved, lock) {
+    try {
+        linkSync(moved, lock);
+        rmSync(moved, { force: true });
+        return;
+    }
+    catch (e) {
+        if (e.code === "EEXIST") {
+            rmSync(moved, { force: true });
+            return;
+        }
+    }
+    if (existsSync(lock)) {
+        rmSync(moved, { force: true });
+        return;
+    }
+    try {
+        renameSync(moved, lock);
+    }
+    catch { }
 }
 const readFileSafe = (p) => { try {
     return readFileSync(p, "utf8").trim();

package/helper/macos/prebuilt/manifest.json

@@ -1,6 +1,6 @@
 {
   "format": 1,
-  "built_at": "2026-10-04T17:35:53.208Z",
+  "built_at": "2026-10-05T08:05:30.441Z",
   "swiftc": "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)",
   "helpers": {
     "pantheon-tray": {

package/helper/windows/pantheon-notice.ps1

@@ -30,37 +30,65 @@
 #>
 param([string]$Mode = '')
 
+# Whether toasts are switched off for an app id: only an explicit Disabled*
+# setting is off. Windows THROWS "Element not found" (0x80070490) for an app id
+# that has never shown a toast for this user, and a plain property read turned
+# that into $null -- which was taken for "off" for every id, so a fresh PC only
+# ever got balloons. Unreadable is unknown, and unknown is tried.
+function global:Get-PantheonToastSetting($Notifier) {
+  $s = $null
+  try { $s = $Notifier.get_Setting() } catch { try { $s = $Notifier.Setting } catch { $s = $null } }
+  if ($null -eq $s) { return 'unknown' }
+  return [string]$s
+}
+
 # One toast: the XML, tried under each app id in turn. Returns @{ code; said }.
-function global:Show-PantheonToast([string]$Xml, [string]$Tag, [string[]]$Aumids) {
+# $Api stands in for the WinRT calls (the checks run it on Linux); left out,
+# the real ToastNotificationManager is used.
+function global:Show-PantheonToast([string]$Xml, [string]$Tag, [string[]]$Aumids, [hashtable]$Api = $null) {
   $said = New-Object System.Collections.Generic.List[string]
-  try {
-    [void][Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime]
-    [void][Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime]
-    $doc = [Windows.Data.Xml.Dom.XmlDocument]::new()
-    $doc.LoadXml($Xml)
-  } catch {
-    $said.Add('no-toast-api ' + $_.Exception.Message)
-    return @{ code = 3; said = $said }
+  $doc = $null
+  if (-not $Api) {
+    try {
+      [void][Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime]
+      [void][Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime]
+      $doc = [Windows.Data.Xml.Dom.XmlDocument]::new()
+      $doc.LoadXml($Xml)
+    } catch {
+      $said.Add('no-toast-api ' + $_.Exception.Message)
+      return @{ code = 3; said = $said }
+    }
+    $Api = @{
+      notifier = { param($id) [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($id) }
+      toast = { param($d) [Windows.UI.Notifications.ToastNotification]::new($d) }
+      history = { param($id) [Windows.UI.Notifications.ToastNotificationManager]::History.GetHistory($id) }
+      remove = { param($t, $id) [Windows.UI.Notifications.ToastNotificationManager]::History.Remove($t, 'pantheon', $id) }
+      wait = { Start-Sleep -Milliseconds 400 }
+    }
   }
   $ids = @($Aumids | Where-Object { $_ })
   for ($i = 0; $i -lt $ids.Count; $i++) {
     $id = $ids[$i]
     $last = ($i -eq $ids.Count - 1)
     try {
-      $notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($id)
-      if ([string]$notifier.Setting -ne 'Enabled') { $said.Add('off ' + $id + ' ' + $notifier.Setting); continue }
-      $toast = [Windows.UI.Notifications.ToastNotification]::new($doc)
+      $notifier = & $Api.notifier $id
+      $setting = Get-PantheonToastSetting $notifier
+      if ($setting -like 'Disabled*') { $said.Add('off ' + $id + ' ' + $setting); continue }
+      $toast = & $Api.toast $doc
       if ($Tag) { $toast.Tag = $Tag; $toast.Group = 'pantheon' }
       $notifier.Show($toast)
       # Pantheon's own app id is used only when Windows then has the toast in
       # its history for that id: a build that ignores the registration falls
       # through to the next id instead of swallowing the alert.
-      if (-not $last -and $Tag) {
-        Start-Sleep -Milliseconds 400
+      # The last id too, when Windows would not say its setting: an unknown
+      # setting that Windows then drops silently must still end in a balloon.
+      $knownOn = ($setting -eq 'Enabled')
+      if ($Tag -and (-not $last -or -not $knownOn)) {
+        & $Api.wait
         $seen = $false
-        foreach ($h in [Windows.UI.Notifications.ToastNotificationManager]::History.GetHistory($id)) { if ($h.Tag -eq $Tag) { $seen = $true } }
+        foreach ($h in @(& $Api.history $id)) { if ($h.Tag -eq $Tag) { $seen = $true } }
         if (-not $seen) {
-          try { [Windows.UI.Notifications.ToastNotificationManager]::History.Remove($Tag, 'pantheon', $id) } catch { }
+          try { & $Api.remove $Tag $id } catch { }
           $said.Add('unseen ' + $id)
           continue
         }