@join-pantheon/cli 0.33.0-rc.2 → 0.33.0

package/dist/board-peer.js

@@ -0,0 +1,136 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { win32 } from "node:path";
+const isPort = (n) => Number.isInteger(n) && n > 0 && n <= 65535;
+export const lsofArgs = (clientPort) => ["-nP", "-w", `-iTCP@127.0.0.1:${clientPort}`, "-sTCP:ESTABLISHED", "-a", "-Fpun"];
+export function parseLsofPeers(out, clientPort, boardPort) {
+    const want = `127.0.0.1:${clientPort}->127.0.0.1:${boardPort}`;
+    const found = [];
+    let pid = NaN, uid = NaN;
+    for (const line of out.split("\n")) {
+        const k = line[0], v = line.slice(1).trim();
+        if (k === "p") {
+            pid = Number(v);
+            uid = NaN;
+        }
+        else if (k === "u")
+            uid = Number(v);
+        else if (k === "n" && v === want && Number.isInteger(pid) && Number.isInteger(uid))
+            found.push({ pid, uid });
+    }
+    return found;
+}
+function runLsof(args) {
+    const exe = existsSync("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+    return new Promise((done) => {
+        execFile(exe, args, { encoding: "utf8", timeout: 5_000, maxBuffer: 1024 * 1024 }, (err, out) => {
+            if (err && typeof err.code !== "number") {
+                done(null);
+                return;
+            }
+            done(out ?? "");
+        });
+    });
+}
+const LSOF_AT_ONCE = 4;
+let lsofRunning = 0;
+const lsofWaiting = [];
+async function lsofSlot(fn) {
+    while (lsofRunning >= LSOF_AT_ONCE)
+        await new Promise((r) => lsofWaiting.push(r));
+    lsofRunning++;
+    try {
+        return await fn();
+    }
+    finally {
+        lsofRunning--;
+        lsofWaiting.shift()?.();
+    }
+}
+export async function macPeer(clientPort, boardPort, me, run = (a) => lsofSlot(() => runLsof(a))) {
+    if (me === null || !isPort(clientPort) || !isPort(boardPort))
+        return "unknown";
+    const out = await run(lsofArgs(clientPort)).catch(() => null);
+    if (out === null)
+        return "unknown";
+    const owners = parseLsofPeers(out, clientPort, boardPort);
+    if (!owners.length)
+        return "unknown";
+    return owners.every((o) => o.uid === me) ? "same" : "other";
+}
+export function windowsPeerScript(boardPort) {
+    if (!isPort(boardPort))
+        throw new Error("not a port");
+    return [
+        "[Console]::OutputEncoding = [Text.Encoding]::UTF8",
+        "$me = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
+        "'ME ' + $me",
+        `foreach ($c in @(Get-NetTCPConnection -RemotePort ${boardPort} -State Established -ErrorAction SilentlyContinue)) {`,
+        "  if (@('127.0.0.1', '::ffff:127.0.0.1') -notcontains $c.LocalAddress -or @('127.0.0.1', '::ffff:127.0.0.1') -notcontains $c.RemoteAddress) { continue }",
+        "  $sid = ''",
+        "  try { $p = Get-CimInstance Win32_Process -Filter ('ProcessId=' + $c.OwningProcess); if ($p) { $o = Invoke-CimMethod -InputObject $p -MethodName GetOwnerSid; if ($o.ReturnValue -eq 0) { $sid = [string]$o.Sid } } } catch { $sid = '' }",
+        "  'C ' + $c.LocalPort + ' ' + $c.OwningProcess + ' ' + $sid",
+        "}",
+    ].join("\n");
+}
+export function parseWindowsPeers(out) {
+    let me = null;
+    const ports = new Map();
+    for (const raw of out.split(/\r?\n/)) {
+        const line = raw.trim();
+        const m = /^ME (S-1-[0-9-]+)$/.exec(line);
+        if (m) {
+            me = m[1];
+            continue;
+        }
+        const c = /^C (\d{1,5}) (\d+)(?: (\S*))?$/.exec(line);
+        if (!c)
+            continue;
+        const sid = /^S-1-[0-9-]+$/.test(c[3] ?? "") ? c[3] : "";
+        ports.set(Number(c[1]), [...(ports.get(Number(c[1])) ?? []), sid]);
+    }
+    return { me, ports };
+}
+export function windowsVerdict(parsed, clientPort) {
+    const owners = parsed.ports.get(clientPort);
+    if (!parsed.me || !owners?.length)
+        return "unknown";
+    if (owners.every((s) => s === parsed.me))
+        return "same";
+    return owners.some((s) => s && s !== parsed.me) ? "other" : "unknown";
+}
+function runWindowsPowerShell(script) {
+    const exe = win32.join(process.env.SystemRoot || process.env.windir || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    return new Promise((done) => {
+        execFile(exe, ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", timeout: 15_000, windowsHide: true, maxBuffer: 1024 * 1024 }, (err, out) => {
+            done(err && !out ? null : (out ?? null));
+        });
+    });
+}
+export function windowsPeerCheck(run = runWindowsPowerShell) {
+    const waiting = new Map();
+    const busy = new Set();
+    const go = (boardPort) => {
+        const batch = waiting.get(boardPort) ?? [];
+        waiting.delete(boardPort);
+        if (!batch.length)
+            return;
+        busy.add(boardPort);
+        run(windowsPeerScript(boardPort)).catch(() => null).then((out) => {
+            const parsed = out === null ? null : parseWindowsPeers(out);
+            for (const w of batch)
+                w.done(parsed ? windowsVerdict(parsed, w.port) : "unknown");
+        }).finally(() => { busy.delete(boardPort); go(boardPort); });
+    };
+    return (clientPort, boardPort) => new Promise((done) => {
+        if (!isPort(clientPort) || !isPort(boardPort)) {
+            done("unknown");
+            return;
+        }
+        waiting.set(boardPort, [...(waiting.get(boardPort) ?? []), { port: clientPort, done }]);
+        if (!busy.has(boardPort))
+            setImmediate(() => { if (!busy.has(boardPort))
+                go(boardPort); });
+    });
+}
+//# sourceMappingURL=board-peer.js.map

package/dist/board.js

@@ -1,11 +1,12 @@
 import { createServer } from "node:http";
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { spawn } from "node:child_process";
-import { chmodSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONFIG_DIR } from "./config.js";
+import { macPeer, windowsPeerCheck } from "./board-peer.js";
 import { LIMITS } from "./protocol.js";
 import { childNodeFlags } from "./managed.js";
 import { which } from "./which.js";
@@ -61,9 +62,23 @@ export function defaultBoardDeps(home = CONFIG_DIR) {
         actionFile: join(home, "bin", ".hud-action.json"),
         openTerminal: (actionId) => openExplainTerminal(home, actionId),
         now: Date.now,
-        peerUid: (c, b) => loopbackPeerUid(c, b),
+        peer: defaultPeerCheck(),
     };
 }
+export function defaultPeerCheck(os = platform()) {
+    const me = typeof process.getuid === "function" ? process.getuid() : null;
+    if (os === "linux") {
+        return async (c, b) => {
+            const uid = loopbackPeerUid(c, b);
+            return uid === null || me === null ? "unknown" : uid === me ? "same" : "other";
+        };
+    }
+    if (os === "darwin")
+        return (c, b) => macPeer(c, b, me);
+    if (os === "win32")
+        return windowsPeerCheck();
+    return async () => "unknown";
+}
 export function loopbackPeerUid(clientPort, boardPort, read = (p) => readFileSync(p, "utf8"), os = platform()) {
     if (os !== "linux")
         return null;
@@ -290,15 +305,13 @@ export async function startBoardServer(o = {}) {
         const known = peerChecked.get(sock);
         if (known !== undefined)
             return known;
-        const me = typeof process.getuid === "function" ? process.getuid() : null;
         const addr = sock.remoteAddress ?? "";
-        let ok = addr === "127.0.0.1" || addr === "::ffff:127.0.0.1";
-        if (ok && me !== null && sock.remotePort) {
-            const uid = deps.peerUid(sock.remotePort, port);
-            ok = uid === null || uid === me;
-        }
-        peerChecked.set(sock, ok);
-        return ok;
+        const local = addr === "127.0.0.1" || addr === "::ffff:127.0.0.1";
+        const check = local && sock.remotePort
+            ? deps.peer(sock.remotePort, port).then((v) => v === "same", () => false)
+            : Promise.resolve(false);
+        peerChecked.set(sock, check);
+        return check;
     };
     const status = async () => {
         const s = await deps.status();
@@ -370,10 +383,6 @@ export async function startBoardServer(o = {}) {
             sendJson(res, 403, { ok: false, error: "wrong host" });
             return;
         }
-        if (!samePerson(req)) {
-            sendJson(res, 403, { ok: false, error: "this board belongs to another user on this computer" });
-            return;
-        }
         const site = req.headers["sec-fetch-site"];
         if (typeof site === "string" && site !== "same-origin" && site !== "none") {
             sendJson(res, 403, { ok: false, error: "cross-site request" });
@@ -410,6 +419,10 @@ export async function startBoardServer(o = {}) {
         if (method === "POST" && url.pathname === "/api/session") {
             const nonce = bearerOf(req);
             const body = strictObject(await readBody(req), []);
+            if (!(await samePerson(req))) {
+                sendJson(res, 403, { ok: false, error: "this board belongs to another user on this computer — or this computer could not show that this connection is yours" });
+                return;
+            }
             if (!nonce || !useLink(nonce)) {
                 sendJson(res, 401, { ok: false, error: "this board link has expired or was already used — run pantheon board for a fresh one" });
                 return;
@@ -565,7 +578,8 @@ export async function startBoardServer(o = {}) {
         }
         catch { } });
     });
-    server.headersTimeout = 15_000;
+    server.keepAliveTimeout = 30_000;
+    server.headersTimeout = 35_000;
     server.requestTimeout = 60_000;
     await new Promise((ok, fail) => { server.once("error", fail); server.listen(0, "127.0.0.1", () => { server.off("error", fail); ok(); }); });
     port = server.address().port;
@@ -620,31 +634,6 @@ export function browserCommand(url, os = platform(), find = (n) => which(n), o =
     const scoped = o.scope ? scopeArgv([x, url], find) : null;
     return scoped ? { cmd: scoped[0], args: scoped.slice(1), opts } : { cmd: x, args: [url], opts };
 }
-export function redirectPage(url, dir, now = Date.now()) {
-    if (!LINK_RE.test(url))
-        throw new Error("not a board link");
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    for (const f of readdirSync(dir)) {
-        if (!/^board-open-[0-9a-f]{16}\.html$/.test(f))
-            continue;
-        try {
-            if (now - statSync(join(dir, f)).mtimeMs > 60_000)
-                rmSync(join(dir, f), { force: true });
-        }
-        catch { }
-    }
-    const file = join(dir, `board-open-${randomBytes(8).toString("hex")}.html`);
-    writeFileSync(file, `<!doctype html><meta charset="utf-8"><meta name="referrer" content="no-referrer"><meta http-equiv="refresh" content="0;url=${url}"><title>Pantheon</title><script>location.replace(${JSON.stringify(url)})</script>\n`, { mode: 0o600 });
-    return file;
-}
-export function fileOpenCommand(file, os = platform()) {
-    const opts = { detached: true, stdio: "ignore", windowsHide: true };
-    if (os === "darwin")
-        return { cmd: "open", args: [file], opts };
-    if (os === "win32")
-        return { cmd: "explorer.exe", args: [file], opts };
-    return null;
-}
 export async function openBrowser(url, d = {}) {
     if (!LINK_RE.test(url))
         throw new Error("not a board link");
@@ -655,11 +644,6 @@ export async function openBrowser(url, d = {}) {
         if (await portal(url).catch(() => false))
             return "portal";
     }
-    if (os === "darwin" || os === "win32") {
-        const page = redirectPage(url, d.pageDir ?? join(CONFIG_DIR, "bin"));
-        const how = fileOpenCommand(page, os);
-        return (await (d.launch ?? launch)(how)) ? "direct" : false;
-    }
     const scope = os === "linux" && (d.inService ?? (() => inServiceCgroup()))();
     const how = browserCommand(url, os, find, { scope });
     if (!how)
@@ -721,7 +705,7 @@ async function openExplainTerminal(home, actionId) {
         return { ok: false, why: `${t.error} — copy the question into your agent instead` };
     return (await launch(t)) ? { ok: true } : { ok: false, why: "the terminal could not be started — copy the question into your agent instead" };
 }
-export async function ping(s, timeoutMs = 1500) {
+export async function ping(s, timeoutMs = 3000) {
     const challenge = randomBytes(16).toString("hex");
     try {
         const res = await fetch(`http://127.0.0.1:${s.port}/api/ping?challenge=${challenge}`, { signal: AbortSignal.timeout(timeoutMs), redirect: "error" });

package/dist/cli.js

@@ -2530,6 +2530,8 @@ async function main() {
                     die(`nothing was changed.${plan.teams.length > 1 ? " Leave one team with: pantheon leave <team>" : ""}`);
             }
             console.error(`${B(uninstalling ? "uninstalling pantheon" : "leaving pantheon")}${plan.teams.length ? D(`   — ${plan.teams.map((t) => t.name).join(", ")}`) : ""}\n`);
+            const { pantheonHomeRefusal, refusedHomeLine } = await import("./home-safety.js");
+            const homeRefusal = pantheonHomeRefusal(CONFIG_DIR);
             const { uninstallMachine, realUninstallIo } = await import("./machine.js");
             const { removeUserMcpEntries } = await import("./install.js");
             const { killRecordedRun } = await import("./worker.js");
@@ -2539,6 +2541,7 @@ async function main() {
                 hasIntent: () => readIntent() !== null,
                 clearIntent: () => clearIntent(),
                 killRun: () => killRecordedRun(dirname(CONFIG_PATH)),
+                homeRefusal,
             }));
             for (const l of done.lines)
                 console.error(`  ${l}`);
@@ -2561,7 +2564,10 @@ async function main() {
             const { unlinkSync, existsSync: exists, rmSync, readdirSync } = await import("node:fs");
             const spare = [];
             const hasConfig = !!all && exists(CONFIG_PATH);
-            if (hasConfig && keepIdentity) {
+            if (homeRefusal) {
+                left.push(refusedHomeLine(CONFIG_DIR, homeRefusal));
+            }
+            else if (hasConfig && keepIdentity) {
                 left.push(`your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} (--keep-identity)`);
             }
             else if (!keepIdentity && (hasConfig || uninstalling)) {
@@ -2613,16 +2619,18 @@ async function main() {
             {
                 const { removePantheonWorktrees, removeHomeLeftovers } = await import("./machine.js");
                 const repos = [project, ...Object.values(all?.bindings ?? {}).map((b) => b.path).filter((p) => !!p)];
-                const trees = removePantheonWorktrees(repos, [join(CONFIG_DIR, "worktrees"), ...repos.map((r) => join(r, ".pantheon", "worktrees"))]);
+                const trees = removePantheonWorktrees(repos, [...(homeRefusal ? [] : [join(CONFIG_DIR, "worktrees")]), ...repos.map((r) => join(r, ".pantheon", "worktrees"))]);
                 removed.push(...trees.removed);
                 left.push(...trees.left);
-                try {
-                    rmSync(join(CONFIG_DIR, "worktrees"), { recursive: true, force: true });
+                if (!homeRefusal) {
+                    try {
+                        rmSync(join(CONFIG_DIR, "worktrees"), { recursive: true, force: true });
+                    }
+                    catch { }
+                    const rest = removeHomeLeftovers(CONFIG_DIR, keepIdentity, { uninstalling, refusal: null });
+                    removed.push(...rest.removed);
+                    left.push(...rest.left);
                 }
-                catch { }
-                const rest = removeHomeLeftovers(CONFIG_DIR, keepIdentity, { uninstalling });
-                removed.push(...rest.removed);
-                left.push(...rest.left);
             }
             if (uninstalling) {
                 if (install?.present) {
@@ -2633,9 +2641,11 @@ async function main() {
                 if (!runningManaged)
                     left.push(`this pantheon itself (${process.argv[1] ?? "the one you ran"}), which npm installed — remove it with: ${NPM_UNINSTALL}`);
                 const { sweepPantheonHome } = await import("./machine.js");
-                const swept = sweepPantheonHome(CONFIG_DIR, { keepIdentity, spare });
-                removed.push(...swept.removed);
-                left.push(...swept.left);
+                if (!homeRefusal) {
+                    const swept = sweepPantheonHome(CONFIG_DIR, { keepIdentity, spare, refusal: null });
+                    removed.push(...swept.removed);
+                    left.push(...swept.left);
+                }
             }
             console.error(`\n${B("Removed")}`);
             for (const r of removed)
@@ -3564,6 +3574,25 @@ async function main() {
                     st = null;
                     raw = null;
                 }
+                if (raw !== null) {
+                    let nonce;
+                    try {
+                        nonce = JSON.parse(raw).nonce;
+                    }
+                    catch {
+                        nonce = undefined;
+                    }
+                    const stale = st !== null && Date.now() - st.mtimeMs > HUD_ACTION_MAX_AGE_MS;
+                    if (stale && typeof nonce === "string" && nonce !== want) {
+                        try {
+                            rmSync(f, { force: true });
+                        }
+                        catch { }
+                        st = null;
+                        raw = null;
+                        nonce = undefined;
+                    }
+                }
                 if (raw !== null) {
                     let nonce;
                     try {

package/dist/config.js

@@ -5,6 +5,7 @@ import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { VERSION } from "./version.js";
 import { repoName } from "./repo-route.js";
+import { markPantheonHome } from "./home-safety.js";
 export const CONFIG_DIR = process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
 export const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 export const DEFAULT_RELAY = process.env.PANTHEON_DEFAULT_RELAY
@@ -146,7 +147,7 @@ export function saveAll(f) {
     return CONFIG_PATH;
 }
 function privateDir() {
-    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    ensurePantheonHome();
     if (process.platform === "win32")
         return;
     try {
@@ -202,6 +203,11 @@ function writeConfigAtomic(data) {
             catch { }
     }
 }
+export function ensurePantheonHome() {
+    const made = !existsSync(CONFIG_DIR);
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    markPantheonHome(CONFIG_DIR, made);
+}
 const CONFIG_LOCK_STALE_MS = 5_000;
 const CONFIG_LOCK_WAIT_MS = 15_000;
 const sleepSync = (ms) => { try {

package/dist/home-safety.js

@@ -0,0 +1,195 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir, platform, userInfo } from "node:os";
+import { basename, dirname, join, posix, sep, win32 } from "node:path";
+export const HOME_MARKER = ".pantheon-home";
+export const PANTHEON_HOME_ENTRIES = [
+    { name: HOME_MARKER, what: "the mark that says this folder is Pantheon's home" },
+    { name: "config.json", what: "your key and team tokens", identity: true },
+    { name: "config.json.bak", what: "the previous config.json", identity: true },
+    { name: "keys.json", what: "the teammates' keys this machine pinned", identity: true },
+    { name: "nonces.json", what: "the signed requests this machine has seen", identity: true },
+    { name: "continued.json", what: "what this machine already handled", identity: true },
+    { name: "cursors.json", what: "where each agent session last read", identity: true },
+    { name: "worker-cursor.json", what: "where the worker last read", identity: true },
+    { name: "profile.json", what: "your profile", identity: true },
+    { name: "worker-policy.json", what: "the worker's wake policy", identity: true },
+    { name: "spend.json", what: "the spend ledger", identity: true },
+    { name: "personas", what: "the worker's personas", dir: true, identity: true },
+    { name: "worker-state.json", what: "the worker's last state" },
+    { name: "worker-run.json", what: "the worker's record of a run in flight" },
+    { name: "run-slot.json", what: "the worker's run slot" },
+    { name: "worker.pid", what: "the worker's pid file" },
+    { name: /^notifier-state(-.+)?\.json$/, sample: "notifier-state-team%2Fone.json", what: "the alerts' state" },
+    { name: "update-check.json", what: "the update check's cache" },
+    { name: "uri-key", what: "the key pantheon:// links are signed with" },
+    { name: "board.json", what: "the board's state" },
+    { name: "hook-intent.json", what: "the hook intent" },
+    { name: "hook-guard.json", what: "the hook guard" },
+    { name: /^(worker|relay|notifier|menubar)\.log(\.1)?$/, sample: "worker.log", what: "service logs an older version wrote here" },
+    { name: /^\.write-check\..+$/, sample: ".write-check.1234.5678", what: "a leftover write probe" },
+    { name: "bin", what: "the menu bar's and alerts' files", dir: true },
+    { name: "logs", what: "the service logs", dir: true },
+    { name: "host", what: "the Windows host's queue, state and markers", dir: true },
+    { name: "mcp", what: "the agent windows' server state", dir: true },
+    { name: "run-homes", what: "the woken runs' homes", dir: true },
+    { name: "worktrees", what: "the worker's worktrees", dir: true },
+    { name: "no-hooks", what: "the empty hooks folder woken runs' git uses", dir: true },
+    { name: "lfs-hooks", what: "the LFS-only hooks folder woken runs' git uses", dir: true },
+    { name: "runtime", what: "Pantheon's own Node", dir: true, kept: "managed" },
+    { name: "data", what: "the relay's ledger", dir: true, kept: "it is your team's history and may be its only copy; delete it yourself once no relay runs from it" },
+    { name: /^(\.DS_Store|Thumbs\.db|desktop\.ini)$/i, sample: ".DS_Store", what: "the file browser's folder cache" },
+];
+const LOCK_OR_TMP = /^(.+?)(\.lock|(\.[0-9a-f]+)+\.tmp)$/i;
+export function homeEntryFor(name) {
+    const direct = (n) => PANTHEON_HOME_ENTRIES.find((e) => typeof e.name === "string" ? e.name === n : e.name.test(n)) ?? null;
+    const e = direct(name);
+    if (e)
+        return e;
+    const m = LOCK_OR_TMP.exec(name);
+    const base = m ? direct(m[1]) : null;
+    return base && !base.dir ? base : null;
+}
+const realOrNull = (p) => { try {
+    return realpathSync.native(p);
+}
+catch {
+    return null;
+} };
+function gitTopOf(dir) {
+    const env = { ...process.env };
+    for (const k of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR", "GIT_CEILING_DIRECTORIES"])
+        delete env[k];
+    try {
+        const out = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: dir, env, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, windowsHide: true }).trim();
+        return out ? realOrNull(out) ?? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const realHomeCheckIo = () => ({
+    real: realOrNull,
+    exists: (p) => existsSync(p),
+    read: (p) => { try {
+        return readFileSync(p, "utf8");
+    }
+    catch {
+        return null;
+    } },
+    homes: () => {
+        const out = [homedir()];
+        try {
+            const u = userInfo().homedir;
+            if (u)
+                out.push(u);
+        }
+        catch { }
+        if (process.env.USERPROFILE)
+            out.push(process.env.USERPROFILE);
+        return out;
+    },
+    cwd: () => process.cwd(),
+    repoTop: gitTopOf,
+    os: platform(),
+});
+export function isPantheonHomeName(dir, os = platform()) {
+    const b = (os === "win32" ? win32 : posix).basename(dir);
+    return os === "win32" ? [".pantheon", "pantheon"].includes(b.toLowerCase()) : b === ".pantheon" || b === "Pantheon";
+}
+function holdsPantheonIdentity(dir, io, pj = join) {
+    if (!io.exists(pj(dir, "keys.json")))
+        return false;
+    const raw = io.read(pj(dir, "config.json"));
+    if (raw === null)
+        return false;
+    try {
+        const c = JSON.parse(raw.replace(/^/, ""));
+        return !!c && typeof c === "object" && typeof c.member === "string" && typeof c.publicKey === "string" && typeof c.privateKey === "string" && typeof c.relay === "string";
+    }
+    catch {
+        return false;
+    }
+}
+export function pantheonHomeRefusal(dir, over = {}) {
+    const io = { ...realHomeCheckIo(), ...over };
+    const r = io.real(dir);
+    if (r === null)
+        return null;
+    const win = io.os === "win32";
+    const P = win ? win32 : posix;
+    const norm = (p) => { const s = p.replace(/[\\/]+$/, "") || p; return win ? s.replace(/\//g, "\\").toLowerCase() : s; };
+    const S = win ? "\\" : sep;
+    const d = norm(r);
+    const inside = (child, parent) => child.startsWith(parent.endsWith(S) ? parent : parent + S);
+    if (P.dirname(r) === r || /^[a-z]:\\?$/i.test(d) || d === "")
+        return `${dir} is the root of a ${win ? "drive" : "filesystem"}`;
+    const homes = [...new Set(io.homes().map((h) => io.real(h) ?? h).map(norm))];
+    for (const h of homes) {
+        if (d === h)
+            return `${dir} is your home folder`;
+        if (inside(h, d))
+            return `${dir} holds your home folder (${h})`;
+    }
+    const cwd = io.real(io.cwd());
+    if (cwd && norm(cwd) === d)
+        return `${dir} is the folder this command runs in`;
+    if (io.exists(P.join(r, ".git")))
+        return `${dir} is a git repository`;
+    let walked = null;
+    for (let p = P.dirname(r), prev = r; p !== prev; prev = p, p = P.dirname(p)) {
+        if (io.exists(P.join(p, ".git"))) {
+            walked = p;
+            break;
+        }
+    }
+    const top = io.repoTop(r) ?? walked;
+    if (top) {
+        const t = norm(top);
+        const dotfiles = homes.some((h) => t === h && inside(d, h));
+        if (t === d)
+            return `${dir} is a git repository`;
+        if (!dotfiles)
+            return `${dir} is inside the git repository ${top}`;
+    }
+    if (!isPantheonHomeName(r, io.os) && !io.exists(P.join(r, HOME_MARKER)) && !holdsPantheonIdentity(r, io, P.join)) {
+        return `${dir} is not a folder Pantheon made: it is not named .pantheon, it has no ${HOME_MARKER} mark, and it holds no Pantheon identity`;
+    }
+    return null;
+}
+export function pantheonNamedFiles(dir) {
+    let names = [];
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    return names.sort().filter((n) => homeEntryFor(n)).map((n) => join(dir, n));
+}
+export function refusedHomeLine(dir, why) {
+    const files = pantheonNamedFiles(dir).filter((p) => !/^(\.DS_Store|Thumbs\.db|desktop\.ini)$/i.test(basename(p)));
+    const cwd = /the folder this command runs in$/.test(why);
+    return `nothing in ${dir} was removed: ${why}, so it may hold files of your own under the names Pantheon uses.` +
+        (cwd ? " Run the command again from another folder to have Pantheon's files there removed." : "") +
+        (files.length ? ` Pantheon's files there, if they are Pantheon's — check each, then delete it yourself: ${files.join(", ")}` : " No file there has a name Pantheon writes.");
+}
+export function markPantheonHome(dir, createdNow, over = {}) {
+    try {
+        const f = join(dir, HOME_MARKER);
+        if (existsSync(f))
+            return;
+        const io = { ...realHomeCheckIo(), ...over };
+        const r = io.real(dir);
+        if (r === null || dirname(r) === r)
+            return;
+        const homes = io.homes().map((h) => io.real(h) ?? h);
+        if (homes.some((h) => h === r || h.startsWith(r.endsWith(sep) ? r : r + sep)))
+            return;
+        if (!createdNow && readdirSync(r).some((n) => !/^(config\.json|keys\.json)(\.tmp[\w.-]*|\.lock)?$/.test(n)))
+            return;
+        writeFileSync(f, "This folder is Pantheon's home. `pantheon uninstall` removes what Pantheon wrote here, and nothing else.\n", { flag: "wx", mode: 0o600 });
+    }
+    catch { }
+}
+//# sourceMappingURL=home-safety.js.map

package/dist/machine.js

@@ -6,6 +6,7 @@ import { CONFIG_DIR } from "./config.js";
 import { borrowedHome, disableService, existingUnitPath, plistPath, serviceInstalled, serviceLogFile, stopWindowsHost, unitPath, unitPaths, uninstallService } from "./service.js";
 import { LEGACY_TASK_NAME, hostAlive, hostChildRunning, hostFiles, isHostKind, readHostState, recordedTaskName } from "./win-host.js";
 import { copilotMcpConfigFile, vsCodeUserDir, kiroMcpConfigFile, kiroDir } from "./install.js";
+import { HOME_MARKER, homeEntryFor, isPantheonHomeName, pantheonHomeRefusal, refusedHomeLine } from "./home-safety.js";
 const sh = (cmd) => {
     try {
         return execFileSync("sh", ["-lc", cmd], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -667,6 +668,9 @@ export function removePantheonWorktrees(repos, roots, git = (repo, args) => exec
 const MANAGED_LAUNCHER = "pantheon";
 export function removeHomeLeftovers(home, keep, opts = {}) {
     const removed = [], left = [];
+    const refusal = opts.refusal !== undefined ? opts.refusal : pantheonHomeRefusal(home);
+    if (refusal)
+        return { removed, left: [refusedHomeLine(home, refusal)] };
     const items = [
         ["worker-policy.json", "the worker's wake policy (who may wake it, and self-upgrade) — a rejoin starts from no grants"],
         ["profile.json", "your profile (name, title, what you decide)"],
@@ -705,52 +709,7 @@ export function removeHomeLeftovers(home, keep, opts = {}) {
     }
     return { removed, left };
 }
-export const PANTHEON_HOME_ENTRIES = [
-    { name: "config.json", what: "your key and team tokens", identity: true },
-    { name: "config.json.bak", what: "the previous config.json", identity: true },
-    { name: "keys.json", what: "the teammates' keys this machine pinned", identity: true },
-    { name: "nonces.json", what: "the signed requests this machine has seen", identity: true },
-    { name: "continued.json", what: "what this machine already handled", identity: true },
-    { name: "cursors.json", what: "where each agent session last read", identity: true },
-    { name: "worker-cursor.json", what: "where the worker last read", identity: true },
-    { name: "profile.json", what: "your profile", identity: true },
-    { name: "worker-policy.json", what: "the worker's wake policy", identity: true },
-    { name: "spend.json", what: "the spend ledger", identity: true },
-    { name: "personas", what: "the worker's personas", dir: true, identity: true },
-    { name: "worker-state.json", what: "the worker's last state" },
-    { name: "worker-run.json", what: "the worker's record of a run in flight" },
-    { name: "run-slot.json", what: "the worker's run slot" },
-    { name: "worker.pid", what: "the worker's pid file" },
-    { name: /^notifier-state(-.+)?\.json$/, sample: "notifier-state-team%2Fone.json", what: "the alerts' state" },
-    { name: "update-check.json", what: "the update check's cache" },
-    { name: "uri-key", what: "the key pantheon:// links are signed with" },
-    { name: "board.json", what: "the board's state" },
-    { name: "hook-intent.json", what: "the hook intent" },
-    { name: "hook-guard.json", what: "the hook guard" },
-    { name: /^(worker|relay|notifier|menubar)\.log(\.1)?$/, sample: "worker.log", what: "service logs an older version wrote here" },
-    { name: /^\.write-check\..+$/, sample: ".write-check.1234.5678", what: "a leftover write probe" },
-    { name: "bin", what: "the menu bar's and alerts' files", dir: true },
-    { name: "logs", what: "the service logs", dir: true },
-    { name: "host", what: "the Windows host's queue, state and markers", dir: true },
-    { name: "mcp", what: "the agent windows' server state", dir: true },
-    { name: "run-homes", what: "the woken runs' homes", dir: true },
-    { name: "worktrees", what: "the worker's worktrees", dir: true },
-    { name: "no-hooks", what: "the empty hooks folder woken runs' git uses", dir: true },
-    { name: "lfs-hooks", what: "the LFS-only hooks folder woken runs' git uses", dir: true },
-    { name: "runtime", what: "Pantheon's own Node", dir: true, kept: "managed" },
-    { name: "data", what: "the relay's ledger", dir: true, kept: "it is your team's history and may be its only copy; delete it yourself once no relay runs from it" },
-    { name: /^(\.DS_Store|Thumbs\.db|desktop\.ini)$/i, sample: ".DS_Store", what: "the file browser's folder cache" },
-];
-const LOCK_OR_TMP = /^(.+?)(\.lock|(\.[0-9a-f]+)+\.tmp)$/i;
-export function homeEntryFor(name) {
-    const direct = (n) => PANTHEON_HOME_ENTRIES.find((e) => typeof e.name === "string" ? e.name === n : e.name.test(n)) ?? null;
-    const e = direct(name);
-    if (e)
-        return e;
-    const m = LOCK_OR_TMP.exec(name);
-    const base = m ? direct(m[1]) : null;
-    return base && !base.dir ? base : null;
-}
+export { PANTHEON_HOME_ENTRIES, homeEntryFor } from "./home-safety.js";
 const pause = (ms) => { try {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -768,6 +727,9 @@ export function sweepPantheonHome(home, o = {}) {
     const removed = [], left = [];
     if (!fs.exists(home))
         return { removed, left, gone: true };
+    const refusal = o.refusal !== undefined ? o.refusal : o.fs ? null : pantheonHomeRefusal(home);
+    if (refusal)
+        return { removed, left: [refusedHomeLine(home, refusal)], gone: false };
     const spare = new Set((o.spare ?? []).map((p) => resolve(p)));
     const attempt = (p, rm) => {
         let why = "";
@@ -801,6 +763,8 @@ export function sweepPantheonHome(home, o = {}) {
             foreign.push(name);
             continue;
         }
+        if (name === HOME_MARKER)
+            continue;
         if (spare.has(resolve(p)))
             continue;
         if (e.kept === "managed")
@@ -828,6 +792,8 @@ export function sweepPantheonHome(home, o = {}) {
         rest = fs.list(home);
     }
     catch { }
+    if (rest.includes(HOME_MARKER) && (rest.length === 1 || isPantheonHomeName(home, os)) && attempt(join(home, HOME_MARKER), fs.remove) === null)
+        rest = rest.filter((n) => n !== HOME_MARKER);
     if (!rest.length) {
         const why = attempt(home, fs.removeDir);
         if (why === null) {
@@ -885,20 +851,22 @@ export function uninstallMachine(opts, io) {
     if (!opts.stopRelay && (io.installed("relay") || io.proc("relay").running)) {
         left.push("the relay — others may be using it. Stop and remove it too: pantheon leave --stop-relay");
     }
-    if (io.hasIntent()) {
+    if (!io.homeRefusal && io.hasIntent()) {
         io.clearIntent();
         removed.push("the hook intent (hook-intent.json) — nothing will put the hooks back");
     }
     const mcp = io.removeMcpEntries();
     removed.push(...mcp.removed);
     left.push(...mcp.left);
-    try {
-        if (existsSync(io.logDir)) {
-            rmSync(io.logDir, { recursive: true, force: true });
-            removed.push(`service logs (${io.logDir})`);
+    if (!io.homeRefusal) {
+        try {
+            if (existsSync(io.logDir)) {
+                rmSync(io.logDir, { recursive: true, force: true });
+                removed.push(`service logs (${io.logDir})`);
+            }
         }
+        catch { }
     }
-    catch { }
     const repoDir = join(opts.project, ".pantheon");
     let repoLogs = 0;
     for (const k of LOG_KINDS) {
@@ -1052,6 +1020,7 @@ export function realUninstallIo(deps) {
         hasIntent: deps.hasIntent,
         clearIntent: deps.clearIntent,
         logDir: join(CONFIG_DIR, "logs"),
+        homeRefusal: deps.homeRefusal !== undefined ? deps.homeRefusal : pantheonHomeRefusal(CONFIG_DIR),
         ownWorkerPid: () => ownWorkerPid(),
         borrowed: () => borrowedHome(),
         kill: (pid) => killPid(pid) === null,

package/dist/service.js

@@ -7,7 +7,7 @@ import { linuxGraphicalSession } from "./host-env.js";
 import { fileURLToPath } from "node:url";
 import { isVersionManagedPath, launcher } from "./install.js";
 import { childNodeFlags, managedLauncher, managedLayout } from "./managed.js";
-import { CONFIG_DIR } from "./config.js";
+import { CONFIG_DIR, ensurePantheonHome } from "./config.js";
 import { HOST_KINDS, LEGACY_TASK_NAME, clearTrayQuit, ensureHostShim, fromUtf16le, hostAlive, hostArgv, hostChildRunning, hostFiles, hostLaunch, isHostKind, launchFileText, legacyTaskIsUsers, readDefinition, readHostState, taskName, taskUserId, taskXml, utf16le, windowsPowerShell, writeDefinition, } from "./win-host.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 const LABEL = (kind) => `dev.pantheon.${kind}`;
@@ -272,6 +272,10 @@ export function installService(kind, cwd, args, sys = realSys()) {
     const noServices = servicesUnavailable(sys.platform);
     if (noServices)
         throw new Error(noServices.replace(/^not available — /, ""));
+    try {
+        ensurePantheonHome();
+    }
+    catch { }
     if (sys.platform === "win32")
         return installWindows(kind, resolve(cwd), args, sys);
     const out = [];

package/dist/win-host.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, linkSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join, resolve, win32 } from "node:path";
@@ -649,7 +649,8 @@ export function takeHostLock(home = CONFIG_DIR, pid = process.pid, now = Date.no
             if (e.code !== "EEXIST")
                 throw e;
         }
-        const held = Number(readFileSafe(f.lock));
+        const judged = readFileSafe(f.lock);
+        const held = Number(judged);
         let age = 0;
         try {
             age = now() - statSync(f.lock).mtimeMs;
@@ -674,10 +675,37 @@ export function takeHostLock(home = CONFIG_DIR, pid = process.pid, now = Date.no
         catch {
             continue;
         }
+        const moved = readFileSafe(gone);
+        if (moved !== judged) {
+            putBack(gone, f.lock);
+            const other = Number(moved);
+            return Number.isInteger(other) && other > 0 ? other : -1;
+        }
         rmSync(gone, { force: true });
     }
     return lastHolder;
 }
+function putBack(moved, lock) {
+    try {
+        linkSync(moved, lock);
+        rmSync(moved, { force: true });
+        return;
+    }
+    catch (e) {
+        if (e.code === "EEXIST") {
+            rmSync(moved, { force: true });
+            return;
+        }
+    }
+    if (existsSync(lock)) {
+        rmSync(moved, { force: true });
+        return;
+    }
+    try {
+        renameSync(moved, lock);
+    }
+    catch { }
+}
 const readFileSafe = (p) => { try {
     return readFileSync(p, "utf8").trim();
 }

package/helper/macos/prebuilt/manifest.json

@@ -1,6 +1,6 @@
 {
   "format": 1,
-  "built_at": "2026-10-05T04:55:37.913Z",
+  "built_at": "2026-10-05T08:38:15.336Z",
   "swiftc": "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)",
   "helpers": {
     "pantheon-tray": {
@@ -17,7 +17,7 @@
     "pantheon-hud": {
       "source": "main.swift",
       "source_sha256": "bcf55a19b658d1f09a9d117c76030393ab08a2569062dd7413f884ca05f3a0eb",
-      "sha256": "0414b397a533940e3a5c324add6250e1ed71919e67e462d11dcb2a1d0c2f9b41",
+      "sha256": "191f3f18e8212e11ad4438bdbef87a5cc533f5ae2fae208801db01c9a265193b",
       "archs": [
         "arm64",
         "x86_64"

package/helper/windows/pantheon-notice.ps1

@@ -30,37 +30,65 @@
 #>
 param([string]$Mode = '')
 
+# Whether toasts are switched off for an app id: only an explicit Disabled*
+# setting is off. Windows THROWS "Element not found" (0x80070490) for an app id
+# that has never shown a toast for this user, and a plain property read turned
+# that into $null -- which was taken for "off" for every id, so a fresh PC only
+# ever got balloons. Unreadable is unknown, and unknown is tried.
+function global:Get-PantheonToastSetting($Notifier) {
+  $s = $null
+  try { $s = $Notifier.get_Setting() } catch { try { $s = $Notifier.Setting } catch { $s = $null } }
+  if ($null -eq $s) { return 'unknown' }
+  return [string]$s
+}
+
 # One toast: the XML, tried under each app id in turn. Returns @{ code; said }.
-function global:Show-PantheonToast([string]$Xml, [string]$Tag, [string[]]$Aumids) {
+# $Api stands in for the WinRT calls (the checks run it on Linux); left out,
+# the real ToastNotificationManager is used.
+function global:Show-PantheonToast([string]$Xml, [string]$Tag, [string[]]$Aumids, [hashtable]$Api = $null) {
   $said = New-Object System.Collections.Generic.List[string]
-  try {
-    [void][Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime]
-    [void][Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime]
-    $doc = [Windows.Data.Xml.Dom.XmlDocument]::new()
-    $doc.LoadXml($Xml)
-  } catch {
-    $said.Add('no-toast-api ' + $_.Exception.Message)
-    return @{ code = 3; said = $said }
+  $doc = $null
+  if (-not $Api) {
+    try {
+      [void][Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime]
+      [void][Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime]
+      $doc = [Windows.Data.Xml.Dom.XmlDocument]::new()
+      $doc.LoadXml($Xml)
+    } catch {
+      $said.Add('no-toast-api ' + $_.Exception.Message)
+      return @{ code = 3; said = $said }
+    }
+    $Api = @{
+      notifier = { param($id) [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($id) }
+      toast = { param($d) [Windows.UI.Notifications.ToastNotification]::new($d) }
+      history = { param($id) [Windows.UI.Notifications.ToastNotificationManager]::History.GetHistory($id) }
+      remove = { param($t, $id) [Windows.UI.Notifications.ToastNotificationManager]::History.Remove($t, 'pantheon', $id) }
+      wait = { Start-Sleep -Milliseconds 400 }
+    }
   }
   $ids = @($Aumids | Where-Object { $_ })
   for ($i = 0; $i -lt $ids.Count; $i++) {
     $id = $ids[$i]
     $last = ($i -eq $ids.Count - 1)
     try {
-      $notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($id)
-      if ([string]$notifier.Setting -ne 'Enabled') { $said.Add('off ' + $id + ' ' + $notifier.Setting); continue }
-      $toast = [Windows.UI.Notifications.ToastNotification]::new($doc)
+      $notifier = & $Api.notifier $id
+      $setting = Get-PantheonToastSetting $notifier
+      if ($setting -like 'Disabled*') { $said.Add('off ' + $id + ' ' + $setting); continue }
+      $toast = & $Api.toast $doc
       if ($Tag) { $toast.Tag = $Tag; $toast.Group = 'pantheon' }
       $notifier.Show($toast)
       # Pantheon's own app id is used only when Windows then has the toast in
       # its history for that id: a build that ignores the registration falls
       # through to the next id instead of swallowing the alert.
-      if (-not $last -and $Tag) {
-        Start-Sleep -Milliseconds 400
+      # The last id too, when Windows would not say its setting: an unknown
+      # setting that Windows then drops silently must still end in a balloon.
+      $knownOn = ($setting -eq 'Enabled')
+      if ($Tag -and (-not $last -or -not $knownOn)) {
+        & $Api.wait
         $seen = $false
-        foreach ($h in [Windows.UI.Notifications.ToastNotificationManager]::History.GetHistory($id)) { if ($h.Tag -eq $Tag) { $seen = $true } }
+        foreach ($h in @(& $Api.history $id)) { if ($h.Tag -eq $Tag) { $seen = $true } }
         if (-not $seen) {
-          try { [Windows.UI.Notifications.ToastNotificationManager]::History.Remove($Tag, 'pantheon', $id) } catch { }
+          try { & $Api.remove $Tag $id } catch { }
           $said.Add('unseen ' + $id)
           continue
         }

package/installer/install.ps1

@@ -186,8 +186,11 @@ function Install-Pantheon {
   # Is a task this user's? Its XML (schtasks /Query /TN <name> /XML) names its
   # principal as DOMAIN\user, a bare user name, or a SID; every one of them must
   # be this user (src/win-host.ts taskIsUsers). A task of the same name that
-  # another person on this PC registered is never ended.
-  function Test-PantheonTaskIsMine([string]$Xml, [string]$UserId, [string]$Sid) {
+  # another person on this PC registered is never ended. A SID is compared as a
+  # SID; a name is first turned into its account's SID ($ToSid) and compared
+  # by that, and only by name when Windows cannot say which account it is.
+  function Test-PantheonTaskIsMine([string]$Xml, [string]$UserId, [string]$Sid,
+    [scriptblock]$ToSid = { param($n) if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) { return '' }; try { ([Security.Principal.NTAccount]$n).Translate([Security.Principal.SecurityIdentifier]).Value } catch { '' } }) {
     if (-not $Xml) { return $false }
     $ids = @([regex]::Matches(($Xml -replace "`0", ''), '<UserId>([^<]*)</UserId>') | ForEach-Object { $_.Groups[1].Value.Trim().ToLowerInvariant() })
     if ($ids.Count -eq 0) { return $false }
@@ -195,14 +198,57 @@ function Install-Pantheon {
     $s = ([string]$Sid).ToLowerInvariant()
     $bare = if ($u.Contains('\')) { $u.Substring($u.LastIndexOf('\') + 1) } else { $u }
     foreach ($id in $ids) {
+      if ($id.StartsWith('s-1-')) { if ($s -and $id -eq $s) { continue }; return $false }
+      $idSid = ''
+      if ($s) { try { $idSid = ([string](& $ToSid $id)).ToLowerInvariant() } catch { $idSid = '' } }
+      if ($idSid) { if ($idSid -eq $s) { continue }; return $false }
       if ($u -and $id -eq $u) { continue }
-      if ($s -and $id -eq $s) { continue }
-      if ($bare -and -not $id.Contains('\') -and -not $id.StartsWith('s-1-') -and $id -eq $bare) { continue }
+      if ($bare -and -not $id.Contains('\') -and $id -eq $bare) { continue }
       return $false
     }
     return $true
   }
 
+  # What schtasks printed, as text. It writes a task's XML as UTF-16 (with or
+  # without a byte order mark); read in the console's code page, a user name
+  # with a letter outside ASCII came out as other letters and never matched.
+  # So the bytes are decoded by what they hold.
+  function ConvertFrom-TaskXmlBytes([byte[]]$Bytes) {
+    if (-not $Bytes -or $Bytes.Length -eq 0) { return '' }
+    if ($Bytes.Length -ge 2 -and $Bytes[0] -eq 0xFF -and $Bytes[1] -eq 0xFE) { return [Text.Encoding]::Unicode.GetString($Bytes, 2, $Bytes.Length - 2) }
+    if ($Bytes.Length -ge 2 -and $Bytes[0] -eq 0xFE -and $Bytes[1] -eq 0xFF) { return [Text.Encoding]::BigEndianUnicode.GetString($Bytes, 2, $Bytes.Length - 2) }
+    if ($Bytes.Length -ge 3 -and $Bytes[0] -eq 0xEF -and $Bytes[1] -eq 0xBB -and $Bytes[2] -eq 0xBF) { return [Text.Encoding]::UTF8.GetString($Bytes, 3, $Bytes.Length - 3) }
+    # No mark: UTF-16LE when most odd bytes of the start are zero ('<', 0, '?', 0, ...).
+    $n = [Math]::Min($Bytes.Length, 64); $odd = 0; $zeros = 0
+    for ($i = 1; $i -lt $n; $i += 2) { $odd++; if ($Bytes[$i] -eq 0) { $zeros++ } }
+    if ($odd -gt 0 -and $zeros * 4 -ge $odd * 3) { return [Text.Encoding]::Unicode.GetString($Bytes) }
+    try { return (New-Object System.Text.UTF8Encoding($false, $true)).GetString($Bytes) } catch { }
+    return [Console]::OutputEncoding.GetString($Bytes)
+  }
+
+  # A task's XML (schtasks /Query /TN <name> /XML), its bytes read as they are
+  # (ConvertFrom-TaskXmlBytes); '' when there is no such task.
+  function Get-PantheonTaskXml([string]$Schtasks, [string]$Name) {
+    $psi = New-Object System.Diagnostics.ProcessStartInfo
+    $psi.FileName = $Schtasks
+    $psi.Arguments = ConvertTo-ArgLine @('/Query', '/TN', $Name, '/XML')
+    $psi.UseShellExecute = $false
+    $psi.CreateNoWindow = $true
+    $psi.RedirectStandardInput = $true
+    $psi.RedirectStandardOutput = $true
+    $psi.RedirectStandardError = $true
+    $p = [System.Diagnostics.Process]::Start($psi)
+    $p.StandardInput.Close()
+    $buf = New-Object System.IO.MemoryStream
+    $copy = $p.StandardOutput.BaseStream.CopyToAsync($buf)
+    $err = $p.StandardError.ReadToEndAsync()
+    $p.WaitForExit()
+    $copy.Wait()
+    $null = $err.Result
+    if ($p.ExitCode -ne 0) { return '' }
+    return ConvertFrom-TaskXmlBytes $buf.ToArray()
+  }
+
   # Before the runtime folder is swapped: Pantheon's background host (the
   # logon task) runs node.exe from it, and Windows will not rename a folder a
   # running program came from. A teammate's request the worker is running
@@ -268,6 +314,68 @@ function Install-Pantheon {
     return @{ code = $p.ExitCode; out = $out.Result; err = $err.Result }
   }
 
+  # Hand over to pantheon with the person's own arguments (join <invite>,
+  # start): after an install, and also when the update was put off because a
+  # teammate's run was in progress -- a join or a start needs a working
+  # pantheon, not the update. Sets $State.code to pantheon's exit code.
+  function Invoke-PantheonHandoff([string]$nodeExe, [string]$entry, [string[]]$ca, [string[]]$Arguments) {
+    if ($null -eq $ca) { $ca = @() }
+    # node.exe directly, not the .cmd: PowerShell hands arguments to a .cmd
+    # through cmd.exe, which would cut an invite at a & or expand a %. And
+    # Start-Process -NoNewWindow, so pantheon gets this console itself: a real
+    # terminal for the sign-in questions, not a pipe PowerShell reads from.
+    $State.step = 'starting pantheon'
+    # With the same --use-system-ca as npm and pantheon.cmd: this first run is the
+    # one that signs in, and behind a TLS-inspecting proxy the relay's
+    # certificate chains only to the company root in the Windows store.
+    $line = ConvertTo-ArgLine (@($ca) + @($entry) + $Arguments)
+    $noConsole = $false
+    try { $noConsole = [Console]::IsInputRedirected } catch { $noConsole = $false }
+    if (-not $noConsole) {
+      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru
+      $null = $p.Handle   # without this, ExitCode is empty once the process is gone
+      $p.WaitForExit()
+      $State.code = $p.ExitCode
+      return
+    }
+
+    # No console to type into (CI, input piped in). pantheon still runs: it
+    # never asks a question without a terminal (every prompt checks
+    # process.stdin.isTTY) and works on flags alone, so a join to a team's own
+    # relay, or from a machine already signed in, needs no answers. Its input
+    # is an empty file, so nothing can wait on it. What it cannot do here is
+    # sign in: on the hosted relay join and start stop at once, before anything
+    # is changed, with "sign in first" (or the relay's NOT_SIGNED_IN). When that
+    # is how it ended and config.json still has no account, the last line says
+    # the one thing to do; any other failure keeps pantheon's own words last.
+    $quiet = Join-Path ([IO.Path]::GetTempPath()) ('pantheon-' + [Guid]::NewGuid().ToString('N').Substring(0, 8))
+    New-Item -ItemType Directory -Force -Path $quiet | Out-Null
+    try {
+      $in = Join-Path $quiet 'in'; $errFile = Join-Path $quiet 'err'
+      [IO.File]::WriteAllText($in, '')
+      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru -RedirectStandardInput $in -RedirectStandardError $errFile
+      $null = $p.Handle
+      $p.WaitForExit()
+      $State.code = $p.ExitCode
+      $said = if (Test-Path -LiteralPath $errFile) { [IO.File]::ReadAllText($errFile) } else { '' }
+      if ($said) { [Console]::Error.Write($said) }
+      if ($State.code -ne 0 -and $said -match 'sign in first|NOT_SIGNED_IN' -and $Arguments[0] -in @('join', 'start')) {
+        $pantheonHome = if ($env:PANTHEON_HOME) { $env:PANTHEON_HOME } else { Join-Path ([Environment]::GetFolderPath('UserProfile')) '.pantheon' }
+        $signedIn = $false
+        try { $signedIn = [bool]((Get-Content -LiteralPath (Join-Path $pantheonHome 'config.json') -Raw | ConvertFrom-Json).account) } catch { $signedIn = $false }
+        if (-not $signedIn) {
+          # Quoted only where PowerShell needs it, so it reads as typed.
+          $show = ($Arguments | ForEach-Object { if ($_ -match '^[A-Za-z0-9_./:=@+,-]+$') { $_ } else { "'" + ($_ -replace "'", "''") + "'" } }) -join ' '
+          $what = if ($Arguments[0] -eq 'join') { 'joining' } else { 'creating your team' }
+          Say ''
+          Say "Pantheon is installed. To finish $what, open PowerShell and run: pantheon $show"
+        }
+      }
+    } finally {
+      Remove-Item -LiteralPath $quiet -Recurse -Force -ErrorAction SilentlyContinue
+    }
+  }
+
   try {
     if ($PantheonVersion -like '*__*') {
       Fail "this copy of install.ps1 has no version filled in. Use the one the relay serves: irm $Site/install.ps1 | iex"
@@ -457,7 +565,7 @@ function Install-Pantheon {
           $stopped = Stop-PantheonHost -NodeDir $nodeDir -HostDir $hostDir -Tasks $tasks `
             -Holders { param($d) Get-FolderHolders $d } -EndTask { param($t) $null = Invoke-Quiet $schtasks @('/End', '/TN', $t) } `
             -RunRecord (Join-Path $pantheonHomeDir 'worker-run.json') `
-            -TaskIsMine { param($t) Test-PantheonTaskIsMine (Invoke-Quiet $schtasks @('/Query', '/TN', $t, '/XML')).out $meUser $meSid }
+            -TaskIsMine { param($t) Test-PantheonTaskIsMine (Get-PantheonTaskXml $schtasks $t) $meUser $meSid }
           # A teammate's run still going after the wait: nothing was stopped,
           # and the runtime is left exactly as it is (see the catch below).
           if ($stopped.busy) { throw 'PANTHEON_BUSY:' }
@@ -617,60 +725,7 @@ function Install-Pantheon {
       return
     }
     Say ''
-    # node.exe directly, not the .cmd: PowerShell hands arguments to a .cmd
-    # through cmd.exe, which would cut an invite at a & or expand a %. And
-    # Start-Process -NoNewWindow, so pantheon gets this console itself: a real
-    # terminal for the sign-in questions, not a pipe PowerShell reads from.
-    $State.step = 'starting pantheon'
-    # With the same --use-system-ca as npm and pantheon.cmd: this first run is the
-    # one that signs in, and behind a TLS-inspecting proxy the relay's
-    # certificate chains only to the company root in the Windows store.
-    $line = ConvertTo-ArgLine (@($ca) + @($entry) + $Arguments)
-    $noConsole = $false
-    try { $noConsole = [Console]::IsInputRedirected } catch { $noConsole = $false }
-    if (-not $noConsole) {
-      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru
-      $null = $p.Handle   # without this, ExitCode is empty once the process is gone
-      $p.WaitForExit()
-      $State.code = $p.ExitCode
-      return
-    }
-
-    # No console to type into (CI, input piped in). pantheon still runs: it
-    # never asks a question without a terminal (every prompt checks
-    # process.stdin.isTTY) and works on flags alone, so a join to a team's own
-    # relay, or from a machine already signed in, needs no answers. Its input
-    # is an empty file, so nothing can wait on it. What it cannot do here is
-    # sign in: on the hosted relay join and start stop at once, before anything
-    # is changed, with "sign in first" (or the relay's NOT_SIGNED_IN). When that
-    # is how it ended and config.json still has no account, the last line says
-    # the one thing to do; any other failure keeps pantheon's own words last.
-    $quiet = Join-Path ([IO.Path]::GetTempPath()) ('pantheon-' + [Guid]::NewGuid().ToString('N').Substring(0, 8))
-    New-Item -ItemType Directory -Force -Path $quiet | Out-Null
-    try {
-      $in = Join-Path $quiet 'in'; $errFile = Join-Path $quiet 'err'
-      [IO.File]::WriteAllText($in, '')
-      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru -RedirectStandardInput $in -RedirectStandardError $errFile
-      $null = $p.Handle
-      $p.WaitForExit()
-      $State.code = $p.ExitCode
-      $said = if (Test-Path -LiteralPath $errFile) { [IO.File]::ReadAllText($errFile) } else { '' }
-      if ($said) { [Console]::Error.Write($said) }
-      if ($State.code -ne 0 -and $said -match 'sign in first|NOT_SIGNED_IN' -and $Arguments[0] -in @('join', 'start')) {
-        $pantheonHome = if ($env:PANTHEON_HOME) { $env:PANTHEON_HOME } else { Join-Path ([Environment]::GetFolderPath('UserProfile')) '.pantheon' }
-        $signedIn = $false
-        try { $signedIn = [bool]((Get-Content -LiteralPath (Join-Path $pantheonHome 'config.json') -Raw | ConvertFrom-Json).account) } catch { $signedIn = $false }
-        if (-not $signedIn) {
-          # Quoted only where PowerShell needs it, so it reads as typed.
-          $show = ($Arguments | ForEach-Object { if ($_ -match '^[A-Za-z0-9_./:=@+,-]+$') { $_ } else { "'" + ($_ -replace "'", "''") + "'" } }) -join ' '
-          $what = if ($Arguments[0] -eq 'join') { 'joining' } else { 'creating your team' }
-          Say ''
-          Say "Pantheon is installed. To finish $what, open PowerShell and run: pantheon $show"
-        }
-      }
-    } finally {
-      Remove-Item -LiteralPath $quiet -Recurse -Force -ErrorAction SilentlyContinue
-    }
+    Invoke-PantheonHandoff $nodeExe $entry $ca $Arguments
   } catch {
     $m = $_.Exception.Message
     if ($m -like 'PANTHEON_BUSY:*') {
@@ -678,6 +733,22 @@ function Install-Pantheon {
       # is none that runs is the exit code non-zero.
       $have = ''
       if ($installedCli) { try { $have = & $installedCli } catch { $have = '' } }
+      if ($have -and $Arguments.Count -gt 0) {
+        # The person's join or start still happens, on the Pantheon that is
+        # here: it does not touch the runtime folder the run is using.
+        Write-Host "Pantheon was not updated to $PantheonVersion because a teammate's run was in progress; Pantheon $have is still installed and working, so your command runs on it now. Run the same line again in a few minutes to update." -ForegroundColor Yellow
+        if ($State.lock) { $State.lock.Dispose(); $State.lock = $null }
+        $caNow = @()
+        try { if ((Invoke-Quiet $nodeExe @('--use-system-ca', '-e', '0')).code -eq 0) { $caNow = @('--use-system-ca') } } catch { $caNow = @() }
+        try {
+          Say ''
+          Invoke-PantheonHandoff $nodeExe $entry $caNow $Arguments
+        } catch {
+          Write-Host "pantheon install failed: it stopped while starting pantheon ($($_.Exception.Message)). Open a new terminal and run your pantheon command again." -ForegroundColor Red
+          $State.code = 1
+        }
+        return
+      }
       $kept = if ($have) { " Pantheon $have is still installed and working." } else { '' }
       Write-Host "Pantheon was not updated because a teammate's run was in progress; run the same line again in a few minutes.$kept" -ForegroundColor Yellow
       $State.code = if ($have) { 0 } else { 1 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.33.0-rc.2",
+  "version": "0.33.0",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {