@join-pantheon/cli 0.33.0 → 0.33.1-rc.1

package/dist/claude-confine.js

@@ -4,7 +4,7 @@ import { lstatSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:
 import { writeInside } from "./safe-write.js";
 import { homedir, platform, tmpdir } from "node:os";
 import { isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
-import { expectedLauncher } from "./managed.js";
+import { expectedLauncher, windowsManagedRoots } from "./managed.js";
 import { agentSpawn } from "./which.js";
 export const NO_CLAUDE_FEATURES = { version: null, permissionPrompts: false, settings: false, settingSources: false, disallowedTools: false };
 export function parseClaudeHelp(help, version = null) {
@@ -169,12 +169,11 @@ function aroundWorktree(top, keeps, named) {
     return out;
 }
 function managedTargets(home, os) {
-    const launcherAt = expectedLauncher(home, os);
-    if (!launcherAt)
-        return [];
     const P = os === "win32" ? win32 : posix;
-    const bin = P.dirname(launcherAt);
-    return [{ abs: bin, dir: true }, { abs: P.join(P.dirname(bin), "runtime"), dir: true }];
+    const roots = os === "win32"
+        ? Object.values(windowsManagedRoots(home)).filter((r) => !!r)
+        : [expectedLauncher(home, os)].filter((l) => !!l).map((l) => P.dirname(P.dirname(l)));
+    return roots.flatMap((root) => [{ abs: P.join(root, "bin"), dir: true }, { abs: P.join(root, "runtime"), dir: true }]);
 }
 export function claudeRunSettings(i) {
     const home = resolve(i.home ?? homedir());

package/dist/cli.js

@@ -914,8 +914,9 @@ ${B("control")}
                             (auto-detects claude / codex / cursor / copilot / kiro on this machine)
   pantheon spend              woken runs on this machine, and what pantheon cannot see
   pantheon leave              remove what pantheon put on this machine
-  pantheon uninstall          leave, then remove Pantheon itself: its own Node, the pantheon command, the PATH lines,
-                            and all it keeps in ~/.pantheon (files of yours there stay)
+  pantheon uninstall          remove Pantheon itself: its services, hooks, its own Node, the pantheon command, the PATH
+                            lines and what it keeps in ~/.pantheon — but not your identity, so installing again puts
+                            you back in your teams (--forget-identity deletes that too; files of yours there stay)
   pantheon panic              emergency stop: ends the run in flight and the worker, and switches off wake rights in every team you are in
   pantheon doctor [--share]   check this machine end to end; --share prints it without names or paths, to paste to us
   pantheon network [--proxy <url> | --direct | --clear]   how this machine reaches the relay; save a proxy for every Pantheon process here
@@ -999,7 +1000,7 @@ const COMMAND_FLAGS = {
     history: "--goal <id>  --from <member>  --last <n>  --since <seq>  --short  --presence  --json",
     network: "--proxy <url> [--no-proxy <hosts>]  |  --direct  |  --clear",
     leave: "[<team>]  --yes  --keep-identity  --stop-relay  --project <dir>",
-    uninstall: "--yes  --keep-identity  --stop-relay  --project <dir>",
+    uninstall: "--yes  --forget-identity  --stop-relay  --project <dir>",
     stop: "[relay|worker|notifier|menubar|all]  --port <n>",
     logs: "[relay|worker|notifier|menubar]  --follow  --n <lines>",
     worker: "--agent <claude-code|codex|cursor|copilot|kiro|auto>  --persona <name>  --project <dir>  --allow-bash  --max-runs <n>  --max-runs-day <n>  --grace <s>  --once",
@@ -1057,7 +1058,8 @@ function slipDistance(a, b) {
 const EXTRA_FLAGS = "--action-id --agent-cmd --approve-all --ask-before-sending --child --code --data --device --display --force --help --host --idle --keywords --local " +
     "--no-browser --no-continue --no-guide --no-notify --only-action --path --peek --poll --portable --publish --queued --quiet --remind --scratch --serve --session --surface --token --unattended " +
     "--until --user --version --all --json " +
-    "--name --title --wake --commands --unsandboxed --alerts --decides --playbook --base --responsibilities --human-required --agent-can-decide --capabilities";
+    "--name --title --wake --commands --unsandboxed --alerts --decides --playbook --base --responsibilities --human-required --agent-can-decide --capabilities" +
+    " --keep-tray-quit --direct";
 const KNOWN_FLAGS = new Set([...`${Object.values(COMMAND_FLAGS).join(" ")} ${EXTRA_FLAGS}`.matchAll(/--([a-z][a-z0-9-]*)/g)].map((m) => m[1]));
 function refuseUnknownFlags() {
     if (["mcp", "hook", "tray-status", "_menubar", "handle-uri"].includes(cmd))
@@ -1518,7 +1520,18 @@ async function main() {
             return;
         }
         case "rewire": {
-            const rows = installForUser().map((t) => ({ tool: t.tool, status: t.status }));
+            const rows = installForUser(undefined, undefined, { direct: argv.includes("--direct") }).map((t) => ({ tool: t.tool, status: t.status }));
+            try {
+                const { refreshUserHooks } = await import("./notify.js");
+                const h = refreshUserHooks();
+                if (h?.refreshed.length)
+                    rows.push({ tool: "hooks", status: `pointed at this install (${h.refreshed.join(", ")})${h.refreshed.includes("codex") ? " — Codex runs a changed hook only once approved: run /hooks inside codex once" : ""}` });
+                else if (h?.project.length)
+                    rows.push({ tool: "hooks", status: `skipped (in this project's files, ${h.project.join(", ")}) — pantheon hook install there points them here` });
+            }
+            catch (e) {
+                rows.push({ tool: "hooks", status: `failed: ${e.message.split("\n")[0]}` });
+            }
             try {
                 const { refreshServiceDefinition, serviceInstalled: installed, restartService: restart } = await import("./service.js");
                 for (const kind of ["worker", "notifier", "menubar"]) {
@@ -2051,8 +2064,11 @@ async function main() {
                     const quit = existsSync(hostFiles().disabled("tray"));
                     console.log(`  tray      ${tray?.phase === "running" ? `${C("running")}   pid ${tray.pid}` : D(quit ? "quit — back at your next logon, or now: pantheon tray" : tray?.gaveUp === "clm" ? "not shown — PowerShell is in Constrained Language Mode here (pantheon board instead)" : "not running")}`);
                 }
-                else
-                    console.log(`  host      ${D("not running")}   ${D(serviceInstalled("worker") || serviceInstalled("notifier") ? "pantheon service start worker (or log out and back in)" : "pantheon service install worker — the worker, alerts and the tray in the background")}`);
+                else {
+                    const { readLaunchError } = await import("./win-host.js");
+                    const why = readLaunchError() ? (await import("./service.js")).hostStartProblem() : null;
+                    console.log(`  host      ${D("not running")}   ${D(why ? `cannot start: ${why}` : serviceInstalled("worker") || serviceInstalled("notifier") ? "pantheon service start worker (or log out and back in)" : "pantheon service install worker — the worker, alerts and the tray in the background")}`);
+                }
             }
             else if (menubar.running) {
                 console.log(`  menu bar  ${C("running")}   ${menubar.managedBy === "launchd" ? `service ${menubar.label}` : "started by hand"}   pid ${menubar.pid}`);
@@ -2485,7 +2501,11 @@ async function main() {
             const { leavePlan } = await import("./machine.js");
             const plan = leavePlan(all);
             const project = resolve(flag("project", "."));
-            const keepIdentity = argv.includes("--keep-identity");
+            const forgetIdentity = argv.includes("--forget-identity");
+            if (forgetIdentity && argv.includes("--keep-identity"))
+                die("--keep-identity and --forget-identity say opposite things — pick one");
+            const keepIdentity = argv.includes("--keep-identity") || (uninstalling && !forgetIdentity);
+            const keptByDefault = uninstalling && keepIdentity && !argv.includes("--keep-identity");
             const standing = new Map();
             if (all && !keepIdentity) {
                 const ms = Object.values(all.spaces ?? {});
@@ -2502,14 +2522,15 @@ async function main() {
                 die(`you founded ${orphaned.map((t) => `"${t}"`).join(", ")}, and others are in ${orphaned.length === 1 ? "it" : "them"}. Leaving removes this machine's key: you could not rejoin as yourself, and only a founder can remove a member or delete a team — nobody there could, ever again.\n` +
                     `  To step out but keep the way back:  ${orphaned.map((t) => `pantheon leave ${t}`).join("  ·  ")}   (keeps your key)\n  Leave anyway:  pantheon ${self} --yes`);
             }
-            const { managedInstall, removeManagedInstall, NPM_UNINSTALL } = await import("./uninstall.js");
-            const install = uninstalling ? managedInstall(homedir()) : null;
+            const { managedInstalls, removeManagedInstall, NPM_UNINSTALL } = await import("./uninstall.js");
+            const installs = uninstalling ? managedInstalls(homedir()) : [];
+            const install = installs[0] ?? null;
             const runningManaged = managedLayout();
             if (uninstalling && !argv.includes("--yes")) {
                 const teams = plan.teams.length && !keepIdentity ? `leaves ${plan.teams.map((t) => `"${t.name}"`).join(", ")} (this machine's key goes), ` : "";
                 const what = `this removes Pantheon from this machine: it ${teams}uninstalls its services, hooks and agent entries` +
                     (install?.present ? `, and deletes Pantheon's own Node in ${install.runtime}, the pantheon command and the PATH lines the installer added` : "") +
-                    `. Everything Pantheon keeps in ${CONFIG_DIR} goes${keepIdentity ? " (but your identity, --keep-identity)" : ""}; files of your own there stay.`;
+                    `. Everything Pantheon keeps in ${CONFIG_DIR} goes${keptByDefault ? `, except your identity (${CONFIG_PATH}: this machine's key${plan.teams.length ? ` and your place in ${plan.teams.map((t) => `"${t.name}"`).join(", ")}` : ""}), so installing again puts you straight back — to delete it too: pantheon uninstall --forget-identity` : keepIdentity ? " (but your identity, --keep-identity)" : ""}; files of your own there stay.`;
                 if (!process.stdin.isTTY)
                     die(`${what}\n  If you mean it:  pantheon uninstall --yes`);
                 const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -2568,7 +2589,9 @@ async function main() {
                 left.push(refusedHomeLine(CONFIG_DIR, homeRefusal));
             }
             else if (hasConfig && keepIdentity) {
-                left.push(`your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} (--keep-identity)`);
+                left.push(keptByDefault
+                    ? `your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} — kept, so installing Pantheon again puts you back in ${plan.teams.length === 1 ? "it" : "them"} as yourself; to delete it: pantheon uninstall --forget-identity`
+                    : `your identity and ${plan.teams.length} team membership${plan.teams.length === 1 ? "" : "s"}, ${CONFIG_PATH} (--keep-identity)`);
             }
             else if (!keepIdentity && (hasConfig || uninstalling)) {
                 if (hasConfig) {
@@ -2633,10 +2656,14 @@ async function main() {
                 }
             }
             if (uninstalling) {
-                if (install?.present) {
-                    const r = removeManagedInstall({ home: homedir(), install, running: runningManaged });
+                for (const one of installs) {
+                    if (!one.present)
+                        continue;
+                    const r = removeManagedInstall({ home: homedir(), install: one, running: runningManaged });
                     removed.push(...r.removed);
                     left.push(...r.left);
+                    if (one.os === "win32" && runningManaged && runningManaged.root.toLowerCase() === one.root.toLowerCase())
+                        spare.push(one.binDir, one.runtime);
                 }
                 if (!runningManaged)
                     left.push(`this pantheon itself (${process.argv[1] ?? "the one you ran"}), which npm installed — remove it with: ${NPM_UNINSTALL}`);
@@ -2661,12 +2688,17 @@ async function main() {
                 const name = me?.member ?? plan.member ?? "<your name>";
                 const listed = plan.teams.filter((t) => { const s = standing.get(t.name); return !s || s.others === null || (s.others.length && !s.founder); }).map((t) => `"${t.name}"`);
                 const founded = plan.teams.filter((t) => { const s = standing.get(t.name); return s?.founder && s.others?.length; }).map((t) => `"${t.name}"`);
-                if (listed.length) {
-                    console.error(`\n  ${D(`Your teammates may still list you in ${listed.join(", ")}. If you are not coming back, ask one in each to run:`)}`);
-                    console.error(`  ${D(`pantheon admit ${name} --revoke`)}`);
+                if (keepIdentity && plan.teams.length) {
+                    console.error(`\n  ${D(`You are still in ${plan.teams.map((t) => `"${t.name}"`).join(", ")} — this machine just has no Pantheon on it now. Install it again (the same one line) and you are back as ${name}, with nothing to rejoin.`)}`);
+                }
+                else {
+                    if (listed.length) {
+                        console.error(`\n  ${D(`Your teammates may still list you in ${listed.join(", ")}. If you are not coming back, ask one in each to run:`)}`);
+                        console.error(`  ${D(`pantheon admit ${name} --revoke`)}`);
+                    }
+                    if (founded.length)
+                        console.error(`\n  ${D(`You founded ${founded.join(", ")}. With this machine's key gone you cannot rejoin as yourself, and nobody there can remove a member or delete the team — only its founder could.`)}`);
                 }
-                if (founded.length)
-                    console.error(`\n  ${D(`You founded ${founded.join(", ")}. With this machine's key gone you cannot rejoin as yourself, and nobody there can remove a member or delete the team — only its founder could.`)}`);
             }
             if (me?.account && !keepIdentity) {
                 const { accountStillExists } = await import("./machine.js");
@@ -4404,7 +4436,7 @@ async function main() {
             if (sub === "start" && process.platform === "win32" && (kind === "worker" || kind === "notifier")) {
                 const { enableService } = await import("./service.js");
                 try {
-                    for (const l of enableService(kind))
+                    for (const l of enableService(kind, undefined, { keepTrayQuit: argv.includes("--keep-tray-quit") }))
                         console.error(l);
                 }
                 catch (e) {

package/dist/doctor.js

@@ -180,7 +180,23 @@ export async function doctor(projectDir) {
     }
     else if (host.platform === "win32") {
         add("pass", "machine", `Windows${host.desktop ? " — the background host, desktop alerts and the tray icon can run here" : " — a remote shell (SSH): the background host's alerts and tray need a session at the desktop"}`, undefined, `win32${host.desktop ? ", desktop" : ""}`);
-        for (const r of windowsDoctorRows(windowsFacts(realSys().exec)))
+        const { thisAppPackage, onlyInsidePackage, packageApp, INSTALL_OUTSIDE_LINE } = await import("./win-package.js");
+        const family = thisAppPackage();
+        if (family) {
+            const own = [process.execPath, process.argv[1] ?? ""].find((p) => p && onlyInsidePackage(p, family));
+            if (own)
+                add("warn", "app package", `this pantheon runs from ${own}, which exists only inside ${packageApp(family)} — Windows keeps what an app like it installs into AppData private to it, so Pantheon's logon task (outside the app) cannot start the worker, alerts or tray`, `${INSTALL_OUTSIDE_LINE} — it puts Pantheon in your profile folder, which every program sees`, "runs from an app-private folder");
+            else
+                add("pass", "app package", `this terminal runs inside ${packageApp(family)}; Pantheon runs from a folder every program sees, so its background host can start outside the app`, undefined, "inside an app package");
+        }
+        const wf = windowsFacts(realSys().exec);
+        if (!wf.hostUp) {
+            const { readLaunchError } = await import("./win-host.js");
+            const { hostStartProblem } = await import("./service.js");
+            if (readLaunchError())
+                wf.launchProblem = hostStartProblem();
+        }
+        for (const r of windowsDoctorRows(wf))
             add(r.level, r.name, r.detail, r.fix, r.share);
     }
     else {

package/dist/home-safety.js

@@ -37,6 +37,7 @@ export const PANTHEON_HOME_ENTRIES = [
     { name: "no-hooks", what: "the empty hooks folder woken runs' git uses", dir: true },
     { name: "lfs-hooks", what: "the LFS-only hooks folder woken runs' git uses", dir: true },
     { name: "runtime", what: "Pantheon's own Node", dir: true, kept: "managed" },
+    { name: "install.log", what: "the installer's log", kept: "managed" },
     { name: "data", what: "the relay's ledger", dir: true, kept: "it is your team's history and may be its only copy; delete it yourself once no relay runs from it" },
     { name: /^(\.DS_Store|Thumbs\.db|desktop\.ini)$/i, sample: ".DS_Store", what: "the file browser's folder cache" },
 ];

package/dist/install.js

@@ -293,10 +293,10 @@ export function claudeUserScope(entry, present = true, claudeBin = which("claude
         const remove = agentSpawn(claudeBin, ["mcp", "remove", "pantheon", "-s", "user"]);
         const add = agentSpawn(claudeBin, ["mcp", "add", "pantheon", "-s", "user", "--", entry.command, ...entry.args]);
         try {
-            execFileSync(remove.command, remove.args, { stdio: "ignore", ...remove.options });
+            execFileSync(remove.command, remove.args, { stdio: "ignore", timeout: 60_000, ...remove.options });
         }
         catch { }
-        execFileSync(add.command, add.args, { stdio: ["ignore", "ignore", "pipe"], ...add.options });
+        execFileSync(add.command, add.args, { stdio: ["ignore", "ignore", "pipe"], timeout: 60_000, ...add.options });
         return { tool, where: "user scope", status: "ready in every project and every Conductor window" };
     }
     catch (e) {

package/dist/machine.js

@@ -665,7 +665,7 @@ export function removePantheonWorktrees(repos, roots, git = (repo, args) => exec
     }
     return { removed, left };
 }
-const MANAGED_LAUNCHER = "pantheon";
+const MANAGED_LAUNCHERS = ["pantheon", "pantheon.cmd"];
 export function removeHomeLeftovers(home, keep, opts = {}) {
     const removed = [], left = [];
     const refusal = opts.refusal !== undefined ? opts.refusal : pantheonHomeRefusal(home);
@@ -683,12 +683,12 @@ export function removeHomeLeftovers(home, keep, opts = {}) {
         if (!existsSync(f))
             continue;
         if (keep && name !== "worker.pid" && name !== "bin") {
-            left.push(`${what}, ${f} (--keep-identity)`);
+            left.push(`${what}, ${f} (kept with your identity)`);
             continue;
         }
-        if (name === "bin" && existsSync(join(f, MANAGED_LAUNCHER))) {
+        if (name === "bin" && MANAGED_LAUNCHERS.some((l) => existsSync(join(f, l)))) {
             try {
-                const others = readdirSync(f).filter((e) => e !== MANAGED_LAUNCHER);
+                const others = readdirSync(f).filter((e) => !MANAGED_LAUNCHERS.includes(e));
                 for (const e of others)
                     rmSync(join(f, e), { recursive: true, force: true });
                 if (others.length)
@@ -730,7 +730,8 @@ export function sweepPantheonHome(home, o = {}) {
     const refusal = o.refusal !== undefined ? o.refusal : o.fs ? null : pantheonHomeRefusal(home);
     if (refusal)
         return { removed, left: [refusedHomeLine(home, refusal)], gone: false };
-    const spare = new Set((o.spare ?? []).map((p) => resolve(p)));
+    const key = (p) => (os === "win32" ? resolve(p).toLowerCase() : resolve(p));
+    const spare = new Set((o.spare ?? []).map(key));
     const attempt = (p, rm) => {
         let why = "";
         for (let i = 0; i < tries; i++) {
@@ -765,7 +766,7 @@ export function sweepPantheonHome(home, o = {}) {
         }
         if (name === HOME_MARKER)
             continue;
-        if (spare.has(resolve(p)))
+        if (spare.has(key(p)))
             continue;
         if (e.kept === "managed")
             continue;
@@ -786,7 +787,7 @@ export function sweepPantheonHome(home, o = {}) {
     if (gone.length)
         removed.push(`Pantheon's own files in ${home}: ${gone.join(", ")}`);
     if (keptForIdentity.length)
-        left.push(`what goes with your identity in ${home}: ${keptForIdentity.join(", ")} (--keep-identity)`);
+        left.push(`what goes with your identity in ${home}: ${keptForIdentity.join(", ")} (kept with your identity)`);
     let rest = [];
     try {
         rest = fs.list(home);

package/dist/managed.js

@@ -15,7 +15,7 @@ export function managedLayout(execPath = process.execPath, os = platform()) {
             return null;
         if (win32.basename(nodeDir).toLowerCase() !== "node" || win32.basename(runtime).toLowerCase() !== "runtime")
             return null;
-        if (win32.basename(root).toLowerCase() !== "pantheon")
+        if (![".pantheon", "pantheon"].includes(win32.basename(root).toLowerCase()))
             return null;
         const binDir = win32.join(root, "bin");
         const pkgDir = win32.join(nodeDir, "node_modules", ...PKG);
@@ -98,10 +98,20 @@ export function runtimeVerdict(f) {
         share: "managed install present, another pantheon ran",
     };
 }
-export function expectedLauncher(home, os = platform(), env = process.env) {
+export function windowsManagedRoots(home, env = process.env) {
+    const local = env.LOCALAPPDATA || (home ? win32.join(home, "AppData", "Local") : "");
+    return { current: home ? win32.join(home, ".pantheon") : null, legacy: local ? win32.join(local, "Pantheon") : null };
+}
+export function expectedLauncher(home, os = platform(), env = process.env, exists = existsSync) {
     if (os === "win32") {
-        const local = env.LOCALAPPDATA || (home ? win32.join(home, "AppData", "Local") : "");
-        return local ? win32.join(local, "Pantheon", "bin", "pantheon.cmd") : null;
+        const { current, legacy } = windowsManagedRoots(home, env);
+        const at = (root) => (root ? win32.join(root, "bin", "pantheon.cmd") : null);
+        const now = at(current), old = at(legacy);
+        if (now && exists(now))
+            return now;
+        if (old && exists(old))
+            return old;
+        return old ?? now;
     }
     return home ? posix.join(home, ".pantheon", "bin", "pantheon") : null;
 }

package/dist/notify.js

@@ -8,6 +8,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { whichPantheon } from "./service.js";
 import { managedLayout } from "./managed.js";
+import { inWokenRun } from "./worker-policy.js";
 import { detectForHooks, agentById } from "./agents.js";
 import { codexHookState, cursorHookState, copilotHookState, kiroHookState, installCodexHooks, installCursorHooks, installCopilotHooks, installKiroHooks, removeCodexHooks, removeCursorHooks, removeCopilotHooks, removeKiroHooks, } from "./hooks-install.js";
 export const HOOK_MARKER = "pantheon hook";
@@ -171,6 +172,37 @@ export function repairHook(home) {
         return null;
     }
 }
+export function refreshUserHooks(home) {
+    if (inWokenRun())
+        return null;
+    const intent = readIntent(home);
+    const bin = hookLauncher();
+    if (!intent || !bin)
+        return null;
+    const targets = intent.agents?.length ? intent.agents : ["claude-code"];
+    if (intent.scope !== "user") {
+        const files = agentHookStates(intent.projectDir ?? process.cwd(), "project").map((s) => s.file).filter((f) => !!f);
+        return { refreshed: [], project: files };
+    }
+    const jsonBin = JSON.stringify(bin).slice(1, -1);
+    const states = new Map(agentHookStates(intent.projectDir ?? process.cwd(), "user").map((st) => [st.agent, st]));
+    const holdsBin = (f) => { try {
+        const t = readFileSync(f, "utf8");
+        return t.includes(bin) || t.includes(jsonBin);
+    }
+    catch {
+        return true;
+    } };
+    const stale = targets.filter((id) => {
+        const st = states.get(id);
+        return !!st?.installed && !!st.file && !holdsBin(st.file);
+    });
+    if (!stale.length)
+        return { refreshed: [], project: [] };
+    installHooks("user", intent.projectDir ?? process.cwd(), stale);
+    const after = new Map(agentHookStates(intent.projectDir ?? process.cwd(), "user").map((st) => [st.agent, st]));
+    return { refreshed: stale.filter((id) => { const st = after.get(id); return !!st?.file && holdsBin(st.file); }), project: [] };
+}
 function installClaudeHook(scope, projectDir = process.cwd()) {
     const file = settingsPath(scope, projectDir);
     const doc = read(file);

package/dist/relay.js

@@ -2701,6 +2701,9 @@ pantheon start</code></pre>
                     }
                     if (verdict === "key-mismatch") {
                         this.log(`[${sp.name}] ! REFUSED ${m.member}: key mismatch (${fingerprint(m.pubkey)})`);
+                        if (sp.allow.founder() === m.member) {
+                            return reject("KEY_MISMATCH", `"${m.member}" founded "${sp.name}" and is registered here with a different key. A founder's key cannot be replaced: if this is really you on another machine, restore your original ~/.pantheon/config.json (the key is in it). Without it, join under another name (--me <new-name>) or start a new team (pantheon start).`);
+                        }
                         return reject("KEY_MISMATCH", `"${m.member}" is already registered here with a different key. If you are someone else, join under your own name (--me <your-name>). If this is really you on another machine, an admitted member who has checked it is you runs  pantheon admit ${m.member} --forget  (it removes whoever holds the name now) and sends you a new invite.`);
                     }
                     if (verdict === "revoked") {

package/dist/roster-file.js

@@ -238,6 +238,18 @@ export class Allowlist {
             return { ok: false, why: `"${member}" was removed from this team${existing?.revoked_by ? ` by ${existing.revoked_by}` : ""}, so only an invite from the founder${this.founderName ? ` (${this.founderName})` : ""}, made since, can bring them back` };
         }
         if (existing && existing.publicKey !== publicKey) {
+            if (this.founderName && member === this.founderName) {
+                return {
+                    ok: false,
+                    why: `"${member}" founded this team and is registered with a different key — a founder's key cannot be replaced`,
+                    fix: [
+                        `If you ARE "${member}" on a new machine: restore your original ~/.pantheon/config.json if you still have it — the key is in it — then redeem this same invite again.`,
+                        `  Without it, nobody can let you back in under "${member}": a team's founder is never removed, so the old key cannot be retired.`,
+                        `  You can join under another name instead (--me <new-name>, this same invite), or start a new team: pantheon start --space <name>.`,
+                        `  If you are not "${member}", join under your own name:  --me <your-name>.`,
+                    ].join("\n"),
+                };
+            }
             return {
                 ok: false,
                 why: `"${member}" is registered here with a different key — the name is taken in this team`,

package/dist/service.js

@@ -6,9 +6,10 @@ import { basename, dirname, isAbsolute, join, posix, resolve } from "node:path";
 import { linuxGraphicalSession } from "./host-env.js";
 import { fileURLToPath } from "node:url";
 import { isVersionManagedPath, launcher } from "./install.js";
-import { childNodeFlags, managedLauncher, managedLayout } from "./managed.js";
+import { childNodeFlags, managedLauncher, managedLayout, windowsManagedRoots } from "./managed.js";
 import { CONFIG_DIR, ensurePantheonHome } from "./config.js";
-import { HOST_KINDS, LEGACY_TASK_NAME, clearTrayQuit, ensureHostShim, fromUtf16le, hostAlive, hostArgv, hostChildRunning, hostFiles, hostLaunch, isHostKind, launchFileText, legacyTaskIsUsers, readDefinition, readHostState, taskName, taskUserId, taskXml, utf16le, windowsPowerShell, writeDefinition, } from "./win-host.js";
+import { HOST_KINDS, LEGACY_TASK_NAME, clearTrayQuit, ensureHostShim, fromUtf16le, hostAlive, hostArgv, hostChildRunning, hostFiles, hostLaunch, isHostKind, launchFileText, legacyTaskIsUsers, readDefinition, readHostState, readLaunchError, taskName, taskUserId, taskXml, utf16le, windowsPowerShell, writeDefinition, } from "./win-host.js";
+import { INSTALL_OUTSIDE_LINE, onlyInsidePackage, packageApp, thisAppPackage } from "./win-package.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 const LABEL = (kind) => `dev.pantheon.${kind}`;
 export function borrowedHome() {
@@ -474,7 +475,14 @@ export function restartService(kind, exec = realExec, opts = {}) {
             }
             if (!st.loaded)
                 return [`  ${kind}: the ${taskName(exec)} task is not registered — pantheon service install ${kind}`];
-            exec("schtasks", ["/Run", "/TN", taskName(exec)]);
+            const name = taskName(exec);
+            runTask(exec, name);
+            const ms = opts.hostStartMs ?? 20_000;
+            if (!waitFor(hostUp, ms, opts.sleep ?? blockingSleep)) {
+                return [readLaunchError() || registeredLaunch() !== "shim"
+                        ? `  ${kind}: the ${name} task started, but the Pantheon host did not come up within ${Math.round(ms / 1000)} s — ${hostStartProblem()}`
+                        : `  ${kind}: started the ${name} task — the Pantheon host is not up yet after ${Math.round(ms / 1000)} s; pantheon ps in a minute shows it`];
+            }
             return [`  ${kind}: the Pantheon host was not running — started it, and the ${kind} with it, on the new code`];
         }
         if (plat === "darwin") {
@@ -614,9 +622,15 @@ export function hostRuntime(o) {
     }
     throw new Error(`this Pantheon runs from ${moving(o.cli) ? o.cli : o.execPath}, a folder a Node version manager replaces when you switch Node versions — a logon task naming it would start nothing after the next switch. Install Pantheon with its own Node (irm https://relay.joinpantheon.network/install.ps1 | iex) or with a Node from nodejs.org (npm install -g @join-pantheon/cli), then run this again`);
 }
-function installedManagedLayout(env) {
-    const local = env.LOCALAPPDATA;
-    return local ? managedLayout(`${local.replace(/[\\/]+$/, "")}\\Pantheon\\runtime\\node\\node.exe`, "win32") : null;
+export function installedManagedLayout(env, home = homedir(), exists = existsSync) {
+    const { current, legacy } = windowsManagedRoots(home, env);
+    const at = (root) => (root ? managedLayout(`${root.replace(/[\\/]+$/, "")}\\runtime\\node\\node.exe`, "win32") : null);
+    const now = at(current), old = at(legacy);
+    if (now && exists(now.node))
+        return now;
+    if (old && exists(old.node))
+        return old;
+    return now ?? old;
 }
 export function desiredTask(sys, log, rt) {
     const env = sys.env ?? process.env;
@@ -626,6 +640,11 @@ export function desiredTask(sys, log, rt) {
         nodesOnPath: [which("node") ?? ""], exists: existsSync,
         ...rt,
     }) : sys.hostRuntime;
+    const family = sys.appPackage !== undefined ? sys.appPackage : thisAppPackage();
+    if (family)
+        for (const f of [runtime.node, runtime.cli])
+            if (onlyInsidePackage(f, family, env, sys.exists))
+                throw new Error(packagedRuntimeProblem(f, family));
     const shim = ensureHostShim({ exec: (c, a) => sys.exec(c, a), env, ...(log ? { log } : {}) });
     const home = nonDefaultHome();
     const launch = hostLaunch({ shim, node: runtime.node, flags: runtime.flags, cli: runtime.cli, home, launch: hostFiles().launch, powershell: windowsPowerShell(env) });
@@ -693,6 +712,49 @@ function replaceLegacyTask(sys, name, unattended, log) {
     }
 }
 const hostUp = () => hostAlive(readHostState());
+export function packagedRuntimeProblem(program, family) {
+    return `${program} exists only inside ${packageApp(family)}: Windows keeps what an app like it installs into AppData private to that app, and Pantheon's logon task runs outside it, so the worker, alerts and tray could never start. To fix it once, ${INSTALL_OUTSIDE_LINE} — it puts Pantheon in your profile folder, which every program sees — then run this again`;
+}
+function runTask(exec, name) {
+    if (readLaunchError()) {
+        try {
+            exec("schtasks", ["/End", "/TN", name]);
+        }
+        catch { }
+    }
+    exec("schtasks", ["/Run", "/TN", name]);
+}
+function registeredLaunch() {
+    try {
+        const cmd = /<Command>([^<]*)<\/Command>/.exec(fromUtf16le(readFileSync(hostFiles().taskXml)))?.[1] ?? "";
+        return /pantheon-host-[0-9a-f]+\.exe$/i.test(cmd) ? "shim" : cmd ? "powershell" : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function confirmHostStart(sys, name) {
+    const ms = sys.hostStartMs ?? 20_000;
+    if (waitFor(hostUp, ms, sys.sleep ?? blockingSleep))
+        return { up: true, line: `  the Pantheon host is up (pid ${readHostState()?.pid ?? "?"})` };
+    if (!readLaunchError() && registeredLaunch() === "shim")
+        return { up: false, slow: true, line: `  started the ${name} task — the Pantheon host is not up yet after ${Math.round(ms / 1000)} s (a first start can be slow while Windows scans it); pantheon ps in a minute shows it` };
+    const why = hostStartProblem(sys);
+    return { up: false, line: `  the ${name} task started, but the Pantheon host did not come up within ${Math.round(ms / 1000)} s — ${why}`, reason: why };
+}
+export function hostStartProblem(sys = {}) {
+    const e = readLaunchError();
+    const env = sys.env ?? process.env;
+    if (e?.what === "missing") {
+        const family = sys.appPackage !== undefined ? sys.appPackage : thisAppPackage();
+        if (family && onlyInsidePackage(e.program, family, env, sys.exists))
+            return packagedRuntimeProblem(e.program, family);
+        return `it cannot find ${e.program} (since ${e.at}). Run the installer again: irm https://relay.joinpantheon.network/install.ps1 | iex`;
+    }
+    if (e?.what === "start-failed")
+        return `Windows would not start ${e.program} (since ${e.at}) — a security product may be blocking it; ${hostFiles().log} may say more`;
+    return `nothing it wrote says why yet. ${hostFiles().log} and pantheon doctor may say more; logging out and back in starts the task again`;
+}
 const windowsBorrowed = (sys) => (sys.borrowed ?? (() => borrowedScheduler(sys.env ?? process.env)))();
 function installWindows(kind, cwd, args, sys) {
     if (!isHostKind(kind)) {
@@ -718,8 +780,15 @@ function installWindows(kind, cwd, args, sys) {
         if (hostUp())
             out.push(`  the host is running — it starts the ${kind} within seconds, and restarts it if it stops`);
         else {
-            sys.exec("schtasks", ["/Run", "/TN", name]);
-            out.push(`  started — the ${kind} now starts at logon and restarts if it stops`);
+            runTask(sys.exec, name);
+            const c = confirmHostStart(sys, name);
+            out.push(c.line);
+            if (c.up || c.slow)
+                out.push(`  started — the ${kind} now starts at logon and restarts if it stops`);
+            else {
+                loaded = false;
+                reason = c.reason;
+            }
         }
     }
     catch (e) {
@@ -827,7 +896,7 @@ function disableWindows(kind, sys) {
     writeFileSync(f.disabled(kind), new Date().toISOString());
     waitFor(() => !hostChildRunning(kind), 6_000, sys.sleep ?? blockingSleep);
 }
-export function enableService(kind, sys = realSys()) {
+export function enableService(kind, sys = realSys(), o = {}) {
     if (sys.platform !== "win32")
         throw new Error("service start is the Windows host's; elsewhere: pantheon service install");
     if (!isHostKind(kind) || !readDefinition(kind))
@@ -835,13 +904,17 @@ export function enableService(kind, sys = realSys()) {
     const f = hostFiles();
     const was = existsSync(f.disabled(kind));
     rmSync(f.disabled(kind), { force: true });
-    const tray = clearTrayQuit() ? ["  the tray icon, which you had quit, shows again"] : [];
+    const tray = !o.keepTrayQuit && clearTrayQuit() ? ["  the tray icon, which you had quit, shows again"] : [];
     if (hostUp())
         return [`  ${kind}: ${was ? "resumed" : "already on"} — the Pantheon host ${was ? "starts it within seconds" : "runs it"}`, ...tray];
     const lines = [];
     ensureTask(sys, (l) => lines.push(l), { migrate: true });
-    sys.exec("schtasks", ["/Run", "/TN", taskName(sys.exec, sys.env)]);
-    return [...lines, `  ${kind}: ${was ? "resumed" : "on"} — started the Pantheon host, which runs it`, ...tray];
+    const name = taskName(sys.exec, sys.env);
+    runTask(sys.exec, name);
+    const c = confirmHostStart(sys, name);
+    if (!c.up && !c.slow)
+        throw new Error(c.line.trim());
+    return [...lines, c.up ? `  ${kind}: ${was ? "resumed" : "on"} — started the Pantheon host, which runs it` : `  ${kind}: ${was ? "resumed" : "on"} —${c.line.replace(/^ {2}started/, " started")}`, ...tray];
 }
 export function showTray(sys = realSys()) {
     const f = hostFiles();
@@ -856,7 +929,9 @@ export function showTray(sys = realSys()) {
     }
     const lines = [];
     ensureTask(sys, (l) => lines.push(l), { migrate: true });
-    sys.exec("schtasks", ["/Run", "/TN", taskName(sys.exec, sys.env)]);
-    return [...lines, "  started the Pantheon host, and the tray icon with it"];
+    const name = taskName(sys.exec, sys.env);
+    runTask(sys.exec, name);
+    const c = confirmHostStart(sys, name);
+    return [...lines, c.up ? "  started the Pantheon host, and the tray icon with it" : c.line];
 }
 //# sourceMappingURL=service.js.map

package/dist/uninstall.js

@@ -2,7 +2,7 @@ import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, lstatSync, readFileSync, readdirSync, rmdirSync, rmSync, writeFileSync } from "node:fs";
 import { platform } from "node:os";
 import { posix, win32 } from "node:path";
-import { expectedLauncher } from "./managed.js";
+import { expectedLauncher, windowsManagedRoots } from "./managed.js";
 export const BEGIN_MARK = "# >>> pantheon >>>";
 export const END_MARK = "# <<< pantheon <<<";
 export const PROFILES = [".profile", ".bash_profile", ".bash_login", ".bashrc", ".zshrc", ".zprofile"];
@@ -83,8 +83,23 @@ export const realUninstallFs = {
     }
     catch { } },
 };
+export function managedInstalls(home, os = platform(), env = process.env, fs = realUninstallFs) {
+    const first = managedInstall(home, os, env, fs);
+    if (!first)
+        return [];
+    if (os !== "win32")
+        return [first];
+    const { current, legacy } = windowsManagedRoots(home, env);
+    const other = [current, legacy].find((r) => r && r.toLowerCase() !== first.root.toLowerCase());
+    if (!other)
+        return [first];
+    const p = win32;
+    const at = { os, root: other, runtime: p.join(other, "runtime"), binDir: p.join(other, "bin"), launcher: p.join(other, "bin", "pantheon.cmd"), log: p.join(other, "install.log"), present: false };
+    at.present = fs.exists(at.runtime) || fs.exists(at.launcher);
+    return at.present ? [first, at] : [first];
+}
 export function managedInstall(home, os = platform(), env = process.env, fs = realUninstallFs) {
-    const launcher = expectedLauncher(home, os, env);
+    const launcher = expectedLauncher(home, os, env, fs.exists);
     if (!launcher)
         return null;
     const p = os === "win32" ? win32 : posix;
@@ -94,8 +109,8 @@ export function managedInstall(home, os = platform(), env = process.env, fs = re
     const log = os === "win32" ? p.join(root, "install.log") : p.join(root, "logs", "install.log");
     return { os, root, runtime, binDir, launcher, log, present: fs.exists(runtime) || fs.exists(launcher) };
 }
-export function finishAfterExit(paths, pids = [process.pid]) {
-    const inner = cleanupScript(paths, pids);
+export function finishAfterExit(paths, pids = [process.pid], ifEmpty = null) {
+    const inner = cleanupScript(paths, pids, ifEmpty);
     if (!inner)
         return false;
     const ps = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
@@ -113,14 +128,15 @@ export function cleanupLauncher(ps, inner) {
     const enc = Buffer.from(inner, "utf16le").toString("base64");
     return `Start-Process -FilePath '${ps.replace(/'/g, "''")}' -WindowStyle Hidden -ArgumentList '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-EncodedCommand','${enc}'`;
 }
-export function cleanupScript(paths, pids) {
-    if (!paths.length || paths.some((x) => /[\r\n]/.test(x)))
+export function cleanupScript(paths, pids, ifEmpty = null) {
+    if (!paths.length || paths.some((x) => /[\r\n]/.test(x)) || (ifEmpty && /[\r\n]/.test(ifEmpty)))
         return null;
     const ids = pids.filter((n) => Number.isInteger(n) && n > 0);
     const steps = [
         ids.length ? `Wait-Process -Id ${ids.join(",")} -Timeout 60 -ErrorAction SilentlyContinue` : "",
         "Start-Sleep -Milliseconds 500",
         `Remove-Item -LiteralPath ${paths.map((x) => `'${x.replace(/'/g, "''")}'`).join(",")} -Recurse -Force`,
+        ifEmpty ? `$d = '${ifEmpty.replace(/'/g, "''")}'; if ((Test-Path -LiteralPath $d) -and -not (Get-ChildItem -LiteralPath $d -Force)) { Remove-Item -LiteralPath $d -Force }` : "",
     ].filter(Boolean).join("; ");
     return `& { ${steps} } *> (Join-Path $env:TEMP 'pantheon-uninstall.log')`;
 }
@@ -200,10 +216,11 @@ export function removeManagedInstall(o) {
     }
     const lockedHere = m.os === "win32" && !!o.running && o.running.root.toLowerCase() === m.root.toLowerCase();
     if (lockedHere) {
-        const finish = (o.finishLater ?? finishAfterExit)([m.runtime, m.binDir, m.log]);
+        const finish = o.finishLater ? o.finishLater([m.runtime, m.binDir, m.log], m.root) : finishAfterExit([m.runtime, m.binDir, m.log], undefined, m.root);
+        const byHand = `Remove-Item -Recurse -Force ${[m.runtime, m.binDir].map((x) => `'${x.replace(/'/g, "''")}'`).join(", ")}`;
         left.push(finish
-            ? `${m.root} — Windows keeps Pantheon's node.exe locked while this command runs, so it is removed a few seconds after this command exits. If it is still there afterwards, an agent window has it open: close them, then in PowerShell: Remove-Item -Recurse -Force "$env:LOCALAPPDATA\\Pantheon"`
-            : `${m.root} — Windows keeps Pantheon's node.exe locked while this command runs. Close your agent windows and this one, then in a new PowerShell: Remove-Item -Recurse -Force "$env:LOCALAPPDATA\\Pantheon"`);
+            ? `${m.runtime} — Windows keeps Pantheon's node.exe locked while this command runs, so it is removed a few seconds after this command exits. If it is still there afterwards, an agent window has it open: close them, then in PowerShell: ${byHand}`
+            : `${m.runtime} — Windows keeps Pantheon's node.exe locked while this command runs. Close your agent windows and this one, then in a new PowerShell: ${byHand}`);
         return { removed, left };
     }
     for (const [path, what] of [[m.launcher, "the pantheon command"], [m.log, "the installer's log"], [m.runtime, "Pantheon's own Node and the CLI in it"]]) {

package/dist/upgrade.js

@@ -8,6 +8,7 @@ import { proxyEnvFor } from "./network.js";
 import { relayProc, workerProc, notifierProc, menubarProc } from "./machine.js";
 import { load } from "./config.js";
 import { compareVersions, INSTALLER_MIN_CLI, isVersion } from "./installer.js";
+export const WINDOWS_PROFILE_ROOT_MIN = "0.33.1-0";
 import { childNodeFlags, installerLineHere, launcherWithRepair, managedLayout, nodeSatisfies, nodeTooOldSentence, runtimeNodeVersion } from "./managed.js";
 export function repoRoot() {
     return join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -125,6 +126,9 @@ export function upgrade(deps = defaultDeps(), opts = {}) {
         if (managed && spec !== "latest" && compareVersions(spec, INSTALLER_MIN_CLI) < 0) {
             return stop("check", `${spec} is older than this install supports (${INSTALLER_MIN_CLI} or newer): it could not upgrade itself again. Nothing was changed.`);
         }
+        if (managed && spec !== "latest" && /^\.pantheon$/i.test(managed.root.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "") && /^[A-Za-z]:\\|^\\\\/.test(managed.root) && compareVersions(spec, WINDOWS_PROFILE_ROOT_MIN) < 0) {
+            return stop("check", `${spec} predates Pantheon in your profile folder (0.33.1 or newer is needed here): it could not find itself to upgrade again. Nothing was changed.`);
+        }
         if (managed && deps.engines) {
             const range = deps.engines(spec);
             const node = deps.runtimeNode ? deps.runtimeNode() : runtimeNodeVersion(managed);

package/dist/win-host.js

@@ -80,6 +80,7 @@ export const hostFiles = (home = CONFIG_DIR) => {
         notices: join(dir, "notices"),
         noticesSkipped: join(dir, "notices.skipped"),
         launch: join(dir, "launch.txt"),
+        launchError: join(dir, "launch-error.txt"),
         clm: join(dir, "clm"),
         state: join(dir, "state.json"),
         lock: join(dir, "host.lock"),
@@ -90,7 +91,7 @@ export const hostFiles = (home = CONFIG_DIR) => {
 };
 export function readDefinition(kind, home = CONFIG_DIR) {
     try {
-        const d = JSON.parse(readFileSync(hostFiles(home).definition(kind), "utf8"));
+        const d = JSON.parse(readFileSync(hostFiles(home).definition(kind), "utf8").replace(/^\uFEFF/, ""));
         if (!d || typeof d.cwd !== "string" || !Array.isArray(d.args) || !d.args.every((a) => typeof a === "string"))
             return null;
         return { kind, cwd: d.cwd, args: d.args };
@@ -117,6 +118,17 @@ function writeAtomic(f, text) {
     }
 }
 export const HOST_BEAT_STALE_MS = 30_000;
+export function readLaunchError(home = CONFIG_DIR) {
+    try {
+        const [at, what, ...rest] = readFileSync(hostFiles(home).launchError, "utf8").replace(/^\uFEFF/, "").trim().split("\t");
+        if (!at || (what !== "missing" && what !== "start-failed") || !rest.length)
+            return null;
+        return { at, what, program: rest.join("\t") };
+    }
+    catch {
+        return null;
+    }
+}
 export function readHostState(home = CONFIG_DIR) {
     try {
         const s = JSON.parse(readFileSync(hostFiles(home).state, "utf8"));
@@ -966,6 +978,9 @@ export function windowsDoctorRows(x) {
         rows.push({ level: "pass", name: "host", detail: `running (pid ${x.state.pid}, ${x.state.version})${restarts.length ? ` — restarted ${restarts.map(([c, n]) => `the ${c} ${n}×`).join(", ")}` : ""}`,
             share: "running" });
     }
+    else if (x.launchProblem) {
+        rows.push({ level: "warn", name: "host", detail: `not running, and will not start as things are — ${x.launchProblem}`, share: "cannot start" });
+    }
     else {
         rows.push({ level: "warn", name: "host", detail: "not running — the worker, alerts and tray are all down until it starts",
             fix: `pantheon service start ${x.installed.worker ? "worker" : "notifier"}   (or log out and back in; its log: ~/.pantheon/logs/host.log)`, share: "not running" });

package/dist/win-package.js

@@ -0,0 +1,70 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { win32 } from "node:path";
+export const realPackageProbeFs = {
+    mkdir: (p) => mkdirSync(p, { recursive: true }),
+    write: (p, text) => writeFileSync(p, text),
+    exists: (p) => existsSync(p),
+    list: (p) => readdirSync(p),
+    remove: (p) => rmSync(p, { recursive: true, force: true }),
+};
+export function appPackage(env = process.env, fs = realPackageProbeFs, rand = () => randomBytes(6).toString("hex")) {
+    const local = env.LOCALAPPDATA;
+    if (!local)
+        return null;
+    const name = `pantheon-probe-${rand()}`;
+    const dir = win32.join(local, name);
+    try {
+        fs.mkdir(dir);
+        fs.write(win32.join(dir, "probe"), "1");
+        let families = [];
+        try {
+            families = fs.list(win32.join(local, "Packages"));
+        }
+        catch {
+            families = [];
+        }
+        return families.find((f) => fs.exists(win32.join(local, "Packages", f, "LocalCache", "Local", name, "probe"))) ?? null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            fs.remove(dir);
+        }
+        catch { }
+    }
+}
+let cached = null;
+export function thisAppPackage() {
+    if (process.platform !== "win32")
+        return null;
+    if (!cached)
+        cached = { value: appPackage() };
+    return cached.value;
+}
+export function onlyInsidePackage(path, family, env = process.env, exists = existsSync) {
+    const local = env.LOCALAPPDATA, roaming = env.APPDATA;
+    const norm = (p) => win32.normalize(p).replace(/[\\]+$/, "").toLowerCase();
+    const p = norm(path);
+    for (const [root, sub] of [[local, "Local"], [roaming, "Roaming"]]) {
+        if (!root)
+            continue;
+        const r = norm(root);
+        if (!p.startsWith(r + "\\"))
+            continue;
+        const rel = win32.normalize(path).slice(win32.normalize(root).replace(/[\\]+$/, "").length + 1);
+        if (!local)
+            return false;
+        if (exists(win32.join(local, "Packages", family, "LocalCache", sub, rel)))
+            return true;
+    }
+    return false;
+}
+export function packageApp(family) {
+    const name = family.replace(/_[a-z0-9]+$/i, "");
+    return /^claude$/i.test(name) ? "the Claude desktop app" : name.replace(/^[A-Za-z0-9]+\./, "") || family;
+}
+export const INSTALL_OUTSIDE_LINE = "open PowerShell from the Start menu (not through the app) and run: irm https://relay.joinpantheon.network/install.ps1 | iex";
+//# sourceMappingURL=win-package.js.map

package/helper/macos/prebuilt/manifest.json

@@ -1,6 +1,6 @@
 {
   "format": 1,
-  "built_at": "2026-10-05T08:38:15.336Z",
+  "built_at": "2026-10-05T16:44:41.416Z",
   "swiftc": "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)",
   "helpers": {
     "pantheon-tray": {
@@ -17,7 +17,7 @@
     "pantheon-hud": {
       "source": "main.swift",
       "source_sha256": "bcf55a19b658d1f09a9d117c76030393ab08a2569062dd7413f884ca05f3a0eb",
-      "sha256": "191f3f18e8212e11ad4438bdbef87a5cc533f5ae2fae208801db01c9a265193b",
+      "sha256": "0414b397a533940e3a5c324add6250e1ed71919e67e462d11dcb2a1d0c2f9b41",
       "archs": [
         "arm64",
         "x86_64"

package/helper/windows/pantheon-host.cs

@@ -23,7 +23,12 @@
 // swapping the runtime folder, a Node upgrade in progress) it waits and looks
 // again, with the same backoff; only after --missing-grace seconds (default
 // ten minutes) of nothing to start does it conclude Pantheon was removed, and
-// exit 3.
+// exit 3. While it waits it says so in launch-error.txt beside the launch file
+// (when, and which program it could not find), so `pantheon service install`,
+// `ps` and `doctor` can tell a host that is starting from one that never will:
+// a Node that exists only inside an app package's private AppData (an install
+// run from the Claude desktop app) looks there to the app and is not there to
+// Task Scheduler. The file goes once a start succeeds.
 //
 // Each start of this shim is one session (PANTHEON_HOST_SESSION, a new GUID):
 // the host uses it to tell a restart (same session) from a new logon.
@@ -42,7 +47,7 @@ using System.Threading;
 [assembly: System.Reflection.AssemblyTitle("Pantheon background host")]
 [assembly: System.Reflection.AssemblyDescription("Keeps Pantheon's worker, alerts and tray running while you are logged on")]
 [assembly: System.Reflection.AssemblyProduct("Pantheon")]
-[assembly: System.Reflection.AssemblyVersion("1.1.0.0")]
+[assembly: System.Reflection.AssemblyVersion("1.2.0.0")]
 
 static class PantheonHost
 {
@@ -84,12 +89,13 @@ static class PantheonHost
         while (true)
         {
             List<string> argv = ReadLaunch(launchFile);
+            string wanted = argv != null ? argv[0] : baked[0];
             if (argv == null || !File.Exists(argv[0])) argv = baked;
             if (!File.Exists(argv[0]))
             {
                 // Nothing to start right now: wait for it to come back, and give up
                 // only once it has been gone longer than any install or upgrade takes.
-                if (missingSince == DateTime.MinValue) missingSince = DateTime.UtcNow;
+                if (missingSince == DateTime.MinValue) { missingSince = DateTime.UtcNow; SayLaunchError(launchFile, "missing", wanted); }
                 if ((DateTime.UtcNow - missingSince).TotalSeconds >= graceSeconds) return 3;
                 Thread.Sleep(delay);
                 delay = Math.Min(delay * 2, MaxDelayMs);
@@ -115,12 +121,14 @@ static class PantheonHost
                 psi.EnvironmentVariables["PANTHEON_HOST_SESSION"] = session;
                 using (Process p = Process.Start(psi))
                 {
+                    ClearLaunchError(launchFile);
                     p.WaitForExit();
                     code = p.ExitCode;
                 }
             }
-            catch (Exception)
+            catch (Exception e)
             {
+                SayLaunchError(launchFile, "start-failed", argv[0] + " (" + e.Message + ")");
                 code = 1;
             }
             if (code == 0) return 0;
@@ -131,6 +139,30 @@ static class PantheonHost
         }
     }
 
+    // launch-error.txt beside the launch file: one line, tab-separated, of when
+    // (UTC, ISO 8601), what ("missing" or "start-failed") and which program.
+    // Best effort: a host that cannot write it still waits and retries.
+    static string LaunchErrorFile(string launchFile)
+    {
+        if (launchFile == null) return null;
+        string dir = Path.GetDirectoryName(launchFile);
+        return string.IsNullOrEmpty(dir) ? null : Path.Combine(dir, "launch-error.txt");
+    }
+
+    static void SayLaunchError(string launchFile, string what, string program)
+    {
+        string f = LaunchErrorFile(launchFile);
+        if (f == null) return;
+        try { File.WriteAllText(f, DateTime.UtcNow.ToString("o") + "\t" + what + "\t" + program + "\r\n", new UTF8Encoding(false)); } catch (Exception) { }
+    }
+
+    static void ClearLaunchError(string launchFile)
+    {
+        string f = LaunchErrorFile(launchFile);
+        if (f == null) return;
+        try { if (File.Exists(f)) File.Delete(f); } catch (Exception) { }
+    }
+
     // The launch file: one argument per line (UTF-8), the program first. null
     // when there is none, or it cannot be read, or it names nothing.
     static List<string> ReadLaunch(string file)

package/installer/install.ps1

@@ -56,15 +56,27 @@
 # What it does, and nothing else:
 #   1. downloads one pinned Node release (the win-x64 or win-arm64 zip) from
 #      nodejs.org, checks its sha256 against the one pinned in this file, and
-#      unpacks it into %LOCALAPPDATA%\Pantheon\runtime\node. That Node is
+#      unpacks it into %USERPROFILE%\.pantheon\runtime\node. That Node is
 #      Pantheon's own; a Node you already have is not touched.
 #   2. installs the Pantheon CLI with THAT Node's npm into that same folder.
 #      No administrator rights, no execution-policy change, no WSL.
-#   3. writes %LOCALAPPDATA%\Pantheon\bin\pantheon.cmd, which runs that Node.
-#   4. puts %LOCALAPPDATA%\Pantheon\bin first on your user PATH, and on this
+#   3. writes %USERPROFILE%\.pantheon\bin\pantheon.cmd, which runs that Node.
+#   4. puts %USERPROFILE%\.pantheon\bin first on your user PATH, and on this
 #      window's PATH.
 #   5. runs `pantheon <the arguments you gave>`.
 #
+# An install from before 0.33.1 lives in %LOCALAPPDATA%\Pantheon instead; when
+# one is there and works, it is updated where it is. New installs use the
+# profile folder because of apps from the Microsoft Store or any MSIX package,
+# the Claude desktop app among them: Windows keeps a NEW folder that anything
+# such an app starts (its agent's shell, this script) creates in AppData
+# private to that app. Pantheon then ran inside the app and nowhere else, and
+# its logon task -- run by Task Scheduler, outside every app -- found no Node.
+# The profile folder is never kept private that way. Run from inside such an
+# app, this script also sets your PATH through a one-off task of your own
+# (outside the app, deleted straight after), since Windows 10 keeps that
+# registry change private to the app too.
+#
 # Running it again is safe: whatever is already right is left as it is. Two
 # copies at once are safe too: the second waits for the first.
 # The relay that serves this file fills in the Pantheon version below.
@@ -129,6 +141,119 @@ function Install-Pantheon {
     [IO.File]::WriteAllText($LogFile, $r.out + $r.err)
     return $r.code
   }
+  # Is this PowerShell inside an app package (the Claude desktop app, any
+  # Microsoft Store or MSIX app)? Windows keeps a NEW folder such a process
+  # creates in %LOCALAPPDATA% private to that app, under
+  # %LOCALAPPDATA%\Packages\<package>\LocalCache\Local. There is no variable
+  # that says so, and asking Windows needs native code; so it is asked the way
+  # the redirection answers: a new folder with a file in it, looked for in each
+  # package's private copy, then removed. The package's folder name, or ''
+  # (not in one, or it cannot tell).
+  function Get-PantheonAppPackage([string]$Local) {
+    if (-not $Local) { return '' }
+    $name = 'pantheon-probe-' + [Guid]::NewGuid().ToString('N').Substring(0, 12)
+    $dir = Join-Path $Local $name
+    $found = ''
+    try {
+      New-Item -ItemType Directory -Force -Path $dir | Out-Null
+      [IO.File]::WriteAllText((Join-Path $dir 'probe'), '1')
+      $pk = Join-Path $Local 'Packages'
+      if (Test-Path -LiteralPath $pk) {
+        foreach ($f in @(Get-ChildItem -LiteralPath $pk -Directory -Force -ErrorAction SilentlyContinue)) {
+          if (Test-Path -LiteralPath ([IO.Path]::Combine($f.FullName, 'LocalCache', 'Local', $name, 'probe'))) { $found = $f.Name; break }
+        }
+      }
+    } catch { $found = '' }
+    finally { Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue }
+    return $found
+  }
+
+  # Where this install goes. Run inside an app package ($Package): <profile>\.pantheon,
+  # the one place such an app writes that every program sees, Task Scheduler
+  # included. Otherwise %LOCALAPPDATA%\Pantheon, as before 0.33.1 (AppData\Local
+  # never roams with an enterprise profile; the profile folder does). Either way
+  # an install already in one of them is updated where it is, so a machine that
+  # works keeps working the same way -- except an AppData install that exists
+  # only inside this app's package, which is never reused: it is what kept the
+  # background host from ever starting.
+  # @{ root; oldPrivate }: oldPrivate when such an app-only install was passed over.
+  function Select-PantheonRoot([string]$ProfileDir, [string]$Local, [string]$Package) {
+    $current = [IO.Path]::Combine($ProfileDir, '.pantheon')
+    $mine = @{ root = $current; oldPrivate = $false }
+    if (Test-Path -LiteralPath ([IO.Path]::Combine($current, 'runtime', 'node', 'node.exe'))) { return $mine }
+    if (-not $Local) { return $mine }
+    # Its Node only in this app's private copy: passed over (and said), whatever else of it is there.
+    if ($Package -and (Test-Path -LiteralPath ([IO.Path]::Combine($Local, 'Packages', $Package, 'LocalCache', 'Local', 'Pantheon', 'runtime', 'node', 'node.exe')))) { return @{ root = $current; oldPrivate = $true } }
+    $legacy = [IO.Path]::Combine($Local, 'Pantheon')
+    $there = (Test-Path -LiteralPath ([IO.Path]::Combine($legacy, 'runtime', 'node', 'node.exe'))) -and (Test-Path -LiteralPath ([IO.Path]::Combine($legacy, 'bin', 'pantheon.cmd')))
+    if ($there -or -not $Package) { return @{ root = $legacy; oldPrivate = $false } }
+    return $mine
+  }
+
+  # The user PATH, set from OUTSIDE this app's package. Inside one, Windows 10
+  # keeps HKCU changes private to the app (Windows 11 lets this key through),
+  # so a terminal opened from the Start menu would not find pantheon. Task
+  # Scheduler runs a task outside every package: a one-off task of this user's
+  # makes the same edit as the installer does below (this folder first, $Drop
+  # taken out, every other entry as it was, %VARS% unexpanded), writes how it
+  # went to a file, and is deleted. Run the way the logon task's PowerShell
+  # fallback runs (-Command, so no execution policy applies, nothing encoded).
+  # '' when it worked; otherwise why.
+  function Set-PantheonPathOutside([string]$BinDir, [string[]]$Drop, [string]$WorkDir, [string]$Schtasks, [string]$PowerShellExe, [string]$UserId) {
+    $tag = [Guid]::NewGuid().ToString('N').Substring(0, 8)
+    $result = Join-Path $WorkDir "path-$tag.result"
+    $xmlFile = Join-Path $WorkDir "path-$tag.xml"
+    $name = "Pantheon-Path-$tag"
+    # PowerShell reads the typographic single quotes as quotes too: each doubled, like '.
+    $q = { param($v) "'" + ([string]$v -replace "['\u2018\u2019\u201A\u201B]", '$0$0') + "'" }
+    $dropList = (@($Drop | Where-Object { $_ }) | ForEach-Object { & $q $_ }) -join ','
+    $inner = "`$ErrorActionPreference = 'Stop'; try { `$bin = $(& $q $BinDir); `$drop = @($dropList); " +
+      "`$same = { param(`$a, `$b) ([Environment]::ExpandEnvironmentVariables(`$a).TrimEnd([char]92)) -ieq ([Environment]::ExpandEnvironmentVariables(`$b).TrimEnd([char]92)) }; " +
+      "`$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment'); " +
+      "try { `$raw = [string]`$key.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames); " +
+      "`$parts = @(`$raw -split ';' | Where-Object { `$_ -ne '' }); " +
+      "`$rest = @(`$parts | Where-Object { `$p = `$_; -not (& `$same `$p `$bin) -and @(`$drop | Where-Object { & `$same `$p `$_ }).Count -eq 0 }); " +
+      "`$new = (@(`$bin) + `$rest) -join ';'; " +
+      "if (`$new -ne `$raw) { `$key.SetValue('Path', `$new, [Microsoft.Win32.RegistryValueKind]::ExpandString); [Environment]::SetEnvironmentVariable('PANTHEON_PATH_UPDATED', '1', 'User'); [Environment]::SetEnvironmentVariable('PANTHEON_PATH_UPDATED', `$null, 'User') } " +
+      "} finally { `$key.Close() }; [IO.File]::WriteAllText($(& $q $result), 'ok') } catch { [IO.File]::WriteAllText($(& $q $result), 'error: ' + `$_.Exception.Message) }"
+    $x = { param($v) [Security.SecurityElement]::Escape([string]$v) }
+    $taskArgs = '-NoProfile -NonInteractive -WindowStyle Hidden -Command "& { ' + $inner + ' }"'
+    $xml = (@(
+      '<?xml version="1.0" encoding="UTF-16"?>',
+      '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
+      '  <RegistrationInfo><Description>Pantheon installer: puts Pantheon on your PATH once; deleted straight after.</Description></RegistrationInfo>',
+      ('  <Principals><Principal id="Author"><UserId>' + (& $x $UserId) + '</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>'),
+      '  <Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>false</StartWhenAvailable><RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable><AllowStartOnDemand>true</AllowStartOnDemand><Enabled>true</Enabled><Hidden>true</Hidden><RunOnlyIfIdle>false</RunOnlyIfIdle><WakeToRun>false</WakeToRun><ExecutionTimeLimit>PT2M</ExecutionTimeLimit><Priority>7</Priority></Settings>',
+      ('  <Actions Context="Author"><Exec><Command>' + (& $x $PowerShellExe) + '</Command><Arguments>' + (& $x $taskArgs) + '</Arguments></Exec></Actions>'),
+      '</Task>') -join "`r`n")
+    # One left by an installer that was stopped while it waited: gone first.
+    try {
+      $listed = Invoke-Quiet $Schtasks @('/Query', '/FO', 'CSV', '/NH')
+      foreach ($line in ($listed.out -split "`r?`n")) {
+        $m = [regex]::Match($line, '^"\\(Pantheon-Path-[0-9a-f]{8})"')
+        if ($m.Success) { $null = Invoke-Quiet $Schtasks @('/Delete', '/TN', $m.Groups[1].Value, '/F') }
+      }
+    } catch { }
+    try {
+      New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
+      [IO.File]::WriteAllText($xmlFile, $xml, [Text.Encoding]::Unicode)
+      $c = Invoke-Quiet $Schtasks @('/Create', '/TN', $name, '/XML', $xmlFile, '/F')
+      if ($c.code -ne 0) { return "Task Scheduler would not take the task ($(($c.err + $c.out).Trim()))" }
+      try {
+        $r = Invoke-Quiet $Schtasks @('/Run', '/TN', $name)
+        if ($r.code -ne 0) { return "Task Scheduler would not start the task ($(($r.err + $r.out).Trim()))" }
+        for ($i = 0; $i -lt 60 -and -not (Test-Path -LiteralPath $result); $i++) { Start-Sleep -Milliseconds 500 }
+        if (-not (Test-Path -LiteralPath $result)) { return 'the task did not finish within 30 seconds' }
+        $said = ([IO.File]::ReadAllText($result)).Trim()
+        if ($said -eq 'ok') { return '' }
+        return $said
+      } finally { $null = Invoke-Quiet $Schtasks @('/Delete', '/TN', $name, '/F') }
+    } catch { return $_.Exception.Message }
+    finally {
+      Remove-Item -LiteralPath $xmlFile, $result -Force -ErrorAction SilentlyContinue
+    }
+  }
+
   # This user's logon task: "Pantheon-<SID>" (src/win-host.ts taskNameFor), and
   # "Pantheon", the name builds before 0.33.0 gave it.
   function Get-PantheonTaskNames {
@@ -419,8 +544,26 @@ function Install-Pantheon {
 
     $localAppData = [Environment]::GetFolderPath('LocalApplicationData')
     if (-not $localAppData) { $localAppData = $env:LOCALAPPDATA }
-    if (-not $localAppData) { Fail 'LOCALAPPDATA is not set, so there is nowhere to install. Run this from your own Windows account.' }
-    $root = Join-Path $localAppData 'Pantheon'
+    $profileDir = [Environment]::GetFolderPath('UserProfile')
+    if (-not $profileDir) { $profileDir = $env:USERPROFILE }
+    if (-not $profileDir) { Fail 'USERPROFILE is not set, so there is nowhere to install. Run this from your own Windows account.' }
+    # Inside an app package (the Claude desktop app): said once, and acted on below.
+    $appPackage = Get-PantheonAppPackage $localAppData
+    $appName = if ($appPackage -match '^Claude_') { 'the Claude desktop app' } elseif ($appPackage) { (($appPackage -replace '_[A-Za-z0-9]+$', '') -replace '^[A-Za-z0-9]+\.', '') } else { '' }
+    $where = Select-PantheonRoot $profileDir $localAppData $appPackage
+    $root = $where.root
+    # A release before 0.33.1 does not know ~\.pantheon (it would not find itself to
+    # upgrade, and its hooks would name a bare node): never put one there. This can
+    # only be asked for when the relay names an older CLI than this script (npm late).
+    $baseVersion = ($PantheonVersion -split '-')[0]
+    $isProfileRoot = $root -ieq [IO.Path]::Combine($profileDir, '.pantheon')
+    $tooOld = $false
+    try { $tooOld = [version]$baseVersion -lt [version]'0.33.1' } catch { $tooOld = $false }
+    if ($isProfileRoot -and $tooOld) { Fail "Pantheon $PantheonVersion cannot go in $root (that needs 0.33.1 or newer), and this is all the relay offers right now. Try again in a few minutes." }
+    $legacyBin = if ($localAppData) { Join-Path $localAppData 'Pantheon\bin' } else { '' }
+    $dropFromPath = @()
+    if ($legacyBin -and -not ($root -ieq (Join-Path $localAppData 'Pantheon'))) { $dropFromPath = @($legacyBin) }
+    if ($where.oldPrivate) { Note "the Pantheon in $(Join-Path $localAppData 'Pantheon') exists only inside $appName (Windows keeps what an app like it installs into AppData private to it), so its background worker could never start. Installing into $root instead, which every program sees." }
     $runtime = Join-Path $root 'runtime'
     $nodeDir = Join-Path $runtime 'node'
     $nodeExe = Join-Path $nodeDir 'node.exe'
@@ -491,8 +634,11 @@ function Install-Pantheon {
 
     # ---- 1. Pantheon's own Node --------------------------------------------
 
+    # Whole means node.exe AND its npm: an uninstall that ran while something
+    # still held node.exe (an agent window) removes the rest of the folder
+    # around it, and a node.exe with no npm beside it cannot install the CLI.
     $haveNode = ''
-    if (Test-Path -LiteralPath $nodeExe) { try { $haveNode = (& $nodeExe --version) 2>$null } catch { $haveNode = '' } }
+    if ((Test-Path -LiteralPath $nodeExe) -and (Test-Path -LiteralPath $npmCli)) { try { $haveNode = (& $nodeExe --version) 2>$null } catch { $haveNode = '' } }
     if ($haveNode -eq "v$NodeVersion") {
       Say "Node v$NodeVersion for Pantheon is already in $nodeDir."
     } else {
@@ -689,8 +835,9 @@ function Install-Pantheon {
     try {
       $raw = [string]$key.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
       $parts = @($raw -split ';' | Where-Object { $_ -ne '' })
-      if ($parts.Count -eq 0 -or -not (& $same $parts[0] $binDir)) {
-        $rest = @($parts | Where-Object { -not (& $same $_ $binDir) })
+      $stale = @($parts | Where-Object { $p = $_; @($dropFromPath | Where-Object { & $same $p $_ }).Count -gt 0 })
+      if ($parts.Count -eq 0 -or -not (& $same $parts[0] $binDir) -or $stale.Count -gt 0) {
+        $rest = @($parts | Where-Object { $p = $_; -not (& $same $p $binDir) -and @($dropFromPath | Where-Object { & $same $p $_ }).Count -eq 0 })
         $key.SetValue('Path', ((@($binDir) + $rest) -join ';'), [Microsoft.Win32.RegistryValueKind]::ExpandString)
         # SetEnvironmentVariable(..., 'User') is what tells Explorer and new
         # terminals that the user environment changed (WM_SETTINGCHANGE).
@@ -699,6 +846,17 @@ function Install-Pantheon {
         Say "Put $binDir first on your user PATH."
       }
     } finally { $key.Close() }
+    # Inside an app package, that change may have stayed inside the app (Windows
+    # 10 keeps HKCU writes private to it): made again from outside it.
+    if ($appPackage) {
+      $State.step = "adding Pantheon to your PATH from outside $appName"
+      $meName = ''
+      try { $meName = [Security.Principal.WindowsIdentity]::GetCurrent().Name } catch { $meName = "$env:USERDOMAIN\$env:USERNAME" }
+      $why = Set-PantheonPathOutside -BinDir $binDir -Drop $dropFromPath -WorkDir $runtime `
+        -Schtasks (Join-Path $env:SystemRoot 'System32\schtasks.exe') -PowerShellExe (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') -UserId $meName
+      if ($why) { Note "this is running inside $appName, and Pantheon could not add $binDir to your PATH from outside it ($why). In a PowerShell window opened from the Start menu, pantheon may not be found by name; $launcher always works." }
+      else { Say "Put $binDir on your user PATH from outside $appName, so terminals opened from the Start menu find pantheon too." }
+    }
     # This window: the bin folder first, and the runtime's own folder (added
     # for npm above) taken off again, as no new terminal will have it.
     $env:Path = (@($binDir) + @($env:Path -split ';' | Where-Object { $_ -ne '' -and -not (& $same $_ $binDir) -and -not (& $same $_ $nodeDir) })) -join ';'
@@ -715,12 +873,58 @@ function Install-Pantheon {
     $State.lock = $null
     # The background host stopped for the swap starts again, on the new Node.
     Start-PantheonTasks $State
+    # A background service set up before (pantheon service install) is pointed
+    # at THIS install: its logon task may still name a Node that is gone, or one
+    # only an app package could see (why 0.33.1 moved Pantheon out of AppData).
+    # `service start` keeps each service's own settings (its folder, its flags),
+    # registers the task again for this Node, starts it, and waits until the host
+    # says it is up. One the person paused stays paused.
+    foreach ($k in @('worker', 'notifier')) {
+      if (-not (Test-Path -LiteralPath (Join-Path $hostDir "$k.json"))) { continue }
+      if (Test-Path -LiteralPath (Join-Path $hostDir "$k.disabled")) { continue }
+      $State.step = "starting Pantheon's background $k on this install"
+      $r = Invoke-Quiet $nodeExe ($ca + @($entry, 'service', 'start', $k, '--keep-tray-quit'))
+      $said = (($r.err + "`n" + $r.out) -split "`r?`n" | Where-Object { $_.Trim() -and $_ -notmatch '^pantheon \d' } | Select-Object -Last 2) -join ' '
+      if ($r.code -eq 0) { Say "Pantheon's background $k runs on this install." }
+      else { Note "Pantheon's background $k did not start on this install: $($said.Trim()). Run: pantheon service start $k" }
+    }
+    # Someone already signed in here (a reinstall, or moving off an install only
+    # an app could see): the agents' Pantheon entries and hooks name a Node by
+    # its full path, so they are pointed at this one -- what `pantheon upgrade`
+    # does after every upgrade.
+    $member = ''
+    $cfgFile = Join-Path $pantheonHomeDir 'config.json'
+    if (Test-Path -LiteralPath $cfgFile) {
+      try { $member = [string]([IO.File]::ReadAllText($cfgFile) | ConvertFrom-Json).member } catch { $member = '' }
+      $State.step = 'pointing your coding agents at this install'
+      $w = Invoke-Quiet $nodeExe ($ca + @($entry, 'rewire', '--direct', '--json'))
+      # Windows PowerShell 5.1 hands a JSON array on as ONE object: enumerated
+      # with foreach, so each row is its own, on 5.1 and 7 alike.
+      $rows = @()
+      try {
+        $json = $w.out -split "`r?`n" | Where-Object { $_.Trim().StartsWith('[') } | Select-Object -Last 1
+        if ($json) { $parsed = ConvertFrom-Json $json; foreach ($x in $parsed) { $rows += , $x } }
+      } catch { $rows = @() }
+      # What was actually pointed here, said from what rewire reported, never assumed.
+      $bad = @($rows | Where-Object { $_.status -match '^failed' })
+      $done = @($rows | Where-Object { $_.status -notmatch '^(failed|skipped|unchanged)' -and $_.tool -notmatch 'perms$' } | ForEach-Object { $_.tool })
+      foreach ($r in $rows) { if ($r.tool -eq 'hooks' -and $r.status -match '(Codex runs a changed hook.*|pantheon hook install there.*)$') { Note "hooks: $($Matches[1])" } }
+      if ($w.code -ne 0 -or $rows.Count -eq 0) { Note 'your coding agents could not be pointed at this install; run: pantheon setup' }
+      elseif ($bad.Count) { Note ("these could not be pointed at this install: " + (($bad | ForEach-Object { "$($_.tool) ($($_.status))" }) -join '; ') + '. Run: pantheon setup') }
+      elseif ($done.Count) { Say "Your coding agents now use this install: $($done -join ', ') (restart any agent window that was open)." }
+      else { Say 'Your coding agents already use this install.' }
+    }
     $State.step = 'starting pantheon'
     if ($Arguments.Count -eq 0) {
       Say ''
-      Say "Pantheon $PantheonVersion is installed. Open a new terminal, then:"
-      Say '  pantheon start                    create a team'
-      Say "  pantheon join '<invite link>'     join a teammate's team"
+      if ($member) {
+        Say "Pantheon $PantheonVersion is installed, and you are still signed in as $member -- nothing to rejoin."
+        Say 'Open a new terminal (or restart your agent) and carry on; pantheon doctor checks everything.'
+      } else {
+        Say "Pantheon $PantheonVersion is installed. Open a new terminal, then:"
+        Say '  pantheon start                    create a team'
+        Say "  pantheon join '<invite link>'     join a teammate's team"
+      }
       $State.code = 0
       return
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.33.0",
+  "version": "0.33.1-rc.1",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {