@join-pantheon/cli 0.33.1 → 0.33.2

package/dist/cli.js

@@ -7,13 +7,13 @@ process.emitWarning = ((warning, ...rest) => {
     return _emitWarning(warning, ...rest);
 });
 import { randomBytes } from "node:crypto";
-import { gitConfigValue, suggestUsername } from "./onboard-defaults.js";
-import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { emailSuggestion, gitConfigValue, isGithubNoreply, pantheonCommand, signinCommand, usernameSuggestion } from "./onboard-defaults.js";
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
 import { agentSpawn, CmdLineUnsafe } from "./which.js";
 import { fromInvite, looksLikeInviteCode, resolveInviteCode, load, save, toInvite, toJoinLink, resolveFor, loadAll, identity, repoInfo, bindRepo, bindFolder, unbindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
-import { fmtLimit } from "./plans.js";
+import { fmtLimit, lastSlotNotice, ownedTeamsIn, spaceLimitAdvice } from "./plans.js";
 import { validEmail, validUsername } from "./accounts.js";
 import { install, launcher, installForUser, windowsRepoOverrides, agentAsksOnce } from "./install.js";
 import { Relay } from "./relay.js";
@@ -32,14 +32,14 @@ import { assess } from "./untrusted.js";
 import { report as spendReport, recentRuns } from "./spend.js";
 import { renderBrief, renderTeam } from "./brief.js";
 import { resolveDataDir, saveAll } from "./config.js";
-import { currentPlan, installNetwork, redactProxy, redactText, normalizeProxy, proxyToRemember, describeNetError } from "./network.js";
+import { currentPlan, installNetwork, redactProxy, redactText, normalizeProxy, proxyToRemember, describeNetError, describeRelayFailure, checkRelayCertificate, interceptedText, interceptionExplanation, relayJson } from "./network.js";
 import { createInterface } from "node:readline";
 import { homedir } from "node:os";
-import { removeHook, decideStop, writeIntent, clearIntent, readIntent, installHooks, agentHookStates } from "./notify.js";
+import { removeHook, decideStop, writeIntent, clearIntent, readIntent, repairNote, installHooks, agentHookStates } from "./notify.js";
 import { pending, render as renderPending } from "./pending.js";
 import { signedRead } from "./reads.js";
-import { start as qsStart, join as qsJoin, wireUp, teamNameFor, deviceLabel } from "./quickstart.js";
-import { folderRefusalHere, isTemporaryRefusal } from "./folder-guard.js";
+import { start as qsStart, join as qsJoin, wireUp, teamNameFor, deviceLabel, bindableFolder } from "./quickstart.js";
+import { folderRefusalHere, isTemporaryRefusal, projectFolderAnswer } from "./folder-guard.js";
 import { installService, serviceInstalled, serviceLogFile, uninstallService } from "./service.js";
 import { LEGACY_TASK_NAME, hostAlive, hostFiles, readHostState, recordedTaskName } from "./win-host.js";
 import { ACTS, LIMITS } from "./protocol.js";
@@ -88,9 +88,9 @@ async function requireSignInOnHostedRelay(relayFlag) {
             console.error("");
             return;
         }
-        die("not signed in yet.\n  When the code arrives:  pantheon verify <code>\n  Then run pantheon start again.");
+        die("not signed in yet.\n  When the code arrives:  pantheon verify <code>   (check spam if it is not in your inbox)\n  Then run pantheon start again.");
     }
-    die(`sign in first — this relay verifies email.\n  New here:        pantheon signup --email you@work.com --username you\n  Have an account: pantheon login  --email you@work.com\n  Then run pantheon start again.`);
+    die(`sign in first — this relay verifies email.\n${signInSteps().join("\n")}\n  Then run pantheon start again.\n  ${SIGNIN_FOR_AGENTS}`);
 }
 async function requireSignInOnAccountsRelay(relayFlag) {
     if (!relayFlag || identity()?.account)
@@ -109,7 +109,7 @@ async function requireSignInOnAccountsRelay(relayFlag) {
             console.error("");
             return;
         }
-        die("not signed in yet.\n  When the code arrives:  pantheon verify <code>\n  Then run this same pantheon start again.");
+        die("not signed in yet.\n  When the code arrives:  pantheon verify <code>   (check spam if it is not in your inbox)\n  Then run this same pantheon start again.");
     }
     if (hasAccounts)
         die(`sign in first — ${relayFlag} verifies email.${signInHint("NOT_SIGNED_IN", relayFlag)}\n  Then run this same pantheon start again.`);
@@ -120,14 +120,15 @@ async function interactiveOnboard(relayArg, opts = {}) {
     const base = relay.replace(/^ws/, "http").replace(/\/+$/, "");
     if (!process.stdin.isTTY) {
         console.error(`${B("pantheon")} — sign in to get started:`);
-        console.error(`  ${C("pantheon signup --email you@work.com --username you")}   then   ${C("pantheon verify <code>")}`);
+        for (const l of signInSteps())
+            console.error(l);
         return false;
     }
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     const ask = async (q) => {
         const a = await questionOrNull(rl, q);
         if (a === null) {
-            console.error(D("\n  cancelled. Pick up where you left off: pantheon signup --email you@work.com --username you"));
+            console.error(D("\n  cancelled. Pick up where you left off: pantheon signin"));
             process.exit(1);
         }
         return a;
@@ -135,84 +136,117 @@ async function interactiveOnboard(relayArg, opts = {}) {
     const kp = prior?.publicKey && prior.privateKey ? { publicKey: prior.publicKey, privateKey: prior.privateKey } : newKeypair();
     const label = deviceLabel();
     const postJson = async (path, body) => fetch(`${base}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) })
-        .then(async (x) => ({ status: x.status, j: await x.json() }));
+        .then(async (x) => ({ status: x.status, j: await relayJson(x, `${base}${path}`) }));
+    const unreachable = async (e) => { console.error(D(`    could not reach the relay: ${await describeRelayFailure(e, relay)}`)); return null; };
     try {
         console.error(opts.joining
             ? `${B("Welcome to Pantheon.")} You've been invited to "${opts.joining}". First, sign this machine in — your email and a 6-digit code, nothing else.\n`
             : opts.starting
                 ? `${B("Welcome to Pantheon.")} First, sign this machine in — your email and a 6-digit code, nothing else. Then your team is created.\n`
-                : `${B("Welcome to pantheon.")} Let's get this machine signed in.\n`);
+                : `${B("Welcome to pantheon.")} Let's get this machine signed in — your email and a 6-digit code, nothing else.\n`);
         const gitEmail = gitConfigValue("user.email");
-        const emailGuess = validEmail(gitEmail) ? gitEmail : "";
+        const pend = prior?.pendingAuth;
+        const emailGuess = pend?.email && validEmail(pend.email) ? pend.email : emailSuggestion(gitEmail);
         let email = "";
         while (!email) {
             const e = (await ask(`  Your work email${emailGuess ? ` [${emailGuess}]` : ""}: `)) || emailGuess;
-            if (validEmail(e))
-                email = e;
-            else
+            if (!validEmail(e)) {
                 console.error(D("    that doesn't look like an email — try again"));
-        }
-        let started = null;
-        let mode = "signup";
-        let signupUsername = "";
-        let userGuess = suggestUsername(email);
-        while (!started || started.status !== 200) {
-            const u = (await ask(`  Pick a username${userGuess ? ` [${userGuess}]` : ""}: `)) || userGuess;
-            if (!validUsername(u.toLowerCase())) {
-                console.error(D("    2–32 chars: letters, digits, . _ - (not at the ends)"));
                 continue;
             }
-            signupUsername = u;
-            started = await postJson("/auth/signup", { email, username: u, pubkey: kp.publicKey, label }).catch((e) => { console.error(D(`    could not reach the relay: ${e.message}`)); return null; });
-            if (!started)
-                return false;
-            if (started.status === 404) {
-                console.error(`\n  ${D("This relay is invite-based (no email accounts). Get started with:")}`);
-                console.error(`    ${C("pantheon start")}   ${D("(create a team)")}   or   ${C("pantheon join <invite>")}`);
-                return false;
+            if (isGithubNoreply(e)) {
+                console.error(D("    that is GitHub's no-reply address: mail sent there goes nowhere, so the code would never arrive — use the email you read"));
+                continue;
             }
-            if (started.status === 200)
-                break;
-            if (started.j.reason === "email_taken") {
-                console.error(D(`    that email already has an account — signing this device in instead…`));
-                started = await postJson("/auth/login", { email, pubkey: kp.publicKey, label }).catch((e) => { console.error(D(`    could not reach the relay: ${e.message}`)); return null; });
+            email = e;
+        }
+        const send = (m, username) => postJson(`/auth/${m}`, m === "signup" ? { email, username, pubkey: kp.publicKey, label } : { email, pubkey: kp.publicKey, label })
+            .catch(unreachable);
+        const justSent = (r) => r.j.reason === "too_soon";
+        let mode = "login";
+        let signupUsername = "";
+        const recentPend = pend && pend.email === email && typeof pend.at === "number" && Date.now() - pend.at < 9 * 60_000 && prior?.publicKey === kp.publicKey ? pend : null;
+        let started = recentPend ? { status: 200, j: { reused: true } } : await send("login");
+        if (recentPend) {
+            mode = recentPend.purpose;
+            signupUsername = recentPend.username ?? "";
+        }
+        if (!started)
+            return false;
+        const noAccount = started.status === 404 && (started.j.reason === "no_such_account" || /no active account/i.test(String(started.j.error ?? "")));
+        if (started.status === 404 && !noAccount) {
+            console.error(`\n  ${D("This relay is invite-based (no email accounts). Get started with:")}`);
+            console.error(`    ${C("pantheon start")}   ${D("(create a team)")}   or   ${C("pantheon join <invite>")}`);
+            return false;
+        }
+        if (noAccount) {
+            mode = "signup";
+            console.error(D(`    no account for ${email} yet — one more question to make it.`));
+            let userGuess = (pend?.purpose === "signup" && pend.email === email && pend.username) || usernameSuggestion(email, gitEmail);
+            for (;;) {
+                const u = (await ask(`  Pick a username${userGuess ? ` [${userGuess}]` : ""}: `)) || userGuess;
+                if (!validUsername(u.toLowerCase())) {
+                    console.error(D("    2–32 chars: letters, digits, . _ - (not at the ends)"));
+                    continue;
+                }
+                signupUsername = u;
+                started = await send("signup", u);
                 if (!started)
                     return false;
-                mode = "login";
-                break;
+                if (started.status === 200 || justSent(started))
+                    break;
+                if (started.j.reason === "email_taken") {
+                    console.error(D(`    that email already has an account — signing this device in instead…`));
+                    started = await send("login");
+                    if (!started)
+                        return false;
+                    mode = "login";
+                    signupUsername = "";
+                    break;
+                }
+                if (started.j.reason !== "username_taken" && started.j.reason !== "bad_username")
+                    break;
+                console.error(D(`    ${started.j.error ?? "try a different username"}`));
+                userGuess = usernameSuggestion(email, gitEmail, Math.floor(10 + Math.random() * 90));
             }
-            console.error(D(`    ${started.j.error ?? "try a different username"}`));
-            userGuess = suggestUsername(email, Math.floor(10 + Math.random() * 90));
         }
-        if (!started || started.status !== 200) {
-            console.error(D(`  ${started?.j.error ?? "sign-up failed"}`));
+        const already = justSent(started);
+        if (started.status !== 200 && !already) {
+            console.error(D(`  ${started.j.error ?? "sign-in failed"}`));
             return false;
         }
         const authUser = mode === "signup" ? signupUsername : undefined;
         save({ ...(prior ?? {}), relay, member: signupUsername || prior?.member || "me",
             space: prior?.space ?? "", token: prior?.token ?? "",
             publicKey: kp.publicKey, privateKey: kp.privateKey, agent: prior?.agent ?? "unknown",
-            pendingAuth: { email, ...(authUser ? { username: authUser } : {}), purpose: mode } });
-        if (started.j.sent === false && started.j.via === "resend") {
-            console.error(`\n  ${D("The relay could not send the email just now.")} Type 'resend' to retry, or run ${C("pantheon")} again shortly.\n`);
+            pendingAuth: { email, ...(authUser ? { username: authUser } : {}), purpose: mode, at: recentPend?.at ?? (already && pend?.email === email && pend.at ? pend.at : Date.now()) } });
+        if (started.j.reused) {
+            console.error(`\n  ${C("A code was sent")} to ${B(email)} ${Math.max(1, Math.round((Date.now() - recentPend.at) / 60_000))} min ago — enter that one, or type 'resend' for a new one. ${SPAM_HINT}\n`);
+        }
+        else if (already && pend?.email !== email) {
+            console.error(`\n  ${D("A code for this email was asked for a moment ago from another device; that one will not work here.")} Wait a minute, then type 'resend'. ${SPAM_HINT}\n`);
+        }
+        else if (already) {
+            console.error(`\n  ${C("A code was sent")} to ${B(email)} a moment ago — use that one. ${SPAM_HINT}\n`);
+        }
+        else if (started.j.sent === false && started.j.via === "resend") {
+            console.error(`\n  ${D("The relay could not send the email just now.")} Type 'resend' to retry, or run ${C("pantheon signin")} again shortly.\n`);
         }
         else {
             const via = started.j.via === "resend" ? "" : `\n  ${D("(this is a dev relay — your code is printed in its log)")}`;
-            console.error(`\n  ${C("Sent a 6-digit code")} to ${B(email)}. Check your inbox.${via}\n`);
+            console.error(`\n  ${C("Sent a 6-digit code")} to ${B(email)}. Check your inbox. ${SPAM_HINT}${via}\n`);
         }
         for (let attempt = 0; attempt < 6; attempt++) {
-            const code = await ask("  Enter the code (or 'resend'): ");
+            const code = await ask("  Enter the code (not in your inbox? check spam · or type 'resend'): ");
             if (/^resend$/i.test(code)) {
-                const rs = await postJson(mode === "signup" ? "/auth/signup" : "/auth/login", mode === "signup"
-                    ? { email, username: signupUsername, pubkey: kp.publicKey, label }
-                    : { email, pubkey: kp.publicKey, label }).catch(() => null);
+                const rs = await send(mode, mode === "signup" ? signupUsername : undefined);
                 if (rs && rs.status === 200 && rs.j.sent !== false)
-                    console.error(D("    sent a fresh code."));
+                    console.error(D(`    sent a fresh code. ${SPAM_HINT}`));
                 else
                     console.error(D(`    could not resend: ${rs?.j.error ?? "the relay did not send an email"} — try again in a minute.`));
                 continue;
             }
-            const v = await postJson("/auth/verify", { email, code, pubkey: kp.publicKey }).catch((e) => ({ status: 0, j: { error: `could not reach the relay (${e.message}) — try the same code again` } }));
+            const v = await postJson("/auth/verify", { email, code, pubkey: kp.publicKey }).catch(async (e) => ({ status: 0, j: { error: `could not reach the relay (${await describeRelayFailure(e, relay)}) — try the same code again` } }));
             if (v.status === 200) {
                 const acct = v.j.account;
                 const cfg = { ...(prior ?? {}), relay, member: acct.username, space: prior?.space ?? "", token: prior?.token ?? "",
@@ -223,6 +257,11 @@ async function interactiveOnboard(relayArg, opts = {}) {
                 console.error(`\n  ${C("You're in")} — signed in as ${B(acct.username)} <${acct.email}> on this machine.\n`);
                 if (opts.joining || opts.starting)
                     return true;
+                if (opts.signin) {
+                    console.error(`  ${B("Signed in — tell your agent to continue;")} it will run the join or start again.`);
+                    console.error(D(`  (On your own? ${C("pantheon start")} creates a team; ${C("pantheon join <invite-link>")} joins one.)`));
+                    return true;
+                }
                 console.error(`  ${B("Next:")}  ${C("pantheon start")}  ${D("(create a team, get a link to send)")}`);
                 console.error(`         ${C("pantheon join <invite-link>")}  ${D("(join a teammate's team)")}`);
                 return true;
@@ -230,13 +269,22 @@ async function interactiveOnboard(relayArg, opts = {}) {
             const spent = v.j.reason === "expired" || v.j.reason === "too_many_attempts" || v.j.tries_left === 0;
             console.error(D(`    ${v.j.error ?? "that code is not right"}${spent ? " — type 'resend' for a new code" : " — try again"}`));
         }
-        console.error(D("\n  Too many tries. Run `pantheon` again to restart, or `pantheon verify <code>` once you have it."));
+        console.error(D("\n  Too many tries. Run `pantheon signin` again to restart, or `pantheon verify <code>` once you have it."));
         return false;
     }
     finally {
         rl.close();
     }
 }
+const SIGNIN_FOR_AGENTS = "A coding agent that cannot sign you in hands you the signin line to run yourself, and runs this again once you say you're signed in.";
+const SPAM_HINT = "Not there in a minute? Check your spam folder.";
+function signInSteps() {
+    return [
+        `  ${C(signinCommand(managedLayout()?.launcher))}   ${D("in a terminal of your own: your email, then the emailed code, in one go")}`,
+        `  ${D("or two commands:")} ${C("pantheon signup --email you@work.com --username you")} ${D("(an account already: pantheon login --email you@work.com)")}`,
+        `                   ${C("pantheon verify <code>")}   ${D("(the code is emailed — check spam)")}`,
+    ];
+}
 function ago(t) {
     const m = Math.round((Date.now() - t) / 60_000);
     if (m < 1)
@@ -458,6 +506,123 @@ async function workerAfterBinding(how) {
         console.error(D(`  the worker did not install: ${e.message} — pantheon service install worker`));
     }
 }
+async function bindProjectFromScratch() {
+    const cwd = process.cwd();
+    if (repoInfo(cwd) || !isTemporaryRefusal(folderRefusalHere(cwd)))
+        return;
+    const all = loadAll(), j = load();
+    const m = all && j ? findMembership(all, j.spaceId ?? j.space) ?? findMembership(all, j.space) : null;
+    if (!all || !m)
+        return;
+    if (Object.values(all.bindings ?? {}).some((b) => b.space === m.id))
+        return;
+    const line = pantheonCommand(managedLayout()?.launcher, `use ${m.name} --here`);
+    const later = () => {
+        console.error(`  From your project folder (the repo or folder you work in), run:  ${C(line)}`);
+        console.error(D(`  The worker stays off until then, and agents opened there do not speak for "${m.name}" yet.`));
+    };
+    console.error(`
+${B("Your project folder.")} ${D(`This is a temporary folder, so nothing in it was bound to "${m.name}".`)}`);
+    if (!process.stdin.isTTY) {
+        later();
+        return;
+    }
+    for (let tries = 0; tries < 3; tries++) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        const a = ((await questionOrNull(rl, `  The folder you work in for "${m.name}" — a repo or a docs folder (Enter to skip): `)) ?? "").trim();
+        rl.close();
+        if (!a)
+            break;
+        const why = await bindProjectFolder(projectFolderAnswer(a, homedir(), cwd), m);
+        if (!why)
+            return;
+        console.error(D(`    ${why} — try another, or press Enter to skip`));
+    }
+    later();
+}
+async function bindProjectFolder(dir, m) {
+    try {
+        if (!statSync(dir).isDirectory())
+            return `${dir} is not a folder`;
+    }
+    catch {
+        return `there is no folder at ${dir}`;
+    }
+    const all = loadAll() ?? die("not configured");
+    const r = repoInfo(dir);
+    if (r) {
+        const held = all.bindings?.[r.fingerprint];
+        if (held && held.space !== m.id) {
+            const other = findMembership(all, held.space)?.name ?? held.space;
+            const rl = createInterface({ input: process.stdin, output: process.stderr });
+            const a = ((await questionOrNull(rl, `  ${r.origin ?? r.root} works for "${other}" now. Move it to "${m.name}"? [y/N] `)) ?? "").trim().toLowerCase();
+            rl.close();
+            if (a !== "y" && a !== "yes")
+                return `left with "${other}"`;
+        }
+        const { replaced } = bindRepo(r, m.id);
+        console.error(`  ${B("bound")} ${r.origin ?? r.root} → "${m.name}"${replaced ? D(`  (was: ${findMembership(all, replaced.space)?.name ?? replaced.space})`) : ""}`);
+        if (!r.shared)
+            console.error(D("  this repo has no origin remote — deliveries from it cannot be fetched by teammates"));
+        const { repo: _r, repoOrigin: _o, ...plain } = configFor(all, m, null);
+        const client = new PantheonClient(plain, undefined, { role: "cli" });
+        try {
+            await client.connect();
+            if (!client.repos.some((x) => x.fingerprint === r.fingerprint))
+                await client.bindRepo(r.fingerprint, repoShare(r));
+        }
+        catch (e) {
+            console.error(D(`  (could not register the repo with the team: ${e.message.split("\n")[0]} — pantheon repo add, from it, when the relay is reachable)`));
+        }
+        finally {
+            client.close();
+        }
+        return null;
+    }
+    const refused = folderRefusalHere(dir);
+    if (refused)
+        return refused.why.replace(/;.*$/, "");
+    if ((await import("./repo-find.js")).holdsRepo(dir)) {
+        const n = await bindReposIn(dir, all, m, false, `pantheon use ${m.name} --here --yes`);
+        return n ? null : "nothing in it was bound";
+    }
+    if (!bindableFolder(dir))
+        return `${dir} holds another team's folder, so it cannot be bound whole`;
+    bindFolder(dir, m.id);
+    console.error(`  ${B("bound")} ${dir} → "${m.name}"   ${D("(agents opened there speak in it; no git needed)")}`);
+    return null;
+}
+async function lastTeamNotice(cfg) {
+    if (!cfg.account)
+        return;
+    const all = loadAll();
+    const m = Object.values(all?.spaces ?? {}).find((x) => sameHost(x.relay, cfg.relay));
+    if (!all || !m)
+        return;
+    const c = new PantheonClient(configFor(all, m, null), undefined, { role: "cli" });
+    try {
+        await Promise.race([c.connect(), new Promise((_, no) => setTimeout(() => no(new Error("timeout")), 5_000))]);
+        const say = lastSlotNotice(c.plan);
+        if (say)
+            console.error(`\x1b[33m  ! ${say}\x1b[0m`);
+    }
+    catch { }
+    finally {
+        c.dispose();
+    }
+}
+async function teamLimitAdvice(warning) {
+    const owned = ownedTeamsIn(warning);
+    const all = loadAll();
+    const teams = await Promise.all(owned.map(async (name) => {
+        const m = all ? findMembership(all, name) : null;
+        if (!all || !m)
+            return { name, here: false, alone: null };
+        const { others } = await teamStanding(all, m);
+        return { name, here: true, alone: others === null ? null : others.length === 0 };
+    }));
+    return spaceLimitAdvice(teams);
+}
 const repoLabel = (r) => r.origin ?? basename(r.root);
 const repoShare = (r) => (r.origin ? r.origin.replace(/^.*[:/]([^:/]+)$/, "$1") : basename(r.root));
 const teamFlag = (cfg) => (flag("space") ? ` --space ${cfg.space}` : "");
@@ -533,7 +698,11 @@ async function launchAgent(binary, args, prompt, cwd) {
         sp = agentSpawn(binary, args(`Read the file ${rel.split(/[\\/]/).join("/")} in this folder and do what it asks.`));
     }
     try {
-        spawnSync(sp.command, sp.args, { stdio: "inherit", ...(cwd ? { cwd } : {}), ...sp.options });
+        const r = spawnSync(sp.command, sp.args, { stdio: "inherit", ...(cwd ? { cwd } : {}), ...sp.options });
+        if (r.error || (r.status ?? 0) !== 0) {
+            console.error(`\n${B("the agent did not start, or stopped with an error")} ${D(`(${r.error ? r.error.message.split("\n")[0] : `exit ${r.status}`}: ${binary})`)}`);
+            process.exitCode = r.status || 1;
+        }
     }
     finally {
         if (handoff)
@@ -543,6 +712,36 @@ async function launchAgent(binary, args, prompt, cwd) {
             catch { }
     }
 }
+async function claudeAppInstead(surface, prompt) {
+    if (surface !== "claude-code")
+        return false;
+    const { detectAvailable } = await import("./agents.js");
+    if (detectAvailable().some((a) => a.backend.id === "claude-code"))
+        return false;
+    const { findClaudeApp, explainInClaudeApp } = await import("./desktop-app.js");
+    const app = findClaudeApp();
+    if (!app)
+        return false;
+    const r = explainInClaudeApp(prompt, app);
+    if (!r.ok) {
+        console.error(D(`  ${r.says} — opening an agent CLI instead`));
+        return false;
+    }
+    console.error(r.says);
+    if (/could not be copied/.test(r.says))
+        console.log(`\n${prompt}\n`);
+    return true;
+}
+async function workerServesLines() {
+    try {
+        const { workerServesReport } = await import("./worker-fleet.js");
+        const { detectAvailable } = await import("./agents.js");
+        return workerServesReport(loadAll(), detectAvailable()).map((r) => (r.warn ? `\x1b[33m${r.line}\x1b[0m` : D(r.line)));
+    }
+    catch {
+        return [];
+    }
+}
 function needStrict() {
     const r = resolveFor(process.cwd(), { strict: true });
     return r.cfg && r.cfg.space ? r.cfg : null;
@@ -847,7 +1046,8 @@ const C = (s) => PLAIN ? s : `\x1b[36m${s}\x1b[0m`;
 const HELP = `${B("pantheon")} — your agent and your teammates' agents, working together
 
 ${B("first time — verify your email once")}
-  pantheon signup --email you@work.com --username you    get a 6-digit code by email
+  pantheon signin                                        in a terminal: your email, then the emailed code (check spam)
+  pantheon signup --email you@work.com --username you    or by flags: get a 6-digit code by email (check spam)
   pantheon verify <code>                                 confirm it — you're in
   pantheon login --email you@work.com                    a second machine, same account
   pantheon whoami · pantheon sessions                      who you are; your devices & sessions
@@ -893,6 +1093,8 @@ ${B("control")}
   pantheon trust [<who>]      the teammates' keys this machine checks their messages against; trust <who> adopts a changed one
                               (this machine only — nothing is sent to the team; --space <team> to pick one)
   pantheon admit <who> --revoke     remove them
+  pantheon recover [<team>]   lost the machine your seat was on? sign in on this one and move it here (a teammate confirms,
+                              or it waits a day); recover confirm|cancel <who> is the teammate's side
   pantheon worker             stay answerable while you are away
                             (--agent claude-code|codex|cursor|copilot|kiro|auto, --persona <name>)
   pantheon policy             what this machine's worker may do, in one screen (grant/revoke self-upgrade)
@@ -995,6 +1197,7 @@ const COMMAND_FLAGS = {
     admit: "<member>  --may-wake | --no-wake  --revoke  --forget  --yes",
     wake: "allow <member> | deny <member> | list   --space <team>",
     trust: "[<member>]  --yes  --space <team>",
+    recover: "[<team>] | withdraw <team> | confirm <member> | cancel <member> [--yes]   --space <team>  --no-worker  --no-hook  --no-notifications  --no-menubar",
     say: "<ACT> <text>  --to <member>[,<member>]  --goal <id>  --ref <id | seq | last>  --summary '<one line>'  --domains <a,b>  --branch --commit --remote (DELIVERED)  --space <team>",
     goal: "list | open \"<title>\" --with <member>[,…] [--acceptance \"…\"] [--deadline <ISO time>] [--list] | close <id> \"<summary>\"",
     history: "--goal <id>  --from <member>  --last <n>  --since <seq>  --short  --presence  --json",
@@ -1010,10 +1213,11 @@ const COMMAND_FLAGS = {
     use: "<team>  --here  --yes   ·   pantheon use --unbind   (this folder or repo bound to no team again)",
     repo: "add [--base <branch>] | list [--all] | find [<folder>] [--recents] [--yes]",
     login: "--email <address>  --relay <url>  --label <device name>",
+    signin: "--relay <url>",
     signup: "--email <address>  --username <name>  --relay <url>  --label <device name>",
     audit: "--space <team>  --since <hours>  --json",
     setup: "--questions  (and every answer as a flag, with --yes)",
-    board: "--open  --url  --watch  --keep  --stop",
+    board: "--open  --url  --watch  --keep  --stop  --focus <id>",
 };
 const HELP_OPAQUE = new Set(["mcp", "hook", "pending", "tray-status", "help", "version", "-v", "--help", "-h"]);
 function rememberWorkingProxy() {
@@ -1104,7 +1308,7 @@ async function main() {
         if (helpAt.some((a) => a === "--help" || a === "-h")) {
             const u = usageFor(cmd, HELP_ALL);
             const flags = COMMAND_FLAGS[cmd];
-            const teamCmd = !["start", "join", "signup", "login", "verify", "whoami", "relay", "help", "version", "upgrade", "network", "ps", "stop", "service", "hook", "mcp", "pending", "tray-status", "uninstall"].includes(cmd);
+            const teamCmd = !["start", "join", "signup", "signin", "login", "verify", "whoami", "relay", "help", "version", "upgrade", "network", "ps", "stop", "service", "hook", "mcp", "pending", "tray-status", "uninstall"].includes(cmd);
             const shown = flags && teamCmd && !/--space/.test(flags) ? `${flags}\n  --space <team>   (the team to act on, when this folder is bound to another or none)` : flags;
             console.log(u || shown ? `${u ?? `  pantheon ${cmd}`}${shown ? `\n\n${B("flags")}\n  ${shown}` : ""}\n\n${D("nothing was run · all commands: pantheon help --all")}` : HELP);
             return;
@@ -1186,12 +1390,17 @@ async function main() {
                 menubar: !argv.includes("--no-menubar"),
                 unattended: wp.project,
                 workerHow: wp.how,
+                beforeCreate: lastTeamNotice,
                 log: (l) => console.error(l),
             });
             for (const t of r.tools)
                 console.error(`  ${t.tool.padEnd(14)}${t.status}`);
             for (const w of r.warnings)
                 console.error(`\x1b[33m  ! ${w}\x1b[0m` + (/NOT_SIGNED_IN/.test(w) ? signInHint("NOT_SIGNED_IN", r.cfg.relay) : ""));
+            const planWarning = r.claimed ? undefined : r.warnings.find((w) => /PLAN_LIMIT/.test(w));
+            if (planWarning)
+                for (const l of await teamLimitAdvice(planWarning))
+                    console.error(`  ${l}`);
             printGranted(r.granted);
             printRelayNote(r.cfg?.relay);
             rememberWorkingProxy();
@@ -1225,6 +1434,7 @@ async function main() {
                 console.error(D(`  ${r.reach.hint}`));
             }
             if (r.claimed) {
+                await bindProjectFromScratch();
                 await bindReposHere(argv.includes("--yes"));
                 await workerAfterBinding(wp.how);
                 windowsOverridesForBoundRepos();
@@ -1389,17 +1599,25 @@ async function main() {
                     die(e.message);
                 const named = flag("relay") ?? process.env.PANTHEON_RELAY;
                 const candidates = (named ? [named] : [load()?.relay, DEFAULT_RELAY]).filter((r) => !!r);
-                parsed = await resolveInviteCode(invite, candidates).catch((err) => die(err.message.replace(/^INVITE_CODE_[A-Z]+:\s*/, "")));
+                parsed = await resolveInviteCode(invite, candidates).catch(async (err) => {
+                    const c = /INVITE_CODE_UNREACHABLE/.test(err.message) && err.nonJsonFrom ? await checkRelayCertificate(err.nonJsonFrom).catch(() => null) : null;
+                    const rest = err.message.replace(/^INVITE_CODE_[A-Z]+:\s*/, "");
+                    if (c?.publicCa === false) {
+                        const x = interceptionExplanation(c);
+                        die(`${x.why} — ${x.fix}.\n${rest.split("\n").slice(1).join("\n")}`);
+                    }
+                    return die(rest);
+                });
                 console.error(D(`That was just the code — it opens "${parsed.space}" on ${new URL(parsed.relay).host}. Joining that team.\n`));
             }
             if (!identity()?.account && sameHost(parsed.relay, DEFAULT_RELAY) && process.stdin.isTTY) {
                 const ok = await interactiveOnboard(parsed.relay, { joining: parsed.space });
                 if (!ok || !identity()?.account)
-                    die(`not signed in yet — the invite is still good.\n  When the code arrives:  pantheon verify <code>\n  Then run this same \`pantheon join\` command again.`);
+                    die(`not signed in yet — the invite is still good.\n  When the code arrives:  pantheon verify <code>   (check spam if it is not in your inbox)\n  Then run this same \`pantheon join\` command again.`);
                 console.error("");
             }
             if (!identity()?.account && sameHost(parsed.relay, DEFAULT_RELAY)) {
-                die(`sign in first — this relay verifies email.\n  New here:        pantheon signup --email you@work.com --username you\n  Have an account: pantheon login  --email you@work.com\n  Then run this same \`pantheon join\` command again — the invite is still good.`);
+                die(`sign in first — this relay verifies email.\n${signInSteps().join("\n")}\n  Then run this same \`pantheon join\` command again — the invite is still good.\n  ${SIGNIN_FOR_AGENTS}`);
             }
             const wp = unattendedProject();
             console.error(`${B("pantheon join")}\n`);
@@ -1422,8 +1640,11 @@ async function main() {
                     }
                 }
                 throw e;
-            }).catch((e) => {
+            }).catch(async (e) => {
                 const m = e.message;
+                const intercepted = await interceptedText(e, parsed.relay);
+                if (intercepted)
+                    die(intercepted);
                 if (/BAD_INVITE/.test(m)) {
                     const body = m.replace(/^BAD_INVITE:\s*/, "");
                     die(/\n/.test(body) || /fresh one|new invite/i.test(body) ? body : `${body}\n  Ask your teammate for a fresh one: pantheon invite`);
@@ -1478,6 +1699,7 @@ async function main() {
                     await findAndBindRepos(all, m, teamRepos, { auto: !process.stdin.isTTY }).catch(() => { });
                 }
             }
+            await bindProjectFromScratch();
             await workerAfterBinding(wp.how);
             windowsOverridesForBoundRepos();
             {
@@ -2027,6 +2249,8 @@ async function main() {
             const worker = workerProc();
             const notifier = notifierProc();
             const cfg = load();
+            const client = cfg ? new PantheonClient(cfg, undefined, { role: "cli" }) : null;
+            const upP = client ? client.connect().then(() => true, () => false) : Promise.resolve(false);
             console.log(B("this machine"));
             if (relay.running) {
                 const how = relay.managedBy === "launchd"
@@ -2044,8 +2268,16 @@ async function main() {
                 }
             }
             else {
-                console.log(`  relay     ${D("not running")}${relay.label ? D(`   (service ${relay.label} is installed but down)`) : ""}`);
-                console.log(`            ${D("start it with: pantheon start")}`);
+                const { relayRowsWhenNoneHere, relayReachable } = await import("./machine.js");
+                const relays = [...new Set([...Object.values(loadAll()?.spaces ?? {}).map((m) => m.relay), ...(cfg?.relay ? [cfg.relay] : [])])];
+                const reach = Object.fromEntries(await Promise.all(relays.map(async (u) => [u,
+                    await Promise.race([u === cfg?.relay ? upP : relayReachable(u), new Promise((r) => setTimeout(() => r(null), 5_000))])])));
+                const rows = relayRowsWhenNoneHere(relays, port, reach);
+                for (const [i, r] of rows.entries()) {
+                    const head = i === 0 ? "  relay     " : "            ";
+                    const named = r.line !== "not running";
+                    console.log(`${head}${named ? r.line : D(r.line)}${i === 0 && relay.label && !named ? D(`   (service ${relay.label} is installed but down)`) : ""}${r.dim ? `   ${D(r.dim)}` : ""}`);
+                }
             }
             if (worker.running) {
                 console.log(`  worker    ${C("running")}   ${worker.managedBy === "launchd" ? `service ${worker.label}` : worker.managedBy === "host" ? `background host (${worker.label})` : "started by hand"}   pid ${worker.pid}`);
@@ -2055,6 +2287,8 @@ async function main() {
                 const paused = worker.managedBy === "host" && existsSync(hostFiles().disabled("worker"));
                 console.log(`  worker    ${D(paused ? "paused" : "not running")}   ${D(paused ? "pantheon service start worker resumes it" : "nobody can start an agent run on this machine")}`);
             }
+            for (const l of await workerServesLines())
+                console.log(`            ${l}`);
             const menubar = menubarProc();
             if (process.platform === "win32") {
                 const st = readHostState();
@@ -2086,7 +2320,7 @@ async function main() {
             }
             console.log(`\n${B("wired into")}`);
             for (const w of wiring())
-                console.log(`  ${w.tool.padEnd(14)}${w.state === "not wired" ? D(w.state) : w.state}`);
+                console.log(`  ${w.tool.padEnd(14)}${w.state.startsWith("not wired") ? D(w.state) : w.state}`);
             const hk = agentHookStates();
             const intent = readIntent();
             if (!hk.length) {
@@ -2099,20 +2333,21 @@ async function main() {
                     ? `\x1b[33mpartial\x1b[0m — ${summary}. Re-run: pantheon hook install`
                     : `on — ${summary}`}`);
             }
-            if (intent?.repairs) {
-                console.log(`  ${"".padEnd(14)}\x1b[33mput back ${intent.repairs} time${intent.repairs === 1 ? "" : "s"} after something removed it\x1b[0m`);
-                console.log(`  ${"".padEnd(14)}${D("something on this machine rewrites ~/.claude/settings.json and drops the hooks key")}`);
+            const repaired = repairNote(intent?.repairs);
+            if (repaired) {
+                console.log(`  ${"".padEnd(14)}${repaired.recurring ? `\x1b[33m${repaired.said}\x1b[0m` : D(repaired.said)}`);
+                if (repaired.why)
+                    console.log(`  ${"".padEnd(14)}${D(repaired.why)}`);
             }
             const pers = loadPersonas(process.cwd());
             if (pers.length) {
                 console.log(`  ${"personas".padEnd(14)}${pers.map((p) => p.name).join(", ")}   ${D("worker takes only matched work — pantheon persona list")}`);
             }
-            if (!cfg) {
+            if (!cfg || !client) {
                 console.log(`\n${D("not joined to a space yet — run: pantheon start")}`);
                 return;
             }
-            const client = new PantheonClient(cfg, undefined, { role: "cli" });
-            const up = await client.connect().then(() => true).catch(() => false);
+            const up = await upP;
             console.log(`\n${B("space")}  ${cfg.space}   you are ${C(cfg.member)}`);
             if (!up) {
                 console.log(`  ${D(client.pending ? "you are not admitted here right now" : "cannot reach the relay from this machine")}`);
@@ -2881,10 +3116,10 @@ async function main() {
                 console.log(`account      ${C(cfg.account.username)}  ${D(`<${cfg.account.email}>`)}  ${D("verified")}`);
             }
             else if (cfg.pendingAuth) {
-                console.log(`account      ${D(`not signed in yet — a code was sent to ${cfg.pendingAuth.email}: pantheon verify <code>`)}`);
+                console.log(`account      ${D(`not signed in yet — a code was sent to ${cfg.pendingAuth.email} (check spam): pantheon verify <code>`)}`);
             }
             else {
-                console.log(`account      ${D("not signed in")}  ${D("— pantheon signup / pantheon login")}`);
+                console.log(`account      ${D("not signed in")}  ${D("— pantheon signin (in a terminal), or pantheon signup / pantheon login")}`);
             }
             console.log(`member       ${C(cfg.member)}`);
             const teams = Object.values(loadAll()?.spaces ?? {}).map((m) => m.name);
@@ -2894,6 +3129,26 @@ async function main() {
             console.log(D(`\nManage your devices and sessions: pantheon sessions`));
             return;
         }
+        case "signin": {
+            const relayArg = flag("relay");
+            const had = identity();
+            if (had?.account && (!relayArg || sameHost(relayArg, had.relay))) {
+                console.error(`${C("already signed in")} as ${B(had.account.username)} <${had.account.email}> on this machine.`);
+                console.error(D(`  A different account? Sign this machine out first:  pantheon logout  — then  pantheon signin  again.`));
+                console.error(`  ${B("Tell your agent to continue;")} it will run the join or start again.`);
+                return;
+            }
+            if (!process.stdin.isTTY) {
+                die(`pantheon signin asks for your email and then the code it emails you, so it needs a terminal to type into.\n` +
+                    `  Run it in a terminal window of your own:  ${pantheonCommand(managedLayout()?.launcher, `signin${relayArg ? ` --relay ${relayArg}` : ""}`)}\n` +
+                    `  Without a terminal, two commands do the same:\n` +
+                    `    pantheon signup --email you@work.com --username you${relayArg ? ` --relay ${relayArg}` : ""}   (an account already: pantheon login --email you@work.com${relayArg ? ` --relay ${relayArg}` : ""})\n` +
+                    `    pantheon verify <code>   (the code is emailed — check spam if it is not in your inbox)`);
+            }
+            if (!await interactiveOnboard(relayArg, { signin: true }))
+                process.exit(1);
+            return;
+        }
         case "signup":
         case "login": {
             const purpose = cmd;
@@ -2910,20 +3165,20 @@ async function main() {
             const base = relay.replace(/^ws/, "http").replace(/\/+$/, "");
             const body = purpose === "signup" ? { email, username, pubkey: kp.publicKey, label } : { email, pubkey: kp.publicKey, label };
             const r = await fetch(`${base}/auth/${purpose}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) })
-                .then(async (x) => ({ status: x.status, j: await x.json() }))
-                .catch((e) => die(describeNetError(e, relay)));
+                .then(async (x) => ({ status: x.status, j: await relayJson(x, `${base}/auth/${purpose}`) }))
+                .catch(async (e) => die(await describeRelayFailure(e, relay)));
             if (r.status !== 200)
                 die(String(r.j.error ?? `signup failed (${r.status})`));
             save({ ...(prior ?? {}), relay, member: username ?? prior?.member ?? "me", space: prior?.space ?? "", token: prior?.token ?? "",
                 publicKey: kp.publicKey, privateKey: kp.privateKey, agent: prior?.agent ?? "unknown",
-                pendingAuth: { email, ...(username ? { username } : {}), purpose } });
+                pendingAuth: { email, ...(username ? { username } : {}), purpose, at: Date.now() } });
             if (r.j.sent === false && r.j.via === "resend") {
                 console.error(`${B("signup accepted, but the email could not be sent just now.")}`);
                 console.error(`Retry in a minute:  ${C(`pantheon ${purpose} --email ${email}${username ? ` --username ${username}` : ""}`)}`);
                 return;
             }
             const via = r.j.via === "resend" ? "" : D("  (dev relay: the code is in the relay log)");
-            console.error(`${B("check your email")} — we sent a 6-digit code to ${C(email)}.${via}`);
+            console.error(`${B("check your email")} — we sent a 6-digit code to ${C(email)}. ${SPAM_HINT}${via}`);
             console.error(`Then run:  ${C("pantheon verify <code>")}`);
             return;
         }
@@ -2933,15 +3188,15 @@ async function main() {
             let code = (argv[1] ?? flag("code") ?? "").trim();
             if (!code && process.stdin.isTTY) {
                 const rl = createInterface({ input: process.stdin, output: process.stderr });
-                code = (await questionOrNull(rl, `Enter the 6-digit code sent to ${pending.email}: `)) ?? "";
+                code = (await questionOrNull(rl, `Enter the 6-digit code sent to ${pending.email} (not in your inbox? check spam): `)) ?? "";
                 rl.close();
             }
             if (!code)
                 die("usage: pantheon verify <6-digit-code>");
             const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
             const r = await fetch(`${base}/auth/verify`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email: pending.email, code, pubkey: cfg.publicKey }) })
-                .then(async (x) => ({ status: x.status, j: await x.json() }))
-                .catch((e) => die(describeNetError(e, cfg.relay)));
+                .then(async (x) => ({ status: x.status, j: await relayJson(x, `${base}/auth/verify`) }))
+                .catch(async (e) => die(await describeRelayFailure(e, cfg.relay)));
             if (r.status !== 200)
                 die(String(r.j.error ?? "verification failed"));
             const acct = r.j.account;
@@ -3300,6 +3555,172 @@ async function main() {
             client.close();
             return;
         }
+        case "recover": {
+            if (inWokenRun())
+                die("a woken run cannot move a seat or vouch for one — a person has to, on their own machine");
+            const sub = argv[1] && !argv[1].startsWith("--") ? argv[1] : null;
+            if (sub === "confirm" || sub === "cancel") {
+                const who = argv[2] && !argv[2].startsWith("--") ? argv[2] : die(`usage: pantheon recover ${sub} <member>  [--space <team>]`);
+                const cfg = need();
+                const client = new PantheonClient(cfg, undefined, { role: "cli" });
+                await client.connect().catch((e) => die(client.pending ?? connectFailure(e, cfg.relay)));
+                await new Promise((r) => setTimeout(r, 300));
+                const e = client.members.find((x) => x.member === who);
+                if (!e?.recovery) {
+                    client.close();
+                    die(`no move of ${who}'s seat is waiting in "${cfg.space}"`);
+                }
+                const { fp, label, requested_at, due_at } = e.recovery;
+                console.log(`${B(`${who} asked to move their seat in ${cfg.space} to a new device`)}`);
+                console.log(`  device   "${label}"`);
+                console.log(`  new key  ${C(fp)}`);
+                console.log(D(`  asked ${ago(requested_at)} ago, after signing in with the code emailed to their account; it moves on its own ${new Date(due_at).toLocaleString()} unless someone cancels`));
+                if (sub === "confirm") {
+                    if (who === cfg.member) {
+                        client.close();
+                        die("a seat move is confirmed by a teammate, not by the person whose seat it is");
+                    }
+                    console.log(D(`\n  Check it with ${who} over a call or a channel you trust: they run  pantheon whoami  on the new machine and read you "this device". Confirm only when it matches.`));
+                }
+                else if (who === cfg.member) {
+                    console.log(D(`\n  If you did not ask for this, someone has signed in to your email account: cancel it, then secure that account.`));
+                }
+                let go = false;
+                if (sub === "confirm") {
+                    if (!process.stdin.isTTY) {
+                        client.close();
+                        die(`confirming is yours to do, in a terminal: pantheon recover confirm ${who}${teamFlag(cfg)} — after ${who} reads you the key from their new machine`);
+                    }
+                    const last = fp.split("-").at(-1);
+                    const rl = createInterface({ input: process.stdin, output: process.stderr });
+                    const a = ((await questionOrNull(rl, `Type the last group of the key ${who} reads you (4 characters), or press Enter to stop: `)) ?? "").trim().toLowerCase();
+                    rl.close();
+                    if (a && a !== last) {
+                        client.close();
+                        die(`that does not match the key waiting (…-${last}). Nothing changed — check again with ${who}.`);
+                    }
+                    go = a === last;
+                }
+                else {
+                    go = argv.includes("--yes");
+                    if (!go && process.stdin.isTTY) {
+                        const rl = createInterface({ input: process.stdin, output: process.stderr });
+                        const a = ((await questionOrNull(rl, `Cancel the move of ${who}'s seat? [y/N] `)) ?? "").trim().toLowerCase();
+                        rl.close();
+                        go = a === "y" || a === "yes";
+                    }
+                }
+                if (!go) {
+                    client.close();
+                    console.log(D(process.stdin.isTTY || sub === "confirm" ? "  nothing changed" : `  nothing changed — to cancel it:  pantheon recover cancel ${who} --yes${teamFlag(cfg)}`));
+                    return;
+                }
+                const body = sub === "confirm"
+                    ? `I checked with ${who}: the new key ${fp} is theirs. Confirming the move of their seat.`
+                    : `Cancelling the move of ${who}'s seat to the key ${fp}${who === cfg.member ? " — I did not ask for it" : ""}.`;
+                await client.send({ act: "NOTE", body, to: null, meta: { recovery: { member: who, fp, action: sub, ...(sub === "confirm" ? { from_fp: e.fingerprint } : {}) } } })
+                    .catch((err) => { client.close(); die(err.message); });
+                await new Promise((r) => setTimeout(r, 800));
+                const { loadPins: lp, pinFor: pf } = await import("./pins.js");
+                const pinned = pf(lp(), client.pinKey(), who)?.fp === fp;
+                client.close();
+                console.log(sub === "confirm"
+                    ? `${C("confirmed")} — ${who}'s seat is on their new device${pinned ? ", and this machine trusts the new key" : ""}. Teammates' machines take it from your signed confirmation.`
+                    : `${C("cancelled")} — ${who}'s seat stays on its current key. The team was told.`);
+                return;
+            }
+            const id = identity() ?? die("not set up on this machine — sign in first, in a terminal: pantheon signin");
+            if (!id.account)
+                die("sign in on this machine first, in a terminal:  pantheon signin  — the code emailed to you is what proves the seat is yours");
+            const acct = id.account;
+            const base0 = id.relay.replace(/^ws/, "http").replace(/\/+$/, "");
+            const call = (method, path, params = {}) => signedFetch(id, method, path, params)
+                .then(async (x) => ({ status: x.status, j: await relayJson(x, `${base0}${path}`) }))
+                .catch(async (e) => die(await describeRelayFailure(e, id.relay)));
+            const noRecovery = (j) => /no accounts/.test(String(j.error ?? ""))
+                ? "this relay has no accounts, so seats cannot be recovered by email here. A teammate retires the old key instead (pantheon admit <you> --forget) and invites you again."
+                : "this relay is older than 0.33.2 and cannot move a seat yet — ask its operator to upgrade it, or have a teammate retire the old key (pantheon admit <you> --forget) and invite you again.";
+            if (sub === "withdraw") {
+                const team = argv[2] ?? die("usage: pantheon recover withdraw <team>");
+                const r = await call("POST", "/account/recover/withdraw", { space: team });
+                if (r.status !== 200)
+                    die(String(r.j.error ?? `the relay said ${r.status}`));
+                console.log(`${C("withdrawn")} — your seat in ${team} stays where it was.`);
+                return;
+            }
+            if (!sub) {
+                const r = await call("GET", "/account/recover");
+                if (r.status === 404)
+                    die(noRecovery(r.j));
+                if (r.status !== 200)
+                    die(String(r.j.error ?? `the relay said ${r.status}`));
+                const seats = (r.j.seats ?? []);
+                console.log(`${B(`Your seats as ${acct.username}`)} ${D(`(this device: ${fingerprint(id.publicKey)})`)}\n`);
+                if (!seats.length)
+                    console.log(D("  none — you are in no team on this relay yet"));
+                for (const s of seats) {
+                    const name = s.space.padEnd(18);
+                    const line = s.state === "here" ? D("on this machine") :
+                        s.state === "ready" ? `moved here — save it on this machine:  ${C(`pantheon recover ${s.space}`)}` :
+                            s.state === "waiting" ? `waiting — moves ${new Date(s.due_at).toLocaleString()} unless someone cancels; a teammate can confirm it sooner` :
+                                s.state === "movable" ? `on another of your devices (${s.fp}) — move it here:  ${C(`pantheon recover ${s.space}`)}${D(s.alone ? "  (you are alone in it: at once)" : "  (a teammate confirms, or it waits a day)")}` :
+                                    D(`its key ${s.fp} was never signed in to your account here, so it cannot be moved by email — a teammate who has checked it is you: pantheon admit ${acct.username} --forget, then a new invite`);
+                    console.log(`  ${name}${line}${s.founder ? D("  (founder)") : ""}`);
+                }
+                return;
+            }
+            const team = sub;
+            let r = await call("POST", "/account/recover", { space: team });
+            if (r.status === 403 && r.j.reason === "sign_in_again" && process.stdin.isTTY) {
+                console.error(`${B("First, prove it is you")} — a code goes to ${C(acct.email)} (look in spam too if it is not there in a minute).`);
+                const base = id.relay.replace(/^ws/, "http").replace(/\/+$/, "");
+                const post = (path, body) => fetch(`${base}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) })
+                    .then(async (x) => ({ status: x.status, j: await relayJson(x, `${base}${path}`) }))
+                    .catch(async (e) => die(await describeRelayFailure(e, id.relay)));
+                const sent = await post("/auth/login", { email: acct.email, pubkey: id.publicKey, label: deviceLabel() });
+                if (sent.status !== 200)
+                    die(String(sent.j.error ?? `the relay said ${sent.status}`));
+                const rl = createInterface({ input: process.stdin, output: process.stderr });
+                let ok = false;
+                for (let i = 0; i < 3 && !ok; i++) {
+                    const code = ((await questionOrNull(rl, `Enter the 6-digit code sent to ${acct.email}: `)) ?? "").trim();
+                    if (!code)
+                        break;
+                    const v = await post("/auth/verify", { email: acct.email, code, pubkey: id.publicKey });
+                    if (v.status === 200)
+                        ok = true;
+                    else
+                        console.error(`  ${String(v.j.error ?? "that code did not work")}`);
+                }
+                rl.close();
+                if (!ok)
+                    die(`not verified — run  pantheon recover ${team}  again for a new code`);
+                r = await call("POST", "/account/recover", { space: team });
+            }
+            if (r.status === 404 && !r.j.reason)
+                die(noRecovery(r.j));
+            if (r.status >= 400)
+                die(String(r.j.error ?? `the relay said ${r.status}`));
+            if (r.j.state === "waiting") {
+                const others = (r.j.others ?? []);
+                console.log(`${B(`Asked: your seat in ${team} moves to this machine`)} ${D(`(new key ${String(r.j.fp)})`)}`);
+                console.log(`  It moves when a teammate confirms it — ${others.join(", ") || "your teammates"} ${others.length === 1 ? "was" : "were"} told — or on its own ${new Date(Number(r.j.due_at)).toLocaleString()} if nobody cancels.`);
+                console.log(`  Speed it up: ask one of them to check your key with you (read them "this device" from  pantheon whoami ) and run  ${C(`pantheon recover confirm ${acct.username} --space ${team}`)}`);
+                console.log(D(`  Once it has moved, run  pantheon recover ${team}  again here to save the team on this machine.`));
+                return;
+            }
+            const token = String(r.j.invite ?? "");
+            if (r.j.state !== "moved" || !token)
+                die(`unexpected answer from the relay: ${JSON.stringify(r.j).slice(0, 200)}`);
+            const how = r.j.how === "alone" ? " (you are alone in it)" : r.j.how === "confirmed" ? " (a teammate confirmed it)" : r.j.how === "waited" ? " (nobody cancelled in the time it waited)" : "";
+            console.error(`${C("moved")} — your seat in ${team} is on this machine now${how}. Saving the team here, as a join does:\n`);
+            console.error(D(`  If the old machine is lost or not yours any more, sign it out of your account too:  pantheon sessions  (then  pantheon sessions revoke <device-id> --device)\n`));
+            const { spawnSync: run } = await import("node:child_process");
+            const invite = toInvite({ ...id, space: String(r.j.space ?? team), token });
+            const keep = argv.slice(2).filter((a) => /^--(no-worker|no-hook|no-notifications|no-menubar|yes)$/.test(a));
+            const res = run(process.execPath, [process.argv[1], "join", invite, ...keep], { stdio: "inherit" });
+            process.exit(res.status ?? 1);
+        }
         case "trust": {
             const { WOKEN_RUN_ENV } = await import("./worker-policy.js");
             const inRun = process.env[WOKEN_RUN_ENV] !== undefined || /[\\/]run-homes[\\/]/.test(process.env.PANTHEON_HOME ?? "");
@@ -3561,8 +3982,8 @@ async function main() {
                 home: uriHome,
                 wokenRun: inWokenRun(),
                 runQueued: (actionId) => spawnSync(process.execPath, self(["explain", "--queued", "--only-action", "--action-id", actionId]), { stdio: "inherit", env: childEnv }).status ?? 1,
-                openBoard: hasBoard ? () => new Promise((done) => {
-                    const c = spawn(process.execPath, self(["board", "--open"]), { detached: true, stdio: "ignore", windowsHide: true, env: childEnv });
+                openBoard: hasBoard ? (focus) => new Promise((done) => {
+                    const c = spawn(process.execPath, self(["board", "--open", ...(focus ? ["--focus", focus] : [])]), { detached: true, stdio: "ignore", windowsHide: true, env: childEnv });
                     const t = setTimeout(() => { c.unref(); done(true); }, 4_000);
                     c.on("error", () => { clearTimeout(t); done(false); });
                     c.on("exit", (status) => { clearTimeout(t); done(status === 0); });
@@ -3794,6 +4215,42 @@ async function main() {
                 console.log(`sent RETRACT id=${sent.id} seq=${sent.seq}`);
                 return;
             }
+            if (hud?.action === "wake") {
+                const notSent = (why) => { console.log(`not sent: ${why}`); process.exit(1); };
+                const { loadPolicy, setLocalWaker, markTeamFlagOnYes, applyLocalAnswer, describeLocalAnswer } = await import("./worker-policy.js");
+                const ref = hud.act;
+                const wa = ref ? loadPolicy().wakeAsks?.[ref] : undefined;
+                if (!wa || !hud.member || wa.member !== hud.member)
+                    notSent("that question is no longer open on this machine — pantheon wake list shows who may wake it");
+                if (![cfg.spaceId, cfg.space].includes(wa.team))
+                    notSent(`that question is about the team "${wa.team}", not "${hud.space ?? cfg.space}" — answer it from that team's board`);
+                const allow = hud.allow === true;
+                const r = setLocalWaker(allow ? [wa.team] : [wa.team, cfg.spaceId, cfg.space], wa.member, allow);
+                if (!r.ok)
+                    notSent(r.why);
+                if (allow && wa.teamBlocked)
+                    markTeamFlagOnYes(wa.team, wa.member);
+                const body = allow ? "allow always" : "deny";
+                const g = applyLocalAnswer(ref, body);
+                if (g)
+                    console.error(describeLocalAnswer(g));
+                const c2 = new PantheonClient(cfg, undefined, { role: "cli" });
+                try {
+                    await c2.connect();
+                    const o = c2.obligations.find((x) => x.id === hud.decision || x.ref === ref);
+                    if (o) {
+                        const sent = await c2.send({ act: "ANSWER", ref: ref, goal: null, after_seq: c2.readSeq, body, meta: { surface: "menubar" } });
+                        console.log(`sent ANSWER id=${sent.id} seq=${sent.seq}`);
+                    }
+                }
+                catch (e) {
+                    console.error(D(`  recorded on this machine; the question could not be marked answered on the relay (${e.message.split("\n")[0]}) — it leaves your board once it is`));
+                }
+                finally {
+                    c2.close();
+                }
+                return;
+            }
             if (hud?.action === "done") {
                 const c2 = new PantheonClient(cfg, undefined, { role: "cli" });
                 await c2.connect().catch((e) => die(connectFailure(e, cfg.relay)));
@@ -4005,6 +4462,8 @@ async function main() {
                     }
                 }
                 if (hud.prompt) {
+                    if (await claudeAppInstead(hud.tool ?? p.agent.primary_surface, hud.prompt))
+                        return;
                     const agent = pickExplainAgent(hud.tool ?? p.agent.primary_surface, detectAvailable());
                     if (!agent)
                         die("no agent CLI found on this machine (claude, cursor-agent, codex, copilot, or kiro-cli)");
@@ -4059,6 +4518,8 @@ async function main() {
                 console.log(D("no decisions waiting on you — nothing to explain"));
                 return;
             }
+            if (await claudeAppInstead(loadProfile(one?.cfg ?? cfg).agent.primary_surface, prompt))
+                return;
             const agent = pickExplainAgent(loadProfile(one?.cfg ?? cfg).agent.primary_surface, detectAvailable());
             if (!agent)
                 die("no agent CLI found on this machine (claude, cursor-agent, codex, copilot, or kiro-cli)");
@@ -4175,7 +4636,7 @@ async function main() {
             (await import("./machine.js")).recordWorkerPid();
             const allCfg = loadAll();
             const bindings = Object.values(allCfg?.bindings ?? {});
-            if (!flag("project") && bindings.length) {
+            if (!flag("project")) {
                 const { WorkerFleet } = await import("./worker-fleet.js");
                 const fleet = new WorkerFleet({
                     ...(flag("agent-cmd") ? { agentCmd: flag("agent-cmd"), agentCmdFromCli: true } : { agent: flag("agent", "auto") }),
@@ -4195,7 +4656,7 @@ async function main() {
                     }),
                     log: (l) => console.error(l),
                 });
-                console.error(`${B("pantheon worker")} ${D(`(${bindings.length} bound folder${bindings.length === 1 ? "" : "s"} · ctrl-c to stop)`)}`);
+                console.error(`${B("pantheon worker")} ${D(`(${bindings.length ? `${bindings.length} bound folder${bindings.length === 1 ? "" : "s"}` : "nothing bound yet — a folder bound with pantheon use <team> --here is served as soon as it is"} · ctrl-c to stop)`)}`);
                 if (argv.includes("--allow-bash")) {
                     console.error(`\x1b[33m  --allow-bash: a woken run may execute commands. Only do this if you trust every\x1b[0m`);
                     console.error(`\x1b[33m  teammate approved to wake this machine (pantheon wake list), since their request is what starts the run.\x1b[0m`);
@@ -4264,7 +4725,11 @@ async function main() {
                 if (!argv.includes("--open"))
                     return;
             }
-            const url = argv.includes("--url") ? await b.boardLinkFor(r.state).catch((e) => die(e.message)) : r.url;
+            const focus = flag("focus");
+            if (focus !== undefined && !b.FOCUS_RE.test(focus))
+                die("--focus takes an act or decision id (a_… or o_…)");
+            const plain = argv.includes("--url") ? await b.boardLinkFor(r.state).catch((e) => die(e.message)) : r.url;
+            const url = focus && r.state.version === VERSION ? b.focusLink(plain, focus) : plain;
             const opened = argv.includes("--no-browser") ? false : await b.openBrowser(url).catch(() => false);
             console.error(`${B("pantheon board")} ${D(r.reused ? "(already running)" : "(started)")}`);
             if (!opened)
@@ -4272,6 +4737,8 @@ async function main() {
             else
                 console.error(D("  opened in your browser · pantheon board --url prints its address · --watch shows it in this terminal"));
             console.error(D(r.state.keep ? "  it stays running" : "  it stops itself after 30 minutes with no open tab"));
+            if (!opened && argv.includes("--open") && !argv.includes("--no-browser"))
+                process.exit(1);
             return;
         }
         case "tray": {
@@ -4694,7 +5161,7 @@ async function main() {
         }
     }
 }
-main().catch((e) => die(describeNetError(e, (() => { try {
+main().catch(async (e) => die(await describeRelayFailure(e, (() => { try {
     return load()?.relay;
 }
 catch {