@join-pantheon/cli 0.33.1 → 0.33.2

package/dist/network.js

@@ -614,6 +614,8 @@ export function explainNetError(e, target, planArg) {
             ? { why: `the connection through the proxy ${shown} was cut`, fix: `the proxy may not allow WebSockets; ask for ${host} to be allowed`, share: "connection reset" }
             : { why: "the connection dropped before the relay answered", fix: "try again", share: "connection reset" };
     }
+    if (UNEXPECTED_REPLY.test(text))
+        return unexpectedReply(text, url ? host : "");
     return null;
 }
 export function describeNetError(e, target, plan) {
@@ -623,4 +625,158 @@ export function describeNetError(e, target, plan) {
     const fix = x ? x.fix.charAt(0).toUpperCase() + x.fix.slice(1) : "";
     return x ? `${x.why}. ${fix}.  (${first})`.replace(/\.\.  \(/, ".  (").replace(/\?\.  \(/, "?  (") : raw;
 }
+export class RelayReplyError extends Error {
+    status;
+    kind;
+    code = "RELAY_UNEXPECTED_REPLY";
+    constructor(status, kind, url) {
+        super(`${url} answered HTTP ${status} with ${kind === "empty" ? "an empty body" : kind === "html" ? "a web page" : "something that is not JSON"}, where the relay always answers JSON`);
+        this.status = status;
+        this.kind = kind;
+        this.name = "RelayReplyError";
+    }
+}
+export function replyKind(body, contentType) {
+    if (!body.trim())
+        return "empty";
+    return /html/i.test(contentType) || /^\s*<(!doctype|html|head|body|\?xml)/i.test(body) ? "html" : "other";
+}
+export async function relayJson(res, url) {
+    const text = await res.text();
+    try {
+        const j = JSON.parse(text);
+        if (j && typeof j === "object" && !Array.isArray(j))
+            return j;
+    }
+    catch { }
+    throw new RelayReplyError(res.status, replyKind(text, res.headers.get("content-type") ?? ""), url ?? (res.url || "the relay"));
+}
+const UNEXPECTED_REPLY = /RELAY_UNEXPECTED_REPLY|Unexpected server response: \d+|answered HTTP \d+/;
+const CHAIN_NOT_PUBLIC = /SELF_SIGNED_CERT_IN_CHAIN|DEPTH_ZERO_SELF_SIGNED_CERT|UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|CERT_UNTRUSTED|self[- ]signed certificate|unable to get local issuer/i;
+export const worthCertificateCheck = (e, o = {}) => {
+    const t = errText(e);
+    const status = replyStatus(t);
+    if (status !== null && status >= 502 && status <= 504)
+        return false;
+    if (UNEXPECTED_REPLY.test(t) || CHAIN_NOT_PUBLIC.test(t))
+        return true;
+    return !!o.nonJsonSeen && /ECONNRESET|socket hang up/i.test(t);
+};
+const replyStatus = (text) => {
+    const m = /Unexpected server response: (\d+)|answered HTTP (\d+)/.exec(text);
+    return m ? Number(m[1] ?? m[2]) : null;
+};
+export const isPantheonHost = (host) => /(^|\.)joinpantheon\.network$/i.test(host.replace(/\.$/, ""));
+function unexpectedReply(text, host) {
+    const status = replyStatus(text);
+    if (status !== null && status >= 502 && status <= 504) {
+        return { why: `the relay's host answered ${status}: the relay is restarting or briefly down`, fix: "try again in a minute; pantheon doctor shows more", share: `relay host answered ${status}` };
+    }
+    const what = /empty body|Unexpected end of JSON input/.test(text) ? `an empty ${status ?? "reply"}`
+        : /web page|Unexpected token '?<|<!doctype|<html/i.test(text) ? "a web page" : status ? `HTTP ${status}` : "something that is not the relay";
+    const allow = !host ? "the relay's address" : isPantheonHost(host) ? "*.joinpantheon.network" : host;
+    return {
+        why: `something other than the relay answered (${what}), which is what an antivirus, a company proxy or a captive portal does when it blocks a site`,
+        fix: `allow ${allow} in your antivirus or proxy (with HTTPS scanning), or ask your IT; pantheon doctor names who signed the connection`,
+        share: "something other than the relay answered",
+    };
+}
+const firstOf = (v) => (Array.isArray(v) ? v[0] : v)?.trim() ?? "";
+export function issuerName(issuer) {
+    const cn = firstOf(issuer?.CN), o = firstOf(issuer?.O);
+    if (cn && o && !cn.toLowerCase().includes(o.toLowerCase()))
+        return `${cn}, ${o}`;
+    return cn || o || firstOf(issuer?.OU) || "an unnamed certificate authority";
+}
+export function judgeCertificate(host, authorized, authorizationError, issuer) {
+    const name = issuerName(issuer);
+    if (authorized)
+        return { host, issuer: name, publicCa: true };
+    const err = authorizationError instanceof Error ? (authorizationError.code ?? authorizationError.message) : String(authorizationError ?? "");
+    return { host, issuer: name, publicCa: CHAIN_NOT_PUBLIC.test(err) ? false : null, ...(err ? { error: err } : {}) };
+}
+export async function checkRelayCertificate(target, opts = {}) {
+    let u;
+    try {
+        u = new URL(target.replace(/^ws/i, "http"));
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "https:")
+        return null;
+    const host = u.hostname.replace(/^\[|\]$/g, "");
+    const port = Number(u.port || 443);
+    const proxy = routeFor(u.href, opts.plan ?? currentPlan());
+    const options = {
+        host, port, ca: opts.ca ?? [...tls.rootCertificates], rejectUnauthorized: false,
+        ...(net.isIP(host) ? {} : { servername: host }),
+    };
+    return new Promise((done) => {
+        let settled = false;
+        let sock = null;
+        const finish = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            sock?.destroy();
+            done(r);
+        };
+        const timer = setTimeout(() => finish(null), opts.timeoutMs ?? 4_000);
+        timer.unref?.();
+        const read = (s) => {
+            sock = s;
+            const c = s.getPeerCertificate(false);
+            if (!c || !Object.keys(c).length)
+                return finish(null);
+            finish(judgeCertificate(host, s.authorized, s.authorizationError, c.issuer));
+        };
+        if (proxy) {
+            tunnelAgent(proxy, true)
+                .createConnection(options, (err, s) => {
+                if (settled) {
+                    s?.destroy();
+                    return;
+                }
+                if (err || !s)
+                    finish(null);
+                else
+                    read(s);
+            });
+        }
+        else {
+            const s = tls.connect(options, () => read(s));
+            sock = s;
+            s.once("error", () => finish(null));
+        }
+    });
+}
+export function interceptionExplanation(c) {
+    if (isPantheonHost(c.host)) {
+        return {
+            why: `your antivirus or proxy (${c.issuer}) intercepts ${c.host}`,
+            fix: "allow *.joinpantheon.network in its web/anti-phishing settings (with HTTPS scanning), or ask your IT",
+            share: "relay intercepted: its certificate is not from a public CA (antivirus or proxy)",
+        };
+    }
+    return {
+        why: `${c.host}'s certificate here does not check out against the public certificate authorities (it names ${c.issuer}): the relay may use a private certificate authority or send an incomplete chain, or an antivirus or proxy may be in between`,
+        fix: `ask whoever runs ${c.host} which it is — a private root goes in NODE_EXTRA_CA_CERTS=/path/to/root.pem; an antivirus or proxy needs ${c.host} allowed`,
+        share: "relay certificate not from a public CA",
+    };
+}
+export async function interceptedText(e, target, check = checkRelayCertificate, o = {}) {
+    if (!target || !worthCertificateCheck(e, o))
+        return null;
+    const c = await check(target).catch(() => null);
+    if (!c || c.publicCa !== false)
+        return null;
+    const x = interceptionExplanation(c);
+    const raw = (e?.message ?? String(e)).split("\n")[0].slice(0, 120);
+    return `${x.why} — ${x.fix}.  (${raw})`;
+}
+export async function describeRelayFailure(e, target, check) {
+    return (await interceptedText(e, target, check)) ?? describeNetError(e, target);
+}
 //# sourceMappingURL=network.js.map

package/dist/notice-linux.js

@@ -46,7 +46,7 @@ export function noticeActions(n) {
     const out = [["default", "Open board"]];
     if (n.kind === "decision" && n.details?.decision)
         out.push(["done", "Done"]);
-    out.push(["board", "Open board"]);
+    out.push(["board", n.focus ? "Approve or decline" : "Open board"]);
     return out;
 }
 export function noticeUrgency(n) {
@@ -157,7 +157,7 @@ export class LinuxAlerts {
             run,
             cli,
             log: deps.log ?? ((l) => console.error(l)),
-            openBoard: deps.openBoard ?? ((env) => openBoardWith(cli, env)),
+            openBoard: deps.openBoard ?? ((env, focus) => openBoardWith(cli, env, focus)),
             sessionEnv: deps.sessionEnv ?? realSessionEnv,
         };
     }
@@ -296,7 +296,7 @@ export class LinuxAlerts {
             else if (action === "board" || action === "default") {
                 const display = this.d.env.DISPLAY || this.d.env.WAYLAND_DISPLAY ? {} : pickDisplay(this.d.sessionEnv());
                 const env = { ...this.d.env, ...display, ...(token ? { XDG_ACTIVATION_TOKEN: token, DESKTOP_STARTUP_ID: token } : {}) };
-                const opening = this.d.openBoard(env).catch(() => false).then(async (opened) => {
+                const opening = this.d.openBoard(env, s.notice.focus).catch(() => false).then(async (opened) => {
                     if (!opened)
                         await this.note("Open the board in a terminal", "Run pantheon board (or pantheon brief) to see everything that needs you.");
                 });
@@ -436,7 +436,7 @@ export function writeHudAction(home, hud) {
     renameSync(tmp, f);
     return f;
 }
-function openBoardWith(cli, env) {
+function openBoardWith(cli, env, focus) {
     return new Promise((done) => {
         const [file, ...args] = cli;
         let settled = false;
@@ -445,8 +445,9 @@ function openBoardWith(cli, env) {
             done(v);
         } };
         let child;
+        const at = focus && /^[ao]_[A-Za-z0-9]{6,48}$/.test(focus) ? ["--focus", focus] : [];
         try {
-            child = spawn(file, [...args, "board", "--open"], { env, stdio: "ignore", detached: true });
+            child = spawn(file, [...args, "board", "--open", ...at], { env, stdio: "ignore", detached: true });
         }
         catch {
             settle(false);

package/dist/notice-windows.js

@@ -42,7 +42,7 @@ export function toastButtons(notice, key) {
     else if (d.act) {
         add("Show details", buildUri("details", { act: d.act, decision: d.decision, space }, key));
     }
-    add("Open board", buildUri("board", {}, key));
+    add(notice.focus ? "Approve or decline" : "Open board", buildUri("board", notice.focus ? { focus: notice.focus } : {}, key));
     return out;
 }
 export function toastTag(notice) {
@@ -60,7 +60,7 @@ export function toastFields(notice, key) {
     return {
         lines,
         who: toastText(notice.who, TOAST_CAPS.who),
-        launch: buildUri("board", {}, key),
+        launch: (notice.focus && buildUri("board", { focus: notice.focus }, key)) || buildUri("board", {}, key),
         buttons: toastButtons(notice, key).map((b) => ({ content: toastText(b.content, TOAST_CAPS.button), uri: b.uri })),
         scenario: notice.ttl === 0 ? "reminder" : "",
         duration: notice.ttl !== 0 && notice.ttl > 7 ? "long" : "",

package/dist/notice.js

@@ -174,4 +174,17 @@ export function composeWorker(run, ctx) {
             : {}),
     };
 }
+export function composeWakeAsk(a) {
+    const where = a.mac ? "in the menu bar, or on the board (pantheon board)" : "on the board";
+    return {
+        kind: "worker",
+        who: fit(`${a.member} · waiting on you`, BUDGET.who),
+        heading: fit(`${a.member} is waiting on your approval`, BUDGET.heading),
+        context: fit(a.space, BUDGET.context),
+        body: fit(`${a.member} asked: ${plain(a.what)} — your worker takes requests only from teammates you approved here. Approve or decline ${where}.`, BUDGET.body),
+        ttl: 0,
+        sound: true,
+        focus: a.focus,
+    };
+}
 //# sourceMappingURL=notice.js.map

package/dist/notifier.js

@@ -9,12 +9,17 @@ import { fileURLToPath } from "node:url";
 import { PantheonClient } from "./client.js";
 import { CONFIG_DIR } from "./config.js";
 import { loadProfile } from "./profile.js";
-import { APP_TOOLS, composeDecision, composeDelivery, TOOL_LABELS } from "./notice.js";
+import { APP_TOOLS, composeDecision, composeDelivery, composeWakeAsk, TOOL_LABELS } from "./notice.js";
+import { loadPolicy } from "./worker-policy.js";
+import { wakeAlerted } from "./continued.js";
 import { cliOnPath, detectAvailable } from "./agents.js";
 import { whichPantheon } from "./service.js";
 export const DEFAULT_REMINDER_MS = 4 * 60 * 60 * 1_000;
 export const MAX_REMINDERS = 4;
 const DAY_MS = 24 * 60 * 60 * 1_000;
+export function wakeAskWhat(body) {
+    return /answer while you are away:\s*(.+)$/m.exec(body)?.[1]?.trim() ?? body.split("\n")[0] ?? "";
+}
 export function humanObligations(obligations, member) {
     return obligations.filter((o) => o.kind === "HUMAN" && o.owner === `human:${member}`);
 }
@@ -164,10 +169,32 @@ export class HumanNotifier {
                 const labelled = this.opts.label ? { ...n, context: n.context ? `${this.opts.label} · ${n.context}` : this.opts.label } : n;
                 return platform() === "darwin" ? labelled : { ...labelled, space: this.cfg.space };
             };
+            let asks = {};
+            try {
+                asks = this.opts.wakeAsks ? this.opts.wakeAsks() : loadPolicy().wakeAsks ?? {};
+            }
+            catch {
+                asks = {};
+            }
             for (const obligation of due) {
                 const isReminder = state.notified_at[obligation.id] !== undefined;
                 const act = client.seenAct(obligation.ref);
-                const notice = withLabel(composeDecision(obligation, act, obligation.goal ? client.goals.get(obligation.goal) : undefined, peerOf(act?.from), { tools, preferred: preferredTool(profile, tools), now: now(), member: this.cfg.member }));
+                const wake = asks[obligation.ref];
+                const workerSaid = (w) => { try {
+                    return this.opts.wakeAlerted ? this.opts.wakeAlerted(w, obligation.ref) : wakeAlerted(w.team, w.member, obligation.ref);
+                }
+                catch {
+                    return false;
+                } };
+                if (wake && !isReminder && workerSaid(wake)) {
+                    state.notified_at[obligation.id] = now();
+                    dirty = true;
+                    this.opts.log(`> ${obligation.id}: the worker alerted this one itself (may ${wake.member} start work here)`);
+                    continue;
+                }
+                const notice = wake
+                    ? withLabel(composeWakeAsk({ member: wake.member, what: wakeAskWhat(act?.body ?? obligation.body), space: this.opts.label ? "" : this.cfg.space, focus: obligation.ref, mac: platform() === "darwin" }))
+                    : withLabel(composeDecision(obligation, act, obligation.goal ? client.goals.get(obligation.goal) : undefined, peerOf(act?.from), { tools, preferred: preferredTool(profile, tools), now: now(), member: this.cfg.member }));
                 const ok = await send(notice);
                 if (ok) {
                     state.notified_at[obligation.id] = now();

package/dist/notify.js

@@ -95,6 +95,17 @@ export function readIntent(home) {
         return null;
     }
 }
+export function repairNote(repairs) {
+    if (!repairs || repairs < 1)
+        return null;
+    if (repairs === 1)
+        return { said: "put back once (it had been removed)", why: null, recurring: false };
+    return {
+        said: `put back ${repairs} times after something removed it`,
+        why: "something on this machine rewrites ~/.claude/settings.json and drops the hooks key",
+        recurring: true,
+    };
+}
 export function writeIntent(next, home) {
     try {
         const f = intentPath(home);

package/dist/onboard-defaults.js

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { validUsername } from "./accounts.js";
+import { validEmail, validUsername } from "./accounts.js";
 export function gitConfigValue(key) {
     try {
         return execFileSync("git", ["config", "--get", key], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 }).trim();
@@ -15,4 +15,40 @@ export function suggestUsername(email, n) {
     const u = n ? `${local}${n}` : local;
     return validUsername(u) ? u : "";
 }
+const GITHUB_NOREPLY = /@users\.noreply\.github\.com$/i;
+export function isGithubNoreply(email) {
+    return GITHUB_NOREPLY.test(email.trim());
+}
+export function githubNoreplyLogin(email) {
+    if (!isGithubNoreply(email))
+        return "";
+    const local = email.trim().split("@")[0];
+    return /^(?:\d+\+)?([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)$/i.exec(local)?.[1]?.toLowerCase() ?? "";
+}
+export function emailSuggestion(gitEmail) {
+    const e = gitEmail.trim();
+    return validEmail(e) && !isGithubNoreply(e) ? e : "";
+}
+export function usernameSuggestion(email, gitEmail = "", n) {
+    const fromEmail = isGithubNoreply(email) ? "" : suggestUsername(email, n);
+    if (fromEmail)
+        return fromEmail;
+    const login = githubNoreplyLogin(email) || githubNoreplyLogin(gitEmail);
+    if (!login)
+        return "";
+    const u = n ? `${login.slice(0, 28)}${n}` : login.slice(0, 32);
+    return validUsername(u) ? u : "";
+}
+export function signinCommand(launcher, platform = process.platform) {
+    return pantheonCommand(launcher, "signin", platform);
+}
+export function pantheonCommand(launcher, rest, platform = process.platform) {
+    if (!launcher)
+        return `pantheon ${rest}`;
+    if (!/\s/.test(launcher))
+        return `${launcher} ${rest}`;
+    if (platform === "win32")
+        return `& "${launcher}" ${rest}   (Command Prompt: "${launcher}" ${rest})`;
+    return `"${launcher}" ${rest}`;
+}
 //# sourceMappingURL=onboard-defaults.js.map

package/dist/pins.js

@@ -74,7 +74,7 @@ export function writeWhole(f, text) {
         throw e;
     }
 }
-export function observeMembers(p, team, members, me, at = Date.now()) {
+export function observeMembers(p, team, members, me, at = Date.now(), vouch) {
     const t = (p.teams[team] ??= { members: dict() });
     const out = [];
     const mine = fingerprint(me.publicKey);
@@ -98,6 +98,12 @@ export function observeMembers(p, team, members, me, at = Date.now()) {
                 delete cur.pending;
             continue;
         }
+        const by = vouch?.(m, fp, p) ?? null;
+        if (by) {
+            t.members[m.member] = { fp, ...(key ? { key } : {}), since: at, ...(cur.signs ? { signs: cur.signs } : {}) };
+            out.push({ member: m.member, kind: "moved", fp, was: cur.fp, by });
+            continue;
+        }
         if (cur.pending?.fp !== fp) {
             cur.pending = { fp, ...(key ? { key } : {}), since: at };
             out.push({ member: m.member, kind: "changed", fp, was: cur.fp });

package/dist/plans.js

@@ -52,4 +52,27 @@ export function planLimits(plans, plan, override) {
     return plans[plan] ?? plans["free"] ?? DEFAULT_PLANS["free"];
 }
 export const fmtLimit = (n) => n >= UNLIMITED ? "unlimited" : String(n);
+export function lastSlotNotice(plan) {
+    if (!plan || plan.limits.spaces >= UNLIMITED)
+        return null;
+    if (plan.usage.spaces + 1 !== plan.limits.spaces)
+        return null;
+    return `this is the last team your ${plan.name} plan allows (${plan.limits.spaces}); if one of your teams was only a test, pantheon space delete <name> frees its place`;
+}
+export function ownedTeamsIn(message) {
+    const m = /you own ((?:"[^"]+"(?:, )?)+)/.exec(message);
+    return m ? [...m[1].matchAll(/"([^"]+)"/g)].map((x) => x[1]) : [];
+}
+export function spaceLimitAdvice(teams) {
+    if (!teams.length)
+        return ["Free a slot: pantheon space delete <team> --yes  (from a machine in that team), or upgrade at https://www.joinpantheon.network"];
+    const out = ["Free a slot by deleting a team you no longer need (it ends that team for everyone in it):"];
+    const width = Math.max(...teams.map((t) => t.name.length));
+    for (const t of teams) {
+        const note = !t.here ? "not on this machine: run it from one that is in it" : t.alone ? "nobody else is in it" : t.alone === false ? "others are in it" : "";
+        out.push(`  pantheon space delete ${t.name.padEnd(width)} --yes${note ? `   (${note})` : ""}`);
+    }
+    out.push("Then run the same pantheon start again. Or upgrade at https://www.joinpantheon.network");
+    return out;
+}
 //# sourceMappingURL=plans.js.map

package/dist/protocol.js

@@ -20,6 +20,10 @@ export const ACTS = [
     "CLOSE",
 ];
 export const SENDABLE = ACTS.filter((a) => a !== "JOIN" && a !== "LEAVE");
+export const UPKEEP_AGENT = "pantheon-upkeep";
+export function siblingSessions(roster, member, session) {
+    return (roster.find((m) => m.id === member)?.sessions ?? []).filter((s) => s.id !== session && s.agent !== UPKEEP_AGENT);
+}
 export const LIMITS = {
     bodyChars: 32000,
     summaryRequiredOver: 2000,
@@ -132,6 +136,7 @@ export const Hello = z.object({
     repo: z.string().regex(/^[rl]_[0-9a-f]{16}$/).optional(),
     repo_origin: z.string().max(200).optional(),
     delegate: DelegateCertSchema.optional(),
+    upkeep: z.boolean().optional(),
 });
 export const OrganizationProfileSchema = z.object({
     version: z.literal(1),

package/dist/quickstart.js

@@ -4,7 +4,7 @@ import { createServer } from "node:net";
 import { basename, join as pathJoin, resolve as resolvePath } from "node:path";
 import { homedir, hostname, platform, userInfo } from "node:os";
 import { lookup } from "node:dns/promises";
-import { describeNetError } from "./network.js";
+import { describeRelayFailure, interceptedText, RelayReplyError } from "./network.js";
 import { PantheonClient } from "./client.js";
 import { holdsRepo } from "./repo-find.js";
 import { folderFacts, folderRefusal, folderRefusalHere, isInside, isTemporaryRefusal } from "./folder-guard.js";
@@ -13,7 +13,7 @@ import { commandsChosen, loadProfile, wakeChosen, wakeDefault } from "./profile.
 import { newKeypair } from "./identity.js";
 import { installForUser } from "./install.js";
 import { writeIntent, installHooks } from "./notify.js";
-import { detectAvailable, agentById, agentsNeedingUnsandboxed } from "./agents.js";
+import { detectAvailable, agentById, agentsNeedingUnsandboxed, folderReaderLine } from "./agents.js";
 import { installService, servicesUnavailable } from "./service.js";
 import { clearTrayQuit } from "./win-host.js";
 import { ensureNativeNotifier } from "./notifier.js";
@@ -147,16 +147,16 @@ export function wireUp(opts, deps = {}) {
                     warnings.push(`the worker is installed but not running (${why}) — this machine cannot answer the team while you are away. Try \`pantheon service restart worker\``);
                 }
                 else {
-                    tools.push({ tool: "worker", status: `on — answers peers from this folder while you are away (it reads it; anything it writes goes to a drafts folder for you)` });
-                    granted.push(`${wakeChosen() === "approved" ? "A teammate you approve from this machine (pantheon wake allow <name>)" : "Your teammates"} can start an agent run that READS ${project} and answers them. It never changes that folder: drafts go to a folder of its own for you to review.`);
-                    const hasClaude = (() => { try {
-                        return detectAvailable().some((a) => a.backend.id === "claude-code");
+                    tools.push({ tool: "worker", status: `on — answers peers from this folder while you are away (it works in a copy; anything it writes is kept as drafts for you)` });
+                    granted.push(`${wakeChosen() === "approved" ? "A teammate you approve from this machine (pantheon wake allow <name>)" : "Your teammates"} can start an agent run that READS a copy of ${project} and answers them. It never changes that folder: anything it writes is kept as drafts for you to review.`);
+                    const reader = (() => { try {
+                        return folderReaderLine(detectAvailable());
                     }
                     catch {
-                        return true;
+                        return null;
                     } })();
-                    if (!hasClaude)
-                        warnings.push(`answering from a plain folder while you are away needs Claude Code (claude), and it is not installed here — until it is, teammates' requests for this folder wait for your live session`);
+                    if (reader && !reader.ok)
+                        warnings.push(`${reader.line} — until then, teammates' requests for this folder wait for your live session`);
                 }
             }
             catch (e) {
@@ -352,6 +352,10 @@ export async function probeRelay(url, timeoutMs, fetchImpl = fetch) {
     const health = url.replace(/^ws/i, "http").replace(/\/+$/, "") + "/health";
     try {
         const r = await fetchImpl(health, { signal: AbortSignal.timeout(timeoutMs) });
+        if (r.ok && /html/i.test(r.headers.get("content-type") ?? "")) {
+            void r.body?.cancel().catch(() => { });
+            return { ok: false, error: new RelayReplyError(r.status, "html", health) };
+        }
         if (r.ok)
             return { ok: true };
         return { ok: false, error: new Error(`${health} answered HTTP ${r.status}`) };
@@ -421,7 +425,7 @@ export async function start(opts) {
     if (chosen && !hostHere) {
         const probe = await probeRelay(reach.url, opts.remoteTimeoutMs ?? 10_000, opts.fetchImpl);
         if (!probe.ok) {
-            return nothing(`cannot reach the relay at ${reach.url}: ${describeNetError(probe.error, reach.url)}` +
+            return nothing(`cannot reach the relay at ${reach.url}: ${await describeRelayFailure(probe.error, reach.url)}` +
                 (place === "remote" ? `\n    If that address is a tunnel to this machine, start the tunnel first (cloudflared tunnel --url http://localhost:${opts.port}) and run this again — Pantheon hosts the relay here when it sees the tunnel.` : ""));
         }
         opts.log(`  relay      ${reach.url}   (${reach.how})`);
@@ -522,11 +526,13 @@ export async function start(opts) {
             client.close();
         }
     };
+    if (!reuse && opts.beforeCreate)
+        await opts.beforeCreate(cfg).catch(() => { });
     try {
         await claim(cfg);
     }
     catch (e) {
-        const msg = e.message;
+        const msg = (await interceptedText(e, cfg.relay)) ?? e.message;
         const nameTaken = !reuse && /BAD_TOKEN/.test(msg);
         if (nameTaken && !opts.space) {
             const alt = `${cfg.space}-${cfg.member}`;

package/dist/refusal.js

@@ -1,7 +1,7 @@
 const NET_CODE = /^(ECONN\w*|ENOTFOUND|ETIMEDOUT|EAI_\w+|EPROTO|EHOSTUNREACH|ENETUNREACH|EPIPE|ECONNRESET|UND_ERR_\w*|ERR_\w+)$/;
 const FIX = {
-    NOT_SIGNED_IN: "sign in on this machine: pantheon login --email you@work.com (or pantheon signup), then try again",
-    KEY_MISMATCH: "a member of the team runs  pantheon admit <you> --forget  and sends you a new invite (or pick another name with --me)",
+    NOT_SIGNED_IN: "sign in on this machine, in a terminal: pantheon signin (your email, then the emailed code — check spam), then try again",
+    KEY_MISMATCH: "if this is you on a new machine: run  pantheon recover <team>  here in a terminal (it signs you in with your email first) to move your seat; otherwise a member of the team runs  pantheon admit <you> --forget  and sends you a new invite (or pick another name with --me)",
     REVOKED: "ask a member of the team to let you back in: pantheon admit <you>",
     PLAN_LIMIT: "the team's owner frees a seat (pantheon invite --revoke all cancels unused invites) or upgrades the plan",
     BAD_TOKEN: "this machine's copy of the team token is wrong — rejoin with a fresh invite: pantheon join <invite>",
@@ -36,7 +36,7 @@ export function signInHint(code, relay, hosted = process.env.PANTHEON_DEFAULT_RE
     catch {
         return "";
     }
-    return `\n  This team is on ${relay}, so sign in there:  pantheon login --email you@work.com --relay ${relay}` +
-        `\n  (new here: pantheon signup --email you@work.com --username you --relay ${relay})`;
+    return `\n  This team is on ${relay}, so sign in there:  pantheon signin --relay ${relay}   (in a terminal: your email, then the emailed code — check spam)` +
+        `\n  Or two commands: pantheon login --email you@work.com --relay ${relay}   (new here: pantheon signup --email you@work.com --username you --relay ${relay}), then pantheon verify <code>`;
 }
 //# sourceMappingURL=refusal.js.map