@join-pantheon/cli 0.33.1 → 0.33.2

package/dist/relay.js

@@ -18,6 +18,7 @@ import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, s
 import { fmtLimit, inviteLimit, parseLimits, planLimits, PLAN_NAME } from "./plans.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
 import { routeDecision } from "./profile.js";
+const presentSessions = (m) => [...m.sessions.values()].filter((s) => !s.quiet);
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
     let busy = false;
@@ -272,6 +273,8 @@ function versionBelow(a, b) {
     }
     return false;
 }
+export const RECOVERY_PROOF_MS = 15 * 60_000;
+const RECOVERY_KEEP_MS = 7 * 86_400_000;
 const LOCKED_MSG = "too many wrong codes from this device or your network in the last hour — wait an hour, then request a new code";
 const STORAGE_UNHEALTHY_MS = 5 * 60_000;
 function isStorageError(e) {
@@ -465,6 +468,7 @@ export class Relay {
     deletedSpaces = new Map();
     authEpoch = 0;
     rotateOnRemove;
+    recoveryWaitMs;
     backupTimer;
     installerGate;
     upgradeHold;
@@ -510,6 +514,10 @@ export class Relay {
             spaceMinAgeMs: opts.spaceLimits?.spaceMinAgeMs ?? LIMITS.spaceMinAgeMs,
         };
         this.rotateOnRemove = opts.rotateOnRemove ?? process.env.PANTHEON_ROTATE_ON_REMOVE === "1";
+        {
+            const h = Number(process.env.PANTHEON_RECOVERY_WAIT_HOURS ?? "24");
+            this.recoveryWaitMs = opts.recoveryWaitMs ?? (Number.isFinite(h) && h >= 0 ? h : 24) * 3_600_000;
+        }
         this.upgradeHold = upgradeHoldFrom(opts.upgradeHoldAt ?? process.env.PANTHEON_HOLD_UPGRADES_AT, VERSION, this.log);
         this.installerGate = opts.installerGate ?? new InstallerGate({ log: this.log, ...(this.upgradeHold ? { version: this.upgradeHold } : {}) });
         this.busyTtlMs = opts.activityBusyTtlMs ?? LIMITS.activityBusyTtlMs;
@@ -624,8 +632,8 @@ export class Relay {
             const detail = (s) => ({
                 name: s.name,
                 members: s.members.size,
-                online: [...s.members.values()].filter((m) => m.sessions.size > 0).length,
-                sessions: [...s.members.values()].reduce((n, m) => n + m.sessions.size, 0),
+                online: [...s.members.values()].filter((m) => presentSessions(m).length > 0).length,
+                sessions: [...s.members.values()].reduce((n, m) => n + presentSessions(m).length, 0),
                 goals: s.goals.size,
                 seq: s.ledger.head,
             });
@@ -982,6 +990,23 @@ export class Relay {
             this.noteAccountRemoval(who.account.username);
             return this.json(res, 200, { ok: true });
         }
+        if (url.pathname === "/account/recover" || url.pathname === "/account/recover/withdraw") {
+            if (!this.authRateOk(ip))
+                return this.json(res, 429, { error: "too many attempts from your network — wait a minute and try again" });
+            const method = url.pathname === "/account/recover" && req.method === "GET" ? "GET" : "POST";
+            if (req.method !== method)
+                return this.json(res, 405, { error: "method not allowed" });
+            const who = this.verifySignedAccount(url, method, url.pathname, ip);
+            if (!who)
+                return this.json(res, 403, { error: "this request must be signed by a device on the account" });
+            if (method === "GET")
+                return this.json(res, 200, { seats: this.recoverableSeats(who.account, who.device) });
+            const name = url.searchParams.get("space") ?? "";
+            const r = url.pathname === "/account/recover/withdraw"
+                ? this.withdrawRecovery(who.account, who.device, name, ip)
+                : this.recoverSeat(who.account, who.device, name, ip);
+            return this.json(res, r.status, r.body);
+        }
         if (url.pathname === "/audit" && req.method === "GET") {
             const who = this.verifySignedAccount(url, "GET", "/audit", ip);
             if (!who)
@@ -1332,7 +1357,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
         for (const sp of this.spaces.values()) {
             seen.add(safeOf(sp.name));
-            const sessions = [...sp.members.values()].flatMap((m) => [...m.sessions.values()]);
+            const sessions = [...sp.members.values()].flatMap((m) => presentSessions(m));
             out.push(spaceHealth({
                 name: sp.name, records: sp.ledger.all(), members: sp.allow.all(),
                 online: sessions.length, interactive: sessions.filter((x) => x.role === "interactive").length,
@@ -1373,7 +1398,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             const name = sp.name;
             out.set(safeOf(name), {
                 name, live: true, id: sp.allow.peekId(),
-                members: sp.allow.all().filter((e) => e.admitted).length, online: [...sp.members.values()].filter((m) => m.sessions.size > 0).length,
+                members: sp.allow.all().filter((e) => e.admitted).length, online: [...sp.members.values()].filter((m) => presentSessions(m).length > 0).length,
                 acts: sp.ledger.head, goals: sp.goals.size, open_goals: [...sp.goals.values()].filter((g) => g.state !== "CLOSED").length, obligations: sp.obligations.size,
                 last: sp.lastTouch, bytes: size(safeOf(name)),
                 activity: activity(sp.ledger.all(), now, (r) => `${name}/${r.from}`), refusals: sp.store.refusals,
@@ -1703,6 +1728,239 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         }
         this.log(`[${sp.name}] * space token rotated (${why}); sent to ${told} live session${told === 1 ? "" : "s"}`);
     }
+    wakeForRelay(name) {
+        const live = this.live(name);
+        if (live)
+            return live;
+        if (!name || this.aliasOf(name) || !this.spaceOnDisk(name))
+            return null;
+        try {
+            const allow = new Allowlist(this.dataDir, safeName(name));
+            let token = allow.currentTokenFromInvites();
+            if (!token) {
+                token = randomBytes(16).toString("hex");
+                allow.rotateToken(token);
+            }
+            return this.getOrCreateSpace(name, token);
+        }
+        catch (e) {
+            this.noteStorageFailure(`[${name}] opening it for a recovery`, e);
+            return null;
+        }
+    }
+    rosterOf(name) {
+        const live = this.live(name);
+        if (live)
+            return live.allow;
+        if (!name || this.aliasOf(name) || !this.spaceOnDisk(name))
+            return null;
+        try {
+            return new Allowlist(this.dataDir, safeName(name));
+        }
+        catch {
+            return null;
+        }
+    }
+    allRosters() {
+        const out = [];
+        const seen = new Set();
+        for (const sp of this.spaces.values()) {
+            seen.add(safeName(sp.name));
+            out.push({ name: sp.name, allow: sp.allow, live: sp });
+        }
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir).filter((f) => f.endsWith(".members.json"));
+        }
+        catch { }
+        for (const f of files) {
+            const stem = f.slice(0, -".members.json".length);
+            if (seen.has(stem))
+                continue;
+            try {
+                const m = statSync(join(this.dataDir, f)).mtimeMs;
+                let c = this.rosterCache.get(stem);
+                if (!c || c.mtimeMs !== m) {
+                    c = { mtimeMs: m, allow: new Allowlist(this.dataDir, stem) };
+                    this.rosterCache.set(stem, c);
+                }
+                out.push({ name: c.allow.recordedName() ?? stem, allow: c.allow, live: undefined });
+            }
+            catch { }
+        }
+        return out;
+    }
+    rosterCache = new Map();
+    recoverableSeats(acct, device) {
+        const A = this.accounts;
+        const u = acct.username;
+        const out = [];
+        for (const { name, allow } of this.allRosters()) {
+            const e = allow.get(u);
+            if (!e?.admitted)
+                continue;
+            const founder = allow.founder() === u;
+            const alone = !allow.all().some((x) => x.admitted && x.member !== u);
+            const fp = fingerprint(e.publicKey);
+            if (e.publicKey === device.pubkey) {
+                const inv = this.openRecoveryInvite(allow, u);
+                out.push({ space: name, state: inv ? "ready" : "here", founder, alone, fp, ...(inv ? { invite: inv.token } : {}) });
+                continue;
+            }
+            const pend = allow.recoveryOf(u);
+            if (pend && pend.pubkey === device.pubkey) {
+                out.push({ space: name, state: "waiting", founder, alone, fp, due_at: pend.due_at });
+                continue;
+            }
+            out.push({ space: name, state: A.wasDeviceOf(acct.id, fp, e.moved?.at ?? e.first_seen) ? "movable" : "unproven", founder, alone, fp });
+        }
+        return out.sort((a, b) => a.space.localeCompare(b.space));
+    }
+    openRecoveryInvite(allow, member) {
+        const all = allow.invites;
+        for (const i of all.values())
+            if (i.recovery_for === member && !i.used_by && Date.now() < i.expires_at)
+                return i;
+        return null;
+    }
+    recoverSeat(acct, device, name, ip) {
+        const A = this.accounts;
+        const u = acct.username;
+        if (!name)
+            return { status: 400, body: { error: "which team? pantheon recover <team>" } };
+        const noSeat = { status: 404, body: { reason: "no_seat", error: `you (${u}) have no seat in a team called "${name}" on this relay — pantheon recover  lists the ones you have` } };
+        const roster = this.rosterOf(name);
+        const seat = roster?.get(u);
+        if (!roster || !seat?.admitted)
+            return noSeat;
+        const known = seat.publicKey === device.pubkey || roster.recoveryOf(u)?.pubkey === device.pubkey;
+        if (!known) {
+            const refused = this.recoveryProofRefusal(A, acct, device, name, seat, roster.founder() === u);
+            if (refused)
+                return refused;
+        }
+        const sp = this.wakeForRelay(name);
+        const e = sp?.allow.get(u);
+        if (!sp || !e?.admitted)
+            return noSeat;
+        if (e.publicKey === device.pubkey) {
+            const inv = this.openRecoveryInvite(sp.allow, u) ?? this.mintRecoveryInvite(sp, u);
+            return { status: 200, body: { state: "moved", space: sp.name, invite: inv.token, how: e.moved?.how ?? null } };
+        }
+        const pend = sp.allow.recoveryOf(u);
+        const now = Date.now();
+        if (pend && pend.pubkey === device.pubkey) {
+            if (now >= pend.due_at) {
+                if (now - pend.due_at > RECOVERY_KEEP_MS) {
+                    sp.allow.cancelRecovery(u);
+                    return { status: 410, body: { reason: "lapsed", error: `that request lapsed (nobody finished it within a week of its time) — ask again: pantheon recover ${sp.name}` } };
+                }
+                const inv = this.completeRecovery(sp, u, device.pubkey, "waited", null, null, ip, acct.id);
+                return { status: 200, body: { state: "moved", space: sp.name, invite: inv.token, how: "waited" } };
+            }
+            return { status: 202, body: { state: "waiting", space: sp.name, due_at: pend.due_at, fp: pend.fp, others: this.othersIn(sp, u) } };
+        }
+        const again = this.recoveryProofRefusal(A, acct, device, sp.name, e, sp.allow.founder() === u);
+        if (again)
+            return again;
+        const oldFp = fingerprint(e.publicKey);
+        const others = this.othersIn(sp, u);
+        if (!others.length) {
+            const inv = this.completeRecovery(sp, u, device.pubkey, "alone", null, null, ip, acct.id);
+            return { status: 200, body: { state: "moved", space: sp.name, invite: inv.token, how: "alone" } };
+        }
+        const r = {
+            member: u, pubkey: device.pubkey, fp: device.fingerprint, label: device.label,
+            account: acct.id, requested_at: now, due_at: now + this.recoveryWaitMs,
+        };
+        sp.allow.requestRecovery(r);
+        if (this.email.sendNotice) {
+            void this.email.sendNotice(acct.email, `A request to move your seat in ${sp.name}`, `A device signed in to your Pantheon account ("${r.label}", key ${r.fp}) asked to move your seat in the team "${sp.name}" to it. ` +
+                `It moves ${new Date(r.due_at).toUTCString()} unless someone cancels, or sooner if a teammate confirms it.\n\n` +
+                `If this was you, nothing to do. If it was not: on a machine that still holds your seat, run  pantheon recover cancel ${u}  — and secure this email account, since whoever asked could read its sign-in code.`).catch(() => false);
+        }
+        A.audit({ event: "seat_recovery_requested", actor_account: acct.id, space: sp.name, target: u, detail: `${oldFp} → ${r.fp}`, ip });
+        this.log(`[${sp.name}] ? RECOVERY ${u}: ${oldFp} → ${r.fp} (${r.label}), due ${new Date(r.due_at).toISOString()}`);
+        const hours = Math.round(this.recoveryWaitMs / 3_600_000);
+        this.commit(sp, {
+            from: RELAY_MEMBER, act: "NOTE", to: null, goal: null, ref: null,
+            body: `${u} asked to move their seat in this team to a new device ("${r.label}", key ${r.fp}), after signing in with the code emailed to their account. ` +
+                `It moves ${hours ? `in ${hours} hour${hours === 1 ? "" : "s"}` : "when they ask again"} unless someone cancels, or sooner when a teammate confirms it. ` +
+                `If you have checked with ${u} (a call, or a channel you trust) that the new key is theirs:  pantheon recover confirm ${u} --space ${sp.name}. ` +
+                `If it is not them:  pantheon recover cancel ${u} --space ${sp.name}.`,
+            meta: { notice: "seat_recovery", recovery: { member: u, fp: r.fp, from_fp: oldFp, state: "waiting", due_at: r.due_at } },
+        });
+        this.broadcast(sp, { t: "members", members: this.members(sp) });
+        return { status: 202, body: { state: "waiting", space: sp.name, due_at: r.due_at, fp: r.fp, others } };
+    }
+    recoveryProofRefusal(A, acct, device, name, seat, founder) {
+        const proof = A.lastEmailProof(acct.id, device.fingerprint);
+        if (!proof || Date.now() - proof > RECOVERY_PROOF_MS) {
+            return { status: 403, body: { reason: "sign_in_again", error: `first prove it is you: run  pantheon recover ${name}  in a terminal (it emails a code to ${acct.email} and asks for it), or sign in with  pantheon signin  and within ${RECOVERY_PROOF_MS / 60_000} minutes run  pantheon recover ${name}  again` } };
+        }
+        const oldFp = fingerprint(seat.publicKey);
+        if (!A.wasDeviceOf(acct.id, oldFp, seat.moved?.at ?? seat.first_seen)) {
+            this.log(`[${name}] ! recovery refused for ${acct.username}: the seat's key ${oldFp} was not a device of their account when the seat was taken`);
+            return { status: 403, body: { reason: "unproven", error: `the key holding your seat in "${name}" (${oldFp}) was not signed in to this account when the seat was taken (an account deleted and made again is a new account, and records over a year old are gone), so the relay cannot tell it was yours. ` +
+                        (founder ? `A founder's seat cannot be handed over any other way: start a new team (pantheon start) and invite your teammates to it.` : `A teammate who has checked it is you can retire it instead (pantheon admit ${acct.username} --forget) and invite you again.`) } };
+        }
+        return null;
+    }
+    withdrawRecovery(acct, device, name, ip) {
+        const sp = name && this.rosterOf(name)?.recoveryOf(acct.username)?.pubkey === device.pubkey ? this.wakeForRelay(name) : null;
+        const pend = sp?.allow.recoveryOf(acct.username);
+        if (!sp || !pend || pend.pubkey !== device.pubkey)
+            return { status: 404, body: { reason: "nothing_waiting", error: "this machine has no seat move waiting in that team" } };
+        this.endRecovery(sp, acct.username, `withdrawn by ${acct.username} from the new device`, acct.username, ip);
+        return { status: 200, body: { state: "withdrawn", space: sp.name } };
+    }
+    othersIn(sp, member) {
+        return sp.allow.all().filter((x) => x.admitted && x.member !== member).map((x) => x.member);
+    }
+    endRecovery(sp, member, why, actor, ip) {
+        const r = sp.allow.cancelRecovery(member);
+        if (!r)
+            return;
+        this.accounts?.audit({ event: "seat_recovery_cancelled", actor_account: this.accounts.accountByUsername(actor)?.id ?? null, space: sp.name, target: member, detail: `${r.fp}: ${why}`, ip });
+        this.log(`[${sp.name}] - RECOVERY of ${member} to ${r.fp} ended: ${why}`);
+        this.commit(sp, {
+            from: RELAY_MEMBER, act: "NOTE", to: null, goal: null, ref: null,
+            body: `${member}'s seat stays on its current key: the request to move it to ${r.fp} was ${why}.`,
+            meta: { notice: "seat_recovery", recovery: { member, fp: r.fp, state: "ended" } },
+        });
+        this.broadcast(sp, { t: "members", members: this.members(sp) });
+    }
+    completeRecovery(sp, member, pubkey, how, by, vouch, ip, accountId) {
+        const before = sp.allow.get(member);
+        const fromFp = fingerprint(before.publicKey);
+        const e = sp.allow.moveSeat(member, pubkey, { at: Date.now(), how, ...(by ? { by } : {}), ...(vouch ? { vouch } : {}) });
+        if (!e)
+            throw new Error(`no admitted seat for ${member} to move`);
+        const live = sp.members.get(member);
+        for (const s of live?.sessions.values() ?? [])
+            this.hangUp(s.ws, "KEY_MISMATCH");
+        live?.sessions.clear();
+        if (this.rotateOnRemove)
+            this.rotateSpaceToken(sp, `${member}'s seat moved to a new key`);
+        const inv = this.mintRecoveryInvite(sp, member);
+        const toFp = fingerprint(pubkey);
+        this.accounts?.audit({ event: "seat_recovered", actor_account: accountId ?? this.accounts.accountByUsername(member)?.id ?? null, space: sp.name, target: member, detail: `${fromFp} → ${toFp} (${how}${by ? ` by ${by}` : ""})`, ip });
+        this.log(`[${sp.name}] * RECOVERED ${member}: ${fromFp} → ${toFp} (${how}${by ? ` by ${by}` : ""})`);
+        const word = how === "alone" ? "alone in the team" : how === "confirmed" ? `confirmed by ${by}` : "nobody cancelled in the time it waited";
+        this.commit(sp, {
+            from: RELAY_MEMBER, act: "NOTE", to: null, goal: null, ref: null,
+            body: `${member} moved to a new device: their seat now has key ${toFp} (was ${fromFp}). They signed in with the code emailed to their account; ${word}.` +
+                (how === "confirmed" ? "" : how === "waited" ? ` Your machine keeps trusting the old key until you check the new one with ${member}: pantheon trust ${member}` : ""),
+            meta: { notice: "seat_recovery", recovery: { member, fp: toFp, from_fp: fromFp, state: "moved", how, ...(by ? { by } : {}) } },
+        });
+        this.broadcast(sp, { t: "members", members: this.members(sp) });
+        this.broadcast(sp, { t: "roster", roster: this.roster(sp) });
+        return inv;
+    }
+    mintRecoveryInvite(sp, member) {
+        const e = sp.allow.get(member);
+        return sp.allow.mintInvite(member, e.may_wake, 7 * 24 * 60, randomBytes(18).toString("base64url"), this.ensureToken(sp), member);
+    }
     noteAccountRemoval(username) {
         this.authEpoch++;
         const u = normalizeUsername(username);
@@ -2209,7 +2467,7 @@ ${done ? `<div class=done role=status>${esc(done)}</div>` : ""}
         const revokeForm = (token) => `<form method=POST action="/admin/action" class=inl onsubmit="return confirm('Revoke this invite? The link stops working immediately.')"><input type=hidden name=csrf value="${csrfTok}"><input type=hidden name=action value=revoke_invite><input type=hidden name=id value="${esc(name)}"><input type=hidden name=token value="${esc(token.slice(-6))}"><button class="act danger">revoke</button></form>`;
         const memberRows = entries.map((e) => {
             const m = sp?.members.get(e.member);
-            const online = m ? m.sessions.size : 0;
+            const online = m ? presentSessions(m).length : 0;
             return `<tr><td><a href="${link({ member: e.member, before: undefined })}"><code>${esc(e.member)}</code></a></td><td>${e.admitted ? '<span class="pill ok">admitted</span>' : '<span class="pill">pending</span>'}</td><td>${e.may_wake ? "yes" : "no"}</td><td>${online ? `<span class="pill ok">${online} session${online === 1 ? "" : "s"}</span> ${esc(m.agent)}` : "<span class=dim>offline</span>"}</td><td class=dim>${m ? ago(m.last_seen) : when(e.first_seen)}</td></tr>`;
         }).join("");
         const repos = allow.repoList();
@@ -2245,7 +2503,7 @@ ${ADMIN_CSS}
 ${url.searchParams.get("done") ? `<div class=done role=status>${esc(url.searchParams.get("done"))}</div>` : ""}
 <main>
 <div class=kpis>
-  <div class=kpi><div class=l>Members</div><div class=v>${entries.filter((e) => e.admitted).length}<small>admitted</small></div><div class=s>${sp ? [...sp.members.values()].filter((m) => m.sessions.size).length : 0} online now · ${openInvites.length} unused invite${openInvites.length === 1 ? "" : "s"}</div></div>
+  <div class=kpi><div class=l>Members</div><div class=v>${entries.filter((e) => e.admitted).length}<small>admitted</small></div><div class=s>${sp ? [...sp.members.values()].filter((m) => presentSessions(m).length).length : 0} online now · ${openInvites.length} unused invite${openInvites.length === 1 ? "" : "s"}</div></div>
   <div class=kpi><div class=l>Goals</div><div class=v>${open}<small>/ ${goals.length} open</small></div><div class=s>${sp ? `${sp.obligations.size} obligation${sp.obligations.size === 1 ? "" : "s"} owed right now` : "asleep — reloads on the next connect"}</div></div>
   <div class=kpi><div class=l>Messages today</div><div class=v>${a.messages_24h}<small>/ ${a.messages} retained</small></div><div class=s>${a.senders_24h.length} delegate${a.senders_24h.length === 1 ? "" : "s"} active today · ${a.sessions_24h} sessions</div></div>
   <div class="kpi${obj24 + esc24 ? " warn" : ""}"><div class=l>Needs a look today</div><div class=v>${obj24 + esc24}</div><div class=s>${obj24} objection${obj24 === 1 ? "" : "s"} · ${esc24} escalation${esc24 === 1 ? "" : "s"} · ${a.by_act_24h.DELIVERED ?? 0} deliver${(a.by_act_24h.DELIVERED ?? 0) === 1 ? "y" : "ies"}</div></div>
@@ -2388,7 +2646,7 @@ ${url.searchParams.get("done") ? `<div class=done role=status>${esc(url.searchPa
 <style>body{font:16px/1.5 system-ui,sans-serif;max-width:40rem;margin:12vh auto;padding:0 1.2rem;color:#222}code,pre{background:#f4f4f5;border-radius:5px}code{padding:2px 6px}pre{padding:.6rem .8rem;overflow-x:auto}h1{font-size:1.6rem}</style>
 <h1>pantheon</h1>
 <p>Your coding agent and your teammates' agents, coordinating across machines.</p>
-${sh && win ? `<p>This is a relay endpoint, not a website. To start a team, paste one line into a terminal on your own computer. It brings its own Node, needs no admin rights, and asks for your email and a 6-digit code.</p>
+${sh && win ? `<p>This is a relay endpoint, not a website. To start a team, paste one line into a terminal on your own computer. It brings its own Node, needs no admin rights, and asks for your email and a 6-digit code (it is emailed; check spam if it does not arrive).</p>
 <p>Mac or Linux (Terminal):</p>
 <pre><code>${esc(sh)}</code></pre>
 <p>Windows (Command Prompt or PowerShell):</p>
@@ -2396,7 +2654,7 @@ ${sh && win ? `<p>This is a relay endpoint, not a website. To start a team, past
 <p>Invited to a team? Use the line in your invite instead. Already have Node.js 22.13 or newer: <code>npm install -g @join-pantheon/cli</code>, then <code>pantheon start</code>.</p>` : `<p>This is a relay endpoint, not a website. With Node.js 22.13 or newer, install the CLI and start a team:</p>
 <pre><code>npm install -g @join-pantheon/cli
 pantheon start</code></pre>
-<p>It asks for your email and sends you a 6-digit code. Invited to a team? Use the line in your invite.</p>`}`);
+<p>It asks for your email and sends you a 6-digit code (check spam if it does not arrive). Invited to a team? Use the line in your invite.</p>`}`);
     }
     startInstallerCheck() { this.installerGate.start(); }
     async serveInstaller(req, res, name) {
@@ -2462,6 +2720,7 @@ pantheon start</code></pre>
         };
         let sessionId = "";
         let role = "interactive";
+        let quiet = false;
         let myPubkey = "";
         let delegated = null;
         let authEpoch = -1, authOk = true;
@@ -2701,10 +2960,21 @@ pantheon start</code></pre>
                     }
                     if (verdict === "key-mismatch") {
                         this.log(`[${sp.name}] ! REFUSED ${m.member}: key mismatch (${fingerprint(m.pubkey)})`);
+                        const moved = sp.allow.get(m.member)?.moved;
+                        if (moved && moved.from_fp === fingerprint(m.pubkey)) {
+                            const how = moved.how === "confirmed" ? `, confirmed by ${moved.by}` : moved.how === "alone" ? "" : ", after nobody cancelled it";
+                            return reject("KEY_MISMATCH", `"${m.member}"'s seat in "${sp.name}" moved to another device on ${new Date(moved.at).toISOString().slice(0, 16).replace("T", " ")} UTC — signed in with the code emailed to ${m.member}'s account${how}. This machine's key no longer opens it. ` +
+                                `If that was you, use the new machine (or run  pantheon recover ${sp.name}  here to move it back). If it was not you, your email account may be compromised: secure it, then tell your team.`);
+                        }
+                        const recover = this.requireAccounts && this.accounts
+                            ? ` If this is really you on a new machine and the old one is gone: run  pantheon recover ${sp.name}  here, in a terminal — it signs you in with your email and moves your seat to this machine.`
+                            : "";
                         if (sp.allow.founder() === m.member) {
-                            return reject("KEY_MISMATCH", `"${m.member}" founded "${sp.name}" and is registered here with a different key. A founder's key cannot be replaced: if this is really you on another machine, restore your original ~/.pantheon/config.json (the key is in it). Without it, join under another name (--me <new-name>) or start a new team (pantheon start).`);
+                            return reject("KEY_MISMATCH", `"${m.member}" founded "${sp.name}" and is registered here with a different key.` + (recover ||
+                                ` A founder's key cannot be replaced: if this is really you on another machine, restore your original ~/.pantheon/config.json (the key is in it). Without it, join under another name (--me <new-name>) or start a new team (pantheon start).`));
                         }
-                        return reject("KEY_MISMATCH", `"${m.member}" is already registered here with a different key. If you are someone else, join under your own name (--me <your-name>). If this is really you on another machine, an admitted member who has checked it is you runs  pantheon admit ${m.member} --forget  (it removes whoever holds the name now) and sends you a new invite.`);
+                        return reject("KEY_MISMATCH", `"${m.member}" is already registered here with a different key. If you are someone else, join under your own name (--me <your-name>).` + (recover ||
+                            ` If this is really you on another machine, an admitted member who has checked it is you runs  pantheon admit ${m.member} --forget  (it removes whoever holds the name now) and sends you a new invite.`));
                     }
                     if (verdict === "revoked") {
                         const e = sp.allow.get(m.member);
@@ -2747,8 +3017,9 @@ pantheon start</code></pre>
                     clearHelloTimer();
                     sessionId = acctSession ?? this.mintSession();
                     role = delegated ? "worker" : m.role;
-                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, role, ws, m.pkg);
-                    const firstSession = me.sessions.size === 1;
+                    quiet = m.upkeep === true && role === "cli";
+                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, role, ws, m.pkg, quiet);
+                    const firstSession = !quiet && presentSessions(me).length === 1;
                     const prior = typeof m.session === "string" ? m.session : "";
                     const stale = prior && prior !== sessionId ? me.sessions.get(prior) : undefined;
                     if (stale && stale.role === m.role) {
@@ -2798,7 +3069,7 @@ pantheon start</code></pre>
                     for (let page = sp.ledger.since(from); page.length; page = sp.ledger.since(from)) {
                         for (const r of page) {
                             this.send(ws, { t: "act", act: r });
-                            if (r.seq > me.delivered_seq)
+                            if (!quiet && r.seq > me.delivered_seq)
                                 me.delivered_seq = r.seq;
                         }
                         from = page[page.length - 1].seq;
@@ -3151,6 +3422,29 @@ pantheon start</code></pre>
                     return fail("BAD_META", "goal_members, organization_profile and notice are written by the relay, not sent", m.cid);
                 if (m.act === "NOTE" && m.body.startsWith("repo registered with this space: "))
                     return fail("BAD_META", "that line is written by the relay, not sent", m.cid);
+                let recoveryStep = null;
+                if (m.act === "NOTE" && m.meta && "recovery" in m.meta) {
+                    const rq = m.meta.recovery;
+                    const target = typeof rq?.member === "string" ? rq.member : "";
+                    const action = rq?.action;
+                    if (action !== "confirm" && action !== "cancel")
+                        return fail("BAD_META", "recovery.action is confirm or cancel", m.cid);
+                    if (delegated || !m.sig || m.sig.role !== "member")
+                        return fail("RECOVERY_BY_PERSON", "only a person, signing with their own key, confirms or cancels a seat move — not a woken run", m.cid);
+                    if (!space.allow.get(me.id)?.admitted)
+                        return fail("NOT_ADMITTED", `only an admitted member of "${space.name}" can confirm or cancel a seat move`, m.cid);
+                    const pend = space.allow.recoveryOf(target);
+                    if (!pend)
+                        return fail("NO_RECOVERY", `no move of ${target || "anyone"}'s seat is waiting in "${space.name}"`, m.cid);
+                    if (rq.fp !== pend.fp)
+                        return fail("RECOVERY_KEY", `the key waiting for ${target} is ${pend.fp}, not ${String(rq.fp)} — check it with them again`, m.cid);
+                    if (action === "confirm" && target === me.id)
+                        return fail("RECOVERY_SELF", "a seat move is confirmed by a teammate, not by the person whose seat it is", m.cid);
+                    const curFp = fingerprint(space.allow.get(target).publicKey);
+                    if (action === "confirm" && rq.from_fp !== curFp)
+                        return fail("RECOVERY_KEY", `${target}'s seat is now on ${curFp}; the confirmation must name it (from_fp) — run the command again`, m.cid);
+                    recoveryStep = { action, member: target, pend };
+                }
                 const fromRepo = m.repo && space.allow.hasRepo(m.repo) ? m.repo : null;
                 const { from_repo: _forged, ...senderMeta } = (m.meta ?? {});
                 const hasMeta = !!m.meta && (Object.keys(senderMeta).length > 0 || _forged === undefined);
@@ -3159,7 +3453,7 @@ pantheon start</code></pre>
                     : undefined;
                 const fp = actFingerprint(me.id, m.act, m.body, m.goal ?? null, m.ref ?? null, m.to ?? null, storedMeta);
                 const prior = space.recent.get(fp);
-                if (prior && Date.now() - prior.at < LIMITS.dedupeWindowMs) {
+                if (prior && !recoveryStep && Date.now() - prior.at < LIMITS.dedupeWindowMs) {
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: prior.id, seq: prior.seq });
                     return;
                 }
@@ -3193,7 +3487,7 @@ pantheon start</code></pre>
                     }
                 }
                 const wasFull = this.spaceFull(space);
-                if (wasFull && !this.freesRoom(space, me.id, m.act, m.ref ?? null))
+                if (wasFull && !recoveryStep && !this.freesRoom(space, me.id, m.act, m.ref ?? null))
                     return fail("SPACE_FULL", this.spaceFullMessage(space), m.cid);
                 const rec = this.commit(space, {
                     ...(m.sig && m.id ? { id: m.id } : {}),
@@ -3226,6 +3520,15 @@ pantheon start</code></pre>
                     space.recent.delete(k);
                 }
                 this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
+                if (recoveryStep) {
+                    const { action, member: who, pend } = recoveryStep;
+                    if (space.allow.recoveryOf(who)?.pubkey === pend.pubkey) {
+                        if (action === "cancel")
+                            this.endRecovery(space, who, `cancelled by ${me.id}`, me.id, ip);
+                        else
+                            this.completeRecovery(space, who, pend.pubkey, "confirmed", me.id, rec, ip, pend.account);
+                    }
+                }
             }
             catch (e) {
                 const cidPart = reqCid ? { cid: reqCid } : {};
@@ -3279,7 +3582,7 @@ pantheon start</code></pre>
                     v.at = Date.now();
             }
             const stillMember = space.members.get(me.id) === me && !!space.allow.get(me.id)?.admitted;
-            if (me.sessions.size === 0 && role !== "cli" && stillMember) {
+            if (presentSessions(me).length === 0 && role !== "cli" && !quiet && stillMember) {
                 me.last_seen = Date.now();
                 this.commit(space, { from: me.id, act: "LEAVE", body: `${me.display} offline`, to: null, goal: null, ref: null });
             }
@@ -4135,12 +4438,16 @@ pantheon start</code></pre>
         if (dropped)
             this.log(`[${sp.name}] compacted ledger — dropped ${dropped} old act(s) from closed goals, ${kept} kept`);
     }
-    attach(sp, id, display, agent, session, role, ws, pkg) {
+    attach(sp, id, display, agent, session, role, ws, pkg, quiet = false) {
         let m = sp.members.get(id);
         if (!m) {
-            m = { id, display, agent, last_seen: Date.now(), sessions: new Map(), activity: new Map(), delivered_seq: 0, stamps: [] };
+            m = { id, display, agent, last_seen: quiet ? 0 : Date.now(), sessions: new Map(), activity: new Map(), delivered_seq: 0, stamps: [] };
             sp.members.set(id, m);
         }
+        if (quiet) {
+            m.sessions.set(session, { id: session, role, agent, ...(pkg ? { pkg } : {}), ws, quiet: true });
+            return m;
+        }
         m.display = display;
         m.agent = agent;
         m.last_seen = Date.now();
@@ -4152,10 +4459,10 @@ pantheon start</code></pre>
         return workState(m, Date.now(), this.busyTtlMs, this.pruneMs);
     }
     roster(sp) {
-        return [...sp.members.values()].map((m) => ({
+        return [...sp.members.values()].filter((m) => m.last_seen > 0 || presentSessions(m).length > 0).map((m) => ({
             id: m.id, display: m.display, agent: m.agent,
-            online: m.sessions.size > 0, last_seen: m.last_seen,
-            sessions: [...m.sessions.values()].map((s) => ({
+            online: presentSessions(m).length > 0, last_seen: m.last_seen,
+            sessions: presentSessions(m).map((s) => ({
                 id: s.id, role: s.role, agent: s.agent, ...(s.pkg ? { pkg: s.pkg } : {}),
             })),
             ...(this.work(m) ? { work: this.work(m) } : {}),
@@ -4171,6 +4478,8 @@ pantheon start</code></pre>
             ...(e.admitted_by ? { admitted_by: e.admitted_by } : {}),
             ...(e.revoked_at ? { revoked_at: e.revoked_at, ...(e.revoked_by ? { revoked_by: e.revoked_by } : {}) } : {}),
             ...(sp.allow.founder() === e.member ? { founder: true } : {}),
+            ...((r) => r ? { recovery: { fp: r.fp, label: r.label, requested_at: r.requested_at, due_at: r.due_at } } : {})(sp.allow.recoveryOf(e.member)),
+            ...(e.moved ? { moved: e.moved } : {}),
         }));
     }
     send(ws, msg) {
@@ -4185,7 +4494,8 @@ pantheon start</code></pre>
             for (const s of m.sessions.values())
                 if (s.ws.readyState === 1) {
                     s.ws.send(payload);
-                    reached = true;
+                    if (!s.quiet)
+                        reached = true;
                 }
             if (reached && seq !== null && seq > m.delivered_seq)
                 m.delivered_seq = seq;

package/dist/repo-find.js

@@ -44,12 +44,15 @@ export function reposUnder(dir, depth = 3, budget = { left: 4000 }) {
     return out;
 }
 export function holdsRepo(dir, budget = 20_000) {
+    return repoInside(dir, budget) !== null;
+}
+export function repoInside(dir, budget = 20_000) {
     let left = budget;
     const stack = [resolve(dir)];
     while (stack.length) {
         const d = stack.pop();
         if (left-- <= 0)
-            return true;
+            return "too-large";
         let entries = [];
         try {
             entries = readdirSync(d, { withFileTypes: true });
@@ -59,12 +62,12 @@ export function holdsRepo(dir, budget = 20_000) {
         }
         for (const e of entries) {
             if (e.name === ".git")
-                return true;
+                return d;
             if (e.isDirectory())
                 stack.push(join(d, e.name));
         }
     }
-    return false;
+    return null;
 }
 export function commonCodeRoots(home = homedir()) {
     return ["code", "Code", "src", "dev", "Developer", "projects", "Projects", "workspace", "work", "repos", "git", "github", "GitHub", "Documents/GitHub", "Documents/code", "Sites"]