@join-pantheon/cli 0.33.2 → 0.33.4-rc.1

package/dist/roster-file.js

@@ -3,7 +3,7 @@ import { randomBytes } from "node:crypto";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
 import { fingerprint } from "./identity.js";
-import { writeFileAtomic } from "./store.js";
+import { pendingView, writerFor } from "./disk-writer.js";
 export class RosterUnreadable extends Error {
     file;
     constructor(file, detail) {
@@ -18,6 +18,8 @@ function hashToken(token) {
     return createHash("sha256").update(token).digest("hex");
 }
 export class Allowlist {
+    dir;
+    stem;
     entries = new Map();
     invites = new Map();
     tokenHash = null;
@@ -31,12 +33,15 @@ export class Allowlist {
     repos = new Map();
     recoveries = new Map();
     file;
-    constructor(dir, space) {
-        this.file = join(dir, `${space}.members.json`);
-        if (existsSync(this.file)) {
+    constructor(dir, stem) {
+        this.dir = dir;
+        this.stem = stem;
+        this.file = join(dir, `${stem}.members.json`);
+        const pending = pendingView(dir, stem, this.file);
+        if (pending !== null && (pending !== undefined || existsSync(this.file))) {
             let raw;
             try {
-                raw = JSON.parse(readFileSync(this.file, "utf8"));
+                raw = JSON.parse(pending ? pending.toString("utf8") : readFileSync(this.file, "utf8"));
             }
             catch (e) {
                 throw new RosterUnreadable(this.file, e.message);
@@ -118,7 +123,7 @@ export class Allowlist {
     }
     founderGuess() { return this.founderGuessed; }
     flush() {
-        writeFileAtomic(this.file, JSON.stringify({
+        writerFor(this.dir, this.stem).replace(this.file, JSON.stringify({
             ...this.extra,
             ...(this.id ? { id: this.id } : {}),
             ...(this.founderName ? { founder: this.founderName } : {}),

package/dist/store.js

@@ -1,6 +1,7 @@
 import { readFileSync, existsSync, mkdirSync, renameSync, openSync, writeSync, fsyncSync, closeSync, chmodSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { emptyRefusals } from "./admin-stats.js";
+import { pendingView, writerFor } from "./disk-writer.js";
 export function ensurePrivateDir(dir) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     try {
@@ -13,6 +14,8 @@ let slowestWaitMs = 0;
 export function setWaitForDisk(on) { waitForDisk = on; }
 export function waitsForDisk() { return waitForDisk; }
 export function takeSlowestDiskWait() { const w = slowestWaitMs; slowestWaitMs = 0; return w; }
+export function noteDiskWait(ms) { if (ms > slowestWaitMs)
+    slowestWaitMs = ms; }
 export function syncFd(fd) {
     if (!waitForDisk)
         return;
@@ -22,8 +25,21 @@ export function syncFd(fd) {
     if (took > slowestWaitMs)
         slowestWaitMs = took;
 }
+export function slowDiskMs() {
+    const v = process.env.PANTHEON_RELAY_SLOW_DISK_MS ?? "";
+    const range = /^(\d+)-(\d+)$/.exec(v);
+    if (range) {
+        const a = Number(range[1]), b = Number(range[2]);
+        return a + Math.random() * Math.max(0, b - a);
+    }
+    const n = Number(v);
+    return Number.isFinite(n) && n > 0 ? Math.random() * n : 0;
+}
 export function writeFileAtomic(file, data, mode = 0o600) {
     mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const slow = slowDiskMs();
+    if (slow)
+        sleepSync(slow);
     const tmp = `${file}.tmp`;
     const fd = openSync(tmp, "w", mode);
     try {
@@ -36,7 +52,7 @@ export function writeFileAtomic(file, data, mode = 0o600) {
     renameRetrying(tmp, file);
     fsyncDir(dirname(file));
 }
-const sleepSync = (ms) => { try {
+export const sleepSync = (ms) => { try {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
 catch { } };
@@ -73,6 +89,8 @@ export function fsyncDir(dir) {
     }
 }
 export class StateStore {
+    dir;
+    stem;
     file;
     timer = null;
     dirty = false;
@@ -80,18 +98,21 @@ export class StateStore {
     headOf;
     rebuilt = null;
     extra = {};
-    constructor(dir, space) {
-        this.file = join(dir, `${space}.state.json`);
+    constructor(dir, stem) {
+        this.dir = dir;
+        this.stem = stem;
+        this.file = join(dir, `${stem}.state.json`);
     }
     load(opts = {}) {
         const goals = new Map();
         const obligations = new Map();
         const profiles = new Map();
-        if (!existsSync(this.file)) {
+        const pending = pendingView(this.dir, this.stem, this.file);
+        if (pending === null || (pending === undefined && !existsSync(this.file))) {
             return { goals, obligations, profiles, unclean: opts.expectHistory ? "the state snapshot is missing but the ledger has history" : null };
         }
         try {
-            const snap = JSON.parse(readFileSync(this.file, "utf8"));
+            const snap = JSON.parse(pending ? pending.toString("utf8") : readFileSync(this.file, "utf8"));
             if (!snap || typeof snap !== "object" || Array.isArray(snap)
                 || (snap.goals !== undefined && !Array.isArray(snap.goals))
                 || (snap.obligations !== undefined && !Array.isArray(snap.obligations))) {
@@ -120,7 +141,7 @@ export class StateStore {
         catch (e) {
             const why = `the state snapshot could not be read (${e.message})`;
             let quarantined;
-            if (opts.quarantine) {
+            if (opts.quarantine && !pending) {
                 const aside = `${this.file}.corrupt-${Date.now()}`;
                 try {
                     renameSync(this.file, aside);
@@ -162,7 +183,7 @@ export class StateStore {
             ...(this.rebuilt ? { rebuilt: this.rebuilt } : {}),
             saved_at: Date.now(),
         };
-        writeFileAtomic(this.file, JSON.stringify(snap, null, 2) + "\n");
+        writerFor(this.dir, this.stem).replace(this.file, JSON.stringify(snap, null, 2) + "\n");
     }
     close(goals, obligations, profiles) {
         if (this.timer) {

package/dist/team-name.js

@@ -0,0 +1,58 @@
+export const TEAM_NAME = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+export const RELAY_TEAM_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
+export const PLACEHOLDER_REFUSAL = "that looks like a placeholder from an example — pick your team's real name";
+export function looksLikePlaceholder(raw) {
+    const s = raw.trim();
+    if (!s)
+        return false;
+    if (/[<>{}[\]]/.test(s))
+        return true;
+    if (/^\$\{?\w+\}?$/.test(s) || /^%\w+%$/.test(s))
+        return true;
+    if (/\.\.\.|…/.test(s))
+        return true;
+    const n = s.toLowerCase().replace(/[\s_.-]+/g, "");
+    return /^(your|the|my|a|some|new)?(team|space|org|organi[sz]ation|workspace|group)(name|slug|id)(here)?$/.test(n)
+        || /^(your)(own)?(team|space|org|organi[sz]ation|workspace|group)(here)?$/.test(n)
+        || /^(insert|put|enter|type|add)(your|the|a)?(team|space)(name)?(here)?$/.test(n)
+        || /^(example|sample|placeholder|changeme|replaceme|tbd|todo|x{3,8}|name|nameofyourteam|nameoftheteam|teamhere|namehere)$/.test(n)
+        || /^(example|sample|placeholder)(team|space)(name)?$/.test(n);
+}
+export function teamSlug(raw) {
+    const s = raw.toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g, "")
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/-{2,}/g, "-")
+        .replace(/^[-_]+/, "")
+        .slice(0, 64)
+        .replace(/[-_]+$/, "");
+    return TEAM_NAME.test(s) ? s : "";
+}
+export function teamNameProblem(name, opts = {}) {
+    if (looksLikePlaceholder(name))
+        return PLACEHOLDER_REFUSAL;
+    if ((opts.relay ? RELAY_TEAM_NAME : TEAM_NAME).test(name))
+        return null;
+    const slug = teamSlug(name);
+    return `"${name}" cannot be a team name: use 1–64 letters, digits, - or _, starting with a letter or digit (it goes into invite links)` +
+        (slug ? ` — for example "${slug}"` : "");
+}
+export function shellArg(name, platform = process.platform) {
+    if (TEAM_NAME.test(name))
+        return name;
+    const dq = anyShellQuoted(name);
+    if (dq)
+        return dq;
+    return platform === "win32" ? psQuoted(name) : posixQuoted(name);
+}
+export function anyShellQuoted(name) {
+    return /[$`"\\!%]/.test(name) ? null : `"${name}"`;
+}
+export const posixQuoted = (name) => `'${name.replace(/'/g, `'\\''`)}'`;
+export const psQuoted = (name) => `'${name.replace(/'/g, "''")}'`;
+export const CMD_SPECIAL = /[&%^|<>]/;
+export function relayShellArg(name) {
+    if (TEAM_NAME.test(name))
+        return name;
+    return anyShellQuoted(name) ?? `${posixQuoted(name)}  (in PowerShell: ${psQuoted(name)})`;
+}
+//# sourceMappingURL=team-name.js.map

package/dist/tray.js

@@ -27,6 +27,11 @@ export function ensureTrayBinary(home = CONFIG_DIR, deps = {}) {
     mkdirSync(dirname(binary), { recursive: true });
     return installHelper({ name: TRAY_PREBUILT, source, binary, what: "the menu bar", service: "menubar" }, deps).binary;
 }
+export function menubarRefusal(f, here) {
+    if (Object.keys(f?.spaces ?? {}).length || here?.space)
+        return null;
+    return "this machine is not on a team yet — pantheon start (create one) or pantheon join <invite> (join one)";
+}
 export function trayStale(home = CONFIG_DIR) { return helperStale(trayBinaryPath(home), traySourcePath()); }
 export function writeTrayCommands(home = CONFIG_DIR) {
     const bin = whichPantheon() ?? "pantheon";

package/dist/worker.js

@@ -31,6 +31,7 @@ import { diagnoseRun, gitProbe, workNeedsCommands } from "./run-failure.js";
 import { installedTools, preferredTool } from "./notifier.js";
 import { loadPersonas, matchPersona, personaByName, personaMatches, effectivePolicy, personaBrief, describePersona, } from "./persona.js";
 import { CONFIG_PATH, loadAll, repoInfo, updateMembershipToken } from "./config.js";
+import { shellArg } from "./team-name.js";
 import { repoName, routeRequest, safeName } from "./repo-route.js";
 import { holdsRepo } from "./repo-find.js";
 import { FOLDER_SNAPSHOT_LIMITS, keepDrafts, removeSnapshot, shown, snapshotDrafts, snapshotRoot, sweepSnapshots, takeSnapshot } from "./folder-snapshot.js";
@@ -1412,14 +1413,15 @@ export class Worker {
             this.keyChangeSaid.add(k);
             this.markDone(k);
             const mine = e.member === this.cfg.member;
-            this.opts.log(`! ${mine ? "someone asked to move YOUR seat" : `${e.member} asked to move their seat`} in ${this.cfg.space} to a new device ("${r.label}", key ${r.fp}) — ${mine ? `not you? pantheon recover cancel ${e.member}` : `check it with them, then pantheon recover confirm ${e.member} (or cancel)`}`);
+            const spaceArg = shellArg(this.cfg.space);
+            this.opts.log(`! ${mine ? "someone asked to move YOUR seat" : `${e.member} asked to move their seat`} in ${this.cfg.space} to a new device ("${r.label}", key ${r.fp}) — ${mine ? `not you? pantheon recover cancel ${e.member} --space ${spaceArg}` : `check it with them, then pantheon recover confirm ${e.member} --space ${spaceArg} (or cancel)`}`);
             try {
                 this.opts.notify?.({
                     kind: "worker", who: "Your worker", context: this.cfg.space, ttl: 0, sound: true,
                     heading: mine ? "Someone asked to move your seat" : `${e.member} asked to move their seat`,
                     body: mine
-                        ? `A device signed in to your email account ("${r.label}", key ${r.fp}) asked for your seat in ${this.cfg.space}. It moves ${new Date(r.due_at).toLocaleString()} unless cancelled. Not you? In a terminal: pantheon recover cancel ${e.member} — and secure your email.`
-                        : `${e.member} signed in on a new device ("${r.label}", key ${r.fp}). Check the key with them on a call, then in a terminal: pantheon recover confirm ${e.member}. Not them? pantheon recover cancel ${e.member}.`,
+                        ? `A device signed in to your email account ("${r.label}", key ${r.fp}) asked for your seat in ${this.cfg.space}. It moves ${new Date(r.due_at).toLocaleString()} unless cancelled. Not you? In a terminal: pantheon recover cancel ${e.member} --space ${spaceArg} — and secure your email.`
+                        : `${e.member} signed in on a new device ("${r.label}", key ${r.fp}). Check the key with them on a call, then in a terminal: pantheon recover confirm ${e.member} --space ${spaceArg}. Not them? pantheon recover cancel ${e.member} --space ${spaceArg}.`,
                 });
             }
             catch { }

package/helper/macos/main.swift

@@ -48,6 +48,8 @@ struct Notice: Decodable {
   let primary: Primary?
   let details: Details?
   let fix: Fix?
+  /** the team it came from (0.33.4): written into every action, so the CLI answers in that team with no default picked */
+  let space: String?
   /** where to write the chosen action and which .command files to open — supplied by the CLI */
   let bin_dir: String
   /** the pantheon CLI to run silently for one-click actions — supplied by the CLI, since this helper has no PATH worth trusting */
@@ -135,21 +137,21 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
       } else { NSApp.terminate(nil) }
       return
     }
-    act(["action": "open", "tool": toolId, "prompt": p.prompt, "decision": notice.details?.decision as Any, "act": notice.details?.act as Any].compactMapValues { $0 is NSNull ? nil : $0 }, command: "pantheon-explain.command")
+    act(["action": "open", "tool": toolId, "prompt": p.prompt, "decision": notice.details?.decision as Any, "act": notice.details?.act as Any, "space": notice.space as Any].compactMapValues { $0 is NSNull ? nil : $0 }, command: "pantheon-explain.command")
   }
 
   @objc func openTool(_ sender: NSMenuItem) { open((sender.representedObject as? String) ?? notice.primary?.default ?? "") }
   @objc func openDefault(_ sender: Any?) { open(notice.primary?.default ?? "") }
 
   @objc func showDetails(_ sender: Any?) {
-    act(["action": "details", "act": notice.details?.act as Any, "decision": notice.details?.decision as Any].compactMapValues { $0 is NSNull ? nil : $0 }, command: "pantheon-details.command")
+    act(["action": "details", "act": notice.details?.act as Any, "decision": notice.details?.decision as Any, "space": notice.space as Any].compactMapValues { $0 is NSNull ? nil : $0 }, command: "pantheon-details.command")
   }
 
   /// Done: write the action, run the CLI without a Terminal, close. The CLI answers the decision as handled.
   @objc func markDone(_ sender: Any?) {
     guard !notice.bin_dir.isEmpty, let decision = notice.details?.decision else { NSApp.terminate(nil); return }
     let dir = URL(fileURLWithPath: notice.bin_dir)
-    let payload: [String: Any] = ["action": "done", "decision": decision, "act": notice.details?.act as Any].compactMapValues { $0 is NSNull ? nil : $0 }
+    let payload: [String: Any] = ["action": "done", "decision": decision, "act": notice.details?.act as Any, "space": notice.space as Any].compactMapValues { $0 is NSNull ? nil : $0 }
     if let data = try? JSONSerialization.data(withJSONObject: payload) {
       try? data.write(to: dir.appendingPathComponent(".hud-action.json"), options: .atomic)
     }

package/helper/macos/prebuilt/manifest.json

@@ -0,0 +1,29 @@
+{
+  "format": 1,
+  "built_at": "2026-10-07T10:18:03.223Z",
+  "swiftc": "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)",
+  "helpers": {
+    "pantheon-tray": {
+      "source": "menubar.swift",
+      "source_sha256": "f079629099a81f9b679ef4133d897ceb09025f675099c5f941951604df3531fa",
+      "sha256": "cc081120555f528c83b38951663d37e8394e3a3e119a19b0bb3b2a737f4d617f",
+      "archs": [
+        "arm64",
+        "x86_64"
+      ],
+      "target": "macos11",
+      "version": "2"
+    },
+    "pantheon-hud": {
+      "source": "main.swift",
+      "source_sha256": "ffda2f8dbec3144ac902f952df1048affce6ec0e6f1b2c65ff87643a484c55c6",
+      "sha256": "3eb87eddbfba8c7d149b10ee34921e336d5670a5fa89243758184e5204264ccb",
+      "archs": [
+        "arm64",
+        "x86_64"
+      ],
+      "target": "macos11",
+      "version": "4"
+    }
+  }
+}

package/installer/install.ps1

@@ -601,6 +601,14 @@ function Install-Pantheon {
     return @{ code = $p.ExitCode; out = $out.Result; err = $err.Result }
   }
 
+  # Exit 3 from pantheon: it ended having said what happens next, and nothing
+  # failed -- a seat move that waits for a teammate to confirm it (recover, or
+  # a join of a team this person is already in). Not a failed install, and its
+  # words stay the last ones: no "Next" line after them.
+  function Resolve-PantheonSaid([hashtable]$St) {
+    if ($St.code -eq 3) { $St.code = 0; $St.said = $true }
+  }
+
   # Hand over to pantheon with the person's own arguments (join <invite>,
   # start): after an install, and also when the update was put off because a
   # teammate's run was in progress -- a join or a start needs a working
@@ -623,6 +631,7 @@ function Install-Pantheon {
       $null = $p.Handle   # without this, ExitCode is empty once the process is gone
       $p.WaitForExit()
       $State.code = $p.ExitCode
+      Resolve-PantheonSaid $State
       return
     }
 
@@ -644,6 +653,7 @@ function Install-Pantheon {
       $null = $p.Handle
       $p.WaitForExit()
       $State.code = $p.ExitCode
+      Resolve-PantheonSaid $State
       $said = if (Test-Path -LiteralPath $errFile) { [IO.File]::ReadAllText($errFile) } else { '' }
       if ($said) { [Console]::Error.Write($said) }
       if ($State.code -ne 0 -and $said -match 'sign in first|NOT_SIGNED_IN' -and $Arguments[0] -in @('join', 'start')) {
@@ -1152,7 +1162,7 @@ function Install-Pantheon {
     }
     Say ''
     Invoke-PantheonHandoff $nodeExe $entry $ca $Arguments
-    if ($State.code -eq 0) {
+    if ($State.code -eq 0 -and -not $State.said) {
       Say ''
       Say "Next, in this window: $(& $nextFor @('doctor'))   (checks that everything works)"
       & $byPathNote
@@ -1174,7 +1184,7 @@ function Install-Pantheon {
         try {
           Say ''
           Invoke-PantheonHandoff $nodeExe $entry $caNow $Arguments
-          if ($State.code -eq 0 -and $nextFor) {
+          if ($State.code -eq 0 -and -not $State.said -and $nextFor) {
             Say ''
             Say "Next, in this window: $(& $nextFor @('doctor'))   (checks that everything works)"
             & $byPathNote

package/installer/install.sh

@@ -714,6 +714,11 @@ export PATH
 # pantheon (a trap is reset in a child, where an ignored signal would not be)
 # and this shell waits for it rather than dying first.
 finish() {
+  # 3: pantheon ended having said what happens next, and nothing failed -- a
+  # seat move that waits for a teammate to confirm it (recover, or a join of a
+  # team this person is already in). Its words stay the last ones, and the
+  # install is not reported as failed.
+  if [ "$1" -eq 3 ]; then exit 0; fi
   if [ "$1" -eq 0 ]; then
     say ""
     say "Next, in this terminal: $(next_line doctor)   (checks that everything works)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.33.2",
+  "version": "0.33.4-rc.1",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {