@join-pantheon/cli 0.33.4 → 0.33.5

package/dist/notifier.js

@@ -9,12 +9,13 @@ import { fileURLToPath } from "node:url";
 import { PantheonClient } from "./client.js";
 import { CONFIG_DIR } from "./config.js";
 import { loadProfile } from "./profile.js";
-import { APP_TOOLS, composeDecision, composeDelivery, composeWakeAsk, TOOL_LABELS } from "./notice.js";
+import { APP_TOOLS, composeDecision, composeDelivery, composePassedOver, composeWakeAsk, neverAlerts, passedOverNotice, TOOL_LABELS } from "./notice.js";
 import { loadPolicy } from "./worker-policy.js";
 import { wakeAlerted } from "./continued.js";
 import { cliOnPath, detectAvailable } from "./agents.js";
 import { whichPantheon } from "./service.js";
 export const DEFAULT_REMINDER_MS = 4 * 60 * 60 * 1_000;
+export const PASSED_OVER_EVERY_MS = 3_600_000;
 export const MAX_REMINDERS = 4;
 const DAY_MS = 24 * 60 * 60 * 1_000;
 export function wakeAskWhat(body) {
@@ -179,6 +180,11 @@ export class HumanNotifier {
             for (const obligation of due) {
                 const isReminder = state.notified_at[obligation.id] !== undefined;
                 const act = client.seenAct(obligation.ref);
+                if (neverAlerts(act)) {
+                    state.notified_at[obligation.id] = now();
+                    dirty = true;
+                    continue;
+                }
                 const wake = asks[obligation.ref];
                 const workerSaid = (w) => { try {
                     return this.opts.wakeAlerted ? this.opts.wakeAlerted(w, obligation.ref) : wakeAlerted(w.team, w.member, obligation.ref);
@@ -210,12 +216,34 @@ export class HumanNotifier {
             if (dirty || !existsSync(stateFile))
                 writeState(stateFile, state);
             const arrived = await client.next(pollMs);
+            if (prefs.decisions) {
+                for (const r of arrived) {
+                    if (!passedOverNotice(r, this.cfg.member) || state.notified_at[`act:${r.id}`])
+                        continue;
+                    state.notified_at[`act:${r.id}`] = now();
+                    const g = r.meta?.goal;
+                    const key = `act:passed:${typeof g === "string" ? g : r.ref ?? r.id}`;
+                    const last = state.notified_at[key];
+                    if (last !== undefined && now() - last < PASSED_OVER_EVERY_MS) {
+                        this.opts.log(`> passed over again on ${key.slice("act:passed:".length)} — said within the hour, not alerted`);
+                        writeState(stateFile, state);
+                        continue;
+                    }
+                    const focus = client.obligations.find((o) => o.ref === r.ref)?.id;
+                    const ok = await send(withLabel(composePassedOver(r, focus, now())));
+                    if (ok) {
+                        state.notified_at[key] = now();
+                        this.opts.log(`> passed-over alert for ${r.ref ?? r.id}`);
+                    }
+                    writeState(stateFile, state);
+                }
+            }
             if (prefs.deliveries) {
                 for (const r of arrived) {
-                    if (r.act !== "DELIVERED" || r.from === this.cfg.member || state.notified_at[`act:${r.id}`])
+                    if (r.act !== "DELIVERED" || neverAlerts(r) || r.from === this.cfg.member || state.notified_at[`act:${r.id}`])
                         continue;
                     const goal = r.goal ? client.goals.get(r.goal) : undefined;
-                    const forMe = (r.to?.includes(this.cfg.member) ?? false) || (goal?.members.includes(this.cfg.member) ?? false);
+                    const forMe = r.to?.length ? r.to.includes(this.cfg.member) : (goal?.members.includes(this.cfg.member) ?? false);
                     if (!forMe)
                         continue;
                     const ok = await send(withLabel(composeDelivery(r, goal, peerOf(r.from), { tools, preferred: preferredTool(profile, tools), now: now() })));

package/dist/notify.js

@@ -391,6 +391,8 @@ export async function decideStop(raw, deps) {
     const work = acts.filter((a) => {
         if (a.goal && closed.has(a.goal))
             return false;
+        if (a.act === "NOTE" && a.meta && typeof a.meta === "object" && "notice" in a.meta)
+            return false;
         const to = Array.isArray(a.to) ? a.to : [];
         if (to.length && deps.me && !to.includes(deps.me))
             return false;

package/dist/profile.js

@@ -192,6 +192,34 @@ export function organizationProfile(profile, ...forSpace) {
         updated_at: profile.updated_at,
     };
 }
+export function honourClearedAuthority(cfg, relayCopy, opts = {}) {
+    const marker = relayCopy?.authority_cleared;
+    if (!marker || !relayCopy)
+        return [];
+    if (!opts.founder || marker.by !== opts.founder)
+        return [];
+    const file = opts.file ?? profilePath();
+    if (!existsSync(file))
+        return [];
+    const local = loadProfile(cfg, file);
+    const relayAt = Math.min(relayCopy.updated_at, Date.now() + 86_400_000);
+    if (!opts.force && local.updated_at > relayAt)
+        return [];
+    const keep = new Set((opts.keep ?? []).map(normalize));
+    const cleared = new Set(marker.domains.map(normalize));
+    const team = teamProfile(local, cfg.spaceId, cfg.space).authority;
+    const dropped = Object.keys(team).filter((d) => cleared.has(normalize(d)) && !keep.has(normalize(d)));
+    if (!dropped.length)
+        return [];
+    const left = Object.fromEntries(Object.entries(team).filter(([d]) => !dropped.includes(d)));
+    const key = [cfg.spaceId, cfg.space].find((k) => k && local.spaces?.[k]) ?? (cfg.spaceId || cfg.space);
+    const own = local.spaces?.[key];
+    const next = own?.authority || (opts.teams ?? 1) > 1
+        ? { ...local, spaces: { ...(local.spaces ?? {}), [key]: { ...(own ?? {}), authority: left } } }
+        : { ...local, authority: left };
+    saveProfile({ ...next, updated_at: Math.max(local.updated_at + 1, Date.now()) }, file);
+    return dropped;
+}
 function domainMatches(rule, domain) {
     if (rule === "*")
         return true;
@@ -199,6 +227,15 @@ function domainMatches(rule, domain) {
         return domain === rule.slice(0, -2) || domain.startsWith(rule.slice(0, -1));
     return rule === domain;
 }
+export function reservedBy(profiles, domains) {
+    const out = [];
+    for (const p of profiles) {
+        const ds = domains.filter((d) => Object.entries(p.authority).some(([rule, mode]) => mode === "human_required" && domainMatches(normalize(rule), normalize(d))));
+        if (ds.length)
+            out.push({ member: p.member, domains: ds });
+    }
+    return out;
+}
 export function routeDecision(profiles, input) {
     const all = [...profiles];
     const byMember = new Map(all.map((p) => [p.member, p]));
@@ -227,7 +264,24 @@ export function routeDecision(profiles, input) {
         current.domains.push(domain);
         bucket.set(p.member, current);
     };
-    for (const domain of domains) {
+    const named = [...new Set((input.named ?? []).map((m) => m.trim()).filter(Boolean))];
+    const passed = new Map();
+    const reservedByOthers = (domain) => all.filter((p) => !named.includes(p.member)
+        && Object.entries(p.authority).some(([rule, mode]) => mode === "human_required" && domainMatches(normalize(rule), domain)));
+    const toNamed = (domain) => {
+        for (const member of named) {
+            const p = byMember.get(member);
+            const own = p ? Object.entries(p.authority).filter(([rule]) => domainMatches(normalize(rule), domain)).map(([, mode]) => mode) : [];
+            add(own.includes("human_required") ? "human_required" : "agent_can_decide", p ?? { member, display_name: member, title: "" }, domain);
+        }
+        for (const p of all) {
+            if (named.includes(p.member))
+                continue;
+            if (Object.keys(p.authority).some((rule) => domainMatches(normalize(rule), domain)))
+                passed.set(p.member, [...(passed.get(p.member) ?? []), domain]);
+        }
+    };
+    const byDirectory = (domain) => {
         const claims = all.flatMap((p) => {
             const modes = [...new Set(Object.entries(p.authority)
                     .filter(([rule]) => domainMatches(normalize(rule), domain)).map(([, mode]) => mode))];
@@ -235,7 +289,7 @@ export function routeDecision(profiles, input) {
         });
         if (!claims.length) {
             unmatched.push(domain);
-            continue;
+            return;
         }
         if (claims.length > 1) {
             conflicts.push({
@@ -243,25 +297,36 @@ export function routeDecision(profiles, input) {
                 reason: new Set(claims.map((x) => x.mode)).size > 1 ? "mixed_authority" : "multiple_owners",
                 members: claims.map((x) => x.profile.member),
             });
-            continue;
+            return;
         }
         const claim = claims[0];
         const active = (claim.profile.delegations ?? []).filter((d) => d.starts_at <= now && now < d.expires_at && d.domains.some((rule) => domainMatches(normalize(rule), domain)));
         if (active.length > 1) {
             conflicts.push({ domain, reason: "multiple_delegates", members: active.map((d) => d.to) });
-            continue;
+            return;
         }
         if (active.length === 1) {
             const delegated = byMember.get(active[0].to);
             if (!delegated) {
                 conflicts.push({ domain, reason: "missing_delegate", members: [active[0].to] });
-                continue;
+                return;
             }
             add(claim.mode, delegated, domain);
         }
         else
             add(claim.mode, claim.profile, domain);
+    };
+    for (const domain of domains) {
+        if (named.length && (input.explicit || !reservedByOthers(domain).length))
+            toNamed(domain);
+        else
+            byDirectory(domain);
     }
+    if (named.length && !domains.length)
+        for (const member of named) {
+            const p = byMember.get(member);
+            agent.set(member, { member, display_name: p?.display_name ?? member, title: p?.title ?? "", domains: [] });
+        }
     return {
         domains,
         inferred,
@@ -269,6 +334,7 @@ export function routeDecision(profiles, input) {
         delegated_agents: [...agent.values()],
         unmatched_domains: unmatched,
         conflicts,
+        ...(named.length ? { named, passed_over: [...passed].map(([member, ds]) => ({ member, domains: ds })) } : {}),
     };
 }
 export function profileInitialized(profile) {

package/dist/protocol.js

@@ -116,7 +116,7 @@ export const GoalSigSchema = z.object({
     kind: z.string().max(32).nullable().optional(),
     cert: DelegateCertSchema.optional(),
 });
-export const RELAY_FEATURES = ["act-sig", "delegate"];
+export const RELAY_FEATURES = ["act-sig", "delegate", "named-decider"];
 export const Hello = z.object({
     t: z.literal("hello"),
     v: z.number().int().optional(),
@@ -160,6 +160,11 @@ export const PublishProfile = z.object({
     cid: z.string().max(64).optional(),
     profile: OrganizationProfileSchema,
 });
+export const ClearAuthority = z.object({
+    t: z.literal("clear_authority"),
+    cid: z.string().max(64).optional(),
+    member: z.string().min(1).max(48),
+});
 export const Claim = z.object({
     t: z.literal("claim"),
     cid: z.string().max(64).optional(),
@@ -237,7 +242,7 @@ export const WorkerState = z.object({
     detail: z.string().max(200).optional(),
     until: z.number().int().positive().optional(),
 });
-export const Inbound = z.discriminatedUnion("t", [Hello, SendAct, OpenGoal, Claim, Admit, MakeInvite, ListInvites, RevokeInvite, PublishProfile, BindRepo, DeleteSpace, WorkerState, Ping]);
+export const Inbound = z.discriminatedUnion("t", [Hello, SendAct, OpenGoal, Claim, Admit, MakeInvite, ListInvites, RevokeInvite, PublishProfile, ClearAuthority, BindRepo, DeleteSpace, WorkerState, Ping]);
 export function shouldDeferToHuman(sessions, work, opts = {}) {
     const now = opts.now ?? Date.now();
     const idleMs = opts.idleMs ?? LIMITS.workerIdleMs;

package/dist/quickstart.js

@@ -14,7 +14,7 @@ import { commandsChosen, loadProfile, wakeChosen, wakeDefault } from "./profile.
 import { newKeypair } from "./identity.js";
 import { installForUser } from "./install.js";
 import { writeIntent, installHooks } from "./notify.js";
-import { detectAvailable, agentById, agentsNeedingUnsandboxed, folderReaderLine } from "./agents.js";
+import { detectAvailable, agentById, agentsNeedingUnsandboxed, folderReaderLine, recordedAgent } from "./agents.js";
 import { installService, servicesUnavailable } from "./service.js";
 import { clearTrayQuit } from "./win-host.js";
 import { ensureNativeNotifier } from "./notifier.js";
@@ -466,13 +466,13 @@ export async function start(opts) {
     const existing = priorCfg;
     const keepIdentity = !!existing && !opts.reset && !!existing.publicKey && !!existing.privateKey;
     let cfg = reuse
-        ? { ...existing, relay: reach.url, agent: detectAgent() }
+        ? { ...existing, relay: reach.url, agent: detectAgent(existing.agent) }
         : {
             relay: reach.url,
             space: opts.space ?? teamNameFor(process.cwd(), repo),
             token: randomBytes(16).toString("hex"),
             member: opts.me ?? (keepIdentity ? existing.member : defaultMemberName()),
-            agent: detectAgent(),
+            agent: detectAgent(existing?.agent),
             ...(keepIdentity ? { publicKey: existing.publicKey, privateKey: existing.privateKey } : newKeypair()),
             ...(keepIdentity && existing.account ? { account: existing.account } : {}),
             ...(repo ? { repo: repo.fingerprint, ...(repo.origin ? { repoOrigin: repo.origin } : {}) } : {}),
@@ -590,7 +590,7 @@ export async function join(opts) {
         space: opts.invite.space,
         token: "",
         member: opts.me ?? existing?.member ?? defaultMemberName(),
-        agent: detectAgent(),
+        agent: detectAgent(existing?.agent),
         ...keys,
         ...(existing?.account ? { account: existing.account } : {}),
         ...(repo ? { repo: repo.fingerprint, ...(repo.origin ? { repoOrigin: repo.origin } : {}) } : {}),
@@ -660,8 +660,7 @@ function temporaryFolderNote(dir, log, team) {
     if (isTemporaryRefusal(r))
         log(`  folder     not bound — ${r.why.replace("<team>", team)}`);
 }
-function detectAgent() {
-    const found = detectAvailable();
-    return found[0]?.backend.id ?? "unknown";
+function detectAgent(prior) {
+    return recordedAgent(prior, { fresh: true });
 }
 //# sourceMappingURL=quickstart.js.map

package/dist/relay.js

@@ -12,7 +12,7 @@ import { installerLine } from "./managed.js";
 import { Ledger, SpaceFull } from "./ledger.js";
 import { fingerprint, newNonce, verifyChallenge, verifyActivity, verifyAccount, verifyRead, actPayload, goalPayload, verifyBytes, verifyDelegate, canonicalJson } from "./identity.js";
 import { Accounts, normalizeUsername, validEmail, validUsername } from "./accounts.js";
-import { emailSenderFromEnv } from "./email.js";
+import { emailSenderFromEnv, maskEmail } from "./email.js";
 import { Allowlist, RosterUnreadable } from "./roster-file.js";
 import { StateStore, ensurePrivateDir, setWaitForDisk, takeSlowestDiskWait, waitsForDisk } from "./store.js";
 import { busyWriter, DiskBusy, flushWrites, onWriteError, pendingView, readLatest, recordWrites, whenLanded, writerFor } from "./disk-writer.js";
@@ -20,7 +20,8 @@ import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, s
 import { fmtLimit, inviteLimit, parseLimits, planLimits, PLAN_NAME } from "./plans.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
 import { relayShellArg, teamNameProblem } from "./team-name.js";
-import { routeDecision } from "./profile.js";
+import { reservedBy, routeDecision } from "./profile.js";
+import { namedMarker } from "./decision-ui.js";
 const presentSessions = (m) => [...m.sessions.values()].filter((s) => !s.quiet);
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
@@ -1031,7 +1032,10 @@ export class Relay {
                                                         : `that code is not right — ${r.tries_left ?? "a few"} ${r.tries_left === 1 ? "try" : "tries"} left on it`;
                     return this.json(res, 400, { error: msg, reason: r.reason, ...(r.tries_left !== undefined ? { tries_left: r.tries_left } : {}) });
                 }
-                return this.json(res, 200, { ok: true, account: { id: r.account.id, username: r.account.username, email: r.account.email }, session: r.session.id, device: r.device.id });
+                this.json(res, 200, { ok: true, account: { id: r.account.id, username: r.account.username, email: r.account.email }, session: r.session.id, device: r.device.id });
+                if (r.welcome)
+                    this.sendWelcome(r.account.email, ip);
+                return;
             });
         }
         if (url.pathname === "/account/sessions" && req.method === "GET") {
@@ -1180,11 +1184,11 @@ export class Relay {
             return own ? "this device has asked for too many codes in the last hour — use the latest one, or try again in an hour"
                 : "too many codes were sent to this address in the last hour — use the latest one, or try again in an hour";
         }
-        if (!own && !this.localTrusted(ip) && live(this.emailSendsFrom.get(netOf(ip)) ?? []).length >= perNet)
+        if (kind !== "welcome" && !own && !this.localTrusted(ip) && live(this.emailSendsFrom.get(netOf(ip)) ?? []).length >= perNet)
             return "too many codes were requested from your network in the last hour — try again later";
         if (this.emailSends.length >= cap)
             return "the relay is sending too many codes right now — try again shortly";
-        if (kind === "signup" && this.emailSends.filter((s) => s.signup).length >= cap - reserved)
+        if (kind !== "login" && this.emailSends.filter((s) => s.signup).length >= cap - reserved)
             return "the relay is taking too many new sign-ups right now — try again shortly";
         return null;
     }
@@ -1194,7 +1198,7 @@ export class Relay {
     }
     noteEmailSent(kind, email, ip, pubkey = "", own = false) {
         const now = Date.now(), hour = 3_600_000;
-        this.emailSends.push({ at: now, signup: kind === "signup" });
+        this.emailSends.push({ at: now, signup: kind !== "login" });
         const bump = (m, k) => {
             m.set(k, [...(m.get(k) ?? []).filter((t) => now - t < hour), now]);
             if (m.size > 10_000)
@@ -1207,9 +1211,26 @@ export class Relay {
                 }
         };
         bump(this.emailSendsTo, this.emailBucket(email, pubkey, own));
-        if (!own && !this.localTrusted(ip))
+        if (kind !== "welcome" && !own && !this.localTrusted(ip))
             bump(this.emailSendsFrom, netOf(ip));
     }
+    sendWelcome(to, ip) {
+        if (!this.email.sendWelcome)
+            return;
+        if (this.emailRefusal("welcome", to, ip)) {
+            this.log(`welcome email to ${maskEmail(to)} skipped: the email budget is spent`);
+            return;
+        }
+        let sending;
+        try {
+            sending = Promise.resolve(this.email.sendWelcome(to));
+        }
+        catch {
+            return;
+        }
+        sending.then((sent) => { if (sent)
+            this.noteEmailSent("welcome", to, ip); }, () => { });
+    }
     authRateOk(ip) {
         if (this.localTrusted(ip))
             return true;
@@ -3223,6 +3244,29 @@ pantheon start</code></pre>
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: me.id, seq: space.ledger.head });
                     return;
                 }
+                if (m.t === "clear_authority") {
+                    const founder = space.allow.founder();
+                    if (!founder || me.id !== founder)
+                        return fail("FOUNDER_ONLY", `only ${founder ?? "the team's founder"}, who founded "${space.name}", can clear someone's decision claims`, m.cid);
+                    if (!this.writeOk(me))
+                        return fail("RATE_LIMIT", "too many changes too fast — wait a few seconds", m.cid);
+                    const current = space.profiles.get(m.member);
+                    const domains = Object.keys(current?.authority ?? {});
+                    if (!current || !domains.length)
+                        return fail("NO_CLAIMS", `${m.member} claims no decisions in "${space.name}" — nothing to clear`, m.cid);
+                    const cleared = { ...current, authority: {}, updated_at: current.updated_at + 1, authority_cleared: { by: me.id, at: Date.now(), domains } };
+                    space.profiles.set(m.member, cleared);
+                    space.store.flush(space.goals, space.obligations, space.profiles);
+                    this.broadcast(space, { t: "profiles", profiles: [...space.profiles.values()] });
+                    const listed = domains.length > 4 ? `${domains.slice(0, 4).join(", ")} …` : domains.join(", ");
+                    const note = this.commit(space, {
+                        from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null,
+                        body: `${me.id} cleared ${m.member}'s decision claims (${listed}); ${m.member} can set them again with pantheon setup --decides. An older Pantheon on ${m.member}'s machine may restore them on its next profile change`,
+                        meta: { organization_profile: cleared },
+                    });
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: note.id, seq: space.ledger.head });
+                    return;
+                }
                 if (m.t === "admit") {
                     const self = space.allow.get(me.id);
                     if (!self?.admitted)
@@ -3621,6 +3665,17 @@ pantheon start</code></pre>
                     space.recent.delete(k);
                 }
                 this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
+                const passedOver = rec.act === "HUMAN_REQUIRED" && rec.meta?.["authority"] === "named" ? passedOverBy(space, rec.to[0], decisionDomains(rec)) : [];
+                const goalTitle = rec.goal ? space.goals.get(rec.goal)?.title : undefined;
+                for (const p of passedOver) {
+                    if (!space.members.has(p.member))
+                        continue;
+                    this.commit(space, {
+                        from: me.id, session: sessionId, role, act: "NOTE", to: [p.member], goal: null, ref: rec.id,
+                        body: `${me.id} named ${rec.to[0]} to decide ${p.domains.join(", ")} on '${goalTitle ?? first(rec.body, 80)}' — you were passed over`,
+                        meta: { notice: "passed_over", decider: rec.to[0], domains: p.domains, ...(rec.goal ? { goal: rec.goal } : {}) },
+                    });
+                }
                 if (recoveryStep) {
                     const { action, member: who, pend } = recoveryStep;
                     if (space.allow.recoveryOf(who)?.pubkey === pend.pubkey) {
@@ -3831,20 +3886,40 @@ pantheon start</code></pre>
                     message: "HUMAN_REQUIRED must name decision_domains so the relay can verify the human owner. Call pantheon_route_decision first." };
             }
             const target = sp.profiles.get(to[0]);
-            const route = routeDecision(sp.profiles.values(), { domains });
-            if (route.conflicts.length) {
+            const flagged = meta?.["named_by_requester"] === true;
+            const passed = flagged ? passedOverBy(sp, to[0], domains) : [];
+            if (flagged && role === "worker" && passed.length) {
+                return { code: "NAMED_BY_A_RUN",
+                    message: "only a person, in their own session, can name who decides over the directory — a woken run routes each domain to its published owner (pantheon_route_decision)" };
+            }
+            const namedBy = flagged && role !== "worker";
+            if (namedBy) {
+                const own = reservedBy(target ? [target] : [], domains)[0]?.domains ?? [];
+                const uncovered = domains.filter((d) => !own.includes(d));
+                if (passed.length) {
+                    meta["authority"] = "named";
+                    meta["unverified_domains"] = uncovered;
+                }
+                else if (uncovered.length) {
+                    meta["authority"] = target ? "partly_unverified" : "unverified";
+                    meta["unverified_domains"] = uncovered;
+                }
+            }
+            const route = namedBy ? null : routeDecision(sp.profiles.values(), { domains });
+            if (route && route.conflicts.length) {
                 return { code: "AMBIGUOUS_DECISION_AUTHORITY",
                     message: `authority conflicts for ${route.conflicts.map((c) => `${c.domain} (${c.reason}: ${c.members.join(", ")})`).join("; ")}. Fix the profiles or ESCALATE instead of guessing.` };
             }
-            const others = route.required_humans.filter((h) => h.member !== to[0] && h.domains.some((d) => domains.includes(d)));
+            const others = (route?.required_humans ?? []).filter((h) => h.member !== to[0] && h.domains.some((d) => domains.includes(d)));
             if (others.length) {
                 const theirs = [...new Set(others.flatMap((h) => h.domains.filter((d) => domains.includes(d))))];
                 return { code: "WRONG_DECISION_OWNER",
-                    message: `${to[0]} is not the human-required owner for: ${theirs.join(", ")} — ${others.map((h) => h.member).join(", ")} ${others.length === 1 ? "is" : "are"}. Call pantheon_route_decision and route each domain to its published owner.` };
+                    message: `${to[0]} is not the human-required owner for: ${theirs.join(", ")} — ${others.map((h) => h.member).join(", ")} ${others.length === 1 ? "is" : "are"}. Call pantheon_route_decision and route each domain to its published owner.` +
+                        (role === "worker" ? "" : ` If the person who asked for this work named ${to[0]} to decide, send it again with named_by_requester: true — a name wins over the directory.`) };
             }
-            const owner = route.required_humans.find((x) => x.member === to[0]);
+            const owner = route?.required_humans.find((x) => x.member === to[0]);
             const uncovered = domains.filter((d) => !owner?.domains.includes(d));
-            if (uncovered.length && meta) {
+            if (route && uncovered.length && meta) {
                 meta["authority"] = target ? "partly_unverified" : "unverified";
                 meta["unverified_domains"] = uncovered;
             }
@@ -4129,7 +4204,7 @@ pantheon start</code></pre>
                 break;
             case "HUMAN_REQUIRED":
                 this.oblige(sp, { kind: "HUMAN", owner: `human:${rec.to[0]}`, ref: rec.id, goal: rec.goal,
-                    body: `${rec.from} needs a decision: ${first(rec.body)}` });
+                    body: decisionBody(rec, sp) });
                 if (goal && goal.state === "OPEN") {
                     goal.state = "BLOCKED";
                     this.broadcast(sp, { t: "goal", goal });
@@ -4157,7 +4232,7 @@ pantheon start</code></pre>
                     if (asked && decider === rec.from && !stillAnswered && !alreadyLive && !retracted.has(asked.id)) {
                         this.oblige(sp, { kind: "HUMAN", owner: `human:${decider}`, ref: asked.id, goal: asked.goal,
                             ...(asked.act === "ESCALATE" && asked.ref ? { about: asked.ref } : {}),
-                            body: asked.act === "ESCALATE" ? `${asked.from} escalated: ${first(asked.body)}` : `${asked.from} needs a decision: ${first(asked.body)}` });
+                            body: asked.act === "ESCALATE" ? `${asked.from} escalated: ${first(asked.body)}` : decisionBody(asked, sp) });
                         const g = asked.goal ? sp.goals.get(asked.goal) : undefined;
                         if (g && g.state === "OPEN") {
                             g.state = "BLOCKED";
@@ -4427,7 +4502,7 @@ pantheon start</code></pre>
         }
         for (const e of allow.all()) {
             if (e.admitted && !sp.members.has(e.member)) {
-                sp.members.set(e.member, { id: e.member, display: e.member, agent: "unknown", last_seen: e.first_seen, sessions: new Map(), activity: new Map(), delivered_seq: 0, stamps: [] });
+                sp.members.set(e.member, { id: e.member, display: e.member, agent: e.last_agent ?? "unknown", last_seen: e.first_seen, sessions: new Map(), activity: new Map(), delivered_seq: 0, stamps: [] });
             }
         }
         this.rebuildRecent(sp);
@@ -4578,7 +4653,9 @@ pantheon start</code></pre>
             return m;
         }
         m.display = display;
-        m.agent = agent;
+        const known = agent && agent !== "unknown";
+        if (known || !m.agent || m.agent === "unknown")
+            m.agent = agent;
         m.last_seen = Date.now();
         m.sessions.set(session, { id: session, role, agent, ...(pkg ? { pkg } : {}), ws });
         sp.allow.touch(id, pkg, agent);
@@ -4686,6 +4763,17 @@ pantheon start</code></pre>
             this.hangUp(failed.ws, "STORAGE");
     }
 }
+function decisionDomains(rec) {
+    const d = rec.meta?.["decision_domains"];
+    return Array.isArray(d) ? [...new Set(d.filter((x) => typeof x === "string" && x.trim().length > 0))] : [];
+}
+function passedOverBy(sp, decider, domains) {
+    return reservedBy([...sp.profiles.values()].filter((p) => p.member !== decider), domains);
+}
+function decisionBody(rec, sp) {
+    const marker = rec.meta?.["authority"] === "named" ? namedMarker(rec.from, rec.meta, passedOverBy(sp, rec.to?.[0] ?? "", decisionDomains(rec))) : null;
+    return `${rec.from} needs a decision: ${marker ? `[${marker}] ` : ""}${first(rec.body)}`;
+}
 function first(s, n = 120) {
     const line = s.split("\n")[0] ?? "";
     return line.length > n ? line.slice(0, n - 1) + "…" : line;

package/dist/secret-guard.js

@@ -138,4 +138,8 @@ export function refuseSecrets(guard, fields) {
     }
     return null;
 }
+export const PRIVATE_ARTIFACT_NOTE = "claude.ai artifact links are private to the sender's Claude account; teammates on other accounts get 'Page not found'. Share files through the repo, Jira, Confluence or Drive instead.";
+export function privateLinkNote(...texts) {
+    return texts.some((t) => typeof t === "string" && /claude\.ai\/(?:artifact\/|public\/artifacts)/i.test(t)) ? PRIVATE_ARTIFACT_NOTE : null;
+}
 //# sourceMappingURL=secret-guard.js.map

package/dist/setup-guide.js

@@ -3,7 +3,7 @@ import { approvalSummary, installForUser } from "./install.js";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { applyProfileInit, loadProfile, profilePath, saveProfile, wakeMode } from "./profile.js";
+import { applyProfileInit, loadProfile, profilePath, saveProfile, spaceOverride, teamProfile, wakeMode } from "./profile.js";
 import { installService as realInstall, uninstallService as realUninstall, serviceInstalled as realInstalled } from "./service.js";
 import { personaDir } from "./persona.js";
 import { hudBinaryPath } from "./notifier.js";
@@ -47,7 +47,7 @@ export function guideDefaults(profile, cfg) {
         approval: profile.agent.approval ?? "approve",
         name: profile.human.display_name || cfg.display || gitUserName() || cfg.member,
         title: profile.human.title || "",
-        decides: Object.entries(profile.authority).filter(([, m]) => m === "human_required").map(([d]) => d),
+        decides: Object.entries(teamProfile(profile, cfg.spaceId, cfg.space).authority).filter(([, m]) => m === "human_required").map(([d]) => d),
         notifications: !n.decisions ? "none" : n.worker_done ? "worker" : n.deliveries ? "deliveries" : "decisions",
         persona: false,
     };
@@ -169,8 +169,21 @@ export function parseSetupFlags(argv) {
     const base = val("base");
     if (base !== undefined && base.trim())
         preset.base = base.trim();
+    for (const f of PROFILE_ONLY_FLAGS) {
+        if (argv.some((x) => x === `--${f}` || x.startsWith(`--${f}=`)))
+            errors.push(`--${f} is a profile field, not a setup answer — nothing was changed. Use pantheon profile set --${f} …${f === "human-required" || f === "agent-can-decide" ? " (decision areas like engineering,product)" : ""}`);
+    }
     return { preset, errors };
 }
+export const PROFILE_ONLY_FLAGS = ["responsibilities", "human-required", "agent-can-decide", "capabilities"];
+export function decisionAreasProblem(flagName, raw) {
+    if (raw === undefined)
+        return null;
+    const items = raw.split(",").map((x) => x.trim()).filter(Boolean);
+    if (!raw.includes(";") && !items.some((x) => /\s/.test(x)))
+        return null;
+    return `--${flagName} "${raw}": these take decision areas like engineering,product; describe the role with --responsibilities`;
+}
 export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const optOut = ctx.optOut ?? {};
     const serves = ctx.project ? { path: ctx.project, repos: true } : ctx.serves ?? null;
@@ -267,7 +280,8 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         }
     }
     let next = a.title ? applyProfileInit(profile, { name: a.name, title: a.title }) : { ...profile, human: { ...profile.human, display_name: a.name } };
-    const authority = { ...next.authority };
+    const ovKey = [ctx.cfg.spaceId, ctx.cfg.space].find((k) => k && spaceOverride(next, k)?.authority);
+    const authority = { ...(ovKey ? next.spaces[ovKey].authority : next.authority) };
     const prior = guideDefaults(profile, ctx.cfg).decides;
     const replace = !!io || preset.decides !== undefined;
     for (const area of DECISION_AREAS) {
@@ -278,7 +292,7 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     }
     next = {
         ...next,
-        authority,
+        ...(ovKey ? { spaces: { ...next.spaces, [ovKey]: { ...next.spaces[ovKey], authority } } } : { authority }),
         agent: { ...next.agent, wake_enabled: a.wake !== "no", wake_default: a.wake, allow_bash: a.commands, approval: a.approval },
         notifications: {
             decisions: a.notifications !== "none",
@@ -291,8 +305,14 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
     applied.push(`profile: ${next.human.display_name}${next.human.title ? `, ${next.human.title}` : ""}${a.decides.length ? ` — you personally decide ${a.decides.join(", ")}` : " — no decisions reserved for you; your agent may decide"}`);
     if (deps.publish) {
         try {
-            await deps.publish(next);
+            const team = await deps.publish(next, a.decides);
             applied.push("profile published to your team, so decisions route to you by name");
+            if (Array.isArray(team)) {
+                const held = (d) => team.some((p) => p.member !== ctx.cfg.member && Object.keys(p.authority).includes(d));
+                for (const d of a.decides.filter((x) => !prior.includes(x) && !held(x))) {
+                    warnings.push(`"${d}": every ${d} decision in ${ctx.cfg.space} will wait for you — nobody else holds it. If that is more than you meant, pantheon setup --decides ${a.decides.filter((x) => x !== d).join(",") || "none"}`);
+                }
+            }
         }
         catch (e) {
             warnings.push(`profile saved but not published (${e.message}) — run \`pantheon profile publish\` when the relay is reachable`);

package/helper/macos/prebuilt/manifest.json

@@ -1,6 +1,6 @@
 {
   "format": 1,
-  "built_at": "2026-10-07T10:43:05.668Z",
+  "built_at": "2026-10-08T17:23:00.642Z",
   "swiftc": "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)",
   "helpers": {
     "pantheon-tray": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.33.4",
+  "version": "0.33.5",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "test:installer": "node scripts/installer-tests/run.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "undici": "^7.29.1",
     "ws": "^8.18.0",
     "zod": "^3.23.8"