@join-pantheon/cli 0.33.5 → 0.33.6

package/README.md

@@ -406,12 +406,30 @@ peer's machine was answered in **31 seconds with no human involved**, and:
   2. …unless that report is over **30 minutes** old with nothing after it. Claude Code runs no
      Stop hook on an interrupt, and no hook at all when a window is closed mid-turn, so a busy
      report can outlive its turn; past 30 minutes it is read as "ended when reported"
-  3. your last turn ended under **2 minutes** ago (`--idle` changes it) → the worker waits
+  3. your last turn ended under **2 minutes** ago → the worker waits. Set the wait on your machine
+     with `pantheon policy set idle-seconds <0-900>` (read each tick, so the background worker needs
+     no restart; `--idle` sets it for one worker). The teammate who asked is told when to expect it:
+     the `pantheon_send` result for an ASK, `pantheon status` and the board say "Rohit's agent will
+     pick this up in about 2 minutes", "Rohit is at his keyboard…", that his worker is offline, or
+     that his machine can't take requests yet (no agent CLI installed or signed in)
   4. nothing has ever reported and no hook is installed here → any open window wins (the
      conservative fallback); with the hook installed, silence reads as idle
   5. otherwise the worker claims the work — after a 20-second grace while a window is open,
      ~2 seconds when none is. `pantheon ps` shows which of these applies right now
+- an agent CLI it can run unattended (Claude Code, Codex, Cursor's `cursor-agent`, or GitHub's
+  `copilot`), installed and signed in. The Claude desktop app alone is not enough. `pantheon join`,
+  `start` and `setup` check this and say what to install for your OS before anyone sends you work
+- on Linux, with commands on: Claude Code's sandbox (bubblewrap, plus socat) must be able to start.
+  Some containers and Ubuntu 23.10+/24.04 (AppArmor's restriction on unprivileged user namespaces)
+  stop it even when both are installed; `pantheon doctor` starts it once and says what failed and the
+  likely fix, and teammates are told "its Linux sandbox can't start". Pantheon never runs commands
+  outside the sandbox instead
 - one run at a time, capped at 12/hour by default
+- each run may take **60 minutes** by default; one still going then is stopped (with everything it
+  started), tried once more in the same worktree, then handed to you with the limit named. Set it
+  on your machine with `pantheon policy set run-minutes <5-180>` (read at the next run, so the
+  background worker needs no reinstall); `pantheon worker --run-minutes <n>` sets it for one worker,
+  and a persona's `max_run_minutes` can only lower it
 - the full transcript is left in `.pantheon-run.log` on the branch, and the run's scratch files
   (brief, transcript, MCP config) are git-excluded so they cannot ride along into a commit —
   **no credential is ever written into the worktree**
@@ -595,6 +613,7 @@ pantheon worker --persona reviewer # pin one; or let each request match by its r
 ---
 allow_bash: false          # never shell for runs this persona handles, even with --allow-bash
 max_runs_per_hour: 6
+max_run_minutes: 30        # a run it handles is stopped after 30 minutes (only lowers the machine's limit)
 wake_by: alice, bob        # only these peers
 kinds: ANSWER, ACCEPT      # asks and proposal verdicts, not revisions
 goals: launch-*            # only matching goals
@@ -613,6 +632,10 @@ The rules that make this safe to commit into a shared repo:
   the skip is logged with the reason. No personas at all = open mode, as before.
 - Several personas match different work (by peer, kind, goal) — one worker, many hats. `default`
   is always tried last, so it never shadows a named persona.
+- **`max_run_minutes` is new in 0.33.6.** A Pantheon before 0.33.6 does not know the key and reads
+  a persona that uses it as broken, so a teammate's worker on an older version skips a *committed*
+  persona with it until they upgrade. `pantheon doctor` and `pantheon persona show` say so. Put it
+  in a persona under `~/.pantheon/personas` (yours alone), or commit it once the team is on 0.33.6.
 
 ## Guardrails
 
@@ -634,7 +657,7 @@ never in a prompt: a prompt can be argued out of its instructions.
 | Invites | single-use, expiring | a leaked link is inert once redeemed or timed out |
 | Claims | one session per obligation | parallel Conductor workspaces cannot duplicate work |
 | Wake rights | `pantheon wake allow`, per machine; `--may-wake`, per member for the team | under "anyone" (the default): every peer the team lets wake; under "approved": only those you also approved here. Checked by the worker before a run starts, and by the relay at its claim |
-| Run budget | 12/hour, 1 concurrent | a peer cannot drain your tokens |
+| Run budget | 12/hour, 1 concurrent, 60 minutes each | a peer cannot drain your tokens; `pantheon policy set run-minutes` (5–180) |
 | Personas | tighten-only | a persona file — even one a teammate committed — can lower caps and turn bash off, never the reverse |
 | Signed acts | every act and goal, ed25519, since 0.31 | checked on each receiving machine against the key it pinned for the sender: the relay cannot forge, alter, re-file or replay a teammate's request without that machine noticing, and a worker runs only requests that check out. A teammate's changed key is held back until you confirm it (`pantheon trust`) |
 | Worktree hygiene | no secrets on disk | credentials reach a woken run through its environment only; run scratch files are git-excluded |
@@ -731,6 +754,15 @@ shape of a common secret).
 Whoever operates the relay can read those acts — the operator dashboard shows each space's
 message history — so treat a space like a shared team channel, not a private notebook.
 
+The relay also keeps **daily usage counts per team** (from 0.33.6), so pricing can follow use
+later; nothing is charged from them. Per team and per UTC day it counts: messages by type (ASK,
+ANSWER, PROPOSE, DELIVERED, …), how many of those an unattended worker run sent and how many a
+person's own session sent, and goals opened and closed. That is all: no count per person or per
+member, no bandwidth, no message content. The counts are kept for 400 days in a file beside the
+team's ledger, survive restarts and ledger compaction, and are deleted with the team. The team's
+founder reads them with `pantheon usage` (last 30 days; other members are refused), and the relay's
+operator through the admin report.
+
 - `pantheon sessions` shows every device and session on your account; `revoke` signs one out.
 - `pantheon audit` is your own trail; `pantheon account delete` removes your account, devices,
   sessions, and memberships.

package/dist/agents.js

@@ -6,7 +6,8 @@ import { join, dirname, isAbsolute, relative } from "node:path";
 import { copyInside, mkdirInside, writeInside } from "./safe-write.js";
 import { gitCallEnv, safeGitArgs } from "./git-safe.js";
 import { launcher, kiroDir } from "./install.js";
-import { agentSpawn, which } from "./which.js";
+import { agentSpawn, loginShellLookup, loginShellRunner, which } from "./which.js";
+import { probeLinuxSandbox, sandboxAdvice } from "./linux-sandbox.js";
 import { earliest, whenAgain } from "./agent-outage.js";
 import { PANTHEON_TOOL_NAMES, PANTHEON_TOOLS } from "./tools.js";
 import { claudeRunSettings, NO_CLAUDE_FEATURES, runTmpDir, sandboxCacheEnv, versionAtLeast } from "./claude-confine.js";
@@ -40,18 +41,19 @@ export function hasCopilotExtension(home = homedir()) {
         return false;
     }
 }
-const sh = (cmd) => {
+const sh = (cmd, timeoutMs = 5_000) => {
     try {
-        return execFileSync("sh", ["-lc", cmd], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+        return execFileSync("sh", ["-lc", cmd], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: timeoutMs, killSignal: "SIGKILL" }).trim() || null;
     }
     catch {
         return null;
     }
 };
 export function cliOnPath(name) {
-    if (!binaryCache.has(`path:${name}`))
-        binaryCache.set(`path:${name}`, which(name));
-    return binaryCache.get(`path:${name}`) ?? null;
+    const k = `path:${name}`, c = binaryCache.get(k);
+    if (!c || (!c.path && Date.now() - c.at > NOT_FOUND_TTL_MS))
+        binaryCache.set(k, { path: which(name), at: Date.now() });
+    return binaryCache.get(k).path;
 }
 export function agentById(id) {
     return AGENTS.find((a) => a.id === id || a.binaries.includes(id));
@@ -84,6 +86,9 @@ export function detectForHooks(projectDir = process.cwd()) {
     }
     return out;
 }
+export function anyUnattendedAgentOnPath(lookupTimeoutMs = READINESS_LOOKUP_MS) {
+    return AGENTS.some((a) => !NOT_FOR_UNATTENDED_RUNS.has(a.id) && !!resolveBinary(a, { lookupTimeoutMs }));
+}
 export function detectAvailable() {
     const out = [];
     for (const backend of AGENTS) {
@@ -124,19 +129,36 @@ export function detectOnPath() {
     return null;
 }
 const binaryCache = new Map();
-export function resolveBinary(backend) {
+const NOT_FOUND_TTL_MS = 30_000;
+const notCursorAgent = new Set();
+export const READINESS_LOOKUP_MS = 3_000;
+export function forgetMissingBinaries() {
+    for (const [b, v] of binaryCache)
+        if (!v.path)
+            binaryCache.delete(b);
+}
+export function resolveBinary(backend, o = {}) {
     for (const b of backend.binaries) {
-        if (!binaryCache.has(b)) {
-            const hit = which(b);
+        const cached = binaryCache.get(b);
+        if (!cached || (!cached.path && Date.now() - cached.at > NOT_FOUND_TTL_MS)) {
+            const hit = o.lookupTimeoutMs !== undefined
+                ? which(b, platform(), process.env, { login: (n) => loginShellLookup(n, loginShellRunner(o.lookupTimeoutMs)) })
+                : which(b);
             let found = hit ? (platform() === "win32" ? hit : b) : null;
             if (found && b === "agent") {
-                const v = `${sh("agent --version 2>/dev/null | head -1") ?? ""} ${sh("agent --help 2>/dev/null | head -3") ?? ""}`;
-                if (!/cursor/i.test(v))
+                if (notCursorAgent.has(hit))
                     found = null;
+                else {
+                    const v = `${sh("agent --version 2>/dev/null | head -1", 3_000) ?? ""} ${sh("agent --help 2>/dev/null | head -3", 3_000) ?? ""}`;
+                    if (!/cursor/i.test(v)) {
+                        found = null;
+                        notCursorAgent.add(hit);
+                    }
+                }
             }
-            binaryCache.set(b, found);
+            binaryCache.set(b, { path: found, at: Date.now() });
         }
-        const hit = binaryCache.get(b);
+        const hit = binaryCache.get(b).path;
         if (hit)
             return hit;
     }
@@ -315,6 +337,85 @@ export function unattendedRefusal(c, o = {}) {
         return null;
     return `${c.backend.label} is not signed in (${c.signIn?.detail ?? "not checked"}), and signed out it opens a browser to log in, so it is not started while you are away — ${SIGN_IN_CHECK[c.backend.id].fix}`;
 }
+export function claudeInstallCommand(os = platform()) {
+    return os === "win32" ? "irm https://claude.ai/install.ps1 | iex   (in PowerShell)" : "curl -fsSL https://claude.ai/install.sh | bash";
+}
+export function unattendedReadiness(o = {}) {
+    if (o.available)
+        return readinessFrom(o.available, o);
+    const resolve = o.resolve ?? ((b) => resolveBinary(b, { lookupTimeoutMs: READINESS_LOOKUP_MS }));
+    let probed = null;
+    const probe = o.sandboxProbe ?? probeLinuxSandbox;
+    const probeOnce = () => (probed ??= { p: probe() }).p;
+    o = { ...o, sandboxProbe: probeOnce };
+    const seen = new Map();
+    const base = o.check === null ? null : (o.check ?? ((b, bin) => signedIn(b, bin, undefined, o.home)));
+    const check = base === null ? null : (b, bin) => { const k = `${b.id}|${bin}`; let r = seen.get(k); if (!r) {
+        r = base(b, bin);
+        seen.set(k, r);
+    } return r; };
+    const pinned = o.pinned && o.pinned !== "auto" ? agentById(o.pinned) : undefined;
+    const wanted = o.prefer ? agentById(o.prefer) : undefined;
+    const order = pinned ? [pinned] : [
+        ...(o.unsandboxedOk ? [] : AGENTS.filter((a) => SANDBOXED_FOR_UNATTENDED.has(a.id))),
+        ...(wanted ? [wanted] : []),
+        ...AGENTS.filter((a) => !NOT_FOR_UNATTENDED_RUNS.has(a.id)),
+        ...AGENTS.filter((a) => NOT_FOR_UNATTENDED_RUNS.has(a.id)),
+    ].filter((a, i, all) => all.findIndex((x) => x.id === a.id) === i);
+    const found = [];
+    let last = null;
+    for (const b of order) {
+        const bin = resolve(b);
+        if (!bin)
+            continue;
+        found.push({ backend: b, binary: bin });
+        if (NOT_FOR_UNATTENDED_RUNS.has(b.id))
+            continue;
+        const r = readinessFrom(found, { ...o, check });
+        if (r.ok)
+            return r;
+        last = { r, n: found.length };
+    }
+    return last && last.n === found.length ? last.r : readinessFrom(found, { ...o, check });
+}
+function readinessFrom(given, o) {
+    const os = o.os ?? platform();
+    const available = given.filter((a) => !NOT_FOR_UNATTENDED_RUNS.has(a.backend.id));
+    if (!available.length && (!o.pinned || o.pinned === "auto")) {
+        const kiro = given.some((a) => a.backend.id === "kiro");
+        return {
+            ok: false, code: kiro ? "kiro_only" : "no_agent", short: "Claude Code (or another agent CLI) isn't installed",
+            says: `No agent on this machine can take teammates' requests while you're away: none of claude, codex, cursor-agent or copilot is installed${kiro ? " (Kiro answers only in your live sessions)" : ""}. ` +
+                `The Claude desktop app alone is not enough — it puts no command-line tool here.`,
+            fix: `Install Claude Code: ${claudeInstallCommand(os)} — then run \`claude\` once and sign in (/login). Codex (npm install -g @openai/codex), Cursor's cursor-agent or GitHub's copilot CLI work too.`,
+        };
+    }
+    let choice;
+    try {
+        choice = (o.choose ?? chooseAgent)(o.pinned ?? "auto", { ...o, available });
+    }
+    catch (e) {
+        const m = e.message;
+        return { ok: false, code: /no agent CLI on PATH|is not on PATH/.test(m) ? "no_agent" : "no_agent_choice", short: m.replace(/ \(looked for .*\)$/, "").slice(0, 120), says: m, fix: "pantheon doctor names what is missing" };
+    }
+    const refused = unattendedRefusal(choice, { ...(o.unsandboxedOk !== undefined ? { unsandboxedOk: o.unsandboxedOk } : {}) });
+    if (refused) {
+        return { ok: false, code: NOT_FOR_UNATTENDED_RUNS.has(choice.backend.id) ? "kiro_only" : "unsandboxed_off", short: `${choice.backend.label} is set to leave requests for them`, says: `Teammates' requests wait for your next session here: ${refused}`,
+            fix: `install Claude Code (${claudeInstallCommand(os)}) to have requests answered in its sandbox, or: pantheon policy grant unsandboxed-runs` };
+    }
+    if (choice.signIn && !choice.signIn.ok && !choice.signIn.unknown) {
+        return { ok: false, code: "not_signed_in", short: `${choice.backend.label} isn't signed in`, says: `${choice.backend.label} is installed but not signed in, so a request while you're away would fail.`,
+            fix: SIGN_IN_CHECK[choice.backend.id].fix };
+    }
+    if (o.commandsOn && choice.backend.id === "claude-code" && os === "linux") {
+        const p = (o.sandboxProbe ?? probeLinuxSandbox)();
+        if (p && !p.ok) {
+            const a = sandboxAdvice(p, { container: !!o.inContainer });
+            return { ok: false, code: "sandbox_unavailable", short: "its Linux sandbox can't start", says: a.says, fix: a.fix };
+        }
+    }
+    return { ok: true, short: "", says: `${choice.backend.label} takes teammates' requests while you're away.`, fix: "" };
+}
 export function describeChoice(c) {
     const head = `${c.backend.label}${c.signIn ? ` — ${c.signIn.detail}` : ""} (${c.because})`;
     return c.skipped.length ? `${head}; skipped ${c.skipped.map((s) => `${s.backend.label} — ${s.why}`).join("; ")}` : head;

package/dist/board.js

@@ -899,6 +899,8 @@ export function renderWatch(s, o = { now: Date.now() }) {
             lines.push(D(fit(`    ${meta}  ${i.id}`)));
             if (i.context)
                 lines.push(D(fit(`    for: ${termSafe(i.context)}`)));
+            if (i.pickup)
+                lines.push(D(fit(`    ${termSafe(i.pickup)}`)));
             if (lane.id === "now")
                 for (const cmd of watchCommands({ ...i, ...(i.space ? { space: termSafe(i.space) } : {}) }, multi))
                     lines.push(`    ${cmd}`);
@@ -1216,6 +1218,8 @@ function row(item, card) {
   else meta.append(el("span", "chip", item.decider ? item.decider + " decides" : "waiting on " + item.who));
   li.append(meta);
   if (item.context) li.append(el("p", "ctx", "For: " + item.context));
+  // When a teammate's agent will pick it up (#69): so a wait does not read as broken.
+  if (item.pickup) li.append(el("p", "ctx", item.pickup));
   const acts = el("div", "actions");
   if (card && item.wake) {
     // A teammate waiting on this person's approval: Approve / Just this once /

package/dist/claude-confine.js

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { lstatSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, mkdirSync, readdirSync, readFileSync, rmdirSync, rmSync, statSync } from "node:fs";
 import { writeInside } from "./safe-write.js";
 import { homedir, platform, tmpdir } from "node:os";
 import { isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
@@ -110,6 +110,50 @@ export function gitDataDeny(common) {
     catch { }
     return { files, dirs: [join(c, "hooks"), join(c, "info")] };
 }
+export function absentDeniedPaths(common) {
+    const d = gitDataDeny(common);
+    const out = new Set();
+    const there = (p) => { try {
+        lstatSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    } };
+    const root = resolve(common);
+    for (const p of [...d.files, ...d.dirs]) {
+        let q = resolve(p);
+        while (!there(q) && q.startsWith(root + sep)) {
+            out.add(q);
+            q = resolve(q, "..");
+        }
+    }
+    return [...out].sort((a, b) => b.length - a.length);
+}
+export function removeSandboxLeftovers(absent) {
+    const removed = [];
+    for (const p of absent) {
+        let st;
+        try {
+            st = lstatSync(p);
+        }
+        catch {
+            continue;
+        }
+        try {
+            if (st.isFile() && st.size === 0 && st.nlink === 1) {
+                rmSync(p, { force: true });
+                removed.push(p);
+            }
+            else if (st.isDirectory() && readdirSync(p).length === 0) {
+                rmdirSync(p);
+                removed.push(p);
+            }
+        }
+        catch { }
+    }
+    return removed;
+}
 const inside = (child, parent) => {
     const r = relative(parent, child);
     return r === "" || (!!r && !r.startsWith("..") && !isAbsolute(r));
@@ -140,7 +184,7 @@ function userExcludedCommands(file) {
     }
 }
 export const SECRET_FILE_GLOBS = [".env", ".env.*", "*.pem", "*.key", "*.p12", "*.pfx", "id_rsa*", "id_ed25519*", ".npmrc", ".netrc", "credentials*", "*.keystore", "service-account*.json"];
-const PANTHEON_HOME_ENTRIES = ["config.json", "config.json.bak", "config.json.lock", "worker-policy.json", "profile.json", "continued.json", "bin", "runtime", "ops", "run-homes", "logs", "mcp", "data"];
+const PANTHEON_HOME_ENTRIES = ["config.json", "config.json.bak", "config.json.lock", "worker-policy.json", "profile.json", "continued.json", "removed.json", "removed.json.lock", "readiness-recheck.stamp", "bin", "runtime", "ops", "run-homes", "logs", "mcp", "data"];
 function aroundWorktree(top, keeps, named) {
     const keep = (typeof keeps === "string" ? [keeps] : [...keeps]).map((k) => resolve(k));
     const out = [];