@join-pantheon/cli 0.33.5 → 0.33.6-rc.1

package/dist/relay.js

@@ -1,11 +1,11 @@
 import { createServer } from "node:http";
 import { createHash, randomBytes, timingSafeEqual as timingSafeEqualBuf } from "node:crypto";
-import { copyFileSync, readdirSync, readFileSync, statSync, existsSync, writeFileSync, openSync, readSync, closeSync, fstatSync } from "node:fs";
+import { copyFileSync, readdirSync, readFileSync, statSync, existsSync, writeFileSync, openSync, readSync, closeSync, fstatSync, promises as fsp } from "node:fs";
 import { spawn } from "node:child_process";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import { basename, join } from "node:path";
 import { WebSocketServer } from "ws";
-import { badRemote, Inbound, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, RELAY_FEATURES, SENDABLE, shouldDeferToHuman, } from "./protocol.js";
+import { badRemote, Inbound, isCatchAllDomain, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, RELAY_FEATURES, SENDABLE, WORKER_REASONS, shouldDeferToHuman, } from "./protocol.js";
 import { VERSION } from "./version.js";
 import { compareVersions, INSTALLER_MIN_CLI, isVersion, installerScript, InstallerGate } from "./installer.js";
 import { installerLine } from "./managed.js";
@@ -15,6 +15,7 @@ import { Accounts, normalizeUsername, validEmail, validUsername } from "./accoun
 import { emailSenderFromEnv, maskEmail } from "./email.js";
 import { Allowlist, RosterUnreadable } from "./roster-file.js";
 import { StateStore, ensurePrivateDir, setWaitForDisk, takeSlowestDiskWait, waitsForDisk } from "./store.js";
+import { countGoal, countMessage, emptyUsage, parseUsage, usageAnswer, USAGE_KEEP_DAYS, USAGE_SHOW_DAYS } from "./usage.js";
 import { busyWriter, DiskBusy, flushWrites, onWriteError, pendingView, readLatest, recordWrites, whenLanded, writerFor } from "./disk-writer.js";
 import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, spaceHealth, fleetReport, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
 import { fmtLimit, inviteLimit, parseLimits, planLimits, PLAN_NAME } from "./plans.js";
@@ -182,6 +183,9 @@ const fmtAgo = (t) => {
     return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
 };
 const safeName = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
+export function printableLine(s, max) {
+    return s.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
+}
 const quoteTeam = (name) => relayShellArg(name);
 function parseLines(text) {
     const records = [];
@@ -775,6 +779,23 @@ export class Relay {
                 : sinceRaw !== null ? space.ledger.since(Number(sinceRaw) || 0) : space.ledger.latest();
             return this.json(res, 200, { acts, head: space.ledger.head });
         }
+        if (url.pathname === "/usage") {
+            const v = { usage_v: 1 };
+            if (!url.searchParams.has("sig"))
+                return this.json(res, 401, { ...v, code: "SIGNED_ONLY", error: "a team's usage is read signed, by its founder: pantheon usage" });
+            const gate = this.readGate(req, url, ip);
+            if (!gate.ok)
+                return this.json(res, gate.status, { ...v, error: gate.error, ...(gate.code ? { code: gate.code } : {}) });
+            const space = gate.space;
+            if (url.searchParams.has("dpub"))
+                return this.json(res, 403, { ...v, code: "NOT_FOR_A_RUN", error: "an unattended run cannot read the team's usage" });
+            const founder = space.allow.founder();
+            if (!founder || gate.reader !== founder) {
+                return this.json(res, 403, { ...v, code: "FOUNDER_ONLY", error: `only ${founder ?? "the team's founder"}, who founded "${space.name}", can see its usage` });
+            }
+            const days = Number(url.searchParams.get("days") ?? USAGE_SHOW_DAYS);
+            return this.json(res, 200, { ...v, ...usageAnswer(space.name, space.store.usage, days) });
+        }
         if (url.pathname === "/obligations") {
             const gate = this.readGate(req, url, ip);
             if (!gate.ok && gate.notice)
@@ -791,7 +812,8 @@ export class Relay {
             const worker_online = member
                 ? [...(space.members.get(member)?.sessions.values() ?? [])].some((s) => s.role === "worker")
                 : false;
-            return this.json(res, 200, { obligations: owed, closed_goals: closed, seq: space.ledger.head, worker_online, space_id: space.allow.spaceId(), members: this.members(space) });
+            return this.json(res, 200, { obligations: owed, closed_goals: closed, seq: space.ledger.head, worker_online, space_id: space.allow.spaceId(), members: this.members(space),
+                ...(gate.reader ? { roster: this.roster(space), now: Date.now() } : {}) });
         }
         if (url.pathname === "/activity") {
             if (req.method !== "POST")
@@ -840,7 +862,7 @@ export class Relay {
             const seen = Number(url.searchParams.get("seen"));
             if (Number.isFinite(seen) && seen > (member.seen_seq ?? 0))
                 member.seen_seq = seen;
-            this.broadcast(space, () => ({ t: "roster", roster: this.roster(space) }));
+            this.broadcast(space, () => ({ t: "roster", roster: this.roster(space), now: Date.now() }));
             return this.json(res, 200, { ok: true });
         }
         this.json(res, 404, { error: "not found" });
@@ -907,6 +929,14 @@ export class Relay {
             if (url.pathname === "/admin/report") {
                 if (!authed)
                     return this.json(res, 401, { error: "admin token required" });
+                if (url.searchParams.get("format") === "usage") {
+                    const days = Number(url.searchParams.get("days") ?? USAGE_SHOW_DAYS);
+                    void this.usageOfAll(days, url.searchParams.get("space"))
+                        .then((spaces) => this.json(res, 200, { relay: VERSION, generated: Date.now(), kept_days: USAGE_KEEP_DAYS, spaces }))
+                        .catch((e) => { this.log(`! usage report failed: ${e.message}`); if (!res.headersSent)
+                        this.json(res, 500, { error: "the usage report could not be made" }); });
+                    return;
+                }
                 const rows = this.fleetHealth();
                 const relayAgeMs = Date.now() - this.startedAt;
                 if (url.searchParams.get("format") === "json")
@@ -1489,11 +1519,45 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         }
         return out;
     }
+    async usageOfAll(days, only) {
+        const out = [];
+        const seen = new Set();
+        const want = (name, safe) => !only || spaceKey(only) === spaceKey(name) || spaceKey(only) === spaceKey(safe);
+        for (const sp of this.spaces.values()) {
+            const safe = safeName(sp.name);
+            seen.add(safe);
+            if (want(sp.name, safe))
+                out.push(usageAnswer(sp.name, sp.store.usage, days));
+        }
+        let files = [];
+        try {
+            files = await fsp.readdir(this.dataDir);
+        }
+        catch { }
+        for (const f of files) {
+            if (!f.endsWith(".usage.json"))
+                continue;
+            const safe = f.slice(0, -".usage.json".length);
+            if (seen.has(safe))
+                continue;
+            let book = emptyUsage();
+            try {
+                const queued = pendingView(this.dataDir, safe, join(this.dataDir, f));
+                if (queued !== null)
+                    book = parseUsage(JSON.parse(queued !== undefined ? queued.toString("utf8") : await fsp.readFile(join(this.dataDir, f), "utf8")));
+            }
+            catch { }
+            const name = book.space ?? safe;
+            if (want(name, safe))
+                out.push(usageAnswer(name, book, days));
+        }
+        return out.sort((a, b) => a.space.localeCompare(b.space));
+    }
     spacesOverview() {
         const now = Date.now();
         const out = new Map();
         const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
-        const size = (safe) => [".jsonl", ".state.json", ".members.json"].reduce((n, suf) => { try {
+        const size = (safe) => [".jsonl", ".state.json", ".members.json", ".usage.json"].reduce((n, suf) => { try {
             return n + statSync(join(this.dataDir, `${safe}${suf}`)).size;
         }
         catch {
@@ -1580,6 +1644,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         const sp = this.spaces.get(spaceKey(name));
         if (sp) {
             sp.deleted = true;
+            sp.store.discardUsage();
             for (const m of sp.members.values())
                 for (const s of m.sessions.values())
                     this.hangUp(s.ws, "SPACE_DELETED");
@@ -2058,7 +2123,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             meta: { notice: "seat_recovery", recovery: { member, fp: toFp, from_fp: fromFp, state: "moved", how, ...(by ? { by } : {}) } },
         });
         this.broadcast(sp, { t: "members", members: this.members(sp) });
-        this.broadcast(sp, () => ({ t: "roster", roster: this.roster(sp) }));
+        this.broadcast(sp, () => ({ t: "roster", roster: this.roster(sp), now: Date.now() }));
         return inv;
     }
     mintRecoveryInvite(sp, member) {
@@ -2123,9 +2188,15 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         const ts = Number(params.ts);
         const refused = { ok: false, status: 403, error: "a read must be signed, recently, by the key of a member admitted to this team" };
         const pub = reader ? target.allow.pubkeyOf(reader) : null;
+        const { sig, ...signed } = params;
+        if (!pub && reader && Number.isFinite(ts) && Math.abs(Date.now() - ts) < LIMITS.activityFreshMs && !signed.dpub) {
+            const e = target.allow.get(reader);
+            if (e && !e.admitted && e.revoked_at && e.publicKey && verifyRead(e.publicKey, req.method ?? "GET", url.pathname, signed, sig)) {
+                return { ok: false, status: 403, code: "REVOKED", error: `"${reader}" was removed from "${name}"${e.revoked_by ? ` by ${e.revoked_by}` : ""}. Only a member of the team can let you back in.` };
+            }
+        }
         if (!pub || !Number.isFinite(ts) || Math.abs(Date.now() - ts) >= LIMITS.activityFreshMs)
             return refused;
-        const { sig, ...signed } = params;
         let signer = pub;
         if (signed.dpub) {
             const cert = { pub: signed.dpub, run: signed.drun ?? "", expires: Number(signed.dexp), sig: signed.dcert ?? "" };
@@ -2513,7 +2584,11 @@ ${done ? `<div class=done role=status>${esc(done)}</div>` : ""}
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
         const sp = this.spaces.get(spaceKey(name)) ?? null;
         const tomb = this.deletedSpaces.get(spaceKey(name));
-        const onDisk = [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
+        const onDisk = [".jsonl", ".state.json", ".members.json"].some((suf) => {
+            const f = join(this.dataDir, `${safe}${suf}`);
+            const queued = pendingView(this.dataDir, safe, f);
+            return queued !== undefined ? queued !== null : existsSync(f);
+        });
         if (!name || (!sp && (!onDisk || (tomb && Date.now() - tomb < 3_600_000))))
             return this.json(res, 404, { error: `no space "${name}" on this relay` });
         const records = sp ? sp.ledger.all() : this.sleepingRecords(safe);
@@ -3174,7 +3249,7 @@ pantheon start</code></pre>
                     }
                     this.send(ws, {
                         t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
-                        roster: this.roster(sp), goals: [...sp.goals.values()],
+                        roster: this.roster(sp), now: Date.now(), goals: [...sp.goals.values()],
                         obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
                         space_id: sp.allow.spaceId(), repos: sp.allow.repoList(), features: [...this.features],
                         ...(acct ? { plan: this.planView(acct, sp) } : {}),
@@ -3202,7 +3277,7 @@ pantheon start</code></pre>
                     if (firstSession && m.role !== "cli") {
                         this.commit(sp, { from: me.id, act: "JOIN", body: `${me.display} online (${me.agent})`, to: null, goal: null, ref: null });
                     }
-                    this.broadcast(sp, () => ({ t: "roster", roster: this.roster(sp) }));
+                    this.broadcast(sp, () => ({ t: "roster", roster: this.roster(sp), now: Date.now() }));
                     this.log(`[${sp.name}] + ${me.id}/${sessionId} (${m.role}, ${me.agent})${verdict === "founder" ? " [founder, auto-admitted]" : ""}`);
                     return;
                 }
@@ -3227,9 +3302,11 @@ pantheon start</code></pre>
                     }
                     if (!this.writeOk(me))
                         return fail("RATE_LIMIT", "too many changes too fast — wait a few seconds", m.cid);
-                    const wild = Object.keys(m.profile.authority ?? {}).filter((k) => /[*?]/.test(k) || k.trim() === "");
-                    if (wild.length)
-                        return fail("BAD_AUTHORITY", `authority is claimed per named domain, not with "${wild[0]}"`, m.cid);
+                    const vague = Object.keys(m.profile.authority ?? {}).filter((k) => isCatchAllDomain(k));
+                    if (vague.length) {
+                        m.profile = { ...m.profile, authority: Object.fromEntries(Object.entries(m.profile.authority).filter(([k]) => !isCatchAllDomain(k))) };
+                        this.log(`[${space.name}] ~ ${me.id}'s profile: dropped ${vague.map((k) => JSON.stringify(k)).join(", ")} — not a decision area`);
+                    }
                     const current = space.profiles.get(me.id);
                     if (!current || m.profile.updated_at > current.updated_at) {
                         space.profiles.set(me.id, m.profile);
@@ -3241,7 +3318,8 @@ pantheon start</code></pre>
                             meta: { organization_profile: m.profile },
                         });
                     }
-                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: me.id, seq: space.ledger.head });
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: me.id, seq: space.ledger.head,
+                        ...(vague.length ? { note: `dropped ${vague.slice(0, 5).map((k) => JSON.stringify(k.slice(0, 40))).join(", ")} — not decision areas; the rest of the profile was published` } : {}) });
                     return;
                 }
                 if (m.t === "clear_authority") {
@@ -3313,15 +3391,20 @@ pantheon start</code></pre>
                         this.log(`[${space.name}] * ADMITTED ${m.member} by ${me.id}${m.may_wake ? " (may wake workers)" : ""}`);
                     }
                     this.broadcast(space, { t: "members", members: this.members(space) });
-                    this.broadcast(space, () => ({ t: "roster", roster: this.roster(space) }));
+                    this.broadcast(space, () => ({ t: "roster", roster: this.roster(space), now: Date.now() }));
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.member, seq: space.ledger.head });
                     return;
                 }
                 if (m.t === "worker_state") {
                     if (role !== "worker")
                         return;
-                    me.worker = { state: m.state, ...(m.detail ? { detail: m.detail } : {}), ...(m.until ? { until: m.until } : {}), at: Date.now() };
-                    this.broadcast(space, () => ({ t: "roster", roster: this.roster(space) }));
+                    const now = Date.now();
+                    const detail = m.detail ? printableLine(m.detail, 120) : "";
+                    const until = m.until_in !== undefined ? now + m.until_in : m.until;
+                    const reason = m.reason ? (WORKER_REASONS.includes(m.reason) ? m.reason : "unknown") : undefined;
+                    me.worker = { state: m.state, ...(detail ? { detail } : {}), ...(until ? { until } : {}), ...(m.idle_ms !== undefined ? { idle_ms: m.idle_ms } : {}),
+                        ...(reason ? { reason } : {}), ...(m.ref ? { ref: m.ref } : {}), ...(m.goal ? { goal: m.goal } : {}), at: now };
+                    this.broadcast(space, () => ({ t: "roster", roster: this.roster(space), now: Date.now() }));
                     return;
                 }
                 if (m.t === "delete_space") {
@@ -3544,6 +3627,7 @@ pantheon start</code></pre>
                     };
                     space.goals.set(goal.id, goal);
                     space.store.flush(space.goals, space.obligations, space.profiles);
+                    this.countUsage(space, (b, now) => countGoal(b, "opened", now));
                     this.broadcast(space, { t: "goal", goal });
                     const rec = this.commit(space, {
                         from: me.id, act: "NOTE", to: null, goal: goal.id, ref: null,
@@ -3647,6 +3731,12 @@ pantheon start</code></pre>
                                 ...(fromRepo ? { from_repo: fromRepo } : {}) } }
                         : {}),
                 });
+                {
+                    const sp = space;
+                    const closed = rec.act === "CLOSE" && !!rec.goal && sp.goals.get(rec.goal)?.state === "CLOSED";
+                    this.countUsage(sp, (b, now) => { countMessage(b, rec.act, role, now); if (closed)
+                        countGoal(b, "closed", now); });
+                }
                 if (wasFull && m.act === "CLOSE") {
                     try {
                         this.compactSpace(space);
@@ -3748,7 +3838,7 @@ pantheon start</code></pre>
                 this.commit(space, { from: me.id, act: "LEAVE", body: `${me.display} offline`, to: null, goal: null, ref: null });
             }
             this.pushObligations(space);
-            this.broadcast(space, () => ({ t: "roster", roster: this.roster(space) }));
+            this.broadcast(space, () => ({ t: "roster", roster: this.roster(space), now: Date.now() }));
             this.log(`[${space.name}] - ${me.id}/${sessionId}`);
         };
         ws.on("close", (code) => { try {
@@ -4091,7 +4181,7 @@ pantheon start</code></pre>
             sp.store.rebuilt = null;
         this.pushObligations(sp);
         this.broadcast(sp, { t: "act", act: rec });
-        this.broadcast(sp, () => ({ t: "roster", roster: this.roster(sp) }));
+        this.broadcast(sp, () => ({ t: "roster", roster: this.roster(sp), now: Date.now() }));
         return rec;
     }
     effects(sp, rec, ctx) {
@@ -4377,10 +4467,28 @@ pantheon start</code></pre>
             }
         }
     }
+    countUsage(sp, fn) {
+        if (sp.deleted)
+            return;
+        try {
+            sp.store.usage.space ??= sp.name;
+            fn(sp.store.usage, Date.now());
+            sp.store.saveUsage();
+        }
+        catch (e) {
+            this.noteStorageFailure(`[${sp.name}] counting usage`, e);
+        }
+    }
     deleteSpaceFiles(name) {
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
-        for (const suffix of [".jsonl", ".state.json", ".members.json"])
+        for (const suffix of [".jsonl", ".state.json", ".members.json", ".usage.json"])
             writerFor(this.dataDir, safe).remove(join(this.dataDir, `${safe}${suffix}`));
+        try {
+            for (const f of readdirSync(this.dataDir))
+                if (f.startsWith(`${safe}.usage.json.corrupt-`))
+                    writerFor(this.dataDir, safe).remove(join(this.dataDir, f));
+        }
+        catch { }
     }
     getOrCreateSpace(name, token, opts = {}) {
         const claim = opts.claim;

package/dist/removed.js

@@ -0,0 +1,132 @@
+import { mkdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { CONFIG_DIR } from "./config.js";
+import { withFileLock } from "./file-lock.js";
+import { writeWhole } from "./pins.js";
+import { trustWrite } from "./home-guard.js";
+export const REMOVED_FIRST_MS = 5 * 60_000;
+export const REMOVED_MAX_MS = 6 * 60 * 60_000;
+export const REMOVED_CHECK_MS = 60_000;
+export const removalKey = (t) => t.spaceId || `${t.relay}|${t.space}`;
+export function removedPath(home) {
+    return join(home ?? process.env.PANTHEON_HOME ?? CONFIG_DIR, "removed.json");
+}
+export function removalRefusal(lastError) {
+    const m = /^REVOKED: "[^"]*" was removed from "[^"]*"(?: by (.+?))?\. Only a member/.exec(lastError ?? "");
+    if (!m)
+        return null;
+    return m[1] ? { by: m[1] } : {};
+}
+export const safeMemberName = (x) => typeof x === "string" && x.length <= 48 && /^[a-z0-9][a-z0-9._-]*$/i.test(x) ? x : undefined;
+function readAll(home) {
+    try {
+        const raw = JSON.parse(readFileSync(removedPath(home), "utf8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return {};
+        const out = {};
+        for (const [k, v] of Object.entries(raw)) {
+            const r = v;
+            if (!r || typeof r !== "object" || typeof r.name !== "string" || typeof r.at !== "number" || typeof r.last !== "number")
+                continue;
+            const by = safeMemberName(r.by);
+            out[k] = { team: k, name: r.name.slice(0, 120), member: String(r.member ?? "").slice(0, 48), relay: String(r.relay ?? "").slice(0, 300), at: r.at, last: r.last,
+                knocks: typeof r.knocks === "number" && Number.isInteger(r.knocks) && r.knocks > 0 ? Math.min(r.knocks, 64) : 1,
+                ...(by ? { by } : {}), ...(typeof r.told === "number" ? { told: r.told } : {}) };
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+function update(home, fn) {
+    const f = removedPath(home);
+    mkdirSync(dirname(f), { recursive: true });
+    return withFileLock(f, () => {
+        let prev = null;
+        try {
+            prev = readFileSync(f);
+        }
+        catch { }
+        const all = readAll(home);
+        const r = fn(all);
+        if (r.changed) {
+            writeWhole(f, JSON.stringify(all, null, 2) + "\n");
+            trustWrite(f, prev);
+        }
+        return r.out;
+    }, 200);
+}
+export function teamsOf(f) {
+    return Object.values(f?.spaces ?? {}).map((m) => ({ space: m.name, spaceId: m.id.startsWith("legacy:") ? null : m.id, relay: m.relay, member: f.member }));
+}
+export function removals(teams, home) {
+    return teams.flatMap((t) => { const record = removalFor(t, home); return record ? [{ team: t, record }] : []; });
+}
+export function removalFor(t, home) {
+    const all = readAll(home);
+    const r = all[removalKey(t)] ?? (t.spaceId ? all[`${t.relay}|${t.space}`] : undefined) ?? null;
+    return r && r.member === t.member ? r : null;
+}
+export function removalWords(t, by) {
+    const b = safeMemberName(by);
+    return { name: t.space, member: t.member, ...(b ? { by: b } : {}) };
+}
+export function removalHoldMs(r) {
+    return Math.min(REMOVED_FIRST_MS * 2 ** Math.max(0, Math.min(r.knocks, 20) - 1), REMOVED_MAX_MS);
+}
+export function removalHolds(r, now = Date.now()) {
+    return !!r && now - r.last < removalHoldMs(r) && r.last <= now + 60_000;
+}
+export function recordRemoval(t, by, home, now = Date.now()) {
+    return update(home, (all) => {
+        const k = removalKey(t);
+        const was = all[k];
+        const knocks = !was ? 1 : now - was.last >= REMOVED_FIRST_MS - 60_000 ? Math.min(was.knocks + 1, 64) : was.knocks;
+        const who = safeMemberName(by) ?? (was?.member === t.member ? was?.by : undefined);
+        const r = { team: k, name: t.space, member: t.member, relay: t.relay, at: was?.member === t.member ? was.at : now, last: now, knocks: was?.member === t.member ? knocks : 1,
+            ...(who ? { by: who } : {}), ...(was?.member === t.member && was?.told ? { told: was.told } : {}) };
+        all[k] = r;
+        return { changed: true, out: r };
+    });
+}
+export function clearRemoval(t, home) {
+    {
+        const all = readAll(home);
+        if (!all[removalKey(t)] && !all[`${t.relay}|${t.space}`])
+            return false;
+    }
+    return update(home, (all) => {
+        let changed = false;
+        for (const k of [removalKey(t), `${t.relay}|${t.space}`])
+            if (all[k]) {
+                delete all[k];
+                changed = true;
+            }
+        return { changed, out: changed };
+    });
+}
+export function takeTold(t, home, now = Date.now()) {
+    if (!removalFor(t, home))
+        return false;
+    return update(home, (all) => {
+        const r = all[removalKey(t)] ?? all[`${t.relay}|${t.space}`];
+        if (!r || r.member !== t.member || r.told)
+            return { changed: false, out: false };
+        r.told = now;
+        return { changed: true, out: true };
+    });
+}
+export function removedLine(r) {
+    return `you (${r.member}) were removed from "${r.name}"${r.by ? ` by ${r.by}` : ""}. This machine has stopped connecting to it (it checks now and then, at most every 6 hours). ` +
+        `To come back you need a new invite from someone in "${r.name}" (pantheon join <invite>), or for a member to let you back in (pantheon admit ${r.member}). ` +
+        `To forget the team here: pantheon leave "${r.name}"`;
+}
+export function removedNotice(r) {
+    return {
+        kind: "worker", who: "Pantheon", context: r.name, ttl: 0, sound: false,
+        heading: `You were removed from ${r.name}`,
+        body: `${r.by ? `${r.by} removed you from "${r.name}". ` : ""}This machine stopped connecting to it, so no requests or alerts come from it (it checks now and then). To come back you need a new invite from someone in the team (pantheon join <invite>).`,
+    };
+}
+//# sourceMappingURL=removed.js.map

package/dist/run-failure.js

@@ -53,6 +53,19 @@ catch {
     return fallback;
 } };
 export function diagnoseRun(f, probe = gitProbe) {
+    if (f.timedOut) {
+        const m = f.timedOut.minutes;
+        const raise = f.timedOut.from === "flag"
+            ? `this worker was started with --run-minutes ${m}; start it with a larger value (up to 180), or without the flag to use this machine's setting`
+            : f.timedOut.from === "persona"
+                ? `the persona that handled it lowers the limit (max_run_minutes) — raise or remove that line, and if the machine's own limit is also too short: pantheon policy set run-minutes <minutes, up to 180>`
+                : `raise it on this machine: pantheon policy set run-minutes <minutes, up to 180> — it applies from the next run, no restart`;
+        return {
+            cause: "timed_out",
+            says: `The run reached this machine's time limit of ${m} minutes and was stopped before it finished.`,
+            fix: `If the work needs longer, ${raise}. Or split the request into smaller pieces. What it did so far is in its worktree; the transcript is at ${f.runLog}.`,
+        };
+    }
     if (!f.exited && AUTH_RE.test(f.detail)) {
         const fix = SIGN_IN_FIX[f.agent ?? ""] ?? "sign in to the agent CLI on this machine";
         return {

package/dist/setup-guide.js

@@ -3,7 +3,8 @@ import { approvalSummary, installForUser } from "./install.js";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { applyProfileInit, loadProfile, profilePath, saveProfile, spaceOverride, teamProfile, wakeMode } from "./profile.js";
+import { applyProfileInit, dropCatchAllClaims, loadProfile, profilePath, saveProfile, spaceOverride, teamProfile, wakeMode } from "./profile.js";
+import { isCatchAllDomain } from "./protocol.js";
 import { installService as realInstall, uninstallService as realUninstall, serviceInstalled as realInstalled } from "./service.js";
 import { personaDir } from "./persona.js";
 import { hudBinaryPath } from "./notifier.js";
@@ -143,9 +144,13 @@ export function parseSetupFlags(argv) {
         preset.title = title.trim();
     const decides = val("decides");
     if (decides !== undefined) {
-        const ids = decides.split(",").map((x) => x.trim().toLowerCase()).filter((x) => x && x !== "none");
-        const bad = ids.filter((id) => !DECISION_AREAS.some((x) => x.id === id));
-        if (bad.length)
+        const all = decides.split(",").map((x) => x.trim().toLowerCase()).filter(Boolean);
+        const ids = all.filter((x) => x !== "none");
+        const vague = ids.filter((id) => isCatchAllDomain(id));
+        const bad = ids.filter((id) => !vague.includes(id) && !DECISION_AREAS.some((x) => x.id === id));
+        if (vague.length)
+            errors.push(catchAllProblem("decides", vague));
+        else if (bad.length)
             errors.push(`--decides: unknown area${bad.length === 1 ? "" : "s"} ${bad.join(", ")} — use ${DECISION_AREAS.map((x) => x.id).join(", ")} or none`);
         else
             preset.decides = [...new Set(ids)];
@@ -180,10 +185,19 @@ export function decisionAreasProblem(flagName, raw) {
     if (raw === undefined)
         return null;
     const items = raw.split(",").map((x) => x.trim()).filter(Boolean);
+    const vague = items.filter((x) => isCatchAllDomain(x));
+    if (vague.length)
+        return catchAllProblem(flagName, vague);
     if (!raw.includes(";") && !items.some((x) => /\s/.test(x)))
         return null;
     return `--${flagName} "${raw}": these take decision areas like engineering,product; describe the role with --responsibilities`;
 }
+export function catchAllProblem(flagName, words) {
+    const w = words.map((x) => `"${x}"`).join(", ");
+    return `--${flagName} ${w}: ${words.length === 1 ? "that is" : "those are"} not a decision area — it would reserve a domain by that name, which no decision is ever filed under. ` +
+        `Name the areas one by one from: ${DECISION_AREAS.map((x) => x.id).join(", ")}. ` +
+        `To reserve nothing for yourself: pantheon setup --decides none`;
+}
 export async function runGuide(io, ctx, deps = {}, preset = {}) {
     const optOut = ctx.optOut ?? {};
     const serves = ctx.project ? { path: ctx.project, repos: true } : ctx.serves ?? null;
@@ -231,6 +245,11 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
                 : !serves ? "nothing is bound to this team on this machine yet, so there is nothing to serve — bind a repo or a docs folder: pantheon use <team> --here"
                     : a.wake === "anyone" ? "your teammates can hand work to this machine while you're away, so nothing waits on you (to approve each one first: pantheon setup --wake approved)"
                         : "only people you approve — you are asked the first time a teammate's request needs this machine (Always / Just this once / No)"}`);
+        if (a.wake !== "no") {
+            const ready = deps.readiness?.();
+            if (ready && !ready.ok)
+                io.say(`  ! Agent: ${ready.says}\n      ${ready.fix}`);
+        }
         if (a.wake !== "no" && serves?.repos) {
             io.say(`  • Commands: ${a.commands ? "work runs your tests, commits, and pushes to its own branch, so it arrives ready for your review" : "edits and answers only — turn commands on to have work arrive tested and ready to review"}`);
             if (awayAgents.length && unsandboxedAllowed(loadPolicy(deps.policyHome))) {
@@ -280,6 +299,10 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
         }
     }
     let next = a.title ? applyProfileInit(profile, { name: a.name, title: a.title }) : { ...profile, human: { ...profile.human, display_name: a.name } };
+    const vague = dropCatchAllClaims(next);
+    next = vague.profile;
+    if (vague.dropped.length)
+        applied.push(`profile: dropped ${vague.dropped.map((d) => `"${d}"`).join(", ")} — not a decision area, so it never routed anything`);
     const ovKey = [ctx.cfg.spaceId, ctx.cfg.space].find((k) => k && spaceOverride(next, k)?.authority);
     const authority = { ...(ovKey ? next.spaces[ovKey].authority : next.authority) };
     const prior = guideDefaults(profile, ctx.cfg).decides;

package/dist/store.js

@@ -2,6 +2,8 @@ import { readFileSync, existsSync, mkdirSync, renameSync, openSync, writeSync, f
 import { dirname, join } from "node:path";
 import { emptyRefusals } from "./admin-stats.js";
 import { pendingView, writerFor } from "./disk-writer.js";
+import { emptyUsage, parseUsage } from "./usage.js";
+export const USAGE_SAVE_MS = 5_000;
 export function ensurePrivateDir(dir) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     try {
@@ -98,15 +100,67 @@ export class StateStore {
     headOf;
     rebuilt = null;
     extra = {};
+    usage = emptyUsage();
+    usageFile;
+    usageTimer = null;
+    usageDirty = false;
     constructor(dir, stem) {
         this.dir = dir;
         this.stem = stem;
         this.file = join(dir, `${stem}.state.json`);
+        this.usageFile = join(dir, `${stem}.usage.json`);
+    }
+    loadUsage(quarantine) {
+        try {
+            const pending = pendingView(this.dir, this.stem, this.usageFile);
+            if (pending === null || (pending === undefined && !existsSync(this.usageFile))) {
+                this.usage = emptyUsage();
+                return;
+            }
+            this.usage = parseUsage(JSON.parse(pending ? pending.toString("utf8") : readFileSync(this.usageFile, "utf8")));
+        }
+        catch {
+            if (quarantine) {
+                try {
+                    if (existsSync(this.usageFile))
+                        renameSync(this.usageFile, `${this.usageFile}.corrupt-${Date.now()}`);
+                }
+                catch { }
+            }
+            this.usage = emptyUsage();
+        }
+    }
+    saveUsage() {
+        this.usageDirty = true;
+        if (this.usageTimer)
+            return;
+        this.usageTimer = setTimeout(() => { this.usageTimer = null; this.writeUsage(); }, USAGE_SAVE_MS);
+        this.usageTimer.unref?.();
+    }
+    discardUsage() {
+        if (this.usageTimer) {
+            clearTimeout(this.usageTimer);
+            this.usageTimer = null;
+        }
+        this.usageDirty = false;
+    }
+    writeUsage() {
+        if (!this.usageDirty)
+            return;
+        this.usageDirty = false;
+        try {
+            writerFor(this.dir, this.stem).replace(this.usageFile, JSON.stringify(this.usage) + "\n", 0o600, "mark");
+        }
+        catch (e) {
+            this.usageDirty = true;
+            this.onError?.(e);
+        }
     }
     load(opts = {}) {
         const goals = new Map();
         const obligations = new Map();
         const profiles = new Map();
+        this.loadUsage(!!opts.quarantine);
         const pending = pendingView(this.dir, this.stem, this.file);
         if (pending === null || (pending === undefined && !existsSync(this.file))) {
             return { goals, obligations, profiles, unclean: opts.expectHistory ? "the state snapshot is missing but the ledger has history" : null };
@@ -190,6 +244,11 @@ export class StateStore {
             clearTimeout(this.timer);
             this.timer = null;
         }
+        if (this.usageTimer) {
+            clearTimeout(this.usageTimer);
+            this.usageTimer = null;
+        }
+        this.writeUsage();
         this.flush(goals, obligations, profiles);
     }
 }