@prohost/cli 0.14.0 → 0.16.0

package/dist/host/command.js

@@ -0,0 +1,584 @@
+/**
+ * `prohost host …` — one background service per computer, serving every AI
+ * employee placed on it, plus the terminal sessions opened on it.
+ *
+ *     prohost host pair [--name <n>] [--token <redeem_token>|-] [--expect-account <id>]
+ *     prohost host unpair
+ *     prohost host run
+ *     prohost host install [--label <id>] [--dedicated --service-user <name> [--service-home <dir>]
+ *                          [--claude-token-file <path>]] | uninstall [--label <id>]
+ *     prohost host status [--json] [--label <id>] | logins [--json] | logins add --runtime claude_code|codex
+ *     prohost host pause | resume
+ *     prohost host migrate [--from <home>]… [--home <dir,…>] [--keep-services] [--dry-run] [--json]
+ */
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { baseUrlProblem } from '../agent/base-url.js';
+import { DEFAULT_API_BASE_URL } from '../agent/contract.js';
+import { prohostHome } from '../agent/credentials.js';
+import { claudeQuotaProvider, codexQuotaProvider } from '../agent/runtime_status.js';
+import { readPipedKey } from '../usage/key-input.js';
+import { CLI_VERSION } from '../version.js';
+import { recommendCapacity } from './capacity.js';
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { addAccount, isValidLabel, loadAccounts, parseAccountRuntime, accountEnv } from '../agent/accounts.js';
+import { revokeComputer } from './api.js';
+import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, hostLockPath, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
+import { journalPath, readEvents } from './events.js';
+import { LAUNCHD_HOST_LABEL, defaultLabel, installService, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
+import { LegacyHarnesses } from './legacy.js';
+import { detectLogins } from './logins.js';
+import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
+import { runHostPair, writeHostPairResult } from './pair.js';
+import { RESTART_EXIT_CODE, runHostService } from './service.js';
+import { STATE_STALE_MS, localLogin, localRunning, slotsFor } from './status.js';
+function str(flags, key) {
+    return typeof flags[key] === 'string' ? flags[key] : undefined;
+}
+function scriptPath() {
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'index.js');
+}
+/** A process with this pid is running. */
+function alive(pid) {
+    if (typeof pid !== 'number' || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/** The shared folders of dedicated services on this computer (`--label` picks one). */
+function sharedDirs(base, label) {
+    if (label)
+        return [path.join(base, label)];
+    try {
+        return readdirSync(base)
+            .map((name) => path.join(base, name))
+            .filter((dir) => existsSync(path.join(dir, 'state.json')) || existsSync(path.join(dir, 'control.json')));
+    }
+    catch {
+        return [];
+    }
+}
+/** The freshest dedicated service's state, as the logged-in user sees it. */
+function dedicatedState(base, now, label) {
+    let best;
+    for (const dir of sharedDirs(base, label)) {
+        const state = readSharedObject(path.join(dir, 'state.json'));
+        const at = typeof state?.updatedAt === 'string' ? Date.parse(state.updatedAt) : Number.NaN;
+        if (!state || !(now - at < STATE_STALE_MS))
+            continue;
+        if (!best || at > Date.parse(String(best.state.updatedAt)))
+            best = { dir, state };
+    }
+    return best;
+}
+export function hardwareFacts() {
+    const cpus = os.cpus();
+    return {
+        memory_gb: Math.round(os.totalmem() / 1024 ** 3),
+        cpu_cores: cpus.length,
+        os: computerOs(),
+        chip: cpus[0]?.model?.trim() || null,
+    };
+}
+/**
+ * `host status --json`: what the desktop app and scripts read. Always an
+ * answer — `{paired: false, …}` before pairing. When this home runs no
+ * service but a dedicated one runs on the computer, that one is reported
+ * (`service.dedicated`), from the state it publishes for the logged-in user.
+ */
+export function statusJson(env, now = Date.now(), options = {}) {
+    const computer = tryLoadComputer(env);
+    const own = readObject(statePath(env));
+    const ownFresh = own !== undefined && now - Date.parse(own.updatedAt) < STATE_STALE_MS;
+    // `--label` asks for that service, even when this home runs one of its own.
+    const shared = ownFresh && !options.label
+        ? undefined
+        : dedicatedState(options.sharedBase ?? sharedBase(options.platform ?? process.platform), now, options.label);
+    const state = shared ? shared.state : own;
+    const fresh = ownFresh || shared !== undefined;
+    const sharedComputer = shared?.state.computer;
+    const paused = readObject(controlPath(env))?.paused === true ||
+        (shared !== undefined && readObject(path.join(shared.dir, 'control.json'))?.paused === true) ||
+        (fresh && state?.paused === true);
+    const recommended = state?.recommended_capacity ?? recommendCapacity({ memoryGb: os.totalmem() / 1024 ** 3, cores: os.cpus().length });
+    const capacity = state?.capacity ?? recommended;
+    const lock = readObject(hostLockPath(env));
+    const events = shared ? readEvents(path.join(shared.dir, 'events.json'), now) : readEvents(journalPath(env), now);
+    return {
+        // Reporting the dedicated service: its own computer, never this home's (they can differ).
+        paired: shared ? sharedComputer !== undefined : computer !== null,
+        computer: shared
+            ? (sharedComputer ?? null)
+            : computer
+                ? { id: computer.computer_id, name: (fresh && state?.name) || computer.name, account: computer.account }
+                : null,
+        online: Boolean(fresh && state?.online),
+        paused,
+        slots: fresh && state ? state.slots : slotsFor(capacity, 0, paused ? 'paused' : null),
+        running: fresh && state ? state.running.map(localRunning) : [],
+        logins: (state?.logins ?? []).map(localLogin),
+        capacity,
+        recommended_capacity: recommended,
+        hardware: hardwareFacts(),
+        events,
+        service: {
+            running: shared !== undefined || alive(lock?.pid),
+            pid: shared ? (shared.state.pid ?? null) : alive(lock?.pid) ? lock?.pid : null,
+            adopted: loadAdopted(env)?.homes.length ?? 0,
+            dedicated: shared !== undefined,
+            ...(shared ? { activity_file: path.join(shared.dir, 'activity.json') } : {}),
+        },
+        version: CLI_VERSION,
+    };
+}
+function printStatus(json, out) {
+    const computer = json.computer;
+    if (!computer) {
+        out('This computer is not added to a workspace yet. Run: prohost host pair');
+        return;
+    }
+    const slots = json.slots;
+    out(`${computer.name}${computer.account.name ? ` · ${computer.account.name}` : ''}`);
+    out(`  ${json.online ? 'online' : 'offline'}${json.paused ? ' · paused' : ''}${slots.held_reason && !json.paused ? ` · holding (${slots.held_reason})` : ''}`);
+    out(`  works on up to ${String(json.capacity)} things at once (recommended ${String(json.recommended_capacity)}); ${slots.busy} going`);
+    for (const run of json.running) {
+        out(`  • ${run.kind === 'terminal' ? 'terminal session' : (run.agent.name ?? 'AI employee')}${run.title ? ` — ${run.title}` : ''}`);
+    }
+}
+function printLogins(logins, out) {
+    if (logins.length === 0) {
+        out('No AI logins found. Sign in with `claude auth login` or `codex login`.');
+        return;
+    }
+    for (const login of logins) {
+        const runtime = login.runtime === 'claude_code' ? 'Claude Code' : 'Codex';
+        const plan = login.plan_label ? ` · ${login.plan_label}` : '';
+        const who = login.email_local ? ` · ${login.email_local}` : '';
+        out(`${login.label} (${runtime}${plan}${who}) — ${login.auth_state === 'ok' ? 'signed in' : login.auth_state}`);
+    }
+}
+function defaultDetect(env) {
+    return () => detectLogins({
+        env,
+        includeEmail: true,
+        quota: (record) => {
+            const accountEnv = () => record.dir ? (record.runtime === 'claude_code' ? { CLAUDE_CONFIG_DIR: record.dir } : { CODEX_HOME: record.dir }) : {};
+            return record.runtime === 'claude_code'
+                ? claudeQuotaProvider({ binary: 'claude', env: accountEnv })
+                : codexQuotaProvider({ binary: 'codex', clientVersion: CLI_VERSION, env: accountEnv });
+        },
+    });
+}
+/** Ask on the terminal; only an explicit yes is yes. */
+function askYesNo(question) {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}
+/** The personal service a home would have: its LaunchAgent / systemd user unit, by the home's own label. */
+function personalServiceOf(platform, home, sudoUser) {
+    if (platform === 'win32')
+        return undefined;
+    const userHome = sudoUser ? path.dirname(homeOfUser(platform, sudoUser)) : os.homedir();
+    const spec = {
+        platform,
+        dedicated: false,
+        nodePath: '',
+        scriptPath: '',
+        home,
+        pathEnv: '',
+        userHome,
+        label: defaultLabel(home, path.join(userHome, '.prohost')),
+    };
+    return { label: spec.label, file: serviceFilePath(spec) };
+}
+/** `~/.prohost` of another account (the one that ran sudo). */
+function homeOfUser(platform, user) {
+    if (platform === 'darwin')
+        return path.join('/Users', user, '.prohost');
+    try {
+        const entry = readFileSync('/etc/passwd', 'utf8')
+            .split('\n')
+            .find((line) => line.startsWith(`${user}:`));
+        const home = entry?.split(':')[5];
+        if (home)
+            return path.join(home, '.prohost');
+    }
+    catch {
+        /* fall through */
+    }
+    return path.join('/home', user, '.prohost');
+}
+/** `claude auth login` / `codex login`, in this terminal, as the new login. */
+const defaultSignIn = (command, args, env) => new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: 'inherit', env: { ...process.env, ...env } });
+    child.on('error', () => resolve(null));
+    child.on('exit', (code) => resolve(code));
+});
+/** The next free label for a runtime's new login: `claude-2`, `codex-3`, … */
+function nextLabel(runtime, env) {
+    const base = runtime === 'claude_code' ? 'claude' : 'codex';
+    const taken = new Set(loadAccounts(env).map((a) => a.label));
+    for (let n = 2;; n += 1)
+        if (!taken.has(`${base}-${n}`))
+            return `${base}-${n}`;
+}
+/**
+ * `host logins add --runtime claude_code|codex [--label <l>]`: a new AI login
+ * in its own config directory, signed in right here in this terminal.
+ */
+async function addLogin(flags, env, out, err, io) {
+    const runtime = parseAccountRuntime(str(flags, 'runtime'));
+    if (!runtime) {
+        err('host logins add needs --runtime claude_code or --runtime codex.');
+        return 1;
+    }
+    const label = str(flags, 'label') ?? nextLabel(runtime, env);
+    if (!isValidLabel(label)) {
+        err(`"${label}" is not a usable label (up to 32 letters, digits, "-" or "_").`);
+        return 1;
+    }
+    let record;
+    try {
+        record = addAccount({ label, runtime }, env);
+    }
+    catch (e) {
+        err(`✗ ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+    out(`Signing in a new ${runtime === 'claude_code' ? 'Claude Code' : 'Codex'} login ("${label}")…`);
+    const [command, ...args] = runtime === 'claude_code' ? ['claude', 'auth', 'login'] : ['codex', 'login'];
+    const code = await (io.signIn ?? defaultSignIn)(command, args, accountEnv(record));
+    if (code !== 0) {
+        err(`✗ The sign-in did not finish (exit ${String(code)}). The login "${label}" is kept: sign it in later with the same command.`);
+        return 1;
+    }
+    out(`✓ Added "${label}". It shows in prohost host logins.`);
+    return 0;
+}
+export async function runHost(subcommand, flags, printHelp, io = {}) {
+    const env = io.env ?? process.env;
+    const out = io.out ?? ((line) => process.stdout.write(`${line}\n`));
+    const err = io.err ?? ((line) => process.stderr.write(`${line}\n`));
+    const platform = io.platform ?? process.platform;
+    switch (subcommand) {
+        case 'pair': {
+            const baseUrl = str(flags, 'base-url') ?? env.PROHOST_BASE_URL ?? DEFAULT_API_BASE_URL;
+            const problem = baseUrlProblem(baseUrl);
+            if (problem) {
+                const result = { version: 1, outcome: 'invalid_arguments', computer_id: null, account: null, message: `--base-url rejected: ${problem}` };
+                writeHostPairResult(result, env, err);
+                err(`✗ ${result.message}`);
+                return 1;
+            }
+            let token = str(flags, 'token') ?? env.PROHOST_REDEEM_TOKEN;
+            if (flags.token === true) {
+                const result = { version: 1, outcome: 'invalid_arguments', computer_id: null, account: null, message: '--token needs a value (or - to read it from stdin).' };
+                writeHostPairResult(result, env, err);
+                err(`✗ ${result.message}`);
+                return 1;
+            }
+            if (token === '-')
+                token = (await readPipedKey((io.stdin ?? process.stdin))) ?? '';
+            const controller = new AbortController();
+            const onSig = () => controller.abort();
+            process.once('SIGINT', onSig);
+            try {
+                const result = await runHostPair({
+                    baseUrl,
+                    name: str(flags, 'name'),
+                    ...(token !== undefined ? { token } : {}),
+                    expectAccount: str(flags, 'expect-account') ?? env.PROHOST_EXPECT_ACCOUNT,
+                    env,
+                    // A person at a terminal confirms the workspace; a program relies on --expect-account.
+                    ...((io.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY))
+                        ? {
+                            confirm: (account) => (io.ask ?? askYesNo)(`Add this computer to ${account.name ?? account.id}? [y/N] `),
+                        }
+                        : {}),
+                    fetchImpl: io.fetchImpl,
+                    log: out,
+                    signal: controller.signal,
+                });
+                writeHostPairResult(result, env, err);
+                (result.outcome === 'paired' ? out : err)(`${result.outcome === 'paired' ? '✓' : '✗'} ${result.message}`);
+                if (result.outcome === 'paired') {
+                    out('  Next: prohost host install   (keeps it running in the background)');
+                }
+                return result.outcome === 'paired' ? 0 : 1;
+            }
+            finally {
+                process.off('SIGINT', onSig);
+            }
+        }
+        case 'run': {
+            const computer = tryLoadComputer(env);
+            const adopted = loadAdopted(env);
+            if (!computer && !adopted?.homes.length) {
+                err('This computer is not added to a workspace yet. Run: prohost host pair');
+                return 1;
+            }
+            const drain = new AbortController();
+            const hard = new AbortController();
+            const onSignal = () => {
+                if (drain.signal.aborted) {
+                    out('Stopping now.');
+                    hard.abort();
+                    return;
+                }
+                out('Finishing the runs going, then stopping (press again to stop now).');
+                drain.abort();
+            };
+            process.on('SIGINT', onSignal);
+            process.on('SIGTERM', onSignal);
+            const legacy = adopted ? new LegacyHarnesses(adopted.homes, { env, log: out, machine: str(flags, 'machine') }) : undefined;
+            try {
+                if (!computer) {
+                    const lock = acquireHostLock(env);
+                    if (!lock.ok) {
+                        err(`Another prohost host service (pid ${lock.heldBy}) is already running for this computer.`);
+                        return 1;
+                    }
+                    try {
+                        legacy.sync(new Set(), false);
+                        await new Promise((resolve) => drain.signal.addEventListener('abort', () => resolve(), { once: true }));
+                        return 0;
+                    }
+                    finally {
+                        lock.release();
+                    }
+                }
+                const codeHostHome = computer.code_host_home ?? adopted?.code_host_home ?? undefined;
+                const withCodeHost = codeHostHome ? { ...computer, code_host_home: codeHostHome } : computer;
+                legacy?.sync(new Set(), true);
+                const timeout = Number(str(flags, 'timeout'));
+                const idle = Number(str(flags, 'idle-timeout'));
+                const workload = str(flags, 'workload');
+                const result = await runHostService({
+                    computer: withCodeHost,
+                    env,
+                    log: out,
+                    signal: drain.signal,
+                    hardStop: hard.signal,
+                    ...(str(flags, 'machine') ? { machine: str(flags, 'machine') } : {}),
+                    ...(Number.isFinite(timeout) && str(flags, 'timeout') ? { timeoutMs: timeout * 1000 } : {}),
+                    ...(Number.isFinite(idle) && str(flags, 'idle-timeout') ? { idleTimeoutMs: idle * 1000 } : {}),
+                    ...(workload === 'coding' || workload === 'chat' ? { workload: workload } : {}),
+                    allowUnverified: flags['allow-unverified'] === true,
+                    workdirFor: (agentId) => adopted?.homes.find((home) => home.agent_id === agentId && !home.host_only)?.hosted_workdir,
+                    onConfig: (config) => legacy?.sync(new Set(config.placements.map((p) => p.agent_id)), true),
+                });
+                if (result.fatal)
+                    return 1;
+                return result.restart ? RESTART_EXIT_CODE : 0;
+            }
+            finally {
+                await legacy?.stop();
+                process.off('SIGINT', onSignal);
+                process.off('SIGTERM', onSignal);
+            }
+        }
+        case 'install':
+        case 'uninstall': {
+            const dedicated = flags.dedicated === true;
+            const serviceUser = str(flags, 'service-user');
+            const ownHome = prohostHome(env);
+            const home = dedicated
+                ? (str(flags, 'service-home') ?? (serviceUser ? serviceUserHome(platform, serviceUser) : ownHome))
+                : ownHome;
+            const userHome = env.HOME || os.homedir();
+            const spec = {
+                platform,
+                dedicated,
+                ...(serviceUser ? { serviceUser } : {}),
+                // The executable that runs this CLI now — Node, or the desktop app's Electron.
+                nodePath: process.execPath,
+                scriptPath: scriptPath(),
+                home,
+                pathEnv: env.PATH ?? '',
+                userHome,
+                label: str(flags, 'label') ?? defaultLabel(home, path.join(userHome, '.prohost')),
+                electron: io.electron ?? (Boolean(process.versions.electron) || env.ELECTRON_RUN_AS_NODE === '1'),
+            };
+            const tokenFile = str(flags, 'claude-token-file');
+            if (flags['claude-token-file'] === true) {
+                err('--claude-token-file needs a path.');
+                return 1;
+            }
+            if (subcommand === 'uninstall') {
+                // A dedicated service is labelled after its own home: without --label,
+                // every one this computer publishes state for is looked at too.
+                const labels = new Set([spec.label]);
+                const admin = platform === 'win32' ? dedicated : (io.serviceIo?.uid ?? process.getuid?.() ?? 1) === 0;
+                if (!str(flags, 'label') && (admin || dedicated)) {
+                    for (const dir of sharedDirs(io.sharedBase ?? sharedBase(platform)))
+                        labels.add(path.basename(dir));
+                }
+                const outcomes = [...labels].map((label) => uninstallService({ ...spec, label }, io.serviceIo));
+                const removed = outcomes.filter((o) => !o.message.startsWith('No host service'));
+                const shown = removed.length > 0 ? removed : outcomes.slice(0, 1);
+                for (const o of shown)
+                    (o.ok ? out : err)(o.message);
+                return shown.every((o) => o.ok) ? 0 : 1;
+            }
+            // The invoking user's home: under sudo, $PROHOST_HOME and $HOME are root's.
+            const adoptFrom = str(flags, 'from-home') ??
+                (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
+            const outcome = installService(spec, io.serviceIo, {
+                ...(tokenFile ? { claudeTokenFile: tokenFile } : {}),
+                ...(dedicated ? { adoptFrom } : {}),
+            });
+            (outcome.ok ? out : err)(outcome.message);
+            if (outcome.ok && !tryLoadComputer({ ...env, PROHOST_HOME: home })) {
+                out(dedicated
+                    ? `  ! ${home} has no computer yet (none in ${adoptFrom}): pair as yourself, then run this again — or pass --from-home <your PROHOST_HOME>.`
+                    : `  This home (${home}) has no computer yet: run prohost host pair.`);
+            }
+            if (outcome.ok && dedicated) {
+                out(`  Its status, for anyone on this computer: ${sharedDirFor(spec)}`);
+                out(`  Remove it with: sudo prohost host uninstall --label ${spec.label}`);
+                // The personal service of the home it took the computer from runs on the same key.
+                const personal = personalServiceOf(platform, adoptFrom, env.SUDO_USER);
+                if (personal && (io.serviceIo?.exists ?? existsSync)(personal.file)) {
+                    out(`  ! Your own service (${personal.label}) still runs this computer too — two services on one key. ` +
+                        `Remove it as yourself: prohost host uninstall${personal.label === LAUNCHD_HOST_LABEL ? '' : ` --label ${personal.label}`}`);
+                }
+            }
+            return outcome.ok ? 0 : 1;
+        }
+        case 'unpair': {
+            const computer = tryLoadComputer(env);
+            if (!computer) {
+                out('This computer is not added to a workspace. Nothing to remove.');
+                return 0;
+            }
+            const revoked = await revokeComputer({ baseUrl: computer.base_url, apiKey: computer.api_key, fetchImpl: io.fetchImpl }, computer.computer_id);
+            if (revoked.result === 'failed') {
+                err(`✗ ProhostAI did not remove this computer (${revoked.status === 0 ? revoked.error ?? 'no answer' : `HTTP ${revoked.status}`}). ` +
+                    'Its key is kept; try again, or remove it on its page in ProhostAI.');
+                return 1;
+            }
+            clearComputer(env);
+            out(revoked.result === 'revoked' ? `✓ Removed "${computer.name}" from its workspace.` : '✓ This computer was already removed; its key is deleted here.');
+            out('  If its background service is installed, remove it too: prohost host uninstall');
+            return 0;
+        }
+        case 'status': {
+            const label = str(flags, 'label');
+            const json = statusJson(env, (io.now ?? Date.now)(), {
+                platform,
+                ...(io.sharedBase ? { sharedBase: io.sharedBase } : {}),
+                ...(label ? { label } : {}),
+            });
+            if (flags.json === true)
+                out(JSON.stringify(json, null, 2));
+            else
+                printStatus(json, out);
+            return 0;
+        }
+        case 'logins': {
+            if (io.args?.[0] === 'add')
+                return addLogin(flags, env, out, err, io);
+            const logins = await (io.detectLogins ?? defaultDetect(env))();
+            if (flags.json === true)
+                out(JSON.stringify({ logins: logins.map(localLogin) }, null, 2));
+            else
+                printLogins(logins, out);
+            return 0;
+        }
+        case 'pause':
+        case 'resume': {
+            const paused = subcommand === 'pause';
+            const control = { v: 1, paused, updated_at: new Date().toISOString() };
+            writePrivateFile(controlPath(env), control);
+            // A dedicated service on this computer reads its own shared switch (writable by everyone on it).
+            const label = str(flags, 'label');
+            for (const dir of sharedDirs(io.sharedBase ?? sharedBase(platform), label)) {
+                try {
+                    writeFileSync(path.join(dir, 'control.json'), `${JSON.stringify(control)}\n`);
+                }
+                catch (e) {
+                    err(`  ! could not ${subcommand} the service in ${dir}: ${e instanceof Error ? e.message : String(e)}`);
+                }
+            }
+            out(paused
+                ? '⏸ Paused: this computer takes no new work. Work already going finishes. Resume with: prohost host resume'
+                : '▶ Resumed: this computer takes new work again.');
+            return 0;
+        }
+        case 'migrate': {
+            const homes = str(flags, 'home')?.split(',').map((h) => h.trim()).filter(Boolean);
+            const from = (io.repeated?.from ?? (str(flags, 'from') ? [str(flags, 'from')] : []))
+                .flatMap((h) => h.split(','))
+                .map((h) => h.trim())
+                .filter(Boolean);
+            if (flags.from === true) {
+                err('--from needs a home directory.');
+                return 1;
+            }
+            const report = runMigrate({
+                env,
+                ...(homes ? { homes } : {}),
+                ...(from.length > 0 ? { only: from } : {}),
+                keepServices: flags['keep-services'] === true,
+                dryRun: flags['dry-run'] === true,
+                ...io.migrate,
+            });
+            // The computer credential, from an adopted agent key: no pairing again.
+            const computerAdoption = report.refused || flags['dry-run'] === true || report.adopted.length === 0
+                ? undefined
+                : await adoptComputer({ env, report, fetchImpl: io.fetchImpl });
+            if (flags.json === true) {
+                out(JSON.stringify({ ...report, ...(computerAdoption ? { computer: computerAdoption } : {}) }, null, 2));
+                return report.refused ? 1 : 0;
+            }
+            if (report.refused) {
+                err(`✗ Not migrated: ${report.refused}.`);
+                return 1;
+            }
+            if (computerAdoption?.status === 'adopted') {
+                out(`✓ This computer is now "${computerAdoption.account.name ?? computerAdoption.account.id}"'s computer (no new pairing).`);
+            }
+            else if (computerAdoption?.status === 'not_adopted') {
+                out(`  · Not added as a computer yet: ${computerAdoption.reason}`);
+            }
+            if (report.adopted.length === 0)
+                out('Nothing to adopt: no agent home with an agent.json was found.');
+            for (const home of report.adopted) {
+                out(`✓ ${home.agent_name} (${home.home})${home.host_only ? ' — terminal sessions' : ''}` +
+                    (home.sessions_copied ? ` — ${home.sessions_copied} conversation sessions carried over` : ''));
+            }
+            if (report.codeHostHome)
+                out(`  Terminal sessions are hosted from ${report.codeHostHome}.`);
+            for (const label of report.servicesStopped)
+                out(`  Stopped and removed the old ${label} launchd agent.`);
+            for (const skipped of report.skipped)
+                err(`  ! ${skipped.home}: ${skipped.reason}`);
+            for (const note of report.notes)
+                out(`  · ${note}`);
+            if (flags['dry-run'] === true)
+                out('(dry run: nothing was changed)');
+            else
+                out('Next: prohost host install   (or restart it, if it is already installed)');
+            return 0;
+        }
+        default:
+            if (subcommand)
+                err(`Unknown host command: ${subcommand}\n`);
+            printHelp();
+            return 1;
+    }
+}