@prohost/cli 0.16.0 → 0.16.1

package/CHANGELOG.md

@@ -6,6 +6,24 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.1
+
+Review follow-ups to `prohost host` that landed on its branch after #22455 merged:
+
+- **Windows dedicated install:** the service home is `C:\ProgramData\Prohost\homes\<account>`, made in
+  one step with administrators-only access, given the computer credential (`wx`), and only then
+  opened to the account — the account can never swap a path in it while an administrator writes
+  there. An existing home is never written into. `--service-home` is refused on Windows (only that folder can
+  be prepared safely), and an install over a 0.16.0 Windows dedicated service (its home was in the
+  account's profile, under another task name) stops and says how to remove it and carry its
+  computer over (`--from-home`), rather than leaving two services on one key.
+- **Claude token scoping:** an adopted Claude harness's sign-in checks add the dedicated install's
+  Claude token only when they run its own Claude binary; the account snapshot's Codex checks never
+  see it.
+- **Muted threads:** an answer dropped because the thread is muted (`409 ai_muted`) — the final one
+  or an early one, Claude or Codex — makes the run forget the conversation's session, so after
+  unmuting nothing resumes from a turn nobody saw.
+
 ## 0.16.0
 
 - **`prohost host` — one service per computer, many employees.** A computer is added once

package/README.md

@@ -202,8 +202,9 @@ from an administrator prompt. It:
   afterwards (owner, no junction, no other principal), and the token is always a
   new file (`wx`) in
   `C:\ProgramData\Prohost\secrets\<label>` (the account may only read it), and
-  the account's home is made private and given the credential only when the
-  install creates it. If your own (personal) service runs on the same computer
+  the account's service home is `C:\ProgramData\Prohost\homes\<account>`:
+  made in one step with administrators-only access, given the credential, and
+  only then opened to the account (an existing one is never written into). If your own (personal) service runs on the same computer
   key, install says so and how to remove it;
 - logs where the service account can't redirect it: the journal on Linux,
   `/Library/Logs/Prohost/<label>.log` (in a root-owned folder) on macOS,

package/dist/agent/api.d.ts

@@ -29,6 +29,12 @@ export interface ApiOptions {
 }
 export interface ApiResult {
     ok: boolean;
+    /**
+     * A send the server answered without sending (still `ok`: the run is done):
+     * saved as a draft for the team (`suggestion`), or dropped because the thread
+     * is muted for AI (`muted`).
+     */
+    withheld?: 'suggestion' | 'muted';
     /** HTTP status, or ``0`` when no response arrived at all — see ``failure``. */
     status: number;
     error?: string;

package/dist/agent/run.d.ts

@@ -276,6 +276,12 @@ type RunOutcome = 'succeeded' | 'failed' | 'cancelled' | 'resolved' | 'unreporte
  * muted; nothing saved, nothing to retry). Either way the run is done.
  */
 export declare function isHeldAsSuggestion(result: ApiResult): boolean;
+/**
+ * A sign-in checker that adds `extra` only when it runs `binary` (this
+ * harness's Claude): the account snapshot checks other runtimes' logins too,
+ * and a Codex check must never see the Claude token.
+ */
+export declare function scopedCommandRunner(binary: string, base: CommandRunner | undefined, extra: () => NodeJS.ProcessEnv): CommandRunner;
 /**
  * A reply without its confidence trailer (`[[confidence=0.9 reply_class=general]]`,
  * see `replyConfidence`), and what the last one said. Every trailer is removed,

package/dist/agent/run.js

@@ -212,10 +212,11 @@ async function postReplyWithReplay(api, send, label, log, sleep) {
     const result = await postReplyOnce(api, send, label, log, sleep);
     // The send rule kept it as a suggestion for the team: handled, not failed.
     if (isHeldAsSuggestion(result)) {
-        log(/ai_muted/.test(result.error ?? '')
+        const muted = /ai_muted/.test(result.error ?? '');
+        log(muted
             ? `${timestamp()} ◦ ${label} reply was not sent: the thread is muted for AI`
             : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule)`);
-        return { ...result, ok: true };
+        return { ...result, ok: true, withheld: muted ? 'muted' : 'suggestion' };
     }
     return result;
 }
@@ -278,6 +279,14 @@ function resolveWorkdir(options, log) {
 export function isHeldAsSuggestion(result) {
     return result.status === 409 && /held_as_suggestion|ai_muted/.test(result.error ?? '');
 }
+/**
+ * A sign-in checker that adds `extra` only when it runs `binary` (this
+ * harness's Claude): the account snapshot checks other runtimes' logins too,
+ * and a Codex check must never see the Claude token.
+ */
+export function scopedCommandRunner(binary, base, extra) {
+    return (command, args, env) => (base ?? defaultCommandRunner)(command, args, command === binary ? { ...env, ...extra() } : env);
+}
 /** The run's extra variables, resolved now. */
 function extraEnvOf(options) {
     return typeof options.extraEnv === 'function' ? options.extraEnv() : (options.extraEnv ?? {});
@@ -392,7 +401,7 @@ function buildRuntime(options, log) {
         binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
         // A Claude harness's sign-in check sees the run's extra variables too (the Claude token).
         run: brain === 'claude' && options.extraEnv
-            ? (command, args, env) => (options.accountCommandRunner ?? defaultCommandRunner)(command, args, { ...env, ...extraEnvOf(options) })
+            ? scopedCommandRunner(options.exec.trim().split(/\s+/)[0] ?? 'claude', options.accountCommandRunner, () => extraEnvOf(options))
             : options.accountCommandRunner,
         warn: (message) => log(`${timestamp()} ! ${message}`),
     });
@@ -1173,6 +1182,8 @@ limited) {
     let earlyCount = 0;
     let earlyPosted = 0;
     let earlyPosts = Promise.resolve();
+    /** An answer of this run was dropped because the thread is muted: its session must not continue. */
+    let muted = false;
     const earlyPath = run.reply_path;
     const earlyBodyKey = run.reply_body_key;
     const stoppedNow = () => control.signal.aborted || control.disposition() !== undefined;
@@ -1200,6 +1211,8 @@ limited) {
             }
             early.shift();
             earlyPosted += 1;
+            if (posted.withheld === 'muted')
+                muted = true;
             log(`${timestamp()} ✓ ${label} posted an answer; a background task is still running`);
         }
     };
@@ -1224,6 +1237,17 @@ limited) {
     // A venue session is never continued: the next turn there starts fresh from
     // the thread the server sends, so nothing of this one is remembered.
     const sessionId = venue ? undefined : result.ok ? result.sessionId : undefined;
+    /**
+     * Continue the conversation's session from this turn — unless an answer of
+     * it was dropped because the thread is muted (any runtime): then the session
+     * holds a turn nobody saw, so it is forgotten, eager record or resumed one alike.
+     */
+    const settleSession = (id) => {
+        if (muted)
+            runtime.sessions.forget(sessionKeyFor(run));
+        else if (id)
+            runtime.sessions.remember(sessionKeyFor(run), id);
+    };
     // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
     // the run is closed — a completion that beats its own last tool row would
     // leave a `calling` row on a finished run. Never rejects, and after `stop`
@@ -1345,9 +1369,7 @@ limited) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
         }
-        if (sessionId) {
-            runtime.sessions.remember(sessionKeyFor(run), sessionId);
-        }
+        settleSession(sessionId);
         return 'succeeded';
     }
     // A run with no reply surface is a legitimate outcome, not an error: it was
@@ -1367,9 +1389,7 @@ limited) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
         }
-        if (sessionId) {
-            runtime.sessions.remember(sessionKeyFor(run), sessionId);
-        }
+        settleSession(sessionId);
         return 'succeeded';
     }
     const replyPath = run.reply_path;
@@ -1392,10 +1412,11 @@ limited) {
     }
     // Advance continuity only after the answer is durable on its reply surface.
     // Remembering at process exit would strand the conversation behind an answer
-    // it never received whenever this POST is rejected.
-    if (sessionId) {
-        runtime.sessions.remember(sessionKeyFor(run), sessionId);
-    }
+    // it never received whenever this POST is rejected. A muted thread kept
+    // nothing of it, so its session is not advanced either (and an eager record undone).
+    if (posted.withheld === 'muted')
+        muted = true;
+    settleSession(sessionId);
     const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
     if (!completed.ok) {
         // The reply is already in the conversation, so this is a bookkeeping

package/dist/host/command.js

@@ -29,7 +29,7 @@ import { addAccount, isValidLabel, loadAccounts, parseAccountRuntime, accountEnv
 import { revokeComputer } from './api.js';
 import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, hostLockPath, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
 import { journalPath, readEvents } from './events.js';
-import { LAUNCHD_HOST_LABEL, defaultLabel, installService, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
+import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
 import { LegacyHarnesses } from './legacy.js';
 import { detectLogins } from './logins.js';
 import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
@@ -434,6 +434,19 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     (o.ok ? out : err)(o.message);
                 return shown.every((o) => o.ok) ? 0 : 1;
             }
+            // 0.16.0 put a Windows dedicated service's home in the account's profile, under another
+            // label: replacing it here would leave two services on one key. Its owner removes it first.
+            if (platform === 'win32' && dedicated && serviceUser && !str(flags, 'service-home')) {
+                const oldHome = path.win32.join('C:\\Users', serviceUser, '.prohost');
+                const oldLabel = defaultLabel(oldHome, path.join(userHome, '.prohost'));
+                const oldTask = windowsTaskOf({ label: oldLabel });
+                if ((io.serviceIo?.run ?? defaultServiceRunner)('schtasks', ['/Query', '/TN', oldTask]).status === 0) {
+                    err(`✗ A host service from CLI 0.16.0 is installed for ${serviceUser} (task ${oldTask}, home ${oldHome}). ` +
+                        `Remove it first: prohost host uninstall --label ${oldLabel} — then run this again with ` +
+                        `--from-home ${oldHome} to carry its computer over.`);
+                    return 1;
+                }
+            }
             // The invoking user's home: under sudo, $PROHOST_HOME and $HOME are root's.
             const adoptFrom = str(flags, 'from-home') ??
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);

package/dist/host/install.d.ts

@@ -135,6 +135,8 @@ export interface DedicatedSetup {
 }
 /** Validate a spec before anything is written. */
 export declare function specProblem(spec: ServiceSpec, io?: InstallIo, setup?: DedicatedSetup): string | undefined;
+/** Where Windows dedicated services' homes live: an administrators' folder. */
+export declare function windowsHomesDir(): string;
 /** Where a Windows dedicated install keeps the Claude token: an administrators' folder the account may only read. */
 export declare function windowsTokenPath(spec: Pick<ServiceSpec, 'label'>): string;
 /**

package/dist/host/install.js

@@ -272,6 +272,10 @@ export function specProblem(spec, io = {}, setup = {}) {
             return '--dedicated needs --service-user <name>: the account the service runs as.';
         if (!SERVICE_USER.test(spec.serviceUser))
             return `"${spec.serviceUser}" is not a usable account name.`;
+        if (spec.platform === 'win32' && path.win32.resolve(path.win32.dirname(spec.home)) !== path.win32.resolve(windowsHomesDir())) {
+            // Only a home under the administrators' folder can be prepared safely (see `prepareDedicated`).
+            return `On Windows a dedicated service's home is ${path.win32.join(windowsHomesDir(), spec.serviceUser)}; --service-home is not supported there.`;
+        }
         const admin = io.isAdmin ??
             (spec.platform === 'win32'
                 ? // `net session` succeeds only from an elevated prompt.
@@ -332,6 +336,10 @@ function ensureServiceUser(spec, run) {
     }
     return undefined;
 }
+/** Where Windows dedicated services' homes live: an administrators' folder. */
+export function windowsHomesDir() {
+    return 'C:\\ProgramData\\Prohost\\homes';
+}
 /** Where a Windows dedicated install keeps the Claude token: an administrators' folder the account may only read. */
 export function windowsTokenPath(spec) {
     return path.win32.join('C:\\ProgramData\\Prohost\\secrets', labelOf(spec), CLAUDE_TOKEN_FILE);
@@ -385,6 +393,7 @@ function claimWindowsDirs(spec, run, mkdirOnce, isSymlink) {
         [path.win32.join(base, 'secrets'), admin],
         [path.win32.dirname(windowsTokenPath(spec)), [...admin, `${user}:(OI)(CI)R`]],
         [path.win32.join(base, 'services'), admin],
+        [windowsHomesDir(), admin],
         [windowsServiceDir(spec), [...admin, `${user}:(OI)(CI)RX`]],
     ];
     const trusted = (owner) => /\\(Administrators|SYSTEM)$/i.test(owner);
@@ -500,17 +509,36 @@ function prepareDedicated(spec, io, setup) {
         // The account's home is ACL'd and filled only when this install creates
         // it: an existing one is the account's, and an administrator writing into
         // it could be redirected.
-        mkdir(path.win32.dirname(spec.home), 0o755);
-        if ((io.mkdirOnce ?? mkdirOnce)(spec.home) === 'created') {
-            mkdir(hostDir, 0o700);
-            const acl = run('icacls', [spec.home, '/inheritance:r', '/grant:r', 'SYSTEM:(OI)(CI)F', 'Administrators:(OI)(CI)F', `${user}:(OI)(CI)F`]);
-            if (acl.status !== 0)
-                return failed(`icacls ${spec.home}`, acl);
-            if (credential)
-                write(join(hostDir, 'computer.json'), credential, 0o600);
-        }
-        else if (isSymlink(spec.home) || isSymlink(hostDir)) {
-            return `${spec.home} is a link: remove it, then install again.`;
+        // The service home is an administrators' folder (ProgramData\Prohost\homes\<label>): made
+        // in one step with no access for the account, filled, and only then opened to it — so it can
+        // never swap a path in it while an administrator writes there. An existing one is never
+        // written into; a --service-home elsewhere is the account's own business.
+        if (path.win32.resolve(path.win32.dirname(spec.home)) === path.win32.resolve(windowsHomesDir())) {
+            const made = (io.mkdirOnce ?? mkdirOnce)(spec.home);
+            if (made === 'exists') {
+                if (isSymlink(spec.home))
+                    return `${spec.home} is a link or junction: remove it, then install again.`;
+                const owner = windowsOwner(run, spec.home);
+                if (!/\\(Administrators|SYSTEM)$/i.test(owner))
+                    return `${spec.home} is owned by ${owner || 'someone else'}: remove it, then install again.`;
+            }
+            else {
+                for (const args of [
+                    [spec.home, '/setowner', 'Administrators'],
+                    [spec.home, '/inheritance:r', '/grant:r', 'SYSTEM:(OI)(CI)F', 'Administrators:(OI)(CI)F'],
+                ]) {
+                    const out = run('icacls', args);
+                    if (out.status !== 0)
+                        return failed(`icacls ${args.slice(0, 2).join(' ')}`, out);
+                }
+                mkdir(hostDir, 0o700);
+                if (credential)
+                    write(join(hostDir, 'computer.json'), credential, 0o600, 'wx');
+            }
+            // The account may now use its home.
+            const open = run('icacls', [spec.home, '/grant', `${user}:(OI)(CI)M`]);
+            if (open.status !== 0)
+                return failed(`icacls ${spec.home}`, open);
         }
     }
     else {
@@ -749,7 +777,8 @@ export function uninstallService(spec, io = {}) {
 export function serviceUserHome(platform, user) {
     if (platform === 'darwin')
         return path.join('/Users', user, '.prohost');
+    // On Windows: an administrators' folder per account (see `prepareDedicated`), not the account's profile.
     if (platform === 'win32')
-        return path.win32.join('C:\\Users', user, '.prohost');
+        return path.win32.join(windowsHomesDir(), user);
     return path.join('/home', user, '.prohost');
 }

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.0";
+export declare const CLI_VERSION = "0.16.1";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.0";
+export declare const USER_AGENT = "prohost-cli/0.16.1";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.0';
+export const CLI_VERSION = '0.16.1';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",