@prohost/cli 0.16.0 → 0.16.2

package/CHANGELOG.md

@@ -6,6 +6,42 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.2
+
+More `prohost host` follow-ups (they missed #22513):
+
+- **Unlabelled `host pause` / `resume` / `status` act on this home only.** A dedicated service on
+  the same computer is addressed only by its `--label`: a personal sign-out (the desktop runs
+  `host pause`) never pauses it. A labelled `pause` / `resume` / `status` is about that service
+  alone: this home's pause, pairing and service never mix into it.
+- **`host install --dedicated --remote-terminal | --no-remote-terminal`:** terminal sessions on a
+  dedicated service, off unless asked for; set in the service's definition, shown as
+  `remote_terminal` in `host status --json` and declared as the `remote_terminal` capability.
+  Every reader of the switches — the daemon, the relay and the permission hook in each Claude
+  window — sees the same setting, so remote approvals wait for an answer from ProhostAI.
+- **`host logins add` on Windows** starts npm's `.cmd` shims through `cmd.exe /d /s /c`.
+- **Reply classes:** only the server's (`general`, `status_update`, `pricing_action`,
+  `billing_action`, `legal_contractual`, `bug_in_our_code`); any other is sent as none, so the
+  server holds the reply.
+
+## 0.16.1
+
+Review follow-ups to `prohost host` that landed on its branch after #22455 merged:
+
+- **Windows dedicated install:** the service home is `C:\ProgramData\Prohost\homes\<account>`, made in
+  one step with administrators-only access, given the computer credential (`wx`), and only then
+  opened to the account — the account can never swap a path in it while an administrator writes
+  there. An existing home is never written into. `--service-home` is refused on Windows (only that folder can
+  be prepared safely), and an install over a 0.16.0 Windows dedicated service (its home was in the
+  account's profile, under another task name) stops and says how to remove it and carry its
+  computer over (`--from-home`), rather than leaving two services on one key.
+- **Claude token scoping:** an adopted Claude harness's sign-in checks add the dedicated install's
+  Claude token only when they run its own Claude binary; the account snapshot's Codex checks never
+  see it.
+- **Muted threads:** an answer dropped because the thread is muted (`409 ai_muted`) — the final one
+  or an early one, Claude or Codex — makes the run forget the conversation's session, so after
+  unmuting nothing resumes from a turn nobody saw.
+
 ## 0.16.0
 
 - **`prohost host` — one service per computer, many employees.** A computer is added once

package/README.md

@@ -202,9 +202,14 @@ from an administrator prompt. It:
   afterwards (owner, no junction, no other principal), and the token is always a
   new file (`wx`) in
   `C:\ProgramData\Prohost\secrets\<label>` (the account may only read it), and
-  the account's home is made private and given the credential only when the
-  install creates it. If your own (personal) service runs on the same computer
+  the account's service home is `C:\ProgramData\Prohost\homes\<account>`:
+  made in one step with administrators-only access, given the credential, and
+  only then opened to the account (an existing one is never written into). If your own (personal) service runs on the same computer
   key, install says so and how to remove it;
+- hosts terminal sessions only with `--remote-terminal` (`--no-remote-terminal`
+  or nothing: none) — decided in the service's definition, shown as
+  `remote_terminal` in `host status --json` and declared as the
+  `remote_terminal` capability only when on;
 - logs where the service account can't redirect it: the journal on Linux,
   `/Library/Logs/Prohost/<label>.log` (in a root-owned folder) on macOS,
   `C:\ProgramData\Prohost\Logs` (ACL: SYSTEM, administrators, the service
@@ -213,8 +218,9 @@ from an administrator prompt. It:
   emails, in a root-owned `/Library/Application Support/Prohost/hosts/<label>`,
   `/var/lib/prohost/hosts/<label>` or `C:\ProgramData\Prohost\hosts\<label>`: the service owns only
   `state.json`, `activity.json` and `events.json` there, and `control.json` is
-  the pause switch anyone on the computer may flip. `host status` and
-  `host pause` run as the logged-in user find it there, and
+  the pause switch anyone on the computer may flip. `host status --label <id>`
+  and `host pause|resume --label <id>` run as the logged-in user address it
+  there (unlabelled, they act on their own home only), and
   `sudo prohost host uninstall` finds the service by it (install prints the exact
   command with its `--label`).
 
@@ -286,8 +292,9 @@ start it again. `--dry-run` shows what it would do; `--json` prints the report.
   `login_moved`, `hold_started`, `hold_ended`, with the `/events` fields plus
   `computer_id` / `computer_name`), newest last, each with a stable `id`.
   `service` says whether a service runs for this home (`host/service.lock`), how
-  many homes it adopted, and — run as the logged-in user on a dedicated computer —
-  that it is the dedicated service (`activity_file` is then its shared copy).
+  many homes it adopted, and — with `--label <id>` of a dedicated service — that
+  it is the dedicated service (`activity_file` is then its shared copy).
+  `remote_terminal` says whether remote terminal sessions are on.
 - `host logins --json` → `{logins: [...same shape as status...]}`.
 - `$PROHOST_HOME/host/activity.json` → `{v: 1, busy, running: [...as in status...], updatedAt}`.
 - `$PROHOST_HOME/host/state.json` is the service's own state (0600); read

package/dist/agent/api.d.ts

@@ -29,6 +29,12 @@ export interface ApiOptions {
 }
 export interface ApiResult {
     ok: boolean;
+    /**
+     * A send the server answered without sending (still `ok`: the run is done):
+     * saved as a draft for the team (`suggestion`), or dropped because the thread
+     * is muted for AI (`muted`).
+     */
+    withheld?: 'suggestion' | 'muted';
     /** HTTP status, or ``0`` when no response arrived at all — see ``failure``. */
     status: number;
     error?: string;

package/dist/agent/prompt.js

@@ -178,7 +178,7 @@ export function buildPrompt(run, context) {
     if (context.resumeNote)
         lines.push(context.resumeNote, '');
     if (context.askConfidence) {
-        lines.push('End your reply with one last line, exactly: [[confidence=<0 to 1> reply_class=<class>]] — how sure you are', 'the reply is right and safe to send as is, and its class: general, pricing_action, billing_action,', 'legal_contractual or bug_in_our_code. That line is removed before sending; below the bar, or for a class', 'that needs approval, your reply is saved as a draft for the team instead of sent.', '');
+        lines.push('End your reply with one last line, exactly: [[confidence=<0 to 1> reply_class=<class>]] — how sure you are', 'the reply is right and safe to send as is, and its class: general, status_update, pricing_action,', 'billing_action, legal_contractual or bug_in_our_code. That line is removed before sending; below the bar, or for a class', 'that needs approval, your reply is saved as a draft for the team instead of sent.', '');
     }
     // The operator's own configuration comes first, above everything the server
     // generated. It is who this agent *is* — persona, house rules, escalation

package/dist/agent/run.d.ts

@@ -276,6 +276,15 @@ type RunOutcome = 'succeeded' | 'failed' | 'cancelled' | 'resolved' | 'unreporte
  * muted; nothing saved, nothing to retry). Either way the run is done.
  */
 export declare function isHeldAsSuggestion(result: ApiResult): boolean;
+/**
+ * A sign-in checker that adds `extra` only when it runs `binary` (this
+ * harness's Claude): the account snapshot checks other runtimes' logins too,
+ * and a Codex check must never see the Claude token.
+ */
+export declare function scopedCommandRunner(binary: string, base: CommandRunner | undefined, extra: () => NodeJS.ProcessEnv): CommandRunner;
+/** A line that is the confidence trailer, however the model dressed it (backticks, bold, commas, quotes). */
+/** The reply classes the server's send rule knows (PR B); any other is sent as none. */
+export declare const REPLY_CLASSES: ReadonlySet<string>;
 /**
  * A reply without its confidence trailer (`[[confidence=0.9 reply_class=general]]`,
  * see `replyConfidence`), and what the last one said. Every trailer is removed,

package/dist/agent/run.js

@@ -212,10 +212,11 @@ async function postReplyWithReplay(api, send, label, log, sleep) {
     const result = await postReplyOnce(api, send, label, log, sleep);
     // The send rule kept it as a suggestion for the team: handled, not failed.
     if (isHeldAsSuggestion(result)) {
-        log(/ai_muted/.test(result.error ?? '')
+        const muted = /ai_muted/.test(result.error ?? '');
+        log(muted
             ? `${timestamp()} ◦ ${label} reply was not sent: the thread is muted for AI`
             : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule)`);
-        return { ...result, ok: true };
+        return { ...result, ok: true, withheld: muted ? 'muted' : 'suggestion' };
     }
     return result;
 }
@@ -278,11 +279,28 @@ function resolveWorkdir(options, log) {
 export function isHeldAsSuggestion(result) {
     return result.status === 409 && /held_as_suggestion|ai_muted/.test(result.error ?? '');
 }
+/**
+ * A sign-in checker that adds `extra` only when it runs `binary` (this
+ * harness's Claude): the account snapshot checks other runtimes' logins too,
+ * and a Codex check must never see the Claude token.
+ */
+export function scopedCommandRunner(binary, base, extra) {
+    return (command, args, env) => (base ?? defaultCommandRunner)(command, args, command === binary ? { ...env, ...extra() } : env);
+}
 /** The run's extra variables, resolved now. */
 function extraEnvOf(options) {
     return typeof options.extraEnv === 'function' ? options.extraEnv() : (options.extraEnv ?? {});
 }
 /** A line that is the confidence trailer, however the model dressed it (backticks, bold, commas, quotes). */
+/** The reply classes the server's send rule knows (PR B); any other is sent as none. */
+export const REPLY_CLASSES = new Set([
+    'general',
+    'status_update',
+    'pricing_action',
+    'billing_action',
+    'legal_contractual',
+    'bug_in_our_code',
+]);
 /** A trailer token anywhere, with any decoration hugging it. */
 const TRAILER_TOKEN = /[`*_]*\[\[\s*confidence\b[^\]]*\]\][`*_]*\.?/gi;
 /** The confidence a trailer states: a plain decimal from 0 to 1, read whole — anything else is no confidence. */
@@ -319,7 +337,9 @@ export function splitConfidence(reply) {
         .join('\n')
         .replace(/\s+$/, '');
     const confidence = trailerConfidence(last);
-    const replyClass = /reply_class\s*[=:]\s*["']?([A-Za-z_]{1,40})/i.exec(last)?.[1]?.toLowerCase();
+    const named = /reply_class\s*[=:]\s*["']?([A-Za-z_]{1,40})/i.exec(last)?.[1]?.toLowerCase();
+    // Only the server's own classes; anything else is no class, so the server holds the reply.
+    const replyClass = named && REPLY_CLASSES.has(named) ? named : undefined;
     if (confidence === undefined)
         return { text };
     return { text, confidence, ...(replyClass ? { replyClass } : {}) };
@@ -392,7 +412,7 @@ function buildRuntime(options, log) {
         binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
         // A Claude harness's sign-in check sees the run's extra variables too (the Claude token).
         run: brain === 'claude' && options.extraEnv
-            ? (command, args, env) => (options.accountCommandRunner ?? defaultCommandRunner)(command, args, { ...env, ...extraEnvOf(options) })
+            ? scopedCommandRunner(options.exec.trim().split(/\s+/)[0] ?? 'claude', options.accountCommandRunner, () => extraEnvOf(options))
             : options.accountCommandRunner,
         warn: (message) => log(`${timestamp()} ! ${message}`),
     });
@@ -1173,6 +1193,8 @@ limited) {
     let earlyCount = 0;
     let earlyPosted = 0;
     let earlyPosts = Promise.resolve();
+    /** An answer of this run was dropped because the thread is muted: its session must not continue. */
+    let muted = false;
     const earlyPath = run.reply_path;
     const earlyBodyKey = run.reply_body_key;
     const stoppedNow = () => control.signal.aborted || control.disposition() !== undefined;
@@ -1200,6 +1222,8 @@ limited) {
             }
             early.shift();
             earlyPosted += 1;
+            if (posted.withheld === 'muted')
+                muted = true;
             log(`${timestamp()} ✓ ${label} posted an answer; a background task is still running`);
         }
     };
@@ -1224,6 +1248,17 @@ limited) {
     // A venue session is never continued: the next turn there starts fresh from
     // the thread the server sends, so nothing of this one is remembered.
     const sessionId = venue ? undefined : result.ok ? result.sessionId : undefined;
+    /**
+     * Continue the conversation's session from this turn — unless an answer of
+     * it was dropped because the thread is muted (any runtime): then the session
+     * holds a turn nobody saw, so it is forgotten, eager record or resumed one alike.
+     */
+    const settleSession = (id) => {
+        if (muted)
+            runtime.sessions.forget(sessionKeyFor(run));
+        else if (id)
+            runtime.sessions.remember(sessionKeyFor(run), id);
+    };
     // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
     // the run is closed — a completion that beats its own last tool row would
     // leave a `calling` row on a finished run. Never rejects, and after `stop`
@@ -1345,9 +1380,7 @@ limited) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
         }
-        if (sessionId) {
-            runtime.sessions.remember(sessionKeyFor(run), sessionId);
-        }
+        settleSession(sessionId);
         return 'succeeded';
     }
     // A run with no reply surface is a legitimate outcome, not an error: it was
@@ -1367,9 +1400,7 @@ limited) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
         }
-        if (sessionId) {
-            runtime.sessions.remember(sessionKeyFor(run), sessionId);
-        }
+        settleSession(sessionId);
         return 'succeeded';
     }
     const replyPath = run.reply_path;
@@ -1392,10 +1423,11 @@ limited) {
     }
     // Advance continuity only after the answer is durable on its reply surface.
     // Remembering at process exit would strand the conversation behind an answer
-    // it never received whenever this POST is rejected.
-    if (sessionId) {
-        runtime.sessions.remember(sessionKeyFor(run), sessionId);
-    }
+    // it never received whenever this POST is rejected. A muted thread kept
+    // nothing of it, so its session is not advanced either (and an eager record undone).
+    if (posted.withheld === 'muted')
+        muted = true;
+    settleSession(sessionId);
     const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
     if (!completed.ok) {
         // The reply is already in the conversation, so this is a bookkeeping

package/dist/codehost/checkouts.js

@@ -72,7 +72,7 @@ const OFFERED_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)?
 /** What a person reads when a thread names a repository this Mac has no checkout of. */
 export function notOfferedReason(repo, offered) {
     if (offered.length === 0) {
-        return `This Mac isn't set up with any repositories for Code threads yet, so it can't work on ${repo}.`;
+        return `This Mac isn't set up with any repositories for terminals yet, so it can't work on ${repo}.`;
     }
     return `This Mac isn't set up for ${repo}. Pick one of its repositories: ${offered.join(', ')}.`;
 }

package/dist/codehost/settings.d.ts

@@ -24,6 +24,13 @@ export interface CodeHostSettings {
     allowRemoteTerminal: boolean;
 }
 export declare const DEFAULT_SETTINGS: CodeHostSettings;
+/**
+ * A dedicated `prohost host` service decides terminal sessions in its own definition
+ * (`host install --dedicated --remote-terminal | --no-remote-terminal`), not in the home's
+ * `settings.json`: `1` hosts with remote control on, `0` hosts nothing. Every reader — the daemon,
+ * the relay and the permission hook in each Claude window (which inherits it) — sees the same.
+ */
+export declare const TERMINAL_SESSIONS_ENV = "PROHOST_HOST_TERMINAL_SESSIONS";
 /** `$PROHOST_HOME/code-host`. */
 export declare function codeHostDir(env?: NodeJS.ProcessEnv): string;
 export declare function settingsPath(env?: NodeJS.ProcessEnv): string;

package/dist/codehost/settings.js

@@ -27,6 +27,13 @@ export const DEFAULT_SETTINGS = Object.freeze({
     enabled: false,
     allowRemoteTerminal: false,
 });
+/**
+ * A dedicated `prohost host` service decides terminal sessions in its own definition
+ * (`host install --dedicated --remote-terminal | --no-remote-terminal`), not in the home's
+ * `settings.json`: `1` hosts with remote control on, `0` hosts nothing. Every reader — the daemon,
+ * the relay and the permission hook in each Claude window (which inherits it) — sees the same.
+ */
+export const TERMINAL_SESSIONS_ENV = 'PROHOST_HOST_TERMINAL_SESSIONS';
 /** `$PROHOST_HOME/code-host`. */
 export function codeHostDir(env = process.env) {
     return path.join(prohostHome(env), 'code-host');
@@ -94,6 +101,11 @@ export function readJsonObject(file) {
  * is the default — both off — and only a literal `true` turns a switch on.
  */
 export function loadSettings(env = process.env) {
+    const decided = env[TERMINAL_SESSIONS_ENV];
+    if (decided === '1')
+        return { version: 1, enabled: true, allowRemoteTerminal: true };
+    if (decided === '0')
+        return { ...DEFAULT_SETTINGS };
     const raw = readJsonObject(settingsPath(env));
     if (!raw || raw.version !== 1)
         return { ...DEFAULT_SETTINGS };

package/dist/codehost/terminals.js

@@ -33,6 +33,7 @@ import { readHistory } from './history.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
 import { claudeSessionSince, isReady, markReady } from './ready.js';
+import { TERMINAL_SESSIONS_ENV } from './settings.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
 import { noteInputTakeover } from './sizing.js';
 import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
@@ -169,6 +170,14 @@ const CLAUDE_THREAD_ENV = { CLAUDE_CODE_ENABLE_CFC: '0' };
  * and the like), then the thread's overrides, which a login's environment never undoes. The one
  * builder for it: `startOnce` launches with it, and `adoptReadiness` reads the config dir from it.
  */
+/**
+ * A dedicated service's terminal switch (`TERMINAL_SESSIONS_ENV`), handed to each window so its
+ * permission hook reads the same switches as the daemon whatever the tmux server inherited.
+ */
+function terminalSessionsEnv(env) {
+    const decided = env[TERMINAL_SESSIONS_ENV];
+    return decided === undefined ? {} : { [TERMINAL_SESSIONS_ENV]: decided };
+}
 function agentWindowEnv(agent, accountEnv) {
     return { ...stringEnv(accountEnv), ...(agent === 'claude_code' ? CLAUDE_THREAD_ENV : {}) };
 }
@@ -480,6 +489,7 @@ export class CodeTerminals {
             cwd: checkout.path,
             env: {
                 ...agentWindowEnv(request.agent, account.env),
+                ...terminalSessionsEnv(this.options.processEnv ?? process.env),
                 PROHOST_HOME: this.options.home,
                 [TERMINAL_ID_ENV]: request.terminalId,
                 [CODE_THREAD_ID_ENV]: request.codeThreadId,

package/dist/host/command.d.ts

@@ -55,5 +55,13 @@ export declare function statusJson(env: NodeJS.ProcessEnv, now?: number, options
     label?: string;
     platform?: NodeJS.Platform;
 }): Record<string, unknown>;
+/**
+ * How to start a sign-in. On Windows npm installs `claude` / `codex` as `.cmd`
+ * shims, which only `cmd.exe` can run: the whole line goes through
+ * `cmd.exe /d /s /c "…"`, each part quoted (they are fixed words here).
+ */
+export declare function signInSpawn(command: string, args: string[], platform?: NodeJS.Platform): [string, string[], {
+    windowsVerbatimArguments?: boolean;
+}];
 export declare function runHost(subcommand: string | undefined, flags: Flags, printHelp: () => void, io?: HostIo): Promise<number>;
 export {};

package/dist/host/command.js

@@ -29,7 +29,7 @@ import { addAccount, isValidLabel, loadAccounts, parseAccountRuntime, accountEnv
 import { revokeComputer } from './api.js';
 import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, hostLockPath, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
 import { journalPath, readEvents } from './events.js';
-import { LAUNCHD_HOST_LABEL, defaultLabel, installService, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
+import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
 import { LegacyHarnesses } from './legacy.js';
 import { detectLogins } from './logins.js';
 import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
@@ -97,26 +97,29 @@ export function hardwareFacts() {
  */
 export function statusJson(env, now = Date.now(), options = {}) {
     const computer = tryLoadComputer(env);
-    const own = readObject(statePath(env));
-    const ownFresh = own !== undefined && now - Date.parse(own.updatedAt) < STATE_STALE_MS;
-    // `--label` asks for that service, even when this home runs one of its own.
-    const shared = ownFresh && !options.label
-        ? undefined
-        : dedicatedState(options.sharedBase ?? sharedBase(options.platform ?? process.platform), now, options.label);
-    const state = shared ? shared.state : own;
-    const fresh = ownFresh || shared !== undefined;
+    // A dedicated service is reported only when asked for by its `--label`, and then only from what
+    // it publishes: unlabelled, status is about this home's own service, whatever else runs on the
+    // computer; labelled, nothing of this home's (its pause, its pairing, its lock) is mixed in.
+    const labelDir = options.label
+        ? path.join(options.sharedBase ?? sharedBase(options.platform ?? process.platform), options.label)
+        : undefined;
+    const shared = options.label
+        ? dedicatedState(options.sharedBase ?? sharedBase(options.platform ?? process.platform), now, options.label)
+        : undefined;
+    const own = labelDir ? undefined : readObject(statePath(env));
+    const state = labelDir ? shared?.state : own;
+    const fresh = labelDir ? shared !== undefined : own !== undefined && now - Date.parse(own.updatedAt) < STATE_STALE_MS;
     const sharedComputer = shared?.state.computer;
-    const paused = readObject(controlPath(env))?.paused === true ||
-        (shared !== undefined && readObject(path.join(shared.dir, 'control.json'))?.paused === true) ||
+    const paused = readObject(labelDir ? path.join(labelDir, 'control.json') : controlPath(env))?.paused === true ||
         (fresh && state?.paused === true);
     const recommended = state?.recommended_capacity ?? recommendCapacity({ memoryGb: os.totalmem() / 1024 ** 3, cores: os.cpus().length });
     const capacity = state?.capacity ?? recommended;
-    const lock = readObject(hostLockPath(env));
-    const events = shared ? readEvents(path.join(shared.dir, 'events.json'), now) : readEvents(journalPath(env), now);
+    const lock = labelDir ? undefined : readObject(hostLockPath(env));
+    const events = readEvents(labelDir ? path.join(labelDir, 'events.json') : journalPath(env), now);
     return {
         // Reporting the dedicated service: its own computer, never this home's (they can differ).
-        paired: shared ? sharedComputer !== undefined : computer !== null,
-        computer: shared
+        paired: labelDir ? sharedComputer !== undefined : computer !== null,
+        computer: labelDir
             ? (sharedComputer ?? null)
             : computer
                 ? { id: computer.computer_id, name: (fresh && state?.name) || computer.name, account: computer.account }
@@ -131,12 +134,13 @@ export function statusJson(env, now = Date.now(), options = {}) {
         hardware: hardwareFacts(),
         events,
         service: {
-            running: shared !== undefined || alive(lock?.pid),
-            pid: shared ? (shared.state.pid ?? null) : alive(lock?.pid) ? lock?.pid : null,
-            adopted: loadAdopted(env)?.homes.length ?? 0,
-            dedicated: shared !== undefined,
-            ...(shared ? { activity_file: path.join(shared.dir, 'activity.json') } : {}),
+            running: labelDir ? shared !== undefined : alive(lock?.pid),
+            pid: labelDir ? (shared?.state.pid ?? null) : alive(lock?.pid) ? lock?.pid : null,
+            adopted: labelDir ? 0 : (loadAdopted(env)?.homes.length ?? 0),
+            dedicated: labelDir !== undefined,
+            ...(labelDir ? { activity_file: path.join(labelDir, 'activity.json') } : {}),
         },
+        remote_terminal: Boolean(fresh && state?.remote_terminal),
         version: CLI_VERSION,
     };
 }
@@ -222,9 +226,21 @@ function homeOfUser(platform, user) {
     }
     return path.join('/home', user, '.prohost');
 }
+/**
+ * How to start a sign-in. On Windows npm installs `claude` / `codex` as `.cmd`
+ * shims, which only `cmd.exe` can run: the whole line goes through
+ * `cmd.exe /d /s /c "…"`, each part quoted (they are fixed words here).
+ */
+export function signInSpawn(command, args, platform = process.platform) {
+    if (platform !== 'win32')
+        return [command, args, {}];
+    const quote = (part) => (/^[A-Za-z0-9._:\\/-]+$/.test(part) ? part : `"${part.replace(/"/g, '""')}"`);
+    return ['cmd.exe', ['/d', '/s', '/c', `"${[command, ...args].map(quote).join(' ')}"`], { windowsVerbatimArguments: true }];
+}
 /** `claude auth login` / `codex login`, in this terminal, as the new login. */
 const defaultSignIn = (command, args, env) => new Promise((resolve) => {
-    const child = spawn(command, args, { stdio: 'inherit', env: { ...process.env, ...env } });
+    const [file, argv, extra] = signInSpawn(command, args);
+    const child = spawn(file, argv, { stdio: 'inherit', env: { ...process.env, ...env }, ...extra });
     child.on('error', () => resolve(null));
     child.on('exit', (code) => resolve(code));
 });
@@ -411,8 +427,14 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 pathEnv: env.PATH ?? '',
                 userHome,
                 label: str(flags, 'label') ?? defaultLabel(home, path.join(userHome, '.prohost')),
+                // Terminal sessions on a dedicated service: off unless --remote-terminal.
+                ...(dedicated ? { terminalSessions: flags['remote-terminal'] === true && flags['no-remote-terminal'] !== true } : {}),
                 electron: io.electron ?? (Boolean(process.versions.electron) || env.ELECTRON_RUN_AS_NODE === '1'),
             };
+            if (flags['remote-terminal'] === true && flags['no-remote-terminal'] === true) {
+                err('Pass --remote-terminal or --no-remote-terminal, not both.');
+                return 1;
+            }
             const tokenFile = str(flags, 'claude-token-file');
             if (flags['claude-token-file'] === true) {
                 err('--claude-token-file needs a path.');
@@ -434,6 +456,19 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     (o.ok ? out : err)(o.message);
                 return shown.every((o) => o.ok) ? 0 : 1;
             }
+            // 0.16.0 put a Windows dedicated service's home in the account's profile, under another
+            // label: replacing it here would leave two services on one key. Its owner removes it first.
+            if (platform === 'win32' && dedicated && serviceUser && !str(flags, 'service-home')) {
+                const oldHome = path.win32.join('C:\\Users', serviceUser, '.prohost');
+                const oldLabel = defaultLabel(oldHome, path.join(userHome, '.prohost'));
+                const oldTask = windowsTaskOf({ label: oldLabel });
+                if ((io.serviceIo?.run ?? defaultServiceRunner)('schtasks', ['/Query', '/TN', oldTask]).status === 0) {
+                    err(`✗ A host service from CLI 0.16.0 is installed for ${serviceUser} (task ${oldTask}, home ${oldHome}). ` +
+                        `Remove it first: prohost host uninstall --label ${oldLabel} — then run this again with ` +
+                        `--from-home ${oldHome} to carry its computer over.`);
+                    return 1;
+                }
+            }
             // The invoking user's home: under sudo, $PROHOST_HOME and $HOME are root's.
             const adoptFrom = str(flags, 'from-home') ??
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
@@ -503,20 +538,28 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
         case 'resume': {
             const paused = subcommand === 'pause';
             const control = { v: 1, paused, updated_at: new Date().toISOString() };
-            writePrivateFile(controlPath(env), control);
-            // A dedicated service on this computer reads its own shared switch (writable by everyone on it).
+            // A dedicated service reads its own shared switch (writable by everyone on the computer):
+            // flipped only when it is named (`--label`), and then it alone. Unlabelled, this home alone
+            // is paused — a personal sign-out never pauses a dedicated service on the same computer.
             const label = str(flags, 'label');
-            for (const dir of sharedDirs(io.sharedBase ?? sharedBase(platform), label)) {
+            if (label) {
+                const dir = path.join(io.sharedBase ?? sharedBase(platform), label);
                 try {
                     writeFileSync(path.join(dir, 'control.json'), `${JSON.stringify(control)}\n`);
                 }
                 catch (e) {
-                    err(`  ! could not ${subcommand} the service in ${dir}: ${e instanceof Error ? e.message : String(e)}`);
+                    err(`Could not ${subcommand} the service in ${dir}: ${e instanceof Error ? e.message : String(e)}`);
+                    return 1;
                 }
             }
+            else {
+                writePrivateFile(controlPath(env), control);
+            }
+            const which = label ? `the service ${label}` : 'this computer';
+            const again = label ? `prohost host resume --label ${label}` : 'prohost host resume';
             out(paused
-                ? '⏸ Paused: this computer takes no new work. Work already going finishes. Resume with: prohost host resume'
-                : '▶ Resumed: this computer takes new work again.');
+                ? `⏸ Paused: ${which} takes no new work. Work already going finishes. Resume with: ${again}`
+                : `▶ Resumed: ${which} takes new work again.`);
             return 0;
         }
         case 'migrate': {

package/dist/host/install.d.ts

@@ -31,6 +31,7 @@ export declare const STOP_TIMEOUT_SECONDS = 600;
 export declare const RESTART_WAIT_MS: number;
 /** Set in a dedicated service's environment: where it publishes its state for the logged-in user. */
 export declare const SHARED_DIR_ENV = "PROHOST_HOST_SHARED_DIR";
+/** Set in a dedicated service's environment: terminal sessions on (`1`) or off (`0`), from install. */
 /** The `claude setup-token` token a dedicated install hands the service user (read by `host run`). */
 export declare const CLAUDE_TOKEN_FILE = "claude-oauth-token";
 export type ServiceRunner = (command: string, args: string[], input?: string) => {
@@ -65,6 +66,11 @@ export interface ServiceSpec {
      * service keeps `ELECTRON_RUN_AS_NODE=1`, or launching it would open the app.
      */
     electron?: boolean;
+    /**
+     * Dedicated only: terminal sessions (remote terminals) on this service —
+     * `--remote-terminal`. Off unless asked for.
+     */
+    terminalSessions?: boolean;
 }
 /** The label for a home: the plain one for the default home, else one with a short digest of the home. */
 export declare function defaultLabel(home: string, defaultHome: string): string;
@@ -135,6 +141,8 @@ export interface DedicatedSetup {
 }
 /** Validate a spec before anything is written. */
 export declare function specProblem(spec: ServiceSpec, io?: InstallIo, setup?: DedicatedSetup): string | undefined;
+/** Where Windows dedicated services' homes live: an administrators' folder. */
+export declare function windowsHomesDir(): string;
 /** Where a Windows dedicated install keeps the Claude token: an administrators' folder the account may only read. */
 export declare function windowsTokenPath(spec: Pick<ServiceSpec, 'label'>): string;
 /**

package/dist/host/install.js

@@ -24,6 +24,7 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writ
 import os from 'node:os';
 import path from 'node:path';
 import { buildLaunchdPlist, waitUntilUnloaded } from '../agent/daemon.js';
+import { TERMINAL_SESSIONS_ENV } from '../codehost/settings.js';
 export const LAUNCHD_HOST_LABEL = 'ai.prohost.host';
 export const SYSTEMD_HOST_UNIT = 'prohost-host.service';
 export const WINDOWS_TASK_NAME = '\\ProhostAI\\Host';
@@ -37,6 +38,7 @@ export const STOP_TIMEOUT_SECONDS = 600;
 export const RESTART_WAIT_MS = (STOP_TIMEOUT_SECONDS + 30) * 1000;
 /** Set in a dedicated service's environment: where it publishes its state for the logged-in user. */
 export const SHARED_DIR_ENV = 'PROHOST_HOST_SHARED_DIR';
+/** Set in a dedicated service's environment: terminal sessions on (`1`) or off (`0`), from install. */
 /** The `claude setup-token` token a dedicated install hands the service user (read by `host run`). */
 export const CLAUDE_TOKEN_FILE = 'claude-oauth-token';
 export const defaultServiceRunner = (command, args, input) => {
@@ -101,7 +103,9 @@ export function serviceEnv(spec) {
     return {
         PATH: spec.pathEnv,
         PROHOST_HOME: spec.home,
-        ...(spec.dedicated ? { PROHOST_HOST_DEDICATED: '1', [SHARED_DIR_ENV]: sharedDirFor(spec) } : {}),
+        ...(spec.dedicated
+            ? { PROHOST_HOST_DEDICATED: '1', [SHARED_DIR_ENV]: sharedDirFor(spec), [TERMINAL_SESSIONS_ENV]: spec.terminalSessions ? '1' : '0' }
+            : {}),
         ...(spec.dedicated && spec.platform === 'darwin' && spec.serviceUser
             ? { HOME: path.posix.join('/Users', spec.serviceUser) }
             : {}),
@@ -272,6 +276,10 @@ export function specProblem(spec, io = {}, setup = {}) {
             return '--dedicated needs --service-user <name>: the account the service runs as.';
         if (!SERVICE_USER.test(spec.serviceUser))
             return `"${spec.serviceUser}" is not a usable account name.`;
+        if (spec.platform === 'win32' && path.win32.resolve(path.win32.dirname(spec.home)) !== path.win32.resolve(windowsHomesDir())) {
+            // Only a home under the administrators' folder can be prepared safely (see `prepareDedicated`).
+            return `On Windows a dedicated service's home is ${path.win32.join(windowsHomesDir(), spec.serviceUser)}; --service-home is not supported there.`;
+        }
         const admin = io.isAdmin ??
             (spec.platform === 'win32'
                 ? // `net session` succeeds only from an elevated prompt.
@@ -332,6 +340,10 @@ function ensureServiceUser(spec, run) {
     }
     return undefined;
 }
+/** Where Windows dedicated services' homes live: an administrators' folder. */
+export function windowsHomesDir() {
+    return 'C:\\ProgramData\\Prohost\\homes';
+}
 /** Where a Windows dedicated install keeps the Claude token: an administrators' folder the account may only read. */
 export function windowsTokenPath(spec) {
     return path.win32.join('C:\\ProgramData\\Prohost\\secrets', labelOf(spec), CLAUDE_TOKEN_FILE);
@@ -385,6 +397,7 @@ function claimWindowsDirs(spec, run, mkdirOnce, isSymlink) {
         [path.win32.join(base, 'secrets'), admin],
         [path.win32.dirname(windowsTokenPath(spec)), [...admin, `${user}:(OI)(CI)R`]],
         [path.win32.join(base, 'services'), admin],
+        [windowsHomesDir(), admin],
         [windowsServiceDir(spec), [...admin, `${user}:(OI)(CI)RX`]],
     ];
     const trusted = (owner) => /\\(Administrators|SYSTEM)$/i.test(owner);
@@ -500,17 +513,36 @@ function prepareDedicated(spec, io, setup) {
         // The account's home is ACL'd and filled only when this install creates
         // it: an existing one is the account's, and an administrator writing into
         // it could be redirected.
-        mkdir(path.win32.dirname(spec.home), 0o755);
-        if ((io.mkdirOnce ?? mkdirOnce)(spec.home) === 'created') {
-            mkdir(hostDir, 0o700);
-            const acl = run('icacls', [spec.home, '/inheritance:r', '/grant:r', 'SYSTEM:(OI)(CI)F', 'Administrators:(OI)(CI)F', `${user}:(OI)(CI)F`]);
-            if (acl.status !== 0)
-                return failed(`icacls ${spec.home}`, acl);
-            if (credential)
-                write(join(hostDir, 'computer.json'), credential, 0o600);
-        }
-        else if (isSymlink(spec.home) || isSymlink(hostDir)) {
-            return `${spec.home} is a link: remove it, then install again.`;
+        // The service home is an administrators' folder (ProgramData\Prohost\homes\<label>): made
+        // in one step with no access for the account, filled, and only then opened to it — so it can
+        // never swap a path in it while an administrator writes there. An existing one is never
+        // written into; a --service-home elsewhere is the account's own business.
+        if (path.win32.resolve(path.win32.dirname(spec.home)) === path.win32.resolve(windowsHomesDir())) {
+            const made = (io.mkdirOnce ?? mkdirOnce)(spec.home);
+            if (made === 'exists') {
+                if (isSymlink(spec.home))
+                    return `${spec.home} is a link or junction: remove it, then install again.`;
+                const owner = windowsOwner(run, spec.home);
+                if (!/\\(Administrators|SYSTEM)$/i.test(owner))
+                    return `${spec.home} is owned by ${owner || 'someone else'}: remove it, then install again.`;
+            }
+            else {
+                for (const args of [
+                    [spec.home, '/setowner', 'Administrators'],
+                    [spec.home, '/inheritance:r', '/grant:r', 'SYSTEM:(OI)(CI)F', 'Administrators:(OI)(CI)F'],
+                ]) {
+                    const out = run('icacls', args);
+                    if (out.status !== 0)
+                        return failed(`icacls ${args.slice(0, 2).join(' ')}`, out);
+                }
+                mkdir(hostDir, 0o700);
+                if (credential)
+                    write(join(hostDir, 'computer.json'), credential, 0o600, 'wx');
+            }
+            // The account may now use its home.
+            const open = run('icacls', [spec.home, '/grant', `${user}:(OI)(CI)M`]);
+            if (open.status !== 0)
+                return failed(`icacls ${spec.home}`, open);
         }
     }
     else {
@@ -749,7 +781,8 @@ export function uninstallService(spec, io = {}) {
 export function serviceUserHome(platform, user) {
     if (platform === 'darwin')
         return path.join('/Users', user, '.prohost');
+    // On Windows: an administrators' folder per account (see `prepareDedicated`), not the account's profile.
     if (platform === 'win32')
-        return path.win32.join('C:\\Users', user, '.prohost');
+        return path.win32.join(windowsHomesDir(), user);
     return path.join('/home', user, '.prohost');
 }

package/dist/host/service.js

@@ -185,6 +185,9 @@ async function serveHost(options) {
     const codeHostEnv = computer.code_host_home
         ? { ...process.env, ...env, PROHOST_HOME: computer.code_host_home }
         : { ...process.env, ...env };
+    // A dedicated install decides terminal sessions in the service's own definition
+    // (`--remote-terminal` / `--no-remote-terminal`, `TERMINAL_SESSIONS_ENV`), which `loadSettings`
+    // reads over the home's switches; a personal service follows the home's switches.
     const codeHost = options.codeHost !== undefined
         ? (options.codeHost ?? undefined)
         : loadCodeHostSettings(codeHostEnv).enabled
@@ -367,6 +370,7 @@ async function serveHost(options) {
             online,
             paused: localPaused || config.paused,
             draining,
+            remote_terminal: capabilities().includes(REMOTE_TERMINAL_CAPABILITY),
             slots: slotsFor(capacity(), active.size + terminals(), held),
             capacity: capacity(),
             recommended_capacity: config.recommended_capacity ?? recommended(),

package/dist/host/status.d.ts

@@ -80,6 +80,8 @@ export interface HostState {
     online: boolean;
     paused: boolean;
     draining: boolean;
+    /** Remote terminal sessions are on (the `remote_terminal` capability). */
+    remote_terminal?: boolean;
     slots: Slots;
     capacity: number;
     recommended_capacity: number;

package/dist/index.js

@@ -35,7 +35,7 @@ function printHelp() {
         '  prohost host unpair                  Remove this computer from its workspace (revokes its key)',
         '  prohost host run                     One service for every AI employee placed on this computer',
         '  prohost host install [--label <id>] [--dedicated --service-user <name> [--service-home <dir>]',
-        '                       [--claude-token-file <path>]] | uninstall [--label <id>]',
+        '                       [--claude-token-file <path>] [--remote-terminal|--no-remote-terminal]] | uninstall [--label <id>]',
         '  prohost host status [--json] [--label <id>] | pause | resume',
         '  prohost host logins [--json] | logins add --runtime claude_code|codex [--label <l>]',
         '  prohost host migrate [--from <home>]… [--home <dir,…>] [--keep-services] [--dry-run] [--json]',
@@ -72,6 +72,8 @@ function printHelp() {
         '                   publishes its status for `host status` run by anyone on the computer.',
         '  --claude-token-file  `host install --dedicated`: a file holding a `claude setup-token` token, installed',
         '                   for the service user as CLAUDE_CODE_OAUTH_TOKEN. Read once, never printed.',
+        '  --remote-terminal / --no-remote-terminal  `host install --dedicated`: terminal sessions on this',
+        '                   service (off unless --remote-terminal); `host status --json` shows remote_terminal.',
         '  --from-home      `host install --dedicated`: the home whose computer.json the service takes over',
         "                   (default: $PROHOST_HOME, or $SUDO_USER's ~/.prohost under sudo).",
         '  --label          `host install` / `uninstall`: the service\'s label (launchd label, systemd unit,',

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.0";
+export declare const CLI_VERSION = "0.16.2";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.0";
+export declare const USER_AGENT = "prohost-cli/0.16.2";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.0';
+export const CLI_VERSION = '0.16.2';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",