@prohost/cli 0.16.1 → 0.16.3

package/CHANGELOG.md

@@ -6,6 +6,43 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.3
+
+- **A dedicated service records its terminal switch in its home's code-host settings** as it
+  starts (`--remote-terminal` / `--no-remote-terminal`), instead of an environment variable a
+  surviving tmux window would keep: after a reinstall with `--no-remote-terminal`, a Claude window
+  still open from before stops advertising remote approvals nobody can give, and answers its
+  permission prompts in the terminal. It fails closed: `--no-remote-terminal` never hosts (the
+  definition decides in the service, whatever the file says), and a switch it can't record hosts
+  nothing and removes the old file when it can, so hooks read remote control as off (the log says
+  when even that fails).
+- **A muted thread's turn is never resumed.** When an early answer was dropped because the thread
+  is muted (`409 ai_muted`), the conversation's session is forgotten on every exit — cancelled,
+  usage-limited, closed server-side, expired or failed too — not only when the run finishes.
+- **Replies the server holds back are handled, not failed or retried** (dispatch #22485):
+  `409 approval_required` ("waiting for approval": sent when someone approves the card — the
+  session continues), `409 send_blocked` ("blocked: <reason>", e.g. a duplicate — never delivered,
+  so the session is forgotten), and `held_as_suggestion` with any reason, `pinned_rule` included
+  (the session continues, as before). Any other 409 is still a failure. Works with today's server.
+
+## 0.16.2
+
+More `prohost host` follow-ups (they missed #22513):
+
+- **Unlabelled `host pause` / `resume` / `status` act on this home only.** A dedicated service on
+  the same computer is addressed only by its `--label`: a personal sign-out (the desktop runs
+  `host pause`) never pauses it. A labelled `pause` / `resume` / `status` is about that service
+  alone: this home's pause, pairing and service never mix into it.
+- **`host install --dedicated --remote-terminal | --no-remote-terminal`:** terminal sessions on a
+  dedicated service, off unless asked for; set in the service's definition, shown as
+  `remote_terminal` in `host status --json` and declared as the `remote_terminal` capability.
+  Every reader of the switches — the daemon, the relay and the permission hook in each Claude
+  window — sees the same setting, so remote approvals wait for an answer from ProhostAI.
+- **`host logins add` on Windows** starts npm's `.cmd` shims through `cmd.exe /d /s /c`.
+- **Reply classes:** only the server's (`general`, `status_update`, `pricing_action`,
+  `billing_action`, `legal_contractual`, `bug_in_our_code`); any other is sent as none, so the
+  server holds the reply.
+
 ## 0.16.1
 
 Review follow-ups to `prohost host` that landed on its branch after #22455 merged:

package/README.md

@@ -206,6 +206,10 @@ from an administrator prompt. It:
   made in one step with administrators-only access, given the credential, and
   only then opened to the account (an existing one is never written into). If your own (personal) service runs on the same computer
   key, install says so and how to remove it;
+- hosts terminal sessions only with `--remote-terminal` (`--no-remote-terminal`
+  or nothing: none) — decided in the service's definition, shown as
+  `remote_terminal` in `host status --json` and declared as the
+  `remote_terminal` capability only when on;
 - logs where the service account can't redirect it: the journal on Linux,
   `/Library/Logs/Prohost/<label>.log` (in a root-owned folder) on macOS,
   `C:\ProgramData\Prohost\Logs` (ACL: SYSTEM, administrators, the service
@@ -214,8 +218,9 @@ from an administrator prompt. It:
   emails, in a root-owned `/Library/Application Support/Prohost/hosts/<label>`,
   `/var/lib/prohost/hosts/<label>` or `C:\ProgramData\Prohost\hosts\<label>`: the service owns only
   `state.json`, `activity.json` and `events.json` there, and `control.json` is
-  the pause switch anyone on the computer may flip. `host status` and
-  `host pause` run as the logged-in user find it there, and
+  the pause switch anyone on the computer may flip. `host status --label <id>`
+  and `host pause|resume --label <id>` run as the logged-in user address it
+  there (unlabelled, they act on their own home only), and
   `sudo prohost host uninstall` finds the service by it (install prints the exact
   command with its `--label`).
 
@@ -287,8 +292,9 @@ start it again. `--dry-run` shows what it would do; `--json` prints the report.
   `login_moved`, `hold_started`, `hold_ended`, with the `/events` fields plus
   `computer_id` / `computer_name`), newest last, each with a stable `id`.
   `service` says whether a service runs for this home (`host/service.lock`), how
-  many homes it adopted, and — run as the logged-in user on a dedicated computer —
-  that it is the dedicated service (`activity_file` is then its shared copy).
+  many homes it adopted, and — with `--label <id>` of a dedicated service — that
+  it is the dedicated service (`activity_file` is then its shared copy).
+  `remote_terminal` says whether remote terminal sessions are on.
 - `host logins --json` → `{logins: [...same shape as status...]}`.
 - `$PROHOST_HOME/host/activity.json` → `{v: 1, busy, running: [...as in status...], updatedAt}`.
 - `$PROHOST_HOME/host/state.json` is the service's own state (0600); read

package/dist/agent/api.d.ts

@@ -31,10 +31,11 @@ export interface ApiResult {
     ok: boolean;
     /**
      * A send the server answered without sending (still `ok`: the run is done):
-     * saved as a draft for the team (`suggestion`), or dropped because the thread
-     * is muted for AI (`muted`).
+     * saved as a draft for the team (`suggestion`), waiting on an approval card
+     * (`approval`), dropped because the thread is muted for AI (`muted`), or
+     * stopped by the outbound guard (`blocked`). See `withheldBy` in run.ts.
      */
-    withheld?: 'suggestion' | 'muted';
+    withheld?: 'suggestion' | 'approval' | 'muted' | 'blocked';
     /** HTTP status, or ``0`` when no response arrived at all — see ``failure``. */
     status: number;
     error?: string;

package/dist/agent/prompt.js

@@ -178,7 +178,7 @@ export function buildPrompt(run, context) {
     if (context.resumeNote)
         lines.push(context.resumeNote, '');
     if (context.askConfidence) {
-        lines.push('End your reply with one last line, exactly: [[confidence=<0 to 1> reply_class=<class>]] — how sure you are', 'the reply is right and safe to send as is, and its class: general, pricing_action, billing_action,', 'legal_contractual or bug_in_our_code. That line is removed before sending; below the bar, or for a class', 'that needs approval, your reply is saved as a draft for the team instead of sent.', '');
+        lines.push('End your reply with one last line, exactly: [[confidence=<0 to 1> reply_class=<class>]] — how sure you are', 'the reply is right and safe to send as is, and its class: general, status_update, pricing_action,', 'billing_action, legal_contractual or bug_in_our_code. That line is removed before sending; below the bar, or for a class', 'that needs approval, your reply is saved as a draft for the team instead of sent.', '');
     }
     // The operator's own configuration comes first, above everything the server
     // generated. It is who this agent *is* — persona, house rules, escalation

package/dist/agent/run.d.ts

@@ -270,18 +270,20 @@ export interface AgentRunMetrics {
  *   nor a failure and must not be counted as either.
  */
 type RunOutcome = 'succeeded' | 'failed' | 'cancelled' | 'resolved' | 'unreported' | 'skipped';
-/**
- * A send the server answered without sending, deliberately: `held_as_suggestion`
- * (saved as a draft for the team — the send rule) or `ai_muted` (the thread is
- * muted; nothing saved, nothing to retry). Either way the run is done.
- */
-export declare function isHeldAsSuggestion(result: ApiResult): boolean;
+export declare function withheldBy(result: ApiResult): {
+    kind: NonNullable<ApiResult['withheld']>;
+    reason?: string;
+    approvalRequestId?: string;
+} | undefined;
 /**
  * A sign-in checker that adds `extra` only when it runs `binary` (this
  * harness's Claude): the account snapshot checks other runtimes' logins too,
  * and a Codex check must never see the Claude token.
  */
 export declare function scopedCommandRunner(binary: string, base: CommandRunner | undefined, extra: () => NodeJS.ProcessEnv): CommandRunner;
+/** A line that is the confidence trailer, however the model dressed it (backticks, bold, commas, quotes). */
+/** The reply classes the server's send rule knows (PR B); any other is sent as none. */
+export declare const REPLY_CLASSES: ReadonlySet<string>;
 /**
  * A reply without its confidence trailer (`[[confidence=0.9 reply_class=general]]`,
  * see `replyConfidence`), and what the last one said. Every trailer is removed,

package/dist/agent/run.js

@@ -210,13 +210,18 @@ const REPLAY_IN_FLIGHT_DELAY_MS = 5_000;
  */
 async function postReplyWithReplay(api, send, label, log, sleep) {
     const result = await postReplyOnce(api, send, label, log, sleep);
-    // The send rule kept it as a suggestion for the team: handled, not failed.
-    if (isHeldAsSuggestion(result)) {
-        const muted = /ai_muted/.test(result.error ?? '');
-        log(muted
+    // The server decided not to send it (yet): handled, not failed, and never retried.
+    const held = withheldBy(result);
+    if (held) {
+        const why = held.reason ? `: ${held.reason}` : '';
+        log(held.kind === 'muted'
             ? `${timestamp()} ◦ ${label} reply was not sent: the thread is muted for AI`
-            : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule)`);
-        return { ...result, ok: true, withheld: muted ? 'muted' : 'suggestion' };
+            : held.kind === 'approval'
+                ? `${timestamp()} ◦ ${label} reply is waiting for approval${held.approvalRequestId ? ` (approval ${held.approvalRequestId})` : ''}: it is sent when someone approves it`
+                : held.kind === 'blocked'
+                    ? `${timestamp()} ◦ ${label} reply was not sent: blocked: ${held.reason ?? 'the outbound guard'}`
+                    : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule${why})`);
+        return { ...result, ok: true, withheld: held.kind };
     }
     return result;
 }
@@ -272,12 +277,62 @@ function resolveWorkdir(options, log) {
     }
 }
 /**
- * A send the server answered without sending, deliberately: `held_as_suggestion`
- * (saved as a draft for the team — the send rule) or `ai_muted` (the thread is
- * muted; nothing saved, nothing to retry). Either way the run is done.
+ * A send the server answered without sending, deliberately (a 409). Either way the run is done,
+ * nothing is retried, and whether the conversation's session continues follows from it:
+ *
+ * - `held_as_suggestion` → `suggestion`: saved as a draft for the team (the send rule, or a
+ *   `pinned_rule`). The team may send it as is: the session continues.
+ * - `approval_required` → `approval`: below the employee's threshold, it waits on an approval card
+ *   and the server sends it when someone approves: the session continues.
+ * - `ai_muted` → `muted`: the thread is muted; nothing saved. The guest never sees it: the session
+ *   is forgotten.
+ * - `send_blocked` → `blocked`: the shared outbound guard stopped it (e.g. a duplicate). Not
+ *   delivered by this run: the session is forgotten.
+ *
+ * Any other 409 is not a decision and stays a failure.
  */
-export function isHeldAsSuggestion(result) {
-    return result.status === 409 && /held_as_suggestion|ai_muted/.test(result.error ?? '');
+const WITHHELD_CODES = new Map([
+    ['ai_muted', 'muted'],
+    ['approval_required', 'approval'],
+    ['send_blocked', 'blocked'],
+    ['held_as_suggestion', 'suggestion'],
+]);
+export function withheldBy(result) {
+    if (result.status !== 409)
+        return undefined;
+    const text = result.error ?? '';
+    // The server's own code, matched exactly — never a word found elsewhere in the body (a 409
+    // like `reply_race_held` quotes another reply's text, which may name any of these):
+    // `{detail: {error, reason, approval_request_id, …}}`, the same fields at the top, or
+    // `{detail: "<code>"}`. A body cut short (`api.ts` keeps 500 chars) is read for its first
+    // `"error": "…"` field only.
+    let fields = {};
+    let code;
+    try {
+        const parsed = JSON.parse(text);
+        const top = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        const detail = top.detail;
+        if (typeof detail === 'string')
+            code = detail;
+        else {
+            fields = detail && typeof detail === 'object' && !Array.isArray(detail) ? detail : top;
+            code = typeof fields.error === 'string' ? fields.error : undefined;
+        }
+    }
+    catch {
+        code = /"error"\s*:\s*"([a-z_]+)"/.exec(text)?.[1];
+    }
+    const kind = code === undefined ? undefined : WITHHELD_CODES.get(code);
+    if (!kind)
+        return undefined;
+    const str = (value) => (typeof value === 'string' && value ? value.slice(0, 120) : undefined);
+    const reason = str(fields.reason);
+    const approvalRequestId = str(fields.approval_request_id);
+    return { kind, ...(reason ? { reason } : {}), ...(approvalRequestId ? { approvalRequestId } : {}) };
+}
+/** A withheld reply the guest will never get from this run: its session must not continue. */
+function undeliveredFor(withheld) {
+    return withheld === 'muted' || withheld === 'blocked';
 }
 /**
  * A sign-in checker that adds `extra` only when it runs `binary` (this
@@ -292,6 +347,15 @@ function extraEnvOf(options) {
     return typeof options.extraEnv === 'function' ? options.extraEnv() : (options.extraEnv ?? {});
 }
 /** A line that is the confidence trailer, however the model dressed it (backticks, bold, commas, quotes). */
+/** The reply classes the server's send rule knows (PR B); any other is sent as none. */
+export const REPLY_CLASSES = new Set([
+    'general',
+    'status_update',
+    'pricing_action',
+    'billing_action',
+    'legal_contractual',
+    'bug_in_our_code',
+]);
 /** A trailer token anywhere, with any decoration hugging it. */
 const TRAILER_TOKEN = /[`*_]*\[\[\s*confidence\b[^\]]*\]\][`*_]*\.?/gi;
 /** The confidence a trailer states: a plain decimal from 0 to 1, read whole — anything else is no confidence. */
@@ -328,7 +392,9 @@ export function splitConfidence(reply) {
         .join('\n')
         .replace(/\s+$/, '');
     const confidence = trailerConfidence(last);
-    const replyClass = /reply_class\s*[=:]\s*["']?([A-Za-z_]{1,40})/i.exec(last)?.[1]?.toLowerCase();
+    const named = /reply_class\s*[=:]\s*["']?([A-Za-z_]{1,40})/i.exec(last)?.[1]?.toLowerCase();
+    // Only the server's own classes; anything else is no class, so the server holds the reply.
+    const replyClass = named && REPLY_CLASSES.has(named) ? named : undefined;
     if (confidence === undefined)
         return { text };
     return { text, confidence, ...(replyClass ? { replyClass } : {}) };
@@ -1182,8 +1248,11 @@ limited) {
     let earlyCount = 0;
     let earlyPosted = 0;
     let earlyPosts = Promise.resolve();
-    /** An answer of this run was dropped because the thread is muted: its session must not continue. */
-    let muted = false;
+    /**
+     * An answer of this run will never reach the guest (the thread is muted, or the outbound guard
+     * blocked it — `undeliveredFor`): its session must not continue.
+     */
+    let undelivered = false;
     const earlyPath = run.reply_path;
     const earlyBodyKey = run.reply_body_key;
     const stoppedNow = () => control.signal.aborted || control.disposition() !== undefined;
@@ -1211,8 +1280,8 @@ limited) {
             }
             early.shift();
             earlyPosted += 1;
-            if (posted.withheld === 'muted')
-                muted = true;
+            if (undeliveredFor(posted.withheld))
+                undelivered = true;
             log(`${timestamp()} ✓ ${label} posted an answer; a background task is still running`);
         }
     };
@@ -1239,15 +1308,19 @@ limited) {
     const sessionId = venue ? undefined : result.ok ? result.sessionId : undefined;
     /**
      * Continue the conversation's session from this turn — unless an answer of
-     * it was dropped because the thread is muted (any runtime): then the session
+     * it will never reach the guest (muted thread, blocked send; any runtime): then the session
      * holds a turn nobody saw, so it is forgotten, eager record or resumed one alike.
      */
     const settleSession = (id) => {
-        if (muted)
+        if (undelivered)
             runtime.sessions.forget(sessionKeyFor(run));
         else if (id)
             runtime.sessions.remember(sessionKeyFor(run), id);
     };
+    // An early answer the guest will never get (muted, blocked): forgotten on every exit, the
+    // stopped, failed and usage-limited ones below included — none may continue a turn nobody saw.
+    if (undelivered)
+        runtime.sessions.forget(sessionKeyFor(run));
     // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
     // the run is closed — a completion that beats its own last tool row would
     // leave a `calling` row on a finished run. Never rejects, and after `stop`
@@ -1412,10 +1485,11 @@ limited) {
     }
     // Advance continuity only after the answer is durable on its reply surface.
     // Remembering at process exit would strand the conversation behind an answer
-    // it never received whenever this POST is rejected. A muted thread kept
-    // nothing of it, so its session is not advanced either (and an eager record undone).
-    if (posted.withheld === 'muted')
-        muted = true;
+    // it never received whenever this POST is rejected. A muted thread or a blocked send delivers
+    // nothing of it, so its session is not advanced either (and an eager record undone); a
+    // suggestion or a reply waiting for approval may still be sent as written, so it continues.
+    if (undeliveredFor(posted.withheld))
+        undelivered = true;
     settleSession(sessionId);
     const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
     if (!completed.ok) {

package/dist/codehost/checkouts.js

@@ -72,7 +72,7 @@ const OFFERED_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)?
 /** What a person reads when a thread names a repository this Mac has no checkout of. */
 export function notOfferedReason(repo, offered) {
     if (offered.length === 0) {
-        return `This Mac isn't set up with any repositories for Code threads yet, so it can't work on ${repo}.`;
+        return `This Mac isn't set up with any repositories for terminals yet, so it can't work on ${repo}.`;
     }
     return `This Mac isn't set up for ${repo}. Pick one of its repositories: ${offered.join(', ')}.`;
 }

package/dist/codehost/settings.d.ts

@@ -24,6 +24,14 @@ export interface CodeHostSettings {
     allowRemoteTerminal: boolean;
 }
 export declare const DEFAULT_SETTINGS: CodeHostSettings;
+/**
+ * A dedicated `prohost host` service decides terminal sessions in its own definition
+ * (`host install --dedicated --remote-terminal | --no-remote-terminal`): `1` hosts with remote
+ * control on, `0` hosts nothing. The service writes it into its home's `settings.json` as it
+ * starts, so every reader — the daemon, the relay and the permission hook of a Claude window
+ * that outlived a reinstall — reads the one file.
+ */
+export declare const TERMINAL_SESSIONS_ENV = "PROHOST_HOST_TERMINAL_SESSIONS";
 /** `$PROHOST_HOME/code-host`. */
 export declare function codeHostDir(env?: NodeJS.ProcessEnv): string;
 export declare function settingsPath(env?: NodeJS.ProcessEnv): string;
@@ -50,3 +58,15 @@ export declare function readJsonObject(file: string): Record<string, unknown> |
  */
 export declare function loadSettings(env?: NodeJS.ProcessEnv): CodeHostSettings;
 export declare function saveSettings(settings: CodeHostSettings, env?: NodeJS.ProcessEnv): void;
+/**
+ * A dedicated service's terminal switch (`TERMINAL_SESSIONS_ENV`), recorded in the home's
+ * `settings.json` as it starts — for the readers outside the service's process: the permission
+ * hook of each window, which may have outlived a reinstall. True only when it is on AND recorded.
+ * Fails closed: a switch it can't record hosts nothing, and the old file is removed when it can be
+ * (a missing or unreadable file is off to every reader). When even that fails — `code-host/`
+ * itself unwritable — the error says so: windows still open keep reading the old switches.
+ */
+export declare function recordServiceSwitch(on: boolean, env: NodeJS.ProcessEnv, save?: (settings: CodeHostSettings, env: NodeJS.ProcessEnv) => void): {
+    hosting: boolean;
+    error?: string;
+};

package/dist/codehost/settings.js

@@ -27,6 +27,14 @@ export const DEFAULT_SETTINGS = Object.freeze({
     enabled: false,
     allowRemoteTerminal: false,
 });
+/**
+ * A dedicated `prohost host` service decides terminal sessions in its own definition
+ * (`host install --dedicated --remote-terminal | --no-remote-terminal`): `1` hosts with remote
+ * control on, `0` hosts nothing. The service writes it into its home's `settings.json` as it
+ * starts, so every reader — the daemon, the relay and the permission hook of a Claude window
+ * that outlived a reinstall — reads the one file.
+ */
+export const TERMINAL_SESSIONS_ENV = 'PROHOST_HOST_TERMINAL_SESSIONS';
 /** `$PROHOST_HOME/code-host`. */
 export function codeHostDir(env = process.env) {
     return path.join(prohostHome(env), 'code-host');
@@ -112,3 +120,30 @@ export function saveSettings(settings, env = process.env) {
         allowRemoteTerminal: settings.enabled && settings.allowRemoteTerminal,
     });
 }
+/**
+ * A dedicated service's terminal switch (`TERMINAL_SESSIONS_ENV`), recorded in the home's
+ * `settings.json` as it starts — for the readers outside the service's process: the permission
+ * hook of each window, which may have outlived a reinstall. True only when it is on AND recorded.
+ * Fails closed: a switch it can't record hosts nothing, and the old file is removed when it can be
+ * (a missing or unreadable file is off to every reader). When even that fails — `code-host/`
+ * itself unwritable — the error says so: windows still open keep reading the old switches.
+ */
+export function recordServiceSwitch(on, env, save = saveSettings) {
+    try {
+        save({ version: 1, enabled: on, allowRemoteTerminal: on }, env);
+        return { hosting: on && loadSettings(env).allowRemoteTerminal };
+    }
+    catch (e) {
+        const error = e instanceof Error ? e.message : String(e);
+        try {
+            rmSync(settingsPath(env), { force: true });
+        }
+        catch {
+            return {
+                hosting: false,
+                error: `${error}; the old switches could not be removed either, so windows still open may wait for remote approvals until ${settingsPath(env)} is writable`,
+            };
+        }
+        return { hosting: false, error };
+    }
+}

package/dist/host/command.d.ts

@@ -55,5 +55,13 @@ export declare function statusJson(env: NodeJS.ProcessEnv, now?: number, options
     label?: string;
     platform?: NodeJS.Platform;
 }): Record<string, unknown>;
+/**
+ * How to start a sign-in. On Windows npm installs `claude` / `codex` as `.cmd`
+ * shims, which only `cmd.exe` can run: the whole line goes through
+ * `cmd.exe /d /s /c "…"`, each part quoted (they are fixed words here).
+ */
+export declare function signInSpawn(command: string, args: string[], platform?: NodeJS.Platform): [string, string[], {
+    windowsVerbatimArguments?: boolean;
+}];
 export declare function runHost(subcommand: string | undefined, flags: Flags, printHelp: () => void, io?: HostIo): Promise<number>;
 export {};

package/dist/host/command.js

@@ -97,26 +97,29 @@ export function hardwareFacts() {
  */
 export function statusJson(env, now = Date.now(), options = {}) {
     const computer = tryLoadComputer(env);
-    const own = readObject(statePath(env));
-    const ownFresh = own !== undefined && now - Date.parse(own.updatedAt) < STATE_STALE_MS;
-    // `--label` asks for that service, even when this home runs one of its own.
-    const shared = ownFresh && !options.label
-        ? undefined
-        : dedicatedState(options.sharedBase ?? sharedBase(options.platform ?? process.platform), now, options.label);
-    const state = shared ? shared.state : own;
-    const fresh = ownFresh || shared !== undefined;
+    // A dedicated service is reported only when asked for by its `--label`, and then only from what
+    // it publishes: unlabelled, status is about this home's own service, whatever else runs on the
+    // computer; labelled, nothing of this home's (its pause, its pairing, its lock) is mixed in.
+    const labelDir = options.label
+        ? path.join(options.sharedBase ?? sharedBase(options.platform ?? process.platform), options.label)
+        : undefined;
+    const shared = options.label
+        ? dedicatedState(options.sharedBase ?? sharedBase(options.platform ?? process.platform), now, options.label)
+        : undefined;
+    const own = labelDir ? undefined : readObject(statePath(env));
+    const state = labelDir ? shared?.state : own;
+    const fresh = labelDir ? shared !== undefined : own !== undefined && now - Date.parse(own.updatedAt) < STATE_STALE_MS;
     const sharedComputer = shared?.state.computer;
-    const paused = readObject(controlPath(env))?.paused === true ||
-        (shared !== undefined && readObject(path.join(shared.dir, 'control.json'))?.paused === true) ||
+    const paused = readObject(labelDir ? path.join(labelDir, 'control.json') : controlPath(env))?.paused === true ||
         (fresh && state?.paused === true);
     const recommended = state?.recommended_capacity ?? recommendCapacity({ memoryGb: os.totalmem() / 1024 ** 3, cores: os.cpus().length });
     const capacity = state?.capacity ?? recommended;
-    const lock = readObject(hostLockPath(env));
-    const events = shared ? readEvents(path.join(shared.dir, 'events.json'), now) : readEvents(journalPath(env), now);
+    const lock = labelDir ? undefined : readObject(hostLockPath(env));
+    const events = readEvents(labelDir ? path.join(labelDir, 'events.json') : journalPath(env), now);
     return {
         // Reporting the dedicated service: its own computer, never this home's (they can differ).
-        paired: shared ? sharedComputer !== undefined : computer !== null,
-        computer: shared
+        paired: labelDir ? sharedComputer !== undefined : computer !== null,
+        computer: labelDir
             ? (sharedComputer ?? null)
             : computer
                 ? { id: computer.computer_id, name: (fresh && state?.name) || computer.name, account: computer.account }
@@ -131,12 +134,13 @@ export function statusJson(env, now = Date.now(), options = {}) {
         hardware: hardwareFacts(),
         events,
         service: {
-            running: shared !== undefined || alive(lock?.pid),
-            pid: shared ? (shared.state.pid ?? null) : alive(lock?.pid) ? lock?.pid : null,
-            adopted: loadAdopted(env)?.homes.length ?? 0,
-            dedicated: shared !== undefined,
-            ...(shared ? { activity_file: path.join(shared.dir, 'activity.json') } : {}),
+            running: labelDir ? shared !== undefined : alive(lock?.pid),
+            pid: labelDir ? (shared?.state.pid ?? null) : alive(lock?.pid) ? lock?.pid : null,
+            adopted: labelDir ? 0 : (loadAdopted(env)?.homes.length ?? 0),
+            dedicated: labelDir !== undefined,
+            ...(labelDir ? { activity_file: path.join(labelDir, 'activity.json') } : {}),
         },
+        remote_terminal: Boolean(fresh && state?.remote_terminal),
         version: CLI_VERSION,
     };
 }
@@ -222,9 +226,21 @@ function homeOfUser(platform, user) {
     }
     return path.join('/home', user, '.prohost');
 }
+/**
+ * How to start a sign-in. On Windows npm installs `claude` / `codex` as `.cmd`
+ * shims, which only `cmd.exe` can run: the whole line goes through
+ * `cmd.exe /d /s /c "…"`, each part quoted (they are fixed words here).
+ */
+export function signInSpawn(command, args, platform = process.platform) {
+    if (platform !== 'win32')
+        return [command, args, {}];
+    const quote = (part) => (/^[A-Za-z0-9._:\\/-]+$/.test(part) ? part : `"${part.replace(/"/g, '""')}"`);
+    return ['cmd.exe', ['/d', '/s', '/c', `"${[command, ...args].map(quote).join(' ')}"`], { windowsVerbatimArguments: true }];
+}
 /** `claude auth login` / `codex login`, in this terminal, as the new login. */
 const defaultSignIn = (command, args, env) => new Promise((resolve) => {
-    const child = spawn(command, args, { stdio: 'inherit', env: { ...process.env, ...env } });
+    const [file, argv, extra] = signInSpawn(command, args);
+    const child = spawn(file, argv, { stdio: 'inherit', env: { ...process.env, ...env }, ...extra });
     child.on('error', () => resolve(null));
     child.on('exit', (code) => resolve(code));
 });
@@ -411,8 +427,14 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 pathEnv: env.PATH ?? '',
                 userHome,
                 label: str(flags, 'label') ?? defaultLabel(home, path.join(userHome, '.prohost')),
+                // Terminal sessions on a dedicated service: off unless --remote-terminal.
+                ...(dedicated ? { terminalSessions: flags['remote-terminal'] === true && flags['no-remote-terminal'] !== true } : {}),
                 electron: io.electron ?? (Boolean(process.versions.electron) || env.ELECTRON_RUN_AS_NODE === '1'),
             };
+            if (flags['remote-terminal'] === true && flags['no-remote-terminal'] === true) {
+                err('Pass --remote-terminal or --no-remote-terminal, not both.');
+                return 1;
+            }
             const tokenFile = str(flags, 'claude-token-file');
             if (flags['claude-token-file'] === true) {
                 err('--claude-token-file needs a path.');
@@ -516,20 +538,28 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
         case 'resume': {
             const paused = subcommand === 'pause';
             const control = { v: 1, paused, updated_at: new Date().toISOString() };
-            writePrivateFile(controlPath(env), control);
-            // A dedicated service on this computer reads its own shared switch (writable by everyone on it).
+            // A dedicated service reads its own shared switch (writable by everyone on the computer):
+            // flipped only when it is named (`--label`), and then it alone. Unlabelled, this home alone
+            // is paused — a personal sign-out never pauses a dedicated service on the same computer.
             const label = str(flags, 'label');
-            for (const dir of sharedDirs(io.sharedBase ?? sharedBase(platform), label)) {
+            if (label) {
+                const dir = path.join(io.sharedBase ?? sharedBase(platform), label);
                 try {
                     writeFileSync(path.join(dir, 'control.json'), `${JSON.stringify(control)}\n`);
                 }
                 catch (e) {
-                    err(`  ! could not ${subcommand} the service in ${dir}: ${e instanceof Error ? e.message : String(e)}`);
+                    err(`Could not ${subcommand} the service in ${dir}: ${e instanceof Error ? e.message : String(e)}`);
+                    return 1;
                 }
             }
+            else {
+                writePrivateFile(controlPath(env), control);
+            }
+            const which = label ? `the service ${label}` : 'this computer';
+            const again = label ? `prohost host resume --label ${label}` : 'prohost host resume';
             out(paused
-                ? '⏸ Paused: this computer takes no new work. Work already going finishes. Resume with: prohost host resume'
-                : '▶ Resumed: this computer takes new work again.');
+                ? `⏸ Paused: ${which} takes no new work. Work already going finishes. Resume with: ${again}`
+                : `▶ Resumed: ${which} takes new work again.`);
             return 0;
         }
         case 'migrate': {

package/dist/host/install.d.ts

@@ -31,6 +31,7 @@ export declare const STOP_TIMEOUT_SECONDS = 600;
 export declare const RESTART_WAIT_MS: number;
 /** Set in a dedicated service's environment: where it publishes its state for the logged-in user. */
 export declare const SHARED_DIR_ENV = "PROHOST_HOST_SHARED_DIR";
+/** Set in a dedicated service's environment: terminal sessions on (`1`) or off (`0`), from install. */
 /** The `claude setup-token` token a dedicated install hands the service user (read by `host run`). */
 export declare const CLAUDE_TOKEN_FILE = "claude-oauth-token";
 export type ServiceRunner = (command: string, args: string[], input?: string) => {
@@ -65,6 +66,11 @@ export interface ServiceSpec {
      * service keeps `ELECTRON_RUN_AS_NODE=1`, or launching it would open the app.
      */
     electron?: boolean;
+    /**
+     * Dedicated only: terminal sessions (remote terminals) on this service —
+     * `--remote-terminal`. Off unless asked for.
+     */
+    terminalSessions?: boolean;
 }
 /** The label for a home: the plain one for the default home, else one with a short digest of the home. */
 export declare function defaultLabel(home: string, defaultHome: string): string;

package/dist/host/install.js

@@ -24,6 +24,7 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writ
 import os from 'node:os';
 import path from 'node:path';
 import { buildLaunchdPlist, waitUntilUnloaded } from '../agent/daemon.js';
+import { TERMINAL_SESSIONS_ENV } from '../codehost/settings.js';
 export const LAUNCHD_HOST_LABEL = 'ai.prohost.host';
 export const SYSTEMD_HOST_UNIT = 'prohost-host.service';
 export const WINDOWS_TASK_NAME = '\\ProhostAI\\Host';
@@ -37,6 +38,7 @@ export const STOP_TIMEOUT_SECONDS = 600;
 export const RESTART_WAIT_MS = (STOP_TIMEOUT_SECONDS + 30) * 1000;
 /** Set in a dedicated service's environment: where it publishes its state for the logged-in user. */
 export const SHARED_DIR_ENV = 'PROHOST_HOST_SHARED_DIR';
+/** Set in a dedicated service's environment: terminal sessions on (`1`) or off (`0`), from install. */
 /** The `claude setup-token` token a dedicated install hands the service user (read by `host run`). */
 export const CLAUDE_TOKEN_FILE = 'claude-oauth-token';
 export const defaultServiceRunner = (command, args, input) => {
@@ -101,7 +103,9 @@ export function serviceEnv(spec) {
     return {
         PATH: spec.pathEnv,
         PROHOST_HOME: spec.home,
-        ...(spec.dedicated ? { PROHOST_HOST_DEDICATED: '1', [SHARED_DIR_ENV]: sharedDirFor(spec) } : {}),
+        ...(spec.dedicated
+            ? { PROHOST_HOST_DEDICATED: '1', [SHARED_DIR_ENV]: sharedDirFor(spec), [TERMINAL_SESSIONS_ENV]: spec.terminalSessions ? '1' : '0' }
+            : {}),
         ...(spec.dedicated && spec.platform === 'darwin' && spec.serviceUser
             ? { HOME: path.posix.join('/Users', spec.serviceUser) }
             : {}),

package/dist/host/service.d.ts

@@ -30,6 +30,7 @@ import { executeHostedRun } from '../agent/run.js';
 import type { AgentRunOptions } from '../agent/run.js';
 import type { CodeHostLike } from '../codehost/host.js';
 import type { HostStats } from '../codehost/host_stats.js';
+import { recordServiceSwitch } from '../codehost/settings.js';
 import type { Workload } from './capacity.js';
 import type { ComputerCredentials } from './computer.js';
 import type { LoginInfo } from './logins.js';
@@ -92,6 +93,8 @@ export interface HostServiceOptions {
     peak?: PeakMemory;
     detectLogins?: () => Promise<LoginInfo[]>;
     codeHost?: CodeHostLike | null;
+    /** Records a dedicated service's terminal switch in the home (tests: one that fails). */
+    recordTerminalSwitch?: typeof recordServiceSwitch;
     executeRun?: typeof executeHostedRun;
     updateAvailable?: () => boolean;
     statusIntervalMs?: number;

package/dist/host/service.js

@@ -40,7 +40,7 @@ import { SessionStore, sessionKeyFor } from '../agent/sessionstore.js';
 import { verifySignature } from '../agent/signature.js';
 import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, REMOTE_TERMINAL_CAPABILITY, RefusedDeliveryError, } from '../codehost/host.js';
 import { HostStatsSampler } from '../codehost/host_stats.js';
-import { loadSettings as loadCodeHostSettings } from '../codehost/settings.js';
+import { TERMINAL_SESSIONS_ENV, loadSettings as loadCodeHostSettings, recordServiceSwitch } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
 import { ServerLiveness, enableTcpKeepAlive, terminateSocket } from '../liveness.js';
 import { CLI_VERSION, USER_AGENT } from '../version.js';
@@ -185,11 +185,21 @@ async function serveHost(options) {
     const codeHostEnv = computer.code_host_home
         ? { ...process.env, ...env, PROHOST_HOME: computer.code_host_home }
         : { ...process.env, ...env };
-    const codeHost = options.codeHost !== undefined
-        ? (options.codeHost ?? undefined)
-        : loadCodeHostSettings(codeHostEnv).enabled
-            ? buildCodeHost()
-            : undefined;
+    // A dedicated install decides terminal sessions in the service's own definition
+    // (`--remote-terminal` / `--no-remote-terminal`): written into the home's switches as it starts,
+    // the one file the daemon, the relay and every window's permission hook read (a window that
+    // outlived a reinstall too). A personal service follows the home's switches as the owner set them.
+    // The definition is authoritative in this process: off never hosts, whatever the file says or
+    // whether it could be written; on hosts only once recorded (`recordServiceSwitch` fails closed).
+    const decided = env[TERMINAL_SESSIONS_ENV] === '1' ? true : env[TERMINAL_SESSIONS_ENV] === '0' ? false : undefined;
+    let hosting = decided ?? loadCodeHostSettings(codeHostEnv).enabled;
+    if (decided !== undefined) {
+        const recorded = (options.recordTerminalSwitch ?? recordServiceSwitch)(decided, codeHostEnv);
+        hosting = decided && recorded.hosting;
+        if (recorded.error)
+            log(`terminal sessions: off — could not record the service's switch (${recorded.error})`);
+    }
+    const codeHost = options.codeHost !== undefined ? (options.codeHost ?? undefined) : hosting ? buildCodeHost() : undefined;
     function buildCodeHost() {
         try {
             return new CodeHost({
@@ -367,6 +377,7 @@ async function serveHost(options) {
             online,
             paused: localPaused || config.paused,
             draining,
+            remote_terminal: capabilities().includes(REMOTE_TERMINAL_CAPABILITY),
             slots: slotsFor(capacity(), active.size + terminals(), held),
             capacity: capacity(),
             recommended_capacity: config.recommended_capacity ?? recommended(),

package/dist/host/status.d.ts

@@ -80,6 +80,8 @@ export interface HostState {
     online: boolean;
     paused: boolean;
     draining: boolean;
+    /** Remote terminal sessions are on (the `remote_terminal` capability). */
+    remote_terminal?: boolean;
     slots: Slots;
     capacity: number;
     recommended_capacity: number;

package/dist/index.js

@@ -35,7 +35,7 @@ function printHelp() {
         '  prohost host unpair                  Remove this computer from its workspace (revokes its key)',
         '  prohost host run                     One service for every AI employee placed on this computer',
         '  prohost host install [--label <id>] [--dedicated --service-user <name> [--service-home <dir>]',
-        '                       [--claude-token-file <path>]] | uninstall [--label <id>]',
+        '                       [--claude-token-file <path>] [--remote-terminal|--no-remote-terminal]] | uninstall [--label <id>]',
         '  prohost host status [--json] [--label <id>] | pause | resume',
         '  prohost host logins [--json] | logins add --runtime claude_code|codex [--label <l>]',
         '  prohost host migrate [--from <home>]… [--home <dir,…>] [--keep-services] [--dry-run] [--json]',
@@ -72,6 +72,8 @@ function printHelp() {
         '                   publishes its status for `host status` run by anyone on the computer.',
         '  --claude-token-file  `host install --dedicated`: a file holding a `claude setup-token` token, installed',
         '                   for the service user as CLAUDE_CODE_OAUTH_TOKEN. Read once, never printed.',
+        '  --remote-terminal / --no-remote-terminal  `host install --dedicated`: terminal sessions on this',
+        '                   service (off unless --remote-terminal); `host status --json` shows remote_terminal.',
         '  --from-home      `host install --dedicated`: the home whose computer.json the service takes over',
         "                   (default: $PROHOST_HOME, or $SUDO_USER's ~/.prohost under sudo).",
         '  --label          `host install` / `uninstall`: the service\'s label (launchd label, systemd unit,',

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.1";
+export declare const CLI_VERSION = "0.16.3";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.1";
+export declare const USER_AGENT = "prohost-cli/0.16.3";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.1';
+export const CLI_VERSION = '0.16.3';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",