@prohost/cli 0.16.10 → 0.16.12

package/CHANGELOG.md

@@ -6,6 +6,23 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.12
+
+- **A computer says what its terminal sessions may start in.** `prohost host run` hosted terminal
+  sessions with no repository checkouts and reported none of its opened folders, so a phone or the
+  web offered no folder to pick and every repository start failed on the Mac. Its status post now
+  carries `code_host` (its checkouts, the folders this Mac has opened, and its home) while it hosts
+  terminal sessions, and its terminal host takes the `--repos` its adopted homes ran with.
+
+## 0.16.11
+
+- **An end that can't check what is left of a terminal is retried, never said done.** When a retry
+  of `code_thread.end_requested` (after a kill whose tmux answer was lost) couldn't ask `ps` which
+  saved panes still belong to the terminal, it reported the end done with nothing reaped, so a
+  process group that outlived its window could keep running. Now what was just closed is reaped,
+  the saved panes stay in the unfinished `.ended` mark, and the end is asked for again until `ps`
+  answers.
+
 ## 0.16.10
 
 - **A Code thread's terminal can be ended from ProhostAI.** `code_thread.end_requested` closes the

package/dist/codehost/filelock.d.ts

@@ -9,10 +9,10 @@
 /** Whether the lock at `file` was left by a holder that died. */
 type StaleJudge = (file: string, nowMs: number) => boolean;
 /**
- * When process `pid` started, in whole seconds, or `undefined` if that can't be told. From its
- * elapsed time (`ps -o etime`), never a printed date: no time zone to get wrong.
+ * When process `pid` started, in whole seconds, or `undefined` if that can't be told (within
+ * `timeoutMs`). From its elapsed time (`ps -o etime`), never a printed date: no time zone to get wrong.
  */
-export declare function processStartSec(pid: number, nowMs?: number): number | undefined;
+export declare function processStartSec(pid: number, nowMs?: number, timeoutMs?: number): number | undefined;
 /**
  * Remove a stale lock without ever removing a live one: it is moved aside atomically first, then
  * judged again. A file that is no longer stale is another process's fresh lock (it took over the

package/dist/codehost/filelock.js

@@ -15,16 +15,17 @@ const olderThan = (staleMs) => (file, nowMs) => nowMs - statSync(file).mtimeMs >
 let ownStart;
 /**
  * When this process started, in whole seconds, as `ps` tells it (the same source a waiter checks it
- * against, so a clock correction since can't set them apart); asked once per process. `0` (none)
- * when `ps` can't tell: such a lock is then judged by its holder's pid alone.
+ * against, so a clock correction since can't set them apart); kept once known. `0` (none) when `ps`
+ * can't tell within `timeoutMs` (asked again next time): such a lock is then judged by its holder's
+ * pid and the lock's age ({@link holderGone}).
  */
-function ownStartSec() {
-    ownStart ??= processStartSec(process.pid) ?? 0;
-    return ownStart;
+function ownStartSec(timeoutMs) {
+    ownStart ??= processStartSec(process.pid, Date.now(), timeoutMs);
+    return ownStart ?? 0;
 }
 /** `<pid>.<start seconds>.<random>`: who holds the lock, and (with `withStart`) which incarnation of that pid. */
-function newToken(withStart) {
-    return `${process.pid}.${withStart ? ownStartSec() : 0}.${Math.random().toString(16).slice(2)}`;
+function newToken(withStart, timeoutMs) {
+    return `${process.pid}.${withStart ? ownStartSec(timeoutMs) : 0}.${Math.random().toString(16).slice(2)}`;
 }
 /** The holder named in the lock at `file`, or `undefined` if its token can't be read. */
 function holderOf(file) {
@@ -66,14 +67,14 @@ function elapsedSec(text) {
     return ((Number(days ?? 0) * 24 + Number(hours ?? 0)) * 60 + Number(minutes)) * 60 + Number(seconds);
 }
 /**
- * When process `pid` started, in whole seconds, or `undefined` if that can't be told. From its
- * elapsed time (`ps -o etime`), never a printed date: no time zone to get wrong.
+ * When process `pid` started, in whole seconds, or `undefined` if that can't be told (within
+ * `timeoutMs`). From its elapsed time (`ps -o etime`), never a printed date: no time zone to get wrong.
  */
-export function processStartSec(pid, nowMs = Date.now()) {
+export function processStartSec(pid, nowMs = Date.now(), timeoutMs = 1_000) {
     try {
         const out = execFileSync('ps', ['-o', 'etime=', '-p', String(pid)], {
             encoding: 'utf8',
-            timeout: 1_000,
+            timeout: timeoutMs,
             stdio: ['ignore', 'pipe', 'ignore'],
         });
         const elapsed = elapsedSec(out);
@@ -88,8 +89,9 @@ const bootedAtMs = () => Date.now() - os.uptime() * 1000;
 /**
  * Stale only once its holder is gone. A holder that still runs (suspended, say, while the Mac slept)
  * keeps its lock. Gone: a lock from before the last boot; a holder pid that runs no process; or, for
- * a lock past `staleMs`, a pid that now belongs to another process (it started at another time). A
- * lock whose token can't be read is judged by age.
+ * a lock past `staleMs`, a pid that now belongs to another process: it started at another time than
+ * the token says, or, for a token that doesn't say (an older build's, or `ps` couldn't tell its
+ * writer), after the lock was made. A lock whose token can't be read is judged by age.
  */
 const holderGone = (staleMs, startOf) => (file, nowMs) => {
     const { mtimeMs } = statSync(file);
@@ -100,11 +102,14 @@ const holderGone = (staleMs, startOf) => (file, nowMs) => {
         return nowMs - mtimeMs > staleMs;
     if (!running(holder.pid))
         return true;
-    if (nowMs - mtimeMs <= staleMs || holder.startSec === undefined)
+    if (nowMs - mtimeMs <= staleMs)
         return false;
-    // Old, and its pid runs: the same process only if it started when the holder did.
+    // Old, and its pid runs: the same process only if it started when the holder did. A process that
+    // started after the lock was made can't have made it.
     const started = startOf(holder.pid);
-    return started !== undefined && Math.abs(started - holder.startSec) > 2;
+    if (started === undefined)
+        return false;
+    return holder.startSec !== undefined ? Math.abs(started - holder.startSec) > 2 : started > mtimeMs / 1000 + 2;
 };
 /**
  * Remove a stale lock without ever removing a live one: it is moved aside atomically first, then
@@ -179,11 +184,19 @@ export function withFileLock(lock, work, options) {
     ensurePrivateDir(path.dirname(lock));
     const now = options.now ?? Date.now;
     const deadline = now() + options.waitMs;
-    const stale = options.liveHolders
-        ? holderGone(options.staleMs, options.processStart ?? processStartSec)
-        : olderThan(options.staleMs);
+    // A holder's start is asked once per attempt (`ps` is synchronous: a waiter polling an old lock must
+    // not run it on every look), and never for longer than the attempt may still wait.
+    const probeTimeoutMs = () => Math.min(1_000, Math.max(50, deadline - now()));
+    const probed = new Map();
+    const startOf = (pid) => {
+        if (!probed.has(pid)) {
+            probed.set(pid, options.processStart ? options.processStart(pid) : processStartSec(pid, Date.now(), probeTimeoutMs()));
+        }
+        return probed.get(pid);
+    };
+    const stale = options.liveHolders ? holderGone(options.staleMs, startOf) : olderThan(options.staleMs);
     // Released only while the file is still this one: never a lock another process holds now.
-    const token = newToken(options.liveHolders === true);
+    const token = newToken(options.liveHolders === true, probeTimeoutMs());
     // The token is written first, privately; the lock appears only as a link to it, whole.
     const draft = `${lock}.${token}.tmp`;
     writeFileSync(draft, token, { mode: 0o600, flag: 'wx' });

package/dist/codehost/folders.d.ts

@@ -56,7 +56,10 @@ export declare function realDirectory(absolute: string): string | undefined;
 export declare function isWithin(child: string, parent: string): boolean;
 /** The list on disk, newest first; a missing, unreadable or malformed file is empty. */
 export declare function loadFolders(env?: NodeJS.ProcessEnv): OpenedFolder[];
-/** A lock older than this was left by a process that died holding it (a change takes milliseconds). */
+/**
+ * A lock whose holder can't be told (its token can't be read) is stale once older than this; past it,
+ * one whose pid now runs another process is too (a change takes milliseconds).
+ */
 export declare const FOLDERS_LOCK_STALE_MS = 10000;
 /** How long a change waits for another process's change to the list before giving up. */
 export declare const FOLDERS_LOCK_WAIT_MS = 3000;
@@ -65,20 +68,24 @@ export declare const TOUCH_LOCK_WAIT_MS = 100;
 export declare class FoldersBusyError extends Error {
     constructor();
 }
-/** {@link takeOverStale} for the folders lock (its stale age). */
-export declare function takeOverStale(lock: string, nowMs?: number): void;
 /**
  * Run `work` (a read-modify-write of `folders.json`) holding the list's lock: `folders.json.lock`,
  * created exclusively ({@link withFileLock}). The desktop app's `folders add`, a second `folders add`
  * and the daemon moving a started folder to the front are separate processes; without it, two that
- * read the same list each write it back without the other's folder. A lock left by a process that
- * died is taken over once it is {@link FOLDERS_LOCK_STALE_MS} old.
+ * read the same list each write it back without the other's folder.
+ *
+ * Judged by its holder, the way the launch lock is (`liveHolders`): a lock whose holder still runs is
+ * never taken over, however old (a holder suspended while the Mac slept would wake up and write the
+ * list over its successor's), and one whose holder is gone is taken over at once: a dead pid, a lock
+ * from before the last boot, or a pid that now runs another process (its start time, carried in the
+ * token, tells them apart).
  *
  * @throws FoldersBusyError when another process holds it past {@link FOLDERS_LOCK_WAIT_MS}.
  */
 export declare function withFoldersLock<T>(env: NodeJS.ProcessEnv, work: () => T, options?: {
     waitMs?: number;
     now?: () => number;
+    processStart?: (pid: number) => number | undefined;
 }): T;
 /**
  * Open `input` on this Mac (`folders add`): it must be an existing directory;

package/dist/codehost/folders.js

@@ -22,7 +22,7 @@
 import { realpathSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { takeOverStale as takeOverStaleLock, withFileLock } from './filelock.js';
+import { withFileLock } from './filelock.js';
 import { codeHostDir, readJsonObject, writePrivateJson } from './settings.js';
 export const FOLDERS_VERSION = 1;
 export const MAX_OPENED_FOLDERS = 50;
@@ -99,7 +99,10 @@ export function loadFolders(env = process.env) {
 function saveFolders(folders, env) {
     writePrivateJson(foldersPath(env), { v: FOLDERS_VERSION, folders: folders.slice(0, MAX_OPENED_FOLDERS) });
 }
-/** A lock older than this was left by a process that died holding it (a change takes milliseconds). */
+/**
+ * A lock whose holder can't be told (its token can't be read) is stale once older than this; past it,
+ * one whose pid now runs another process is too (a change takes milliseconds).
+ */
 export const FOLDERS_LOCK_STALE_MS = 10_000;
 /** How long a change waits for another process's change to the list before giving up. */
 export const FOLDERS_LOCK_WAIT_MS = 3_000;
@@ -110,24 +113,27 @@ export class FoldersBusyError extends Error {
         super('The opened-folders list is busy (another prohost is changing it). Try again.');
     }
 }
-/** {@link takeOverStale} for the folders lock (its stale age). */
-export function takeOverStale(lock, nowMs = Date.now()) {
-    takeOverStaleLock(lock, FOLDERS_LOCK_STALE_MS, nowMs);
-}
 /**
  * Run `work` (a read-modify-write of `folders.json`) holding the list's lock: `folders.json.lock`,
  * created exclusively ({@link withFileLock}). The desktop app's `folders add`, a second `folders add`
  * and the daemon moving a started folder to the front are separate processes; without it, two that
- * read the same list each write it back without the other's folder. A lock left by a process that
- * died is taken over once it is {@link FOLDERS_LOCK_STALE_MS} old.
+ * read the same list each write it back without the other's folder.
+ *
+ * Judged by its holder, the way the launch lock is (`liveHolders`): a lock whose holder still runs is
+ * never taken over, however old (a holder suspended while the Mac slept would wake up and write the
+ * list over its successor's), and one whose holder is gone is taken over at once: a dead pid, a lock
+ * from before the last boot, or a pid that now runs another process (its start time, carried in the
+ * token, tells them apart).
  *
  * @throws FoldersBusyError when another process holds it past {@link FOLDERS_LOCK_WAIT_MS}.
  */
 export function withFoldersLock(env, work, options = {}) {
     const held = withFileLock(`${foldersPath(env)}.lock`, work, {
         staleMs: FOLDERS_LOCK_STALE_MS,
+        liveHolders: true,
         waitMs: options.waitMs ?? FOLDERS_LOCK_WAIT_MS,
         now: options.now,
+        processStart: options.processStart,
     });
     if (!held.ok)
         throw new FoldersBusyError();

package/dist/codehost/ready.d.ts

@@ -16,23 +16,16 @@
  * its hooks inherit), recorded in `<state>/<terminal>.launch` as pending until
  * the new process's own first hook runs; meanwhile no other hook marks the
  * window, however late it runs. A launch the daemon couldn't confirm stays
- * pending (no reply types) until its own hook runs or the window is restarted
- * again. A window with no launch record (one an older build started) is judged
- * by the mark alone, as before.
+ * pending (no reply types) until its own hook runs, or until the daemon sees the
+ * window still runs the very process it was to replace ({@link abandonLaunch}):
+ * then it never ran, and the window gets back the launch it ran before. A second
+ * restart while one is pending supersedes it ({@link beginLaunch}); undoing the
+ * second leaves the first as it is by then, never as it was before. A window with
+ * no launch record (one an older build started) is judged by the mark alone, as
+ * before.
  */
 /** The launch id a window's agent process runs under, in its environment (and so its hooks'). */
 export declare const LAUNCH_ENV = "PROHOST_LAUNCH_ID";
-/**
- * `<state>/<terminal>.launch`: the launch the window runs (`launch`; `null` for a process with no
- * launch id, such as one an older build started), and `next`, one about to replace it whose own
- * hook hasn't run yet. `gen` changes with every write, and a mark counts only for the `gen` it was
- * written under, so a mark whose writer looked before a launch began never counts after it.
- */
-interface LaunchRecord {
-    launch: string | null;
-    next?: string;
-    gen: number;
-}
 export declare function readyPath(terminalId: string, env?: NodeJS.ProcessEnv): string;
 export declare function launchPath(terminalId: string, env?: NodeJS.ProcessEnv): string;
 /**
@@ -42,11 +35,23 @@ export declare function launchPath(terminalId: string, env?: NodeJS.ProcessEnv):
 export declare function currentLaunch(terminalId: string, env?: NodeJS.ProcessEnv): string | null | undefined;
 /** The launch waiting for its first hook, if one is. */
 export declare function pendingLaunch(terminalId: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** The pane process a relaunch replaces: its pid, and when it started (ms), if that was known. */
+export interface ReplacedPane {
+    pid: number;
+    startedAtMs?: number;
+}
+/** A relaunch waiting for its first hook, with the pane process it replaces, if one is (and that pid is known). */
+export declare function pendingRelaunch(terminalId: string, env?: NodeJS.ProcessEnv): {
+    launch: string;
+    pane: ReplacedPane;
+} | undefined;
 /**
  * A hook of launch `launch` ran in the window (by default the caller's own, from its environment):
  * mark the window past its trust dialog. Atomic (`writePrivateJson`).
  *
  * - The pending launch's own hook proves it runs: it becomes the window's launch, and is marked.
+ * - A hook of a launch the pending one superseded proves that one ran: it becomes the window's
+ *   launch (what an undone restart goes back to), but the window stays unmarked while one is pending.
  * - While a launch is pending, any other hook is of a process being replaced: it has no say, however
  *   late it runs (a hook suspended while the Mac slept may resume long after).
  * - With nothing pending, a hook of another launch is of the process the window runs (an older
@@ -64,21 +69,24 @@ export declare function clearReady(terminalId: string, env?: NodeJS.ProcessEnv):
 /**
  * Launch `launch` is about to run in the window (a start or a restart): pending until its own first
  * hook runs, and no other hook marks the window meanwhile. Recorded first, then the old mark dropped.
- * Returns whether both were done; on `false` the caller must not launch.
+ * `replacing`: the pane process it replaces (a restart: its pid and start), so a relaunch that never
+ * ran can be told later ({@link abandonLaunch}). A launch still pending is superseded: it was seen running, and its
+ * own hook still makes it the window's launch. Returns whether both were done; on `false` the
+ * caller must not launch.
  */
-export declare function beginLaunch(terminalId: string, launch: string, env?: NodeJS.ProcessEnv, now?: number): boolean;
-/** What {@link restoreLaunch} puts back: the window's launch record and readiness before {@link beginLaunch}. */
-export interface LaunchState {
-    record: LaunchRecord | null | undefined;
-    ready: boolean | undefined;
-}
-export declare function launchState(terminalId: string, env?: NodeJS.ProcessEnv): LaunchState;
+export declare function beginLaunch(terminalId: string, launch: string, env?: NodeJS.ProcessEnv, now?: number, replacing?: ReplacedPane): boolean;
 /**
- * The new launch never ran (nothing was replaced): the window's old process keeps its launch and,
- * if it had it, its readiness. If that can't be written, the launch stays pending (no reply types)
- * until the window is restarted again.
+ * Launch `launch` never ran (nothing was replaced: tmux refused, or the window still runs the
+ * process it was to replace): taken back out of the record as the record is now, never as it was
+ * before it began, so whatever settled meanwhile stands. Only while it is still the pending one.
+ * - It superseded a launch still pending: that one is pending again (it was seen running).
+ * - Otherwise the window runs its launch again, marked if that one was past its screens (its own
+ *   hook ran, before or meanwhile).
+ *
+ * Returns `false` when the record couldn't be read or written: the launch then stays pending (no
+ * reply types), which fails closed.
  */
-export declare function restoreLaunch(terminalId: string, state: LaunchState, env?: NodeJS.ProcessEnv, now?: number): void;
+export declare function abandonLaunch(terminalId: string, launch: string, env?: NodeJS.ProcessEnv, now?: number): boolean;
 /**
  * The transcript files (`<session>.jsonl`) Claude Code keeps for `cwd` under `configDir`: one exists
  * for a session only once its first prompt ran. Empty when there are none or they can't be read.
@@ -90,4 +98,3 @@ export declare function claudeSessionSince(cwd: string, configDir: string, since
  * pending), `false` not yet, `undefined` when the state can't be read.
  */
 export declare function isReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean | undefined;
-export {};

package/dist/codehost/ready.js

@@ -16,9 +16,13 @@
  * its hooks inherit), recorded in `<state>/<terminal>.launch` as pending until
  * the new process's own first hook runs; meanwhile no other hook marks the
  * window, however late it runs. A launch the daemon couldn't confirm stays
- * pending (no reply types) until its own hook runs or the window is restarted
- * again. A window with no launch record (one an older build started) is judged
- * by the mark alone, as before.
+ * pending (no reply types) until its own hook runs, or until the daemon sees the
+ * window still runs the very process it was to replace ({@link abandonLaunch}):
+ * then it never ran, and the window gets back the launch it ran before. A second
+ * restart while one is pending supersedes it ({@link beginLaunch}); undoing the
+ * second leaves the first as it is by then, never as it was before. A window with
+ * no launch record (one an older build started) is judged by the mark alone, as
+ * before.
  */
 import { closeSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync } from 'node:fs';
 import path from 'node:path';
@@ -27,6 +31,8 @@ import { codeHostDir, writePrivateJson } from './settings.js';
 import { isValidId } from './tmux.js';
 /** The launch id a window's agent process runs under, in its environment (and so its hooks'). */
 export const LAUNCH_ENV = 'PROHOST_LAUNCH_ID';
+/** How many superseded launches a record keeps: an older one's hook then has no say (fails closed). */
+const MAX_SUPERSEDED = 8;
 export function readyPath(terminalId, env = process.env) {
     if (!isValidId(terminalId))
         throw new Error('invalid terminal id');
@@ -53,7 +59,22 @@ function readLaunch(terminalId, env) {
             return undefined;
         if (parsed.next !== undefined && typeof parsed.next !== 'string')
             return undefined;
-        return { launch, gen: parsed.gen, ...(parsed.next !== undefined ? { next: parsed.next } : {}) };
+        const record = { launch, gen: parsed.gen };
+        if (parsed.next !== undefined) {
+            record.next = parsed.next;
+            const superseded = Array.isArray(parsed.superseded) ? parsed.superseded.filter((id) => typeof id === 'string') : [];
+            if (superseded.length > 0)
+                record.superseded = superseded;
+            if (Number.isInteger(parsed.pane) && parsed.pane > 0) {
+                record.pane = parsed.pane;
+                if (typeof parsed.paneStartedAtMs === 'number' && Number.isFinite(parsed.paneStartedAtMs)) {
+                    record.paneStartedAtMs = parsed.paneStartedAtMs;
+                }
+            }
+        }
+        if (parsed.launchReady === true)
+            record.launchReady = true;
+        return record;
     }
     catch {
         return undefined;
@@ -100,11 +121,40 @@ export function currentLaunch(terminalId, env = process.env) {
 export function pendingLaunch(terminalId, env = process.env) {
     return readLaunch(terminalId, env)?.next;
 }
+/** A relaunch waiting for its first hook, with the pane process it replaces, if one is (and that pid is known). */
+export function pendingRelaunch(terminalId, env = process.env) {
+    const record = readLaunch(terminalId, env);
+    if (record?.next === undefined || record.pane === undefined)
+        return undefined;
+    return {
+        launch: record.next,
+        pane: { pid: record.pane, ...(record.paneStartedAtMs !== undefined ? { startedAtMs: record.paneStartedAtMs } : {}) },
+    };
+}
+/** The record as written: only the fields it has. */
+function recordOf(fields) {
+    const record = { launch: fields.launch, gen: fields.gen };
+    if (fields.next !== undefined) {
+        record.next = fields.next;
+        if (fields.superseded && fields.superseded.length > 0)
+            record.superseded = fields.superseded;
+        if (fields.pane !== undefined) {
+            record.pane = fields.pane;
+            if (fields.paneStartedAtMs !== undefined)
+                record.paneStartedAtMs = fields.paneStartedAtMs;
+        }
+    }
+    if (fields.launchReady)
+        record.launchReady = true;
+    return record;
+}
 /**
  * A hook of launch `launch` ran in the window (by default the caller's own, from its environment):
  * mark the window past its trust dialog. Atomic (`writePrivateJson`).
  *
  * - The pending launch's own hook proves it runs: it becomes the window's launch, and is marked.
+ * - A hook of a launch the pending one superseded proves that one ran: it becomes the window's
+ *   launch (what an undone restart goes back to), but the window stays unmarked while one is pending.
  * - While a launch is pending, any other hook is of a process being replaced: it has no say, however
  *   late it runs (a hook suspended while the Mac slept may resume long after).
  * - With nothing pending, a hook of another launch is of the process the window runs (an older
@@ -139,6 +189,14 @@ function markReadyLocked(terminalId, env, launch, now) {
         let current = record;
         if (record.next !== undefined) {
             // Pending: only its own hook settles it (or the daemon, knowing nothing was replaced).
+            const superseded = record.superseded ?? [];
+            const at = launch === null ? -1 : superseded.indexOf(launch);
+            if (at >= 0) {
+                // A launch the pending one superseded ran, and is past its screens: the window's launch if the
+                // pending one never runs. Every launch before it is gone (it replaced them), their hooks too.
+                writePrivateJson(launchPath(terminalId, env), recordOf({ ...record, launch, superseded: superseded.slice(at + 1), launchReady: true, gen: nextGen(record, now) }));
+                return true;
+            }
             if (launch !== record.next)
                 return true;
             current = { launch, gen: nextGen(record, now) };
@@ -177,17 +235,32 @@ export function clearReady(terminalId, env = process.env) {
 /**
  * Launch `launch` is about to run in the window (a start or a restart): pending until its own first
  * hook runs, and no other hook marks the window meanwhile. Recorded first, then the old mark dropped.
- * Returns whether both were done; on `false` the caller must not launch.
+ * `replacing`: the pane process it replaces (a restart: its pid and start), so a relaunch that never
+ * ran can be told later ({@link abandonLaunch}). A launch still pending is superseded: it was seen running, and its
+ * own hook still makes it the window's launch. Returns whether both were done; on `false` the
+ * caller must not launch.
  */
-export function beginLaunch(terminalId, launch, env = process.env, now = Date.now()) {
+export function beginLaunch(terminalId, launch, env = process.env, now = Date.now(), replacing) {
     if (!isValidId(terminalId) || launch === '')
         return false;
     return withLaunchLock(terminalId, env, false, () => {
         const record = readLaunch(terminalId, env);
         if (record === undefined)
             return false;
+        // What the window is again if this launch (and any it supersedes) never runs, read under the lock.
+        const launchReady = record?.next !== undefined ? record.launchReady === true : isReady(terminalId, env) === true;
+        const superseded = record?.next !== undefined ? [...(record.superseded ?? []), record.next].slice(-MAX_SUPERSEDED) : [];
         try {
-            writePrivateJson(launchPath(terminalId, env), { launch: record?.launch ?? null, next: launch, gen: nextGen(record, now) });
+            writePrivateJson(launchPath(terminalId, env), recordOf({
+                launch: record?.launch ?? null,
+                next: launch,
+                superseded,
+                ...(replacing !== undefined && replacing.pid > 0
+                    ? { pane: replacing.pid, ...(replacing.startedAtMs !== undefined ? { paneStartedAtMs: replacing.startedAtMs } : {}) }
+                    : {}),
+                launchReady,
+                gen: nextGen(record, now),
+            }));
         }
         catch {
             return false;
@@ -195,43 +268,44 @@ export function beginLaunch(terminalId, launch, env = process.env, now = Date.no
         return clearReady(terminalId, env);
     });
 }
-export function launchState(terminalId, env = process.env) {
-    return { record: readLaunch(terminalId, env), ready: isReady(terminalId, env) };
-}
 /**
- * The new launch never ran (nothing was replaced): the window's old process keeps its launch and,
- * if it had it, its readiness. If that can't be written, the launch stays pending (no reply types)
- * until the window is restarted again.
+ * Launch `launch` never ran (nothing was replaced: tmux refused, or the window still runs the
+ * process it was to replace): taken back out of the record as the record is now, never as it was
+ * before it began, so whatever settled meanwhile stands. Only while it is still the pending one.
+ * - It superseded a launch still pending: that one is pending again (it was seen running).
+ * - Otherwise the window runs its launch again, marked if that one was past its screens (its own
+ *   hook ran, before or meanwhile).
+ *
+ * Returns `false` when the record couldn't be read or written: the launch then stays pending (no
+ * reply types), which fails closed.
  */
-export function restoreLaunch(terminalId, state, env = process.env, now = Date.now()) {
-    const before = state.record;
-    if (before === undefined)
-        return;
-    withLaunchLock(terminalId, env, undefined, () => restoreLocked(terminalId, before, state.ready === true, env, now));
-}
-function restoreLocked(terminalId, previous, ready, env, now) {
-    try {
-        if (previous === null) {
-            rmSync(launchPath(terminalId, env), { force: true });
-            if (ready)
-                writePrivateJson(readyPath(terminalId, env), { launch: null, at: now });
-            return;
+export function abandonLaunch(terminalId, launch, env = process.env, now = Date.now()) {
+    if (!isValidId(terminalId) || launch === '')
+        return false;
+    return withLaunchLock(terminalId, env, false, () => {
+        const record = readLaunch(terminalId, env);
+        if (record === undefined)
+            return false;
+        // Not pending (its own hook ran after all) or another one is: nothing of it to take back.
+        if (record === null || record.next !== launch)
+            return true;
+        const superseded = record.superseded ?? [];
+        const gen = nextGen(record, now);
+        try {
+            const previous = superseded.at(-1);
+            if (previous !== undefined) {
+                writePrivateJson(launchPath(terminalId, env), recordOf({ launch: record.launch, next: previous, superseded: superseded.slice(0, -1), launchReady: record.launchReady, gen }));
+                return true;
+            }
+            writePrivateJson(launchPath(terminalId, env), recordOf({ launch: record.launch, gen }));
+            if (record.launchReady)
+                writePrivateJson(readyPath(terminalId, env), { launch: record.launch, gen, at: now });
+            return true;
         }
-        const pending = readLaunch(terminalId, env);
-        // Exactly as it was, a launch still pending included: a failed attempt never lifts its protection.
-        const record = {
-            launch: previous.launch,
-            ...(previous.next !== undefined ? { next: previous.next } : {}),
-            gen: nextGen(pending ?? previous, now),
-        };
-        writePrivateJson(launchPath(terminalId, env), record);
-        if (ready && record.next === undefined) {
-            writePrivateJson(readyPath(terminalId, env), { launch: record.launch, gen: record.gen, at: now });
+        catch {
+            return false;
         }
-    }
-    catch {
-        /* left pending (see above): fails closed */
-    }
+    });
 }
 /** How much of a transcript is read looking for its folder (its first entries carry `cwd`). */
 const TRANSCRIPT_HEAD_BYTES = 256 * 1024;

package/dist/codehost/terminals.d.ts

@@ -393,6 +393,11 @@ export declare class CodeTerminals {
     private lastListUncertain;
     /** Each agent window's pane process at the last `adopt`: a restart is confirmed by its changing. */
     private panePids;
+    /**
+     * Terminals whose restart is between recording its launch and its last look: their pane may be
+     * mid-replacement, so no `adopt` judges their pending launch meanwhile ({@link settleRelaunches}).
+     */
+    private readonly relaunching;
     /** Every thread window's pane process at the last `adopt`, by window name: what an end makes sure exits. */
     private windowPids;
     /** Per terminal: how to close each viewer attached to it now (an end closes them before its windows). */
@@ -450,6 +455,17 @@ export declare class CodeTerminals {
      */
     reloadConfig(): Promise<boolean>;
     adopt(): Promise<number>;
+    /**
+     * A restart nobody could confirm (tmux timed out, its window couldn't be looked at), or one this
+     * daemon died in the middle of, leaves its launch pending. Once a look shows the window still runs
+     * the very pane process that launch was to replace (its pid, started when that one did: a reused
+     * pid is another process), it never ran: the old process is the window's again, with its launch
+     * and readiness ({@link abandonLaunch}), so replies reach the process that is really there instead
+     * of waiting for a hook that never comes. A pane that changed keeps it pending, as does one whose
+     * start can't be told (fails closed): the new process's own hook settles it. Judged by process,
+     * never by time.
+     */
+    private settleRelaunches;
     /**
      * The environment a Claude Code thread starts with: what `startOnce` hands its window, and so
      * the only source of where that window's Claude Code keeps its sessions (`adoptReadiness`).
@@ -544,8 +560,8 @@ export declare class CodeTerminals {
      * Of panes an earlier attempt saved, those whose process group is still this terminal's. A group
      * outlives its leader, and a pid is never handed out while a group of that id exists: so one whose
      * leader pid runs no process now is ours if anything is left in it. One whose pid runs a process is
-     * ours only if that process started when the saved one did; one with no saved start, or when `ps`
-     * can't say, is left alone.
+     * ours only if that process started when the saved one did; one with no saved start is left alone.
+     * `undefined` when `ps` couldn't say: nothing is judged, and the caller keeps them for a retry.
      */
     private stillOurs;
     restart(request: RestartRequest, outcome?: RestartOutcome, hooks?: RestartHooks): Promise<boolean>;

package/dist/codehost/terminals.js

@@ -36,7 +36,7 @@ import { loginOf, readSession } from './session.js';
 import { codeHostDir, writePrivateJson } from './settings.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
-import { beginLaunch, claudeSessionSince, claudeTranscripts, currentLaunch, isReady, LAUNCH_ENV, launchState, markReady, restoreLaunch, } from './ready.js';
+import { abandonLaunch, beginLaunch, claudeSessionSince, claudeTranscripts, currentLaunch, isReady, LAUNCH_ENV, markReady, pendingRelaunch, } from './ready.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
 import { noteInputTakeover } from './sizing.js';
 import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, respawnPaneArgs, killSessionArgs, killWindowArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
@@ -270,6 +270,11 @@ export class CodeTerminals {
     lastListUncertain = false;
     /** Each agent window's pane process at the last `adopt`: a restart is confirmed by its changing. */
     panePids = new Map();
+    /**
+     * Terminals whose restart is between recording its launch and its last look: their pane may be
+     * mid-replacement, so no `adopt` judges their pending launch meanwhile ({@link settleRelaunches}).
+     */
+    relaunching = new Set();
     /** Every thread window's pane process at the last `adopt`, by window name: what an end makes sure exits. */
     windowPids = new Map();
     /** Per terminal: how to close each viewer attached to it now (an end closes them before its windows). */
@@ -435,6 +440,7 @@ export class CodeTerminals {
             this.records.set(id, record);
         this.panePids = panes;
         this.windowPids = windowPids;
+        await this.settleRelaunches([...found.values()], panes);
         // Once per daemon start: the windows an older build left behind are all there now. Started by
         // the first call; every call waits for it, so none returns before those windows are marked. A
         // pass that fails (a keychain still locked right after login) never fails an adopt: it is
@@ -452,6 +458,42 @@ export class CodeTerminals {
         this.touchLiveLanes();
         return this.records.size;
     }
+    /**
+     * A restart nobody could confirm (tmux timed out, its window couldn't be looked at), or one this
+     * daemon died in the middle of, leaves its launch pending. Once a look shows the window still runs
+     * the very pane process that launch was to replace (its pid, started when that one did: a reused
+     * pid is another process), it never ran: the old process is the window's again, with its launch
+     * and readiness ({@link abandonLaunch}), so replies reach the process that is really there instead
+     * of waiting for a hook that never comes. A pane that changed keeps it pending, as does one whose
+     * start can't be told (fails closed): the new process's own hook settles it. Judged by process,
+     * never by time.
+     */
+    async settleRelaunches(records, panes) {
+        const env = { PROHOST_HOME: this.options.home };
+        const candidates = [];
+        for (const record of records) {
+            if (record.agent !== 'claude_code' || this.relaunching.has(record.terminalId))
+                continue;
+            const pending = pendingRelaunch(record.terminalId, env);
+            if (!pending || pending.pane.startedAtMs === undefined || panes.get(record.terminalId) !== pending.pane.pid)
+                continue;
+            candidates.push({ record, launch: pending.launch, pid: pending.pane.pid, startedAtMs: pending.pane.startedAtMs });
+        }
+        if (candidates.length === 0)
+            return;
+        const starts = await this.startsOf(candidates.map((candidate) => candidate.pid));
+        for (const { record, launch, pid, startedAtMs } of candidates) {
+            const now = starts.get(pid);
+            if (now === undefined || Math.abs(now - startedAtMs) > PANE_START_SLACK_MS)
+                continue;
+            // A restart of it may have begun while `ps` ran: its window is its own until its last look.
+            if (this.relaunching.has(record.terminalId))
+                continue;
+            if (abandonLaunch(record.terminalId, launch, env)) {
+                this.log(`    ⚙ code thread ${record.codeThreadId.slice(0, 12)}: its restart never ran; the agent it was to replace still runs`);
+            }
+        }
+    }
     /**
      * The environment a Claude Code thread starts with: what `startOnce` hands its window, and so
      * the only source of where that window's Claude Code keeps its sessions (`adoptReadiness`).
@@ -856,7 +898,22 @@ export class CodeTerminals {
         this.records.delete(request.terminalId);
         this.panePids.delete(request.terminalId);
         this.lastInterrupt.delete(request.terminalId);
-        await this.reapGroups(fresh.map((entry) => entry.pid), await this.stillOurs(saved));
+        const ours = await this.stillOurs(saved);
+        if (ours === undefined) {
+            // `ps` couldn't say which saved panes are still this terminal's: what was just closed is reaped,
+            // the rest stays saved in the unfinished mark, and the end is asked for again rather than said done.
+            await this.reapGroups(fresh.map((entry) => entry.pid));
+            try {
+                this.markEnded(request, saved, false);
+            }
+            catch {
+                /* the earlier mark still holds them */
+            }
+            this.log(`    ! code thread ${short}: couldn't check what is left of its terminal; retrying`);
+            outcome.retry = true;
+            return false;
+        }
+        await this.reapGroups(fresh.map((entry) => entry.pid), ours);
         try {
             // Finished and reaped: nothing left for a retry to signal, and a late redelivery is answered ended.
             this.markEnded(request, [], true);
@@ -899,8 +956,8 @@ export class CodeTerminals {
      * Of panes an earlier attempt saved, those whose process group is still this terminal's. A group
      * outlives its leader, and a pid is never handed out while a group of that id exists: so one whose
      * leader pid runs no process now is ours if anything is left in it. One whose pid runs a process is
-     * ours only if that process started when the saved one did; one with no saved start, or when `ps`
-     * can't say, is left alone.
+     * ours only if that process started when the saved one did; one with no saved start is left alone.
+     * `undefined` when `ps` couldn't say: nothing is judged, and the caller keeps them for a retry.
      */
     async stillOurs(saved) {
         if (saved.length === 0)
@@ -910,7 +967,7 @@ export class CodeTerminals {
             starts = await (this.options.paneStarts ?? paneStarts)(saved.map((entry) => entry.pid));
         }
         catch {
-            return [];
+            return undefined;
         }
         return saved
             .filter((entry) => {
@@ -924,7 +981,14 @@ export class CodeTerminals {
     async restart(request, outcome = {}, hooks = {}) {
         if (!isValidId(request.terminalId) || !isValidId(request.codeThreadId))
             return false;
-        return this.serialize(request.terminalId, () => this.restartNow(request, outcome, hooks));
+        return this.serialize(request.terminalId, async () => {
+            try {
+                return await this.restartNow(request, outcome, hooks);
+            }
+            finally {
+                this.relaunching.delete(request.terminalId);
+            }
+        });
     }
     /** Once every typing job and restart already queued for the terminal has finished (never rejects). */
     async settled(terminalId) {
@@ -997,6 +1061,21 @@ export class CodeTerminals {
         // Like a new window: replies wait for the new Claude Code's first hook (`ready.ts`). Its launch is
         // recorded (and the old mark dropped) before the old process goes, so that hook's mark is never
         // wiped after it was written, and a late hook of the old process can't mark the new one.
+        const before = this.panePids.get(record.terminalId);
+        // When the pane process to be replaced started: with its pid, what tells later that it still runs.
+        const beforeStartedAtMs = agent === 'claude_code' && before !== undefined ? (await this.startsOf([before])).get(before) : undefined;
+        const earlier = agent === 'claude_code' && before !== undefined ? pendingRelaunch(record.terminalId, env) : undefined;
+        if (earlier &&
+            earlier.pane.pid === before &&
+            earlier.pane.startedAtMs !== undefined &&
+            (beforeStartedAtMs === undefined || Math.abs(beforeStartedAtMs - earlier.pane.startedAtMs) <= PANE_START_SLACK_MS)) {
+            // An earlier relaunch that never ran (or may not have: `ps` didn't say) is still recorded as
+            // pending (`adopt` couldn't take it back): superseded now, it would be waited on forever. Tried
+            // again once it is settled.
+            this.log(`    ! code thread ${short} not restarted yet: an earlier restart of it isn't settled`);
+            outcome.retry = true;
+            return false;
+        }
         // The switch once more, as late as it can be: nothing awaits between here and `respawn-pane`, so a
         // `remote off` that landed during the looks above stops it before anything is claimed or touched.
         if (request.skipPermissions && !this.canType())
@@ -1012,11 +1091,14 @@ export class CodeTerminals {
             outcome.repeat = true;
             return false;
         }
-        const before = this.panePids.get(record.terminalId);
-        const previous = agent === 'claude_code' ? launchState(record.terminalId, env) : undefined;
-        if (previous && !beginLaunch(record.terminalId, token, env)) {
+        const launched = agent === 'claude_code';
+        // From here until its last look, no `adopt` judges this window's pending launch (`settleRelaunches`).
+        if (launched)
+            this.relaunching.add(record.terminalId);
+        const replacing = before === undefined ? undefined : { pid: before, ...(beforeStartedAtMs !== undefined ? { startedAtMs: beforeStartedAtMs } : {}) };
+        if (launched && !beginLaunch(record.terminalId, token, env, Date.now(), replacing)) {
             // Nothing was replaced, and nothing may be until the new launch can be told from the old one.
-            restoreLaunch(record.terminalId, previous, env);
+            abandonLaunch(record.terminalId, token, env);
             this.log(`    ! code thread ${short} not restarted yet: its launch could not be recorded`);
             outcome.retry = true;
             outcome.release = true;
@@ -1039,8 +1121,8 @@ export class CodeTerminals {
         }));
         if (!respawned.ok && !respawned.uncertain) {
             // Nothing was replaced: the old process (its launch and readiness) stays, and it is worth sending again.
-            if (previous)
-                restoreLaunch(record.terminalId, previous, env);
+            if (launched)
+                abandonLaunch(record.terminalId, token, env);
             this.log(`    ! code thread ${short} not restarted: tmux said ${respawned.stderr.trim()}`);
             outcome.retry = true;
             outcome.release = true;
@@ -1052,8 +1134,8 @@ export class CodeTerminals {
         const after = await this.panePidNow(record.terminalId);
         if (after !== undefined && after === before) {
             // The same process still runs: nothing was replaced. It keeps its launch and readiness, and is sent again.
-            if (previous)
-                restoreLaunch(record.terminalId, previous, env);
+            if (launched)
+                abandonLaunch(record.terminalId, token, env);
             this.log(`    ! code thread ${short} not restarted: its window still runs the same process`);
             outcome.retry = true;
             outcome.release = true;
@@ -1061,8 +1143,9 @@ export class CodeTerminals {
         }
         const replaced = after !== undefined && before !== undefined;
         if (!replaced && !respawned.ok) {
-            // Can't be told (tmux timed out and didn't answer the look): the old process may still run, so
-            // its state stays as it was. Never done twice, never reported done.
+            // Can't be told (tmux timed out and didn't answer the look): the old process may still run. The
+            // launch stays pending, with the pane it was to replace, until a look tells (`settleRelaunches`:
+            // the next `adopt`, or a reply it would refuse). Never done twice, never reported done.
             this.log(`    ! code thread ${short}: couldn't confirm ${agent} restarted; it may or may not have`);
             outcome.refused = 'restart_unconfirmed';
             return false;
@@ -1270,6 +1353,12 @@ export class CodeTerminals {
             // Typed only once a hook has run in the window (`ready.ts`): before that its trust dialog
             // is up or about to be drawn, and an Enter would answer it. Never judged from the screen.
             let ready = this.isReady(record.terminalId);
+            if (ready === false && pendingRelaunch(record.terminalId, { PROHOST_HOME: this.options.home }) !== undefined) {
+                // A restart nobody could confirm: one look tells whether it ever ran (`settleRelaunches`). If
+                // it didn't, the process it was to replace still runs, and is the one this reply is for.
+                await this.adopt();
+                ready = this.isReady(record.terminalId);
+            }
             if (ready === false && !record.readyMark) {
                 // A window an older build started: its readiness pass may be running, or have failed
                 // (then this tries it once more, now, rather than at the next adopt).

package/dist/host/command.js

@@ -32,7 +32,7 @@ import { journalPath, readEvents } from './events.js';
 import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, installedDedicatedService, systemdUnitOf, publishedComputer, publishedComputerId, readServiceCredential, rewriteHomeCredential, windowsServiceCredentialPath, windowsHomesDir, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
 import { LegacyHarnesses } from './legacy.js';
 import { detectLogins } from './logins.js';
-import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
+import { adoptComputer, adoptedRepos, loadAdopted, runMigrate } from './migrate.js';
 import { runHostPair, writeHostPairResult } from './pair.js';
 import { RESTART_EXIT_CODE, runHostService } from './service.js';
 import { STATE_STALE_MS, localLogin, localRunning, slotsFor } from './status.js';
@@ -697,6 +697,7 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     ...(workload === 'coding' || workload === 'chat' ? { workload: workload } : {}),
                     allowUnverified: flags['allow-unverified'] === true,
                     workdirFor: (agentId) => adopted?.homes.find((home) => home.agent_id === agentId && !home.host_only)?.hosted_workdir,
+                    codeHostRepos: adoptedRepos(adopted ?? undefined, codeHostHome),
                     onConfig: (config) => legacy?.sync(new Set(config.placements.map((p) => p.agent_id)), true),
                 });
                 if (result.fatal)

package/dist/host/migrate.d.ts

@@ -162,4 +162,9 @@ export declare function adoptComputer(options: {
     facts?: MachineFacts;
     name?: string;
 }): Promise<ComputerAdoption>;
+/**
+ * The checkouts this computer's terminal sessions may start in: the `--repos` its adopted homes
+ * ran with (the code-host home's first), each once. A home that ran with none adds none.
+ */
+export declare function adoptedRepos(adopted: Adopted | undefined, codeHostHome: string | undefined): string[];
 export {};

package/dist/host/migrate.js

@@ -366,3 +366,17 @@ export async function adoptComputer(options) {
     }
     return { status: 'not_adopted', reason };
 }
+/**
+ * The checkouts this computer's terminal sessions may start in: the `--repos` its adopted homes
+ * ran with (the code-host home's first), each once. A home that ran with none adds none.
+ */
+export function adoptedRepos(adopted, codeHostHome) {
+    const homes = [...(adopted?.homes ?? [])].sort((a, b) => Number(b.home === codeHostHome) - Number(a.home === codeHostHome));
+    const repos = [];
+    for (const home of homes) {
+        for (const repo of home.repos ?? [])
+            if (repo && !repos.includes(repo))
+                repos.push(repo);
+    }
+    return repos;
+}

package/dist/host/service.d.ts

@@ -75,6 +75,11 @@ export interface HostServiceOptions {
     workdirFor?: (agentId: string) => string | undefined;
     /** Called with each config the server sends (placements decide which adopted homes still run on their own). */
     onConfig?: (config: ComputerConfig) => void;
+    /**
+     * The checkouts terminal sessions may start in (`--repos`, else what the adopted homes ran
+     * with): declared on every status post, and the only repositories a start is taken for.
+     */
+    codeHostRepos?: string[];
     webSocketCtor?: typeof WebSocket;
     fetchImpl?: typeof fetch;
     spawnImpl?: typeof spawn;

package/dist/host/service.js

@@ -227,7 +227,7 @@ async function serveHost(options) {
                 machine,
                 clientVersion: CLI_VERSION,
                 accountId: computer.account.id,
-                repos: [],
+                repos: options.codeHostRepos ?? [],
                 cliEntrypoint: path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'index.js'),
                 log,
                 slots: () => ({ busy: active.size + terminals(), total: capacity() }),
@@ -270,6 +270,18 @@ async function serveHost(options) {
         }
         return caps;
     }
+    /**
+     * What a phone may start a terminal session in here, while this computer hosts them (the same
+     * rule as `code_threads_v2` in {@link capabilities}): its checkouts and the folders it opened.
+     */
+    function codeHostReport() {
+        if (!codeHost?.authorized() || !config.terminal_sessions_enabled)
+            return undefined;
+        const opened = codeHost.openedFolders?.();
+        if (!opened)
+            return undefined;
+        return { repos: codeHost.offeredRepos?.(), folders: opened.folders, home: opened.home };
+    }
     // ── What is running ──────────────────────────────────────────────────────
     function runningEntries() {
         const runs = [...active.values()].map((run) => ({ ...run.entry, peak_mem_mb: peak.peakMb(run.entry.run_id) }));
@@ -370,6 +382,7 @@ async function serveHost(options) {
                 capabilities: capabilities(),
                 recommendedCapacity: recommended(),
                 dedicated: env[DEDICATED_ENV] === '1',
+                codeHost: codeHostReport(),
             });
             const response = await callJson(computerApi, statusPath(computer.computer_id), body);
             if (response.status >= 200 && response.status < 300) {

package/dist/host/status.d.ts

@@ -7,6 +7,7 @@
  * stay in the local files only.
  */
 import type { AccountRuntime } from '../agent/accounts.js';
+import type { ReportedFolder } from '../codehost/folders.js';
 import type { HostStats } from '../codehost/host_stats.js';
 import type { HeldReason } from './capacity.js';
 import type { LoginInfo } from './logins.js';
@@ -69,6 +70,15 @@ export interface StatusInputs {
     recommendedCapacity: number;
     /** Running as a dedicated service (keeps working when no one is logged in). */
     dedicated?: boolean;
+    /**
+     * What the terminal host has, while it hosts terminal sessions: its checkouts (`undefined` while
+     * it can't say), the folders this Mac has opened, and its home. Absent: no `code_host` is sent.
+     */
+    codeHost?: {
+        repos: string[] | undefined;
+        folders: readonly ReportedFolder[];
+        home: string;
+    };
 }
 /** `POST /v1/computers/{id}/status` body. */
 export declare function buildStatusBody(inputs: StatusInputs): Record<string, unknown>;

package/dist/host/status.js

@@ -98,6 +98,8 @@ export function loginBody(login, conversations) {
         conversations,
     };
 }
+/** The most folders and repositories a status post carries (the server keeps no more). */
+const MAX_CODE_HOST_ENTRIES = 50;
 /** `POST /v1/computers/{id}/status` body. */
 export function buildStatusBody(inputs) {
     return {
@@ -119,6 +121,18 @@ export function buildStatusBody(inputs) {
         capabilities: [...inputs.capabilities],
         recommended_capacity: inputs.recommendedCapacity,
         ...(inputs.dedicated !== undefined ? { dedicated: inputs.dedicated } : {}),
+        ...(inputs.codeHost
+            ? {
+                code_host: {
+                    // `null`: it can't say which (a list too long to declare); the server then refuses none.
+                    repos: inputs.codeHost.repos ? inputs.codeHost.repos.slice(0, MAX_CODE_HOST_ENTRIES) : null,
+                    folders: inputs.codeHost.folders
+                        .slice(0, MAX_CODE_HOST_ENTRIES)
+                        .map((folder) => ({ path: folder.path, git: folder.git })),
+                    home: inputs.codeHost.home,
+                },
+            }
+            : {}),
     };
 }
 /** A run as `host status --json` and `activity.json` show it. */

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.10";
+export declare const CLI_VERSION = "0.16.12";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.10";
+export declare const USER_AGENT = "prohost-cli/0.16.12";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.10';
+export const CLI_VERSION = '0.16.12';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.10",
+  "version": "0.16.12",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",