@prohost/cli 0.16.2 → 0.16.3

package/CHANGELOG.md

@@ -6,6 +6,25 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.3
+
+- **A dedicated service records its terminal switch in its home's code-host settings** as it
+  starts (`--remote-terminal` / `--no-remote-terminal`), instead of an environment variable a
+  surviving tmux window would keep: after a reinstall with `--no-remote-terminal`, a Claude window
+  still open from before stops advertising remote approvals nobody can give, and answers its
+  permission prompts in the terminal. It fails closed: `--no-remote-terminal` never hosts (the
+  definition decides in the service, whatever the file says), and a switch it can't record hosts
+  nothing and removes the old file when it can, so hooks read remote control as off (the log says
+  when even that fails).
+- **A muted thread's turn is never resumed.** When an early answer was dropped because the thread
+  is muted (`409 ai_muted`), the conversation's session is forgotten on every exit — cancelled,
+  usage-limited, closed server-side, expired or failed too — not only when the run finishes.
+- **Replies the server holds back are handled, not failed or retried** (dispatch #22485):
+  `409 approval_required` ("waiting for approval": sent when someone approves the card — the
+  session continues), `409 send_blocked` ("blocked: <reason>", e.g. a duplicate — never delivered,
+  so the session is forgotten), and `held_as_suggestion` with any reason, `pinned_rule` included
+  (the session continues, as before). Any other 409 is still a failure. Works with today's server.
+
 ## 0.16.2
 
 More `prohost host` follow-ups (they missed #22513):

package/dist/agent/api.d.ts

@@ -31,10 +31,11 @@ export interface ApiResult {
     ok: boolean;
     /**
      * A send the server answered without sending (still `ok`: the run is done):
-     * saved as a draft for the team (`suggestion`), or dropped because the thread
-     * is muted for AI (`muted`).
+     * saved as a draft for the team (`suggestion`), waiting on an approval card
+     * (`approval`), dropped because the thread is muted for AI (`muted`), or
+     * stopped by the outbound guard (`blocked`). See `withheldBy` in run.ts.
      */
-    withheld?: 'suggestion' | 'muted';
+    withheld?: 'suggestion' | 'approval' | 'muted' | 'blocked';
     /** HTTP status, or ``0`` when no response arrived at all — see ``failure``. */
     status: number;
     error?: string;

package/dist/agent/run.d.ts

@@ -270,12 +270,11 @@ export interface AgentRunMetrics {
  *   nor a failure and must not be counted as either.
  */
 type RunOutcome = 'succeeded' | 'failed' | 'cancelled' | 'resolved' | 'unreported' | 'skipped';
-/**
- * A send the server answered without sending, deliberately: `held_as_suggestion`
- * (saved as a draft for the team — the send rule) or `ai_muted` (the thread is
- * muted; nothing saved, nothing to retry). Either way the run is done.
- */
-export declare function isHeldAsSuggestion(result: ApiResult): boolean;
+export declare function withheldBy(result: ApiResult): {
+    kind: NonNullable<ApiResult['withheld']>;
+    reason?: string;
+    approvalRequestId?: string;
+} | undefined;
 /**
  * A sign-in checker that adds `extra` only when it runs `binary` (this
  * harness's Claude): the account snapshot checks other runtimes' logins too,

package/dist/agent/run.js

@@ -210,13 +210,18 @@ const REPLAY_IN_FLIGHT_DELAY_MS = 5_000;
  */
 async function postReplyWithReplay(api, send, label, log, sleep) {
     const result = await postReplyOnce(api, send, label, log, sleep);
-    // The send rule kept it as a suggestion for the team: handled, not failed.
-    if (isHeldAsSuggestion(result)) {
-        const muted = /ai_muted/.test(result.error ?? '');
-        log(muted
+    // The server decided not to send it (yet): handled, not failed, and never retried.
+    const held = withheldBy(result);
+    if (held) {
+        const why = held.reason ? `: ${held.reason}` : '';
+        log(held.kind === 'muted'
             ? `${timestamp()} ◦ ${label} reply was not sent: the thread is muted for AI`
-            : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule)`);
-        return { ...result, ok: true, withheld: muted ? 'muted' : 'suggestion' };
+            : held.kind === 'approval'
+                ? `${timestamp()} ◦ ${label} reply is waiting for approval${held.approvalRequestId ? ` (approval ${held.approvalRequestId})` : ''}: it is sent when someone approves it`
+                : held.kind === 'blocked'
+                    ? `${timestamp()} ◦ ${label} reply was not sent: blocked: ${held.reason ?? 'the outbound guard'}`
+                    : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule${why})`);
+        return { ...result, ok: true, withheld: held.kind };
     }
     return result;
 }
@@ -272,12 +277,62 @@ function resolveWorkdir(options, log) {
     }
 }
 /**
- * A send the server answered without sending, deliberately: `held_as_suggestion`
- * (saved as a draft for the team — the send rule) or `ai_muted` (the thread is
- * muted; nothing saved, nothing to retry). Either way the run is done.
+ * A send the server answered without sending, deliberately (a 409). Either way the run is done,
+ * nothing is retried, and whether the conversation's session continues follows from it:
+ *
+ * - `held_as_suggestion` → `suggestion`: saved as a draft for the team (the send rule, or a
+ *   `pinned_rule`). The team may send it as is: the session continues.
+ * - `approval_required` → `approval`: below the employee's threshold, it waits on an approval card
+ *   and the server sends it when someone approves: the session continues.
+ * - `ai_muted` → `muted`: the thread is muted; nothing saved. The guest never sees it: the session
+ *   is forgotten.
+ * - `send_blocked` → `blocked`: the shared outbound guard stopped it (e.g. a duplicate). Not
+ *   delivered by this run: the session is forgotten.
+ *
+ * Any other 409 is not a decision and stays a failure.
  */
-export function isHeldAsSuggestion(result) {
-    return result.status === 409 && /held_as_suggestion|ai_muted/.test(result.error ?? '');
+const WITHHELD_CODES = new Map([
+    ['ai_muted', 'muted'],
+    ['approval_required', 'approval'],
+    ['send_blocked', 'blocked'],
+    ['held_as_suggestion', 'suggestion'],
+]);
+export function withheldBy(result) {
+    if (result.status !== 409)
+        return undefined;
+    const text = result.error ?? '';
+    // The server's own code, matched exactly — never a word found elsewhere in the body (a 409
+    // like `reply_race_held` quotes another reply's text, which may name any of these):
+    // `{detail: {error, reason, approval_request_id, …}}`, the same fields at the top, or
+    // `{detail: "<code>"}`. A body cut short (`api.ts` keeps 500 chars) is read for its first
+    // `"error": "…"` field only.
+    let fields = {};
+    let code;
+    try {
+        const parsed = JSON.parse(text);
+        const top = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        const detail = top.detail;
+        if (typeof detail === 'string')
+            code = detail;
+        else {
+            fields = detail && typeof detail === 'object' && !Array.isArray(detail) ? detail : top;
+            code = typeof fields.error === 'string' ? fields.error : undefined;
+        }
+    }
+    catch {
+        code = /"error"\s*:\s*"([a-z_]+)"/.exec(text)?.[1];
+    }
+    const kind = code === undefined ? undefined : WITHHELD_CODES.get(code);
+    if (!kind)
+        return undefined;
+    const str = (value) => (typeof value === 'string' && value ? value.slice(0, 120) : undefined);
+    const reason = str(fields.reason);
+    const approvalRequestId = str(fields.approval_request_id);
+    return { kind, ...(reason ? { reason } : {}), ...(approvalRequestId ? { approvalRequestId } : {}) };
+}
+/** A withheld reply the guest will never get from this run: its session must not continue. */
+function undeliveredFor(withheld) {
+    return withheld === 'muted' || withheld === 'blocked';
 }
 /**
  * A sign-in checker that adds `extra` only when it runs `binary` (this
@@ -1193,8 +1248,11 @@ limited) {
     let earlyCount = 0;
     let earlyPosted = 0;
     let earlyPosts = Promise.resolve();
-    /** An answer of this run was dropped because the thread is muted: its session must not continue. */
-    let muted = false;
+    /**
+     * An answer of this run will never reach the guest (the thread is muted, or the outbound guard
+     * blocked it — `undeliveredFor`): its session must not continue.
+     */
+    let undelivered = false;
     const earlyPath = run.reply_path;
     const earlyBodyKey = run.reply_body_key;
     const stoppedNow = () => control.signal.aborted || control.disposition() !== undefined;
@@ -1222,8 +1280,8 @@ limited) {
             }
             early.shift();
             earlyPosted += 1;
-            if (posted.withheld === 'muted')
-                muted = true;
+            if (undeliveredFor(posted.withheld))
+                undelivered = true;
             log(`${timestamp()} ✓ ${label} posted an answer; a background task is still running`);
         }
     };
@@ -1250,15 +1308,19 @@ limited) {
     const sessionId = venue ? undefined : result.ok ? result.sessionId : undefined;
     /**
      * Continue the conversation's session from this turn — unless an answer of
-     * it was dropped because the thread is muted (any runtime): then the session
+     * it will never reach the guest (muted thread, blocked send; any runtime): then the session
      * holds a turn nobody saw, so it is forgotten, eager record or resumed one alike.
      */
     const settleSession = (id) => {
-        if (muted)
+        if (undelivered)
             runtime.sessions.forget(sessionKeyFor(run));
         else if (id)
             runtime.sessions.remember(sessionKeyFor(run), id);
     };
+    // An early answer the guest will never get (muted, blocked): forgotten on every exit, the
+    // stopped, failed and usage-limited ones below included — none may continue a turn nobody saw.
+    if (undelivered)
+        runtime.sessions.forget(sessionKeyFor(run));
     // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
     // the run is closed — a completion that beats its own last tool row would
     // leave a `calling` row on a finished run. Never rejects, and after `stop`
@@ -1423,10 +1485,11 @@ limited) {
     }
     // Advance continuity only after the answer is durable on its reply surface.
     // Remembering at process exit would strand the conversation behind an answer
-    // it never received whenever this POST is rejected. A muted thread kept
-    // nothing of it, so its session is not advanced either (and an eager record undone).
-    if (posted.withheld === 'muted')
-        muted = true;
+    // it never received whenever this POST is rejected. A muted thread or a blocked send delivers
+    // nothing of it, so its session is not advanced either (and an eager record undone); a
+    // suggestion or a reply waiting for approval may still be sent as written, so it continues.
+    if (undeliveredFor(posted.withheld))
+        undelivered = true;
     settleSession(sessionId);
     const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
     if (!completed.ok) {

package/dist/codehost/settings.d.ts

@@ -26,9 +26,10 @@ export interface CodeHostSettings {
 export declare const DEFAULT_SETTINGS: CodeHostSettings;
 /**
  * A dedicated `prohost host` service decides terminal sessions in its own definition
- * (`host install --dedicated --remote-terminal | --no-remote-terminal`), not in the home's
- * `settings.json`: `1` hosts with remote control on, `0` hosts nothing. Every reader — the daemon,
- * the relay and the permission hook in each Claude window (which inherits it) — sees the same.
+ * (`host install --dedicated --remote-terminal | --no-remote-terminal`): `1` hosts with remote
+ * control on, `0` hosts nothing. The service writes it into its home's `settings.json` as it
+ * starts, so every reader — the daemon, the relay and the permission hook of a Claude window
+ * that outlived a reinstall — reads the one file.
  */
 export declare const TERMINAL_SESSIONS_ENV = "PROHOST_HOST_TERMINAL_SESSIONS";
 /** `$PROHOST_HOME/code-host`. */
@@ -57,3 +58,15 @@ export declare function readJsonObject(file: string): Record<string, unknown> |
  */
 export declare function loadSettings(env?: NodeJS.ProcessEnv): CodeHostSettings;
 export declare function saveSettings(settings: CodeHostSettings, env?: NodeJS.ProcessEnv): void;
+/**
+ * A dedicated service's terminal switch (`TERMINAL_SESSIONS_ENV`), recorded in the home's
+ * `settings.json` as it starts — for the readers outside the service's process: the permission
+ * hook of each window, which may have outlived a reinstall. True only when it is on AND recorded.
+ * Fails closed: a switch it can't record hosts nothing, and the old file is removed when it can be
+ * (a missing or unreadable file is off to every reader). When even that fails — `code-host/`
+ * itself unwritable — the error says so: windows still open keep reading the old switches.
+ */
+export declare function recordServiceSwitch(on: boolean, env: NodeJS.ProcessEnv, save?: (settings: CodeHostSettings, env: NodeJS.ProcessEnv) => void): {
+    hosting: boolean;
+    error?: string;
+};

package/dist/codehost/settings.js

@@ -29,9 +29,10 @@ export const DEFAULT_SETTINGS = Object.freeze({
 });
 /**
  * A dedicated `prohost host` service decides terminal sessions in its own definition
- * (`host install --dedicated --remote-terminal | --no-remote-terminal`), not in the home's
- * `settings.json`: `1` hosts with remote control on, `0` hosts nothing. Every reader — the daemon,
- * the relay and the permission hook in each Claude window (which inherits it) — sees the same.
+ * (`host install --dedicated --remote-terminal | --no-remote-terminal`): `1` hosts with remote
+ * control on, `0` hosts nothing. The service writes it into its home's `settings.json` as it
+ * starts, so every reader — the daemon, the relay and the permission hook of a Claude window
+ * that outlived a reinstall — reads the one file.
  */
 export const TERMINAL_SESSIONS_ENV = 'PROHOST_HOST_TERMINAL_SESSIONS';
 /** `$PROHOST_HOME/code-host`. */
@@ -101,11 +102,6 @@ export function readJsonObject(file) {
  * is the default — both off — and only a literal `true` turns a switch on.
  */
 export function loadSettings(env = process.env) {
-    const decided = env[TERMINAL_SESSIONS_ENV];
-    if (decided === '1')
-        return { version: 1, enabled: true, allowRemoteTerminal: true };
-    if (decided === '0')
-        return { ...DEFAULT_SETTINGS };
     const raw = readJsonObject(settingsPath(env));
     if (!raw || raw.version !== 1)
         return { ...DEFAULT_SETTINGS };
@@ -124,3 +120,30 @@ export function saveSettings(settings, env = process.env) {
         allowRemoteTerminal: settings.enabled && settings.allowRemoteTerminal,
     });
 }
+/**
+ * A dedicated service's terminal switch (`TERMINAL_SESSIONS_ENV`), recorded in the home's
+ * `settings.json` as it starts — for the readers outside the service's process: the permission
+ * hook of each window, which may have outlived a reinstall. True only when it is on AND recorded.
+ * Fails closed: a switch it can't record hosts nothing, and the old file is removed when it can be
+ * (a missing or unreadable file is off to every reader). When even that fails — `code-host/`
+ * itself unwritable — the error says so: windows still open keep reading the old switches.
+ */
+export function recordServiceSwitch(on, env, save = saveSettings) {
+    try {
+        save({ version: 1, enabled: on, allowRemoteTerminal: on }, env);
+        return { hosting: on && loadSettings(env).allowRemoteTerminal };
+    }
+    catch (e) {
+        const error = e instanceof Error ? e.message : String(e);
+        try {
+            rmSync(settingsPath(env), { force: true });
+        }
+        catch {
+            return {
+                hosting: false,
+                error: `${error}; the old switches could not be removed either, so windows still open may wait for remote approvals until ${settingsPath(env)} is writable`,
+            };
+        }
+        return { hosting: false, error };
+    }
+}

package/dist/codehost/terminals.js

@@ -33,7 +33,6 @@ import { readHistory } from './history.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
 import { claudeSessionSince, isReady, markReady } from './ready.js';
-import { TERMINAL_SESSIONS_ENV } from './settings.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
 import { noteInputTakeover } from './sizing.js';
 import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
@@ -170,14 +169,6 @@ const CLAUDE_THREAD_ENV = { CLAUDE_CODE_ENABLE_CFC: '0' };
  * and the like), then the thread's overrides, which a login's environment never undoes. The one
  * builder for it: `startOnce` launches with it, and `adoptReadiness` reads the config dir from it.
  */
-/**
- * A dedicated service's terminal switch (`TERMINAL_SESSIONS_ENV`), handed to each window so its
- * permission hook reads the same switches as the daemon whatever the tmux server inherited.
- */
-function terminalSessionsEnv(env) {
-    const decided = env[TERMINAL_SESSIONS_ENV];
-    return decided === undefined ? {} : { [TERMINAL_SESSIONS_ENV]: decided };
-}
 function agentWindowEnv(agent, accountEnv) {
     return { ...stringEnv(accountEnv), ...(agent === 'claude_code' ? CLAUDE_THREAD_ENV : {}) };
 }
@@ -489,7 +480,6 @@ export class CodeTerminals {
             cwd: checkout.path,
             env: {
                 ...agentWindowEnv(request.agent, account.env),
-                ...terminalSessionsEnv(this.options.processEnv ?? process.env),
                 PROHOST_HOME: this.options.home,
                 [TERMINAL_ID_ENV]: request.terminalId,
                 [CODE_THREAD_ID_ENV]: request.codeThreadId,

package/dist/host/service.d.ts

@@ -30,6 +30,7 @@ import { executeHostedRun } from '../agent/run.js';
 import type { AgentRunOptions } from '../agent/run.js';
 import type { CodeHostLike } from '../codehost/host.js';
 import type { HostStats } from '../codehost/host_stats.js';
+import { recordServiceSwitch } from '../codehost/settings.js';
 import type { Workload } from './capacity.js';
 import type { ComputerCredentials } from './computer.js';
 import type { LoginInfo } from './logins.js';
@@ -92,6 +93,8 @@ export interface HostServiceOptions {
     peak?: PeakMemory;
     detectLogins?: () => Promise<LoginInfo[]>;
     codeHost?: CodeHostLike | null;
+    /** Records a dedicated service's terminal switch in the home (tests: one that fails). */
+    recordTerminalSwitch?: typeof recordServiceSwitch;
     executeRun?: typeof executeHostedRun;
     updateAvailable?: () => boolean;
     statusIntervalMs?: number;

package/dist/host/service.js

@@ -40,7 +40,7 @@ import { SessionStore, sessionKeyFor } from '../agent/sessionstore.js';
 import { verifySignature } from '../agent/signature.js';
 import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, REMOTE_TERMINAL_CAPABILITY, RefusedDeliveryError, } from '../codehost/host.js';
 import { HostStatsSampler } from '../codehost/host_stats.js';
-import { loadSettings as loadCodeHostSettings } from '../codehost/settings.js';
+import { TERMINAL_SESSIONS_ENV, loadSettings as loadCodeHostSettings, recordServiceSwitch } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
 import { ServerLiveness, enableTcpKeepAlive, terminateSocket } from '../liveness.js';
 import { CLI_VERSION, USER_AGENT } from '../version.js';
@@ -186,13 +186,20 @@ async function serveHost(options) {
         ? { ...process.env, ...env, PROHOST_HOME: computer.code_host_home }
         : { ...process.env, ...env };
     // A dedicated install decides terminal sessions in the service's own definition
-    // (`--remote-terminal` / `--no-remote-terminal`, `TERMINAL_SESSIONS_ENV`), which `loadSettings`
-    // reads over the home's switches; a personal service follows the home's switches.
-    const codeHost = options.codeHost !== undefined
-        ? (options.codeHost ?? undefined)
-        : loadCodeHostSettings(codeHostEnv).enabled
-            ? buildCodeHost()
-            : undefined;
+    // (`--remote-terminal` / `--no-remote-terminal`): written into the home's switches as it starts,
+    // the one file the daemon, the relay and every window's permission hook read (a window that
+    // outlived a reinstall too). A personal service follows the home's switches as the owner set them.
+    // The definition is authoritative in this process: off never hosts, whatever the file says or
+    // whether it could be written; on hosts only once recorded (`recordServiceSwitch` fails closed).
+    const decided = env[TERMINAL_SESSIONS_ENV] === '1' ? true : env[TERMINAL_SESSIONS_ENV] === '0' ? false : undefined;
+    let hosting = decided ?? loadCodeHostSettings(codeHostEnv).enabled;
+    if (decided !== undefined) {
+        const recorded = (options.recordTerminalSwitch ?? recordServiceSwitch)(decided, codeHostEnv);
+        hosting = decided && recorded.hosting;
+        if (recorded.error)
+            log(`terminal sessions: off — could not record the service's switch (${recorded.error})`);
+    }
+    const codeHost = options.codeHost !== undefined ? (options.codeHost ?? undefined) : hosting ? buildCodeHost() : undefined;
     function buildCodeHost() {
         try {
             return new CodeHost({

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.2";
+export declare const CLI_VERSION = "0.16.3";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.2";
+export declare const USER_AGENT = "prohost-cli/0.16.3";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.2';
+export const CLI_VERSION = '0.16.3';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",