@prohost/cli 0.16.3 → 0.16.5

package/dist/host/command.js

@@ -24,12 +24,12 @@ import { claudeQuotaProvider, codexQuotaProvider } from '../agent/runtime_status
 import { readPipedKey } from '../usage/key-input.js';
 import { CLI_VERSION } from '../version.js';
 import { recommendCapacity } from './capacity.js';
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { addAccount, isValidLabel, loadAccounts, parseAccountRuntime, accountEnv } from '../agent/accounts.js';
 import { revokeComputer } from './api.js';
-import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, hostLockPath, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
+import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, handoffNotice, handoffOf, hostLockPath, SERVICE_LABEL, readHandoff, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
 import { journalPath, readEvents } from './events.js';
-import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
+import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, installedDedicatedService, publishedComputer, publishedComputerId, readServiceCredential, rewriteHomeCredential, windowsServiceCredentialPath, windowsHomesDir, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
 import { LegacyHarnesses } from './legacy.js';
 import { detectLogins } from './logins.js';
 import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
@@ -97,6 +97,7 @@ export function hardwareFacts() {
  */
 export function statusJson(env, now = Date.now(), options = {}) {
     const computer = tryLoadComputer(env);
+    const handoff = options.label ? undefined : readHandoff(env);
     // A dedicated service is reported only when asked for by its `--label`, and then only from what
     // it publishes: unlabelled, status is about this home's own service, whatever else runs on the
     // computer; labelled, nothing of this home's (its pause, its pairing, its lock) is mixed in.
@@ -118,13 +119,18 @@ export function statusJson(env, now = Date.now(), options = {}) {
     const events = readEvents(labelDir ? path.join(labelDir, 'events.json') : journalPath(env), now);
     return {
         // Reporting the dedicated service: its own computer, never this home's (they can differ).
-        paired: labelDir ? sharedComputer !== undefined : computer !== null,
+        // A home that handed its computer to a dedicated service is still that computer's (served
+        // elsewhere, `handed_to`): paired, offline here — never read as "not added", which would invite
+        // a second pairing beside the service that holds the key.
+        paired: labelDir ? sharedComputer !== undefined : computer !== null || handoff !== undefined,
         computer: labelDir
             ? (sharedComputer ?? null)
             : computer
                 ? { id: computer.computer_id, name: (fresh && state?.name) || computer.name, account: computer.account }
-                : null,
-        online: Boolean(fresh && state?.online),
+                : handoff
+                    ? { id: handoff.computer_id, name: handoff.name, account: handoff.account }
+                    : null,
+        online: Boolean(!handoff && fresh && state?.online),
         paused,
         slots: fresh && state ? state.slots : slotsFor(capacity, 0, paused ? 'paused' : null),
         running: fresh && state ? state.running.map(localRunning) : [],
@@ -141,11 +147,19 @@ export function statusJson(env, now = Date.now(), options = {}) {
             ...(labelDir ? { activity_file: path.join(labelDir, 'activity.json') } : {}),
         },
         remote_terminal: Boolean(fresh && state?.remote_terminal),
+        // This home handed its computer to a dedicated service: where to look instead.
+        ...(handoff ? { handed_to: { label: handoff.handed_to.label, service_user: handoff.handed_to.service_user, service_home: handoff.handed_to.service_home } } : {}),
         version: CLI_VERSION,
     };
 }
 function printStatus(json, out) {
     const computer = json.computer;
+    const handedTo = json.handed_to;
+    if (handedTo) {
+        out(`This computer runs as the dedicated service ${handedTo.label}${handedTo.service_user ? ` (user ${handedTo.service_user})` : ''}. ` +
+            `See it with: prohost host status --label ${handedTo.label}`);
+        return;
+    }
     if (!computer) {
         out('This computer is not added to a workspace yet. Run: prohost host pair');
         return;
@@ -285,6 +299,207 @@ async function addLogin(flags, env, out, err, io) {
     out(`✓ Added "${label}". It shows in prohost host logins.`);
     return 0;
 }
+/**
+ * `sudo prohost host unpair --label <label>` (or `--dedicated`, the label read from this home's
+ * hand-off note): remove a dedicated service's computer. As root / an administrator it reads the
+ * key from the service's own home — the one its installed definition names (root's file), never a
+ * path from the note, which the home's owner can edit — removes the computer from its workspace,
+ * uninstalls the service (stopped and its definition removed: without a key it could only fail),
+ * deletes the key there and clears the note in the home it was handed from. Nothing is changed
+ * when the removal is refused. Exits 0 once the computer is removed, even if some local cleanup
+ * could not be done (each such step is reported).
+ */
+async function unpairDedicated(flags, env, out, err, io, platform) {
+    const serviceIo = io.serviceIo ?? {};
+    const run = serviceIo.run ?? defaultServiceRunner;
+    const admin = serviceIo.isAdmin ??
+        (platform === 'win32' ? run('net', ['session']).status === 0 : (serviceIo.uid ?? process.getuid?.() ?? 1) === 0);
+    if (!admin) {
+        err(platform === 'win32'
+            ? '✗ A dedicated service is removed from an administrator prompt.'
+            : '✗ A dedicated service is removed as root: run it with sudo.');
+        return 1;
+    }
+    const fromHome = handedFromHome(flags, env, platform);
+    const note = readHandoff({ ...env, PROHOST_HOME: fromHome });
+    const explicit = str(flags, 'label');
+    // The note is only a hint for the label: everything else comes from what root installed.
+    const label = explicit ?? note?.handed_to.label;
+    if (!label) {
+        err('✗ Which dedicated service? Pass --label <label> (prohost host status --label <label> shows it).');
+        return 1;
+    }
+    if (!SERVICE_LABEL.test(label) || !label.startsWith(LAUNCHD_HOST_LABEL)) {
+        err(`✗ "${label}" is not a label this CLI installs services under.`);
+        return 1;
+    }
+    const installed = installedDedicatedService(platform, label, serviceIo);
+    if (!installed) {
+        err(`✗ No dedicated service ${label} is installed here (no service definition for it): remove the computer on its page in ProhostAI.`);
+        return 1;
+    }
+    const flagUser = str(flags, 'service-user');
+    if (flagUser && installed.user && flagUser !== installed.user) {
+        err(`✗ ${label} runs as ${installed.user}, not ${flagUser}: nothing was changed.`);
+        return 1;
+    }
+    const serviceUser = installed.user ?? flagUser;
+    const serviceHome = installed.home;
+    const noted = note?.handed_to.label === label ? note : undefined;
+    if (noted && path.resolve(noted.handed_to.service_home) !== path.resolve(serviceHome)) {
+        err(`✗ The note in ${fromHome} says ${label} lives in ${noted.handed_to.service_home}, but it is installed with ${serviceHome}: nothing was changed.`);
+        return 1;
+    }
+    // The home the definition names must be the service account's own folder, not a link to elsewhere.
+    const homeProblem = serviceHomeProblem(platform, serviceHome, serviceUser, serviceIo);
+    if (homeProblem) {
+        err(`✗ ${homeProblem}: nothing was changed.`);
+        return 1;
+    }
+    const computer = serviceCredential(platform, serviceHome, serviceUser, serviceIo, label);
+    // Named only by the note: only the service that holds that very computer.
+    if (!explicit && note && computer && computer.computer_id !== note.computer_id) {
+        err(`✗ ${label} runs a different computer than the note in ${fromHome} names: nothing was changed. Pass --label to name the service.`);
+        return 1;
+    }
+    const uninstall = () => {
+        const outcome = uninstallService({
+            platform,
+            dedicated: true,
+            ...(serviceUser ? { serviceUser } : {}),
+            nodePath: process.execPath,
+            scriptPath: scriptPath(),
+            home: serviceHome,
+            pathEnv: env.PATH ?? '',
+            userHome: env.HOME || os.homedir(),
+            label,
+        }, serviceIo);
+        (outcome.ok ? out : err)(`  ${outcome.message}`);
+        return outcome.ok;
+    };
+    if (computer && platform === 'win32' && publishedComputerId({ platform, label }, serviceIo) !== computer.computer_id) {
+        // The copy is an install-time snapshot: the service now runs another computer (it re-paired),
+        // or publishes none. Root never revokes the old one, nor uninstalls the new one, on a guess.
+        err(`✗ ${label} no longer publishes the computer its key on record is for: nothing was changed. ` +
+            'Sign the computer out on its page in ProhostAI (AI Employees › Computers).');
+        return 1;
+    }
+    if (!computer && platform === 'win32') {
+        // No administrators' copy of the key (installed by a CLI before 0.16.5, or never paired): the
+        // key in the account's home is never read by an administrator, so nothing is changed here.
+        err(`✗ ${label} has no administrators' copy of its key (${windowsServiceCredentialPath({ label })}): nothing was changed. ` +
+            `Remove the computer on its page in ProhostAI, then: prohost host uninstall --label ${label} --dedicated`);
+        return 1;
+    }
+    if (!computer) {
+        // Nothing to remove it with: the service can't run either. Only a service named on purpose is
+        // uninstalled (never one picked by the note alone); its note goes with it.
+        err(`✗ ${serviceHome} holds no computer key for ${label}: remove the computer on its page in ProhostAI.`);
+        if (explicit) {
+            uninstall();
+            if (noted)
+                clearHandedHome(platform, fromHome, 'the note', serviceIo, err);
+        }
+        else {
+            err(`  To uninstall it anyway: sudo prohost host unpair --label ${label}`);
+        }
+        return 1;
+    }
+    const revoked = await revokeComputer({ baseUrl: computer.base_url, apiKey: computer.api_key, fetchImpl: io.fetchImpl }, computer.computer_id);
+    if (revoked.result === 'failed') {
+        err(`✗ ProhostAI did not remove this computer (${revoked.status === 0 ? revoked.error ?? 'no answer' : `HTTP ${revoked.status}`}). ` +
+            'Nothing was changed; try again, or remove it on its page in ProhostAI.');
+        return 1;
+    }
+    if (platform === 'win32' && revoked.status === 401) {
+        // The administrators' copy is an install-time snapshot: a key refused may only mean it was
+        // re-paired since, and the service's live key is never read here. Never cleaned up on a guess.
+        err(`✗ ProhostAI no longer accepts the key on record for ${label} (re-paired since it was installed?): nothing was changed. ` +
+            `Remove the computer on its page in ProhostAI, then: prohost host uninstall --label ${label} --dedicated`);
+        return 1;
+    }
+    out(revoked.result === 'revoked' ? `✓ Removed "${computer.name}" from its workspace.` : `✓ "${computer.name}" was already removed from its workspace.`);
+    let clean = uninstall();
+    clean = clearHandedHome(platform, serviceHome, 'its key', serviceIo, err) && clean;
+    if (platform === 'win32') {
+        try {
+            (serviceIo.removeFile ?? ((f) => rmSync(f, { force: true })))(windowsServiceCredentialPath({ label }));
+        }
+        catch (e) {
+            clean = false;
+            err(`  ✗ Could not delete ${windowsServiceCredentialPath({ label })} (${e instanceof Error ? e.message : String(e)}): delete it yourself.`);
+        }
+    }
+    // The home it was handed from: its note, or — installed by a CLI before 0.16.5 — its own copy of this key.
+    const fromCopy = tryLoadComputer({ ...env, PROHOST_HOME: fromHome });
+    if ((noted || fromCopy?.computer_id === computer.computer_id) && path.resolve(fromHome) !== path.resolve(serviceHome)) {
+        clean = clearHandedHome(platform, fromHome, noted ? 'the note' : 'the old copy of its key', serviceIo, err) && clean;
+    }
+    out(clean ? `  ${label} is uninstalled and this computer's key is gone.` : `  The computer is removed; finish the steps above by hand.`);
+    return 0;
+}
+/**
+ * What is wrong with the service home an installed definition names, if anything: on macOS / Linux
+ * it must be a real folder (no link) owned by the service account; on Windows, the administrators'
+ * folder for it (`windowsHomesDir`), no junction.
+ */
+function serviceHomeProblem(platform, home, user, serviceIo) {
+    if (platform === 'win32') {
+        const parent = path.win32.resolve(path.win32.dirname(home));
+        if (parent !== path.win32.resolve(windowsHomesDir()))
+            return `${home} is not a dedicated service home (${windowsHomesDir()})`;
+        const isSymlink = serviceIo.isSymlink ?? ((f) => {
+            try {
+                return lstatSync(f).isSymbolicLink();
+            }
+            catch {
+                return false;
+            }
+        });
+        return isSymlink(home) ? `${home} is a link or junction` : undefined;
+    }
+    const owner = serviceIo.ownerOf?.(home) ?? (() => {
+        try {
+            const stat = lstatSync(home);
+            return { uid: stat.uid, link: stat.isSymbolicLink() };
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!owner)
+        return `${home} is not there`;
+    if (owner.link)
+        return `${home} is a link`;
+    if (!user)
+        return `${home}: the service's account is unknown`;
+    const id = (serviceIo.run ?? defaultServiceRunner)('id', ['-u', user]);
+    if (id.status !== 0 || Number.parseInt(id.stdout.trim(), 10) !== owner.uid)
+        return `${home} is not owned by ${user}`;
+    return undefined;
+}
+/** A dedicated service home's key, read as `readServiceCredential` reads it (never through the account's links). */
+function serviceCredential(platform, home, user, serviceIo, label) {
+    const text = readServiceCredential(platform, home, user, serviceIo, label);
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/** The home a dedicated install took its computer from: `--from-home`, else (under sudo `$PROHOST_HOME` is root's) `$SUDO_USER`'s. */
+function handedFromHome(flags, env, platform) {
+    return str(flags, 'from-home') ?? (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : prohostHome(env));
+}
+function clearHandedHome(platform, home, what, serviceIo, err) {
+    const problem = rewriteHomeCredential(platform, home, undefined, serviceIo);
+    if (problem)
+        err(`  ✗ Could not delete ${what} in ${home} (${problem}): delete ${path.join(home, 'host', 'computer.json')} yourself.`);
+    return !problem;
+}
 export async function runHost(subcommand, flags, printHelp, io = {}) {
     const env = io.env ?? process.env;
     const out = io.out ?? ((line) => process.stdout.write(`${line}\n`));
@@ -292,6 +507,13 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
     const platform = io.platform ?? process.platform;
     switch (subcommand) {
         case 'pair': {
+            const handedOff = readHandoff(env);
+            if (handedOff) {
+                const result = { version: 1, outcome: 'handed_off', computer_id: handedOff.computer_id, account: handedOff.account, message: handoffNotice(handedOff) };
+                writeHostPairResult(result, env, err);
+                err(`✗ ${result.message}`);
+                return 1;
+            }
             const baseUrl = str(flags, 'base-url') ?? env.PROHOST_BASE_URL ?? DEFAULT_API_BASE_URL;
             const problem = baseUrlProblem(baseUrl);
             if (problem) {
@@ -341,6 +563,12 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
             }
         }
         case 'run': {
+            const handedOff = readHandoff(env);
+            if (handedOff) {
+                // The dedicated service runs this computer (and any homes adopted here are its business now).
+                err(`✗ ${handoffNotice(handedOff)}`);
+                return 1;
+            }
             const computer = tryLoadComputer(env);
             const adopted = loadAdopted(env);
             if (!computer && !adopted?.homes.length) {
@@ -444,17 +672,65 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 // A dedicated service is labelled after its own home: without --label,
                 // every one this computer publishes state for is looked at too.
                 const labels = new Set([spec.label]);
-                const admin = platform === 'win32' ? dedicated : (io.serviceIo?.uid ?? process.getuid?.() ?? 1) === 0;
+                // Elevated, whatever the flags say (on Windows an administrator prompt, as unpair checks it).
+                const admin = io.serviceIo?.isAdmin ??
+                    (platform === 'win32'
+                        ? dedicated || (io.serviceIo?.run ?? defaultServiceRunner)('net', ['session']).status === 0
+                        : (io.serviceIo?.uid ?? process.getuid?.() ?? 1) === 0);
                 if (!str(flags, 'label') && (admin || dedicated)) {
                     for (const dir of sharedDirs(io.sharedBase ?? sharedBase(platform)))
                         labels.add(path.basename(dir));
                 }
-                const outcomes = [...labels].map((label) => uninstallService({ ...spec, label }, io.serviceIo));
+                // A home that handed its computer to one of these services gets the key back once that
+                // service is gone (the mirror of install): `prohost host install` runs it there again.
+                const fromHome = admin ? handedFromHome(flags, env, platform) : undefined;
+                const note = fromHome ? readHandoff({ ...env, PROHOST_HOME: fromHome }) : undefined;
+                const handedTo = note && labels.has(note.handed_to.label) ? installedDedicatedService(platform, note.handed_to.label, io.serviceIo) : undefined;
+                // Read before the service goes (on Windows its administrators' copy goes with it), and only
+                // from the home the definition names when it is the service account's own folder.
+                const handedKey = note && handedTo && !serviceHomeProblem(platform, handedTo.home, handedTo.user, io.serviceIo ?? {})
+                    ? serviceCredential(platform, handedTo.home, handedTo.user, io.serviceIo ?? {}, note.handed_to.label)
+                    : null;
+                // Windows reads the administrators' copy (an install-time snapshot): it is given back while the
+                // service publishes that same computer, or publishes none yet (never started, failed early)
+                // and the copy is for the computer the note names. Another computer published: never.
+                // A state that can't be read is not "none published": then nothing is given back.
+                const published = platform === 'win32' && note ? publishedComputer({ platform, label: note.handed_to.label }, io.serviceIo) : undefined;
+                const handedKeyLive = handedKey &&
+                    (platform !== 'win32' ||
+                        (published?.kind === 'none' ? handedKey.computer_id === note?.computer_id : published?.kind === 'published' && published.id === handedKey.computer_id))
+                    ? handedKey
+                    : null;
+                const outcomes = [...labels].map((label) => ({ label, ...uninstallService({ ...spec, label }, io.serviceIo) }));
                 const removed = outcomes.filter((o) => !o.message.startsWith('No host service'));
                 const shown = removed.length > 0 ? removed : outcomes.slice(0, 1);
                 for (const o of shown)
                     (o.ok ? out : err)(o.message);
-                return shown.every((o) => o.ok) ? 0 : 1;
+                let ok = shown.every((o) => o.ok);
+                if (note && fromHome && outcomes.some((o) => o.label === note.handed_to.label && o.ok)) {
+                    const key = handedKeyLive;
+                    if (key && key.computer_id === note.computer_id && handedTo) {
+                        const problem = rewriteHomeCredential(platform, fromHome, `${JSON.stringify(key, null, 2)}\n`, io.serviceIo);
+                        if (problem) {
+                            ok = false;
+                            err(`  ✗ Could not give the computer's key back to ${fromHome} (${problem}); it stays in ${handedTo.home}.`);
+                        }
+                        else {
+                            // On Windows the (administrators') service home keeps its copy: a later dedicated
+                            // install finds that home and writes nothing into it, so it must still hold the key.
+                            if (platform !== 'win32')
+                                clearHandedHome(platform, handedTo.home, 'its key', io.serviceIo ?? {}, err);
+                            out(`  The computer's key is back in ${fromHome}: prohost host install runs it there (prohost host unpair removes it).`);
+                            if (platform === 'win32')
+                                out(`  To install it as a dedicated service again, first remove the folder ${handedTo.home}.`);
+                        }
+                    }
+                    else {
+                        clearHandedHome(platform, fromHome, 'the note', io.serviceIo ?? {}, err);
+                        out(`  ${fromHome} no longer points at ${note.handed_to.label}. Its key was not found: add the computer again with prohost host pair, or remove it on its page in ProhostAI.`);
+                    }
+                }
+                return ok ? 0 : 1;
             }
             // 0.16.0 put a Windows dedicated service's home in the account's profile, under another
             // label: replacing it here would leave two services on one key. Its owner removes it first.
@@ -469,12 +745,21 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     return 1;
                 }
             }
+            // A home whose computer went to a dedicated service has no key to run a service of its own on.
+            const ownHandoff = dedicated ? undefined : readHandoff(env);
+            if (ownHandoff) {
+                err(`✗ ${handoffNotice(ownHandoff)}`);
+                return 1;
+            }
             // The invoking user's home: under sudo, $PROHOST_HOME and $HOME are root's.
             const adoptFrom = str(flags, 'from-home') ??
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
+            // The key this install takes over, read before it runs: only a copy it really made is retired.
+            const handedFrom = dedicated && path.resolve(adoptFrom) !== path.resolve(home) ? tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom }) : null;
             const outcome = installService(spec, io.serviceIo, {
                 ...(tokenFile ? { claudeTokenFile: tokenFile } : {}),
                 ...(dedicated ? { adoptFrom } : {}),
+                ...(dedicated && readHandoff({ ...env, PROHOST_HOME: adoptFrom })?.handed_to.label === spec.label ? { handedOffHere: true } : {}),
             });
             (outcome.ok ? out : err)(outcome.message);
             if (outcome.ok && !tryLoadComputer({ ...env, PROHOST_HOME: home })) {
@@ -482,9 +767,41 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     ? `  ! ${home} has no computer yet (none in ${adoptFrom}): pair as yourself, then run this again — or pass --from-home <your PROHOST_HOME>.`
                     : `  This home (${home}) has no computer yet: run prohost host pair.`);
             }
+            if (outcome.ok && dedicated && handedFrom) {
+                // One key, one holder: the home it came from keeps a note of where the computer went, never
+                // the key — so an `unpair`, `pair` or personal `install` there can't revoke or run it twice.
+                const serviceHas = serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label);
+                if (serviceHas && serviceHas.computer_id === handedFrom.computer_id && serviceHas.api_key !== handedFrom.api_key) {
+                    // Re-paired since the service got its copy: it holds an older key (no longer valid).
+                    // This home's key is the live one, so it stays here.
+                    err(`  ! The service in ${home} holds an older key for this computer than ${adoptFrom} (re-paired since?). ` +
+                        `This home keeps its key. To move it over: sudo prohost host uninstall --label ${spec.label}, ` +
+                        (platform === 'win32'
+                            ? // An existing administrators' home is never written into: the whole folder goes.
+                                `remove the folder ${home}, then install again.`
+                            : `delete ${path.join(home, 'host', 'computer.json')}, then install again.`));
+                }
+                else if (serviceHas?.computer_id === handedFrom.computer_id) {
+                    const note = handoffOf(handedFrom, {
+                        label: spec.label,
+                        service_user: serviceUser ?? null,
+                        service_home: home,
+                        at: new Date((io.now ?? Date.now)()).toISOString(),
+                    });
+                    const problem = rewriteHomeCredential(platform, adoptFrom, `${JSON.stringify(note, null, 2)}\n`, io.serviceIo);
+                    if (problem) {
+                        err(`  ✗ The service has the computer, but its key is still in ${adoptFrom} too (${problem}). ` +
+                            `Delete ${path.join(adoptFrom, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from that home: it would remove the computer.`);
+                    }
+                    else {
+                        out(`  The computer's key is the service's alone now: ${adoptFrom} keeps a note of where it went.`);
+                    }
+                }
+            }
             if (outcome.ok && dedicated) {
                 out(`  Its status, for anyone on this computer: ${sharedDirFor(spec)}`);
                 out(`  Remove it with: sudo prohost host uninstall --label ${spec.label}`);
+                out(`  Remove the computer from its workspace too: sudo prohost host unpair --label ${spec.label}`);
                 // The personal service of the home it took the computer from runs on the same key.
                 const personal = personalServiceOf(platform, adoptFrom, env.SUDO_USER);
                 if (personal && (io.serviceIo?.exists ?? existsSync)(personal.file)) {
@@ -495,6 +812,14 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
             return outcome.ok ? 0 : 1;
         }
         case 'unpair': {
+            const labelFlag = str(flags, 'label');
+            if (labelFlag || flags.dedicated === true)
+                return unpairDedicated(flags, env, out, err, io, platform);
+            const handedOff = readHandoff(env);
+            if (handedOff) {
+                err(`✗ ${handoffNotice(handedOff)}`);
+                return 1;
+            }
             const computer = tryLoadComputer(env);
             if (!computer) {
                 out('This computer is not added to a workspace. Nothing to remove.');

package/dist/host/computer.d.ts

@@ -78,6 +78,37 @@ export interface ComputerCredentials {
 }
 export declare class ComputerMissingError extends Error {
 }
+/**
+ * What a home keeps once a dedicated install has taken its computer over (`host install
+ * --dedicated`): no key — the dedicated service holds the only one — just where it went, so
+ * `host status` / `unpair` / `pair` / `install` here explain instead of acting on a copy of it.
+ * `code_host_home` stays for the desktop app, which reads it from this file.
+ */
+export interface ComputerHandoff {
+    version: 1;
+    handed_to: {
+        label: string;
+        service_user: string | null;
+        service_home: string;
+        at: string;
+    };
+    computer_id: string;
+    name: string;
+    account: ProhostAccount;
+    base_url?: string;
+    code_host_home?: string;
+}
+export declare function handoffOf(credentials: ComputerCredentials, to: ComputerHandoff['handed_to']): ComputerHandoff;
+/** A service label (launchd label, systemd unit, Windows task): the one rule, never a path. */
+export declare const SERVICE_LABEL: RegExp;
+/**
+ * This home's hand-off note, when its computer went to a dedicated service. The note is the home
+ * owner's file: its label is checked like any label, and nothing run as an administrator takes a
+ * path from it.
+ */
+export declare function readHandoff(env?: NodeJS.ProcessEnv): ComputerHandoff | undefined;
+/** How to reach the dedicated service a home handed its computer to — the one line every refusal here says. */
+export declare function handoffNotice(handoff: ComputerHandoff): string;
 export declare function saveComputer(credentials: ComputerCredentials, env?: NodeJS.ProcessEnv): string;
 export declare function loadComputer(env?: NodeJS.ProcessEnv): ComputerCredentials;
 /** The `claude setup-token` token a dedicated install put in this home (`host/claude-oauth-token`). */

package/dist/host/computer.js

@@ -209,6 +209,39 @@ export function readObject(file) {
 }
 export class ComputerMissingError extends Error {
 }
+export function handoffOf(credentials, to) {
+    return {
+        version: 1,
+        handed_to: to,
+        computer_id: credentials.computer_id,
+        name: credentials.name,
+        account: credentials.account,
+        base_url: credentials.base_url,
+        ...(credentials.code_host_home ? { code_host_home: credentials.code_host_home } : {}),
+    };
+}
+/** A service label (launchd label, systemd unit, Windows task): the one rule, never a path. */
+export const SERVICE_LABEL = /^[A-Za-z0-9][A-Za-z0-9.-]{0,127}$/;
+/**
+ * This home's hand-off note, when its computer went to a dedicated service. The note is the home
+ * owner's file: its label is checked like any label, and nothing run as an administrator takes a
+ * path from it.
+ */
+export function readHandoff(env = process.env) {
+    const raw = readObject(computerPath(env));
+    const to = raw?.handed_to;
+    if (!raw || typeof raw.api_key === 'string' || !to || typeof to.label !== 'string' || typeof to.service_home !== 'string')
+        return undefined;
+    if (!SERVICE_LABEL.test(to.label))
+        return undefined;
+    return raw;
+}
+/** How to reach the dedicated service a home handed its computer to — the one line every refusal here says. */
+export function handoffNotice(handoff) {
+    const { label, service_user: user } = handoff.handed_to;
+    return (`This computer ("${handoff.name}") runs as the dedicated service ${label}${user ? ` (user ${user})` : ''}; this home no longer holds its key. ` +
+        `See it with: prohost host status --label ${label} — remove it as an administrator with: sudo prohost host unpair --label ${label}`);
+}
 export function saveComputer(credentials, env = process.env) {
     const file = computerPath(env);
     writePrivateFile(file, credentials);
@@ -219,6 +252,9 @@ export function loadComputer(env = process.env) {
     const raw = readObject(file);
     if (!raw)
         throw new ComputerMissingError(`This computer isn't added yet (no ${file}). Run: prohost host pair`);
+    const handoff = readHandoff(env);
+    if (handoff)
+        throw new ComputerMissingError(handoffNotice(handoff));
     if (typeof raw.api_key !== 'string' || !raw.api_key || typeof raw.computer_id !== 'string' || !raw.computer_id) {
         throw new ComputerMissingError(`${file} has no computer key. Add the computer again: prohost host pair`);
     }

package/dist/host/install.d.ts

@@ -100,6 +100,13 @@ export declare function buildWindowsWrapper(spec: ServiceSpec): string;
 export declare function windowsWrapperPath(spec: ServiceSpec): string;
 /** Where a Windows dedicated install keeps its task definition and wrapper: administrators write, the account reads. */
 export declare function windowsServiceDir(spec: Pick<ServiceSpec, 'label'>): string;
+/**
+ * The administrators' copy of a Windows dedicated service's key (`services\<label>`: the account
+ * may read it, never change it) — what an administrator's `unpair` / `uninstall` reads. Written
+ * when an install creates the service's home; a home installed before 0.16.5 has none, and is
+ * then never handed a note nor unpaired by label (its computer is removed on its page).
+ */
+export declare function windowsServiceCredentialPath(spec: Pick<ServiceSpec, 'label'>): string;
 /** Task Scheduler XML: at logon (personal) or at boot as the service user via S4U (dedicated). */
 export declare function buildWindowsTaskXml(spec: ServiceSpec, currentUser: string): string;
 export interface InstallOutcome {
@@ -126,6 +133,19 @@ export interface InstallIo {
         link: boolean;
     } | undefined;
     removeFile?: (file: string) => void;
+    /** Rename `from` over `to` (Windows hand-off note: a fresh file, then renamed into place). */
+    rename?: (from: string, to: string) => void;
+    /** The real path of a folder, links resolved (Windows hand-off note: checked before and after). */
+    realpath?: (file: string) => string;
+    /**
+     * Open a file once and read it through that handle, with what `fstat` says about the very file
+     * opened (Windows service key: no re-open between the check and the read). Undefined: not there.
+     */
+    readHandle?: (file: string) => {
+        isFile: boolean;
+        nlink: number;
+        text: string;
+    } | undefined;
     exists?: (file: string) => boolean;
     mkdir?: (dir: string, mode: number) => void;
     /** Seams for waiting on a re-install's previous service to stop (macOS). */
@@ -138,6 +158,11 @@ export interface DedicatedSetup {
     claudeTokenFile?: string;
     /** The invoking user's `PROHOST_HOME`: its computer credential is copied into the service home if that has none. */
     adoptFrom?: string;
+    /**
+     * That home already handed its computer to this very service (its note names this label): a
+     * reinstall, whose administrators' key copy (Windows) is kept although no credential is handed.
+     */
+    handedOffHere?: boolean;
 }
 /** Validate a spec before anything is written. */
 export declare function specProblem(spec: ServiceSpec, io?: InstallIo, setup?: DedicatedSetup): string | undefined;
@@ -145,6 +170,45 @@ export declare function specProblem(spec: ServiceSpec, io?: InstallIo, setup?: D
 export declare function windowsHomesDir(): string;
 /** Where a Windows dedicated install keeps the Claude token: an administrators' folder the account may only read. */
 export declare function windowsTokenPath(spec: Pick<ServiceSpec, 'label'>): string;
+/**
+ * The home (and account) an installed dedicated service runs with, read from its definition —
+ * root's / the administrators' own file (`/Library/LaunchDaemons`, `/etc/systemd/system`,
+ * `ProgramData\\Prohost\\services`) — or undefined when none is installed under `label`. What
+ * an administrator's `unpair` / `uninstall` trusts, never a note in an account's home.
+ */
+export declare function installedDedicatedService(platform: NodeJS.Platform, label: string, io?: InstallIo): {
+    home: string;
+    user?: string;
+} | undefined;
+/**
+ * A dedicated service home's `computer.json` text, when it holds a key, read the safe way for an
+ * administrator: on macOS / Linux as the service's account (`sudo -u` / `runuser … cat`), so a link
+ * the account planted at `host` or `computer.json` reaches only what that account may read itself;
+ * on Windows from the service's administrators-only copy, never from the account's home.
+ */
+export declare function readServiceCredential(platform: NodeJS.Platform, home: string, user: string | undefined, io?: InstallIo, label?: string): string | undefined;
+/**
+ * What a dedicated service last published about its computer (`hosts\\<label>\\state.json`): its id,
+ * `none` when it has published nothing yet (no file, or the `{}` an install starts it with), or
+ * `unreadable` (a read error or JSON that does not parse, even after a retry) — never taken as none.
+ */
+export declare function publishedComputer(spec: Pick<ServiceSpec, 'platform' | 'label'>, io?: InstallIo): {
+    kind: 'published';
+    id: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'unreadable';
+};
+/** The computer id a dedicated service last published, if it did (see `publishedComputer`). */
+export declare function publishedComputerId(spec: Pick<ServiceSpec, 'platform' | 'label'>, io?: InstallIo): string | undefined;
+/**
+ * Write (`content`) or remove (`undefined`) `<home>/host/computer.json` in a home another user
+ * owns — the one a dedicated install took its computer from. As root on macOS / Linux it is done
+ * as the folder's owner (root never writes through a path an account controls); anyone else, and
+ * an administrator on Windows, writes it directly. Returns what went wrong, if anything.
+ */
+export declare function rewriteHomeCredential(platform: NodeJS.Platform, home: string, content: string | undefined, io?: InstallIo): string | undefined;
 /**
  * Create or take over the ProgramData folders a Windows dedicated install
  * uses, top-down: each one is checked for a junction, owned by