@prohost/cli 0.16.3 → 0.16.5

package/dist/host/install.js

@@ -20,11 +20,12 @@
  */
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { buildLaunchdPlist, waitUntilUnloaded } from '../agent/daemon.js';
 import { TERMINAL_SESSIONS_ENV } from '../codehost/settings.js';
+import { SERVICE_LABEL, readSharedObject } from './computer.js';
 export const LAUNCHD_HOST_LABEL = 'ai.prohost.host';
 export const SYSTEMD_HOST_UNIT = 'prohost-host.service';
 export const WINDOWS_TASK_NAME = '\\ProhostAI\\Host';
@@ -46,7 +47,7 @@ export const defaultServiceRunner = (command, args, input) => {
     return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? result.error?.message ?? '' };
 };
 const SERVICE_USER = /^[A-Za-z0-9._-][A-Za-z0-9._ -]{0,63}$/;
-const LABEL = /^[A-Za-z0-9][A-Za-z0-9.-]{0,127}$/;
+const LABEL = SERVICE_LABEL;
 /** Paths for the OS the service is for (tests build every OS's files on one). */
 function joinFor(platform) {
     return platform === 'win32' ? path.win32.join : path.posix.join;
@@ -197,6 +198,15 @@ export function windowsWrapperPath(spec) {
 export function windowsServiceDir(spec) {
     return path.win32.join('C:\\ProgramData\\Prohost\\services', labelOf(spec));
 }
+/**
+ * The administrators' copy of a Windows dedicated service's key (`services\<label>`: the account
+ * may read it, never change it) — what an administrator's `unpair` / `uninstall` reads. Written
+ * when an install creates the service's home; a home installed before 0.16.5 has none, and is
+ * then never handed a note nor unpaired by label (its computer is removed on its page).
+ */
+export function windowsServiceCredentialPath(spec) {
+    return path.win32.join(windowsServiceDir(spec), 'computer.json');
+}
 /** Task Scheduler XML: at logon (personal) or at boot as the service user via S4U (dedicated). */
 export function buildWindowsTaskXml(spec, currentUser) {
     const user = xmlEscape(spec.dedicated && spec.serviceUser ? spec.serviceUser : currentUser);
@@ -267,7 +277,12 @@ function failed(step, outcome) {
 /** Validate a spec before anything is written. */
 export function specProblem(spec, io = {}, setup = {}) {
     if (spec.label !== undefined && !LABEL.test(spec.label)) {
-        return `"${spec.label}" is not a usable label (letters, digits, "." and "-", like ai.prohost.desktop.host).`;
+        return `"${spec.label}" is not a usable label (letters, digits, "." and "-", like ai.prohost.host.office).`;
+    }
+    // A dedicated service is one root may later remove by its label (`host unpair --label`), which
+    // only ever acts on ours: the label says so.
+    if (spec.dedicated && spec.label !== undefined && !spec.label.startsWith(LAUNCHD_HOST_LABEL)) {
+        return `A dedicated service's label starts with ${LAUNCHD_HOST_LABEL} (for example ${LAUNCHD_HOST_LABEL}.office), not "${spec.label}".`;
     }
     if (setup.claudeTokenFile && !spec.dedicated)
         return '--claude-token-file is for a dedicated install (--dedicated).';
@@ -359,6 +374,247 @@ function mkdirOnce(dir) {
         throw err;
     }
 }
+/**
+ * The home (and account) an installed dedicated service runs with, read from its definition —
+ * root's / the administrators' own file (`/Library/LaunchDaemons`, `/etc/systemd/system`,
+ * `ProgramData\\Prohost\\services`) — or undefined when none is installed under `label`. What
+ * an administrator's `unpair` / `uninstall` trusts, never a note in an account's home.
+ */
+export function installedDedicatedService(platform, label, io = {}) {
+    if (!LABEL.test(label))
+        return undefined;
+    const read = reader(io);
+    const unxml = (v) => v.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, '&');
+    if (platform === 'darwin') {
+        const plist = read(path.join('/Library/LaunchDaemons', `${label}.plist`));
+        const home = plist && /<key>WorkingDirectory<\/key>\s*<string>([^<]*)<\/string>/.exec(plist)?.[1];
+        const user = plist && /<key>UserName<\/key>\s*<string>([^<]*)<\/string>/.exec(plist)?.[1];
+        return home ? { home: unxml(home), ...(user ? { user: unxml(user) } : {}) } : undefined;
+    }
+    if (platform === 'linux') {
+        const unit = read(path.join('/etc/systemd/system', systemdUnitOf({ label })));
+        const quoted = unit && /^WorkingDirectory="((?:[^"\\]|\\.)*)"$/m.exec(unit)?.[1];
+        const user = unit && /^User=(\S+)$/m.exec(unit)?.[1];
+        const home = quoted?.replace(/%%/g, '%').replace(/\\(.)/g, '$1');
+        return home ? { home, ...(user ? { user } : {}) } : undefined;
+    }
+    if (platform === 'win32') {
+        const wrapper = read(path.win32.join(windowsServiceDir({ label }), 'host-service.cmd'));
+        const home = wrapper && /^set "PROHOST_HOME=([^"\r\n]*)"\r?$/m.exec(wrapper)?.[1];
+        return home ? { home: home.replace(/%%/g, '%') } : undefined;
+    }
+    return undefined;
+}
+/**
+ * A dedicated service home's `computer.json` text, when it holds a key, read the safe way for an
+ * administrator: on macOS / Linux as the service's account (`sudo -u` / `runuser … cat`), so a link
+ * the account planted at `host` or `computer.json` reaches only what that account may read itself;
+ * on Windows from the service's administrators-only copy, never from the account's home.
+ */
+export function readServiceCredential(platform, home, user, io = {}, label) {
+    const join = joinFor(platform);
+    const dir = join(home, 'host');
+    const file = join(dir, 'computer.json');
+    const uid = io.uid ?? process.getuid?.() ?? 1;
+    if (platform === 'win32') {
+        // Never from the account's home (it can swap a junction in there while an administrator opens
+        // a path, and Windows can't read as the account): from the copy the install put in the
+        // service's administrators-only folder (`windowsServiceCredentialPath`), read through one handle.
+        if (!label)
+            return undefined;
+        const opened = (() => {
+            try {
+                return (io.readHandle ?? readThroughHandle)(windowsServiceCredentialPath({ label }));
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        if (!opened || !opened.isFile || opened.nlink !== 1)
+            return undefined;
+        return keyedCredential(opened.text);
+    }
+    if (uid !== 0 || !user)
+        return keyedCredential(reader(io)(file));
+    const read = asUser(io.run ?? defaultServiceRunner, platform, user, 'cat "$1"', [file]);
+    return read.status === 0 ? keyedCredential(read.stdout) : undefined;
+}
+/**
+ * What a dedicated service last published about its computer (`hosts\\<label>\\state.json`): its id,
+ * `none` when it has published nothing yet (no file, or the `{}` an install starts it with), or
+ * `unreadable` (a read error or JSON that does not parse, even after a retry) — never taken as none.
+ */
+export function publishedComputer(spec, io = {}) {
+    const file = joinFor(spec.platform)(sharedDirFor(spec), 'state.json');
+    const parse = () => {
+        if (io.readFile) {
+            const text = io.readFile(file);
+            return text === undefined ? null : JSON.parse(text);
+        }
+        if (!(io.exists ?? existsSync)(file))
+            return null;
+        // The service rewrites it in place: a read caught mid-write is tried again (`readSharedObject`).
+        const state = readSharedObject(file);
+        if (state === undefined)
+            throw new Error('unreadable');
+        return state;
+    };
+    let state;
+    try {
+        state = parse();
+    }
+    catch {
+        return { kind: 'unreadable' };
+    }
+    if (state === null)
+        return { kind: 'none' };
+    if (typeof state !== 'object' || Array.isArray(state))
+        return { kind: 'unreadable' };
+    const id = state.computer?.id;
+    return typeof id === 'string' && id ? { kind: 'published', id } : { kind: 'none' };
+}
+/** The computer id a dedicated service last published, if it did (see `publishedComputer`). */
+export function publishedComputerId(spec, io = {}) {
+    const published = publishedComputer(spec, io);
+    return published.kind === 'published' ? published.id : undefined;
+}
+/** One open: `fstat` and the text read through the same descriptor. */
+function readThroughHandle(file) {
+    let fd;
+    try {
+        fd = openSync(file, 'r');
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const stat = fstatSync(fd);
+        return { isFile: stat.isFile(), nlink: stat.nlink, text: stat.isFile() ? readFileSync(fd, 'utf8') : '' };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** `computer.json`'s text when it holds a computer key — never a hand-off note (`ComputerHandoff`), which is copied nowhere. */
+function keyedCredential(text) {
+    if (!text)
+        return undefined;
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed.api_key === 'string' && parsed.api_key && typeof parsed.computer_id === 'string' ? text : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Write (`content`) or remove (`undefined`) `<home>/host/computer.json` in a home another user
+ * owns — the one a dedicated install took its computer from. As root on macOS / Linux it is done
+ * as the folder's owner (root never writes through a path an account controls); anyone else, and
+ * an administrator on Windows, writes it directly. Returns what went wrong, if anything.
+ */
+export function rewriteHomeCredential(platform, home, content, io = {}) {
+    const join = joinFor(platform);
+    const dir = join(home, 'host');
+    const file = join(dir, 'computer.json');
+    const run = io.run ?? defaultServiceRunner;
+    const uid = io.uid ?? process.getuid?.() ?? 1;
+    if (platform === 'win32') {
+        // An administrator in someone else's home: never through a junction or link the account
+        // could have put there (`isSymlink` is true for both), and a fresh file renamed into place.
+        // Windows offers no owner-run write here the way `sudo -u` does elsewhere: the folders' real
+        // paths are checked before the write, between it and the rename, and after. That narrows a
+        // folder swapped in between, it does not close it (best effort; a delete has one check).
+        const isSymlink = io.isSymlink ?? ((f) => {
+            try {
+                return lstatSync(f).isSymbolicLink();
+            }
+            catch {
+                return false;
+            }
+        });
+        const linked = [home, dir, file, `${file}.handoff`].find((f) => isSymlink(f));
+        if (linked)
+            return `${linked} is a link or junction`;
+        // The folders are where they say they are: checked right before the write and again after it.
+        const real = io.realpath ?? ((f) => realpathSync.native(f));
+        const inPlace = () => {
+            try {
+                const realHome = real(home);
+                if (path.win32.resolve(realHome).toLowerCase() !== path.win32.resolve(home).toLowerCase())
+                    return `${home} resolves to ${realHome}`;
+                const realDir = real(dir);
+                if (path.win32.resolve(realDir).toLowerCase() !== path.win32.join(path.win32.resolve(realHome), 'host').toLowerCase())
+                    return `${dir} resolves to ${realDir}`;
+                return undefined;
+            }
+            catch (e) {
+                return e instanceof Error ? e.message : String(e);
+            }
+        };
+        const before = inPlace();
+        if (before)
+            return before;
+        try {
+            const remove = io.removeFile ?? ((f) => rmSync(f, { force: true }));
+            if (content === undefined) {
+                remove(file);
+                return undefined;
+            }
+            remove(`${file}.handoff`);
+            writer(io)(`${file}.handoff`, content, 0o600, 'wx');
+            const between = inPlace();
+            if (between)
+                return `${between} (moved while writing: nothing renamed)`;
+            (io.rename ?? renameSync)(`${file}.handoff`, file);
+            const after = inPlace();
+            if (after)
+                return `${after} (moved while writing: check ${file} by hand)`;
+            return undefined;
+        }
+        catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+    if (uid !== 0) {
+        try {
+            if (content === undefined)
+                (io.removeFile ?? ((f) => rmSync(f, { force: true })))(file);
+            else
+                writer(io)(file, content, 0o600);
+            return undefined;
+        }
+        catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+    const owner = io.ownerOf?.(dir) ?? ownerOf(dir);
+    if (!owner)
+        return `${dir} is not there`;
+    if (owner.link)
+        return `${dir} is a link`;
+    if (owner.uid === 0) {
+        try {
+            if (content === undefined)
+                rmSync(file, { force: true });
+            else
+                writer(io)(file, content, 0o600);
+            return undefined;
+        }
+        catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+    const name = run('id', ['-nu', String(owner.uid)]);
+    const user = name.stdout.trim();
+    if (name.status !== 0 || !user)
+        return failed(`finding the owner of ${dir}`, name);
+    const done = content === undefined
+        ? asUser(run, platform, user, 'rm -f "$1"', [file])
+        : // A fresh file beside it (noclobber), then renamed over: never written through.
+            asUser(run, platform, user, 'rm -f "$1.handoff" && set -C && cat > "$1.handoff" && mv -f "$1.handoff" "$1"', [file], content);
+    return done.status === 0 ? undefined : failed(`${content === undefined ? 'removing' : 'rewriting'} ${file} as ${user}`, done);
+}
 function ownerOf(file) {
     try {
         const stat = lstatSync(file);
@@ -487,7 +743,7 @@ function prepareDedicated(spec, io, setup) {
         return problem;
     const hostDir = join(spec.home, 'host');
     const credential = setup.adoptFrom && path.resolve(setup.adoptFrom) !== path.resolve(spec.home)
-        ? read(join(setup.adoptFrom, 'host', 'computer.json'))
+        ? keyedCredential(read(join(setup.adoptFrom, 'host', 'computer.json')))
         : undefined;
     let token;
     if (setup.claudeTokenFile) {
@@ -517,6 +773,13 @@ function prepareDedicated(spec, io, setup) {
         // in one step with no access for the account, filled, and only then opened to it — so it can
         // never swap a path in it while an administrator writes there. An existing one is never
         // written into; a --service-home elsewhere is the account's own business.
+        // No computer handed to this install (and not a reinstall of the one handed to it before): no
+        // administrators' copy of an older one may outlive it.
+        if (!credential && !setup.handedOffHere) {
+            const copy = windowsServiceCredentialPath(spec);
+            if (exists(copy))
+                remove(copy);
+        }
         if (path.win32.resolve(path.win32.dirname(spec.home)) === path.win32.resolve(windowsHomesDir())) {
             const made = (io.mkdirOnce ?? mkdirOnce)(spec.home);
             if (made === 'exists') {
@@ -525,6 +788,13 @@ function prepareDedicated(spec, io, setup) {
                 const owner = windowsOwner(run, spec.home);
                 if (!/\\(Administrators|SYSTEM)$/i.test(owner))
                     return `${spec.home} is owned by ${owner || 'someone else'}: remove it, then install again.`;
+                // A computer handed to a home that already exists but has no administrators' copy of its key
+                // (uninstalled before, or installed before 0.16.5): nothing here could vouch for the key in
+                // it, so it would run without the hand-off. A fresh home gets both.
+                // (A copy that is there but holds no usable key, e.g. an interrupted write, counts as none.)
+                if (credential && !setup.handedOffHere && !keyedCredential(read(windowsServiceCredentialPath(spec)))) {
+                    return `${spec.home} is left from an earlier install and has no administrators' copy of its key: remove that folder, then install again.`;
+                }
             }
             else {
                 for (const args of [
@@ -536,8 +806,14 @@ function prepareDedicated(spec, io, setup) {
                         return failed(`icacls ${args.slice(0, 2).join(' ')}`, out);
                 }
                 mkdir(hostDir, 0o700);
-                if (credential)
+                if (credential) {
                     write(join(hostDir, 'computer.json'), credential, 0o600, 'wx');
+                    // The administrators' copy, in the folder just claimed: what root-level commands read.
+                    const copy = windowsServiceCredentialPath(spec);
+                    if (exists(copy))
+                        remove(copy);
+                    write(copy, credential, 0o600, 'wx');
+                }
             }
             // The account may now use its home.
             const open = run('icacls', [spec.home, '/grant', `${user}:(OI)(CI)M`]);
@@ -654,8 +930,13 @@ export function installService(spec, io = {}, setup = {}) {
         const plist = buildHostPlist(spec);
         const loaded = run('launchctl', ['print', `${domain}/${label}`]).status === 0;
         // Re-running it changes nothing that is already right: the service keeps
-        // working through every app update that didn't move it.
+        // working through every app update that didn't move it. Enablement is
+        // persistent state separate from whether launchd currently has the job
+        // loaded, so repair it before returning through this fast path.
         if (loaded && read(file) === plist) {
+            const enable = run('launchctl', ['enable', `${domain}/${label}`]);
+            if (enable.status !== 0)
+                return { ok: false, file, message: `Wrote ${file}, but ${failed('launchctl enable', enable)}` };
             return { ok: true, file, message: `✓ ${label} is installed and running (${file})\n  logs: ${logs}` };
         }
         write(file, plist, spec.dedicated ? 0o644 : 0o600);
@@ -673,12 +954,15 @@ export function installService(spec, io = {}, setup = {}) {
                 timeoutMs: RESTART_WAIT_MS,
                 onWaiting: (line) => process.stderr.write(`${line.replace('agent', 'host service')}\n`),
             });
+        // A disabled label cannot load: enabling must succeed before bootstrap.
+        const enable = run('launchctl', ['enable', `${domain}/${label}`]);
+        if (enable.status !== 0)
+            return { ok: false, file, message: `Wrote ${file}, but ${failed('launchctl enable', enable)}` };
         const boot = run('launchctl', ['bootstrap', domain, file]);
         if (boot.status !== 0) {
             const still = oldGone ? '' : ` (the previous host service was still finishing its runs after ${RESTART_WAIT_MS / 1000}s)`;
             return { ok: false, file, message: `Wrote ${file}, but ${failed('launchctl bootstrap', boot)}${still}` };
         }
-        run('launchctl', ['enable', `${domain}/${label}`]);
         return { ok: true, file, message: `✓ Installed ${label} (${file})\n  logs: ${logs}` };
     }
     if (spec.platform === 'linux') {
@@ -768,6 +1052,32 @@ export function uninstallService(spec, io = {}) {
             if (exists(file))
                 remove(file);
         }
+        // The administrators' copy of its key goes with the service: a reinstall never finds an old one.
+        const copy = windowsServiceCredentialPath(spec);
+        if (out.status === 0 && exists(copy)) {
+            try {
+                remove(copy);
+            }
+            catch (e) {
+                notes.push(`could not delete ${copy} (${e instanceof Error ? e.message : String(e)}): delete it yourself`);
+            }
+        }
+    }
+    // A dedicated service gone: its published state goes too, so nothing (the desktop's note check)
+    // reads a service that ran once as one that is installed.
+    // (Windows: a task by that label, removed with or without --dedicated; only a dedicated one publishes state.)
+    const dedicatedGone = spec.platform === 'win32'
+        ? removed.length > 0
+        : removed.some((file) => file === serviceFilePath({ ...spec, dedicated: true }));
+    if (dedicatedGone) {
+        const state = joinFor(spec.platform)(sharedDirFor(spec), 'state.json');
+        try {
+            if (exists(state))
+                remove(state);
+        }
+        catch {
+            /* the next install rewrites it */
+        }
     }
     if (removed.length === 0 && notes.length === 0) {
         return { ok: true, message: 'No host service was installed. Nothing to remove.' };

package/dist/host/migrate.js

@@ -49,7 +49,7 @@ import { loadCredentials, prohostHome } from '../agent/credentials.js';
 import { LAUNCHD_LABEL_PREFIX } from '../agent/daemon.js';
 import { resolveAgentAccount } from '../agent/accounts.js';
 import { PAIRING_ADOPT_PATH, callJson } from './api.js';
-import { machineFacts } from './computer.js';
+import { handoffNotice, machineFacts, readHandoff } from './computer.js';
 import { credentialsFrom } from './pair.js';
 import { isCodexExec } from '../agent/codex.js';
 import { SessionStore } from '../agent/sessionstore.js';
@@ -328,6 +328,10 @@ export async function adoptComputer(options) {
     const env = options.env ?? process.env;
     if (tryLoadComputer(env))
         return { status: 'already_paired' };
+    // Handed to a dedicated service: never a second key over its note.
+    const handedOff = readHandoff(env);
+    if (handedOff)
+        return { status: 'not_adopted', reason: handoffNotice(handedOff) };
     let facts;
     try {
         facts = options.facts ?? machineFacts({ env, name: options.name });

package/dist/host/pair.d.ts

@@ -21,7 +21,7 @@
  */
 import type { ProhostAccount } from '../agent/credentials.js';
 import type { ComputerCredentials, MachineFacts } from './computer.js';
-export declare const HOST_PAIR_OUTCOMES: readonly ["paired", "expired", "token_rejected", "workspace_unconfirmed", "declined", "rate_limited", "unreachable", "invalid_arguments", "failed"];
+export declare const HOST_PAIR_OUTCOMES: readonly ["paired", "expired", "token_rejected", "workspace_unconfirmed", "declined", "rate_limited", "unreachable", "invalid_arguments", "handed_off", "failed"];
 export type HostPairOutcome = (typeof HOST_PAIR_OUTCOMES)[number];
 export interface HostPairResult {
     version: 1;

package/dist/host/pair.js

@@ -38,6 +38,8 @@ export const HOST_PAIR_OUTCOMES = [
     'rate_limited',
     'unreachable',
     'invalid_arguments',
+    /** This home handed its computer to a dedicated service (`host install --dedicated`): it pairs nothing. */
+    'handed_off',
     'failed',
 ];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/host/scheduler.d.ts

@@ -67,8 +67,12 @@ export declare class HostScheduler<T extends QueuedRun = QueuedRun> {
      * run keeps its place and does not block the others.
      *
      * Taking it marks it running; call {@link finish} when it is done.
+     *
+     * A `parked` run (one the server said must wait for another turn of its conversation) neither
+     * starts nor holds its lane: the next run of the lane — possibly the very turn it waits for —
+     * is the lane's candidate instead. Runs of one lane still never run side by side.
      */
-    take(config: SchedulerConfig, eligible?: (run: T) => boolean): T | undefined;
+    take(config: SchedulerConfig, eligible?: (run: T) => boolean, parked?: (run: T) => boolean): T | undefined;
     /** A started run is done. */
     finish(runId: string): void;
     /** A taken run could not start after all: back in the queue, in its old place. */

package/dist/host/scheduler.js

@@ -66,14 +66,20 @@ export class HostScheduler {
      * run keeps its place and does not block the others.
      *
      * Taking it marks it running; call {@link finish} when it is done.
+     *
+     * A `parked` run (one the server said must wait for another turn of its conversation) neither
+     * starts nor holds its lane: the next run of the lane — possibly the very turn it waits for —
+     * is the lane's candidate instead. Runs of one lane still never run side by side.
      */
-    take(config, eligible = () => true) {
+    take(config, eligible = () => true, parked = () => false) {
         if (config.held)
             return undefined;
         const busyLanes = new Set([...this.running.values()].map((r) => r.lane));
         const seenLanes = new Set();
         const candidates = [];
         for (const run of this.queue) {
+            if (parked(run))
+                continue;
             // Only the oldest run of each lane is a candidate: later ones wait their turn.
             if (seenLanes.has(run.lane))
                 continue;

package/dist/host/service.d.ts

@@ -112,6 +112,11 @@ export interface HostServiceResult {
     runsStarted: number;
     runsSkipped: number;
 }
+/**
+ * How long a run whose conversation is busy waits before it is claimed again, unless the server
+ * sends its frame first (it does when the earlier turn ends): 30 s, doubling, at most 2 min.
+ */
+export declare function busyBackoffMs(waits: number): number;
 /** The CLI's own entry file: when it changes on disk, an update was installed. */
 export declare function entrypointStamp(entry?: string): () => boolean;
 export declare function runHostService(options: HostServiceOptions): Promise<HostServiceResult>;

package/dist/host/service.js

@@ -38,7 +38,7 @@ import { HeartbeatLoop } from '../agent/heartbeat.js';
 import { executeHostedRun } from '../agent/run.js';
 import { SessionStore, sessionKeyFor } from '../agent/sessionstore.js';
 import { verifySignature } from '../agent/signature.js';
-import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, REMOTE_TERMINAL_CAPABILITY, RefusedDeliveryError, } from '../codehost/host.js';
+import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_RESTART_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, REMOTE_TERMINAL_CAPABILITY, RefusedDeliveryError, } from '../codehost/host.js';
 import { HostStatsSampler } from '../codehost/host_stats.js';
 import { TERMINAL_SESSIONS_ENV, loadSettings as loadCodeHostSettings, recordServiceSwitch } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
@@ -82,6 +82,13 @@ const ACK_RETRY = 503;
 const RECONNECT_MAX_DELAY_MS = 30_000;
 /** An employee id names a folder: nothing else gets in. */
 const SAFE_ID = /^[A-Za-z0-9-]{1,64}$/;
+/**
+ * How long a run whose conversation is busy waits before it is claimed again, unless the server
+ * sends its frame first (it does when the earlier turn ends): 30 s, doubling, at most 2 min.
+ */
+export function busyBackoffMs(waits) {
+    return Math.min(30_000 * 2 ** waits, 120_000);
+}
 function timestamp() {
     return new Date().toISOString().slice(11, 19);
 }
@@ -241,8 +248,12 @@ async function serveHost(options) {
         if (codeHost?.authorized() && config.terminal_sessions_enabled) {
             caps.push(CODE_THREADS_CAPABILITY, CODE_THREAD_FOLDERS_CAPABILITY, codeHost.instanceCapability());
             caps.push(...(codeHost.agentCapabilities?.() ?? []));
-            if (codeHost.remoteTerminalAllowed())
+            if (codeHost.remoteTerminalAllowed()) {
                 caps.push(REMOTE_TERMINAL_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY);
+                // Relaunching a running thread's agent without prompts (`code_thread.restart_requested`): the same rule.
+                if (codeHost.handleRestart)
+                    caps.push(CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY);
+            }
         }
         return caps;
     }
@@ -260,6 +271,8 @@ async function serveHost(options) {
     }
     /** Runs being claimed right now, and the login each will run on. */
     const claiming = new Map();
+    /** Runs the server resent while their claim was in flight: a `conversation_busy` answer to that claim is already stale. */
+    const resentWhileClaiming = new Set();
     function runsOnLogin(accountKey) {
         let n = 0;
         for (const run of active.values())
@@ -489,7 +502,9 @@ async function serveHost(options) {
                     return false;
                 const pick = pool.pick(runtimeOf(run.agentId, run.data), conversationOf(run.lane), config.share_logins[runtimeOf(run.agentId, run.data)], runsOnLogin);
                 return pick.kind === 'use' || pick.kind === 'move';
-            });
+            }, 
+            // Waiting on an earlier turn of its conversation: that turn may be queued behind it.
+            (run) => Boolean(run.busyWaits) && run.notBefore > now());
             if (!next)
                 break;
             background.push(startRun(next));
@@ -516,6 +531,19 @@ async function serveHost(options) {
         const claim = await claimRun(computerApi, computer.computer_id, queued.runId).finally(() => {
             claiming.delete(queued.runId);
         });
+        const resent = resentWhileClaiming.delete(queued.runId);
+        if (claim.kind === 'busy' && !draining) {
+            // Serialized server-side: an earlier turn of this conversation is still open. Not dropped,
+            // not failed: queued again (its slot is free for other work) until the server resends its
+            // frame, or its backoff ends. A resend that came while this claim was in flight already
+            // said the earlier turn ended: claimed again at once.
+            const waits = queued.busyWaits ?? 0;
+            scheduler.requeue({ ...queued, busyWaits: waits + 1, notBefore: resent ? 0 : now() + busyBackoffMs(waits) });
+            if (waits === 0)
+                log(`${timestamp()} ◦ run ${queued.runId.slice(0, 12)} waits — an earlier turn of its conversation is still open`);
+            pump();
+            return;
+        }
         if (claim.kind !== 'claimed') {
             if (claim.kind === 'retry' && queued.claimAttempts + 1 < MAX_CLAIM_ATTEMPTS && !draining) {
                 scheduler.requeue({ ...queued, claimAttempts: queued.claimAttempts + 1, notBefore: now() + 2_000 * 2 ** queued.claimAttempts });
@@ -525,7 +553,7 @@ async function serveHost(options) {
                 result.runsSkipped += 1;
                 const why = claim.kind === 'elsewhere'
                     ? 'another computer has it'
-                    : claim.kind === 'gone'
+                    : claim.kind === 'gone' || claim.kind === 'busy'
                         ? 'it is no longer waiting'
                         : `the claim was refused (${claim.status}${'error' in claim && claim.error ? `: ${claim.error}` : ''})`;
                 log(`${timestamp()} ◦ run ${queued.runId.slice(0, 12)} skipped — ${why}`);
@@ -948,7 +976,8 @@ async function serveHost(options) {
                 }
                 if (frame.event === EVENT_CODE_THREAD_START_REQUESTED ||
                     frame.event === EVENT_CODE_THREAD_INPUT_REQUESTED ||
-                    frame.event === EVENT_CODE_THREAD_APPROVAL_DECIDED) {
+                    frame.event === EVENT_CODE_THREAD_APPROVAL_DECIDED ||
+                    frame.event === EVENT_CODE_THREAD_RESTART_REQUESTED) {
                     if (!codeHost || !config.terminal_sessions_enabled) {
                         ack(ACK_IGNORED);
                         return;
@@ -980,7 +1009,9 @@ async function serveHost(options) {
                         ? codeHost.handleStart(data)
                         : frame.event === EVENT_CODE_THREAD_INPUT_REQUESTED
                             ? codeHost.handleInput(data, frame.delivery_id)
-                            : codeHost.handleApproval(data, frame.delivery_id);
+                            : frame.event === EVENT_CODE_THREAD_RESTART_REQUESTED
+                                ? (codeHost.handleRestart?.(data, frame.delivery_id) ?? Promise.resolve(false))
+                                : codeHost.handleApproval(data, frame.delivery_id);
                     background.push(handled
                         .then((ok) => {
                         ack(starting || ok ? ACK_ACCEPTED : ACK_IGNORED);
@@ -1016,8 +1047,19 @@ async function serveHost(options) {
             return [ACK_IGNORED];
         if (typeof data.computer_id === 'string' && data.computer_id !== computer.computer_id)
             return [ACK_IGNORED];
-        if (scheduler.has(runId) || active.has(runId) || ledger.get(runId))
+        if (scheduler.has(runId) || active.has(runId) || ledger.get(runId)) {
+            // The server's resend of a run waiting on its busy conversation: the earlier turn ended, so
+            // it is claimed now rather than at the end of its backoff.
+            const waiting = scheduler.queued().find((run) => run.runId === runId);
+            if (waiting?.busyWaits && waiting.notBefore > now()) {
+                waiting.notBefore = 0;
+                pump();
+            }
+            else if (claiming.has(runId)) {
+                resentWhileClaiming.add(runId);
+            }
             return [ACK_ACCEPTED];
+        }
         if (draining)
             return [ACK_RETRY, 'draining'];
         if (!config.ai_employees_enabled)

package/dist/index.js

@@ -33,6 +33,7 @@ function printHelp() {
         '  prohost host pair [--name <name>] [--token <redeem-token>|-] [--expect-account <workspace-id>]',
         '                    Add this computer to a workspace (prints a code to enter in ProhostAI)',
         '  prohost host unpair                  Remove this computer from its workspace (revokes its key)',
+        '  sudo prohost host unpair --label <id> [--service-user <name>]   Remove a dedicated service\'s computer and uninstall it',
         '  prohost host run                     One service for every AI employee placed on this computer',
         '  prohost host install [--label <id>] [--dedicated --service-user <name> [--service-home <dir>]',
         '                       [--claude-token-file <path>] [--remote-terminal|--no-remote-terminal]] | uninstall [--label <id>]',
@@ -81,7 +82,10 @@ function printHelp() {
         '                   or one derived from $PROHOST_HOME. Re-running install changes nothing that is right.',
         '  Under the ProhostAI desktop app, host install keeps ELECTRON_RUN_AS_NODE=1 in the service it writes',
         '                   (and the PATH it was launched with), so the service runs the CLI, never the app.',
-        '  `host unpair` removes this computer from its workspace and deletes its key here.',
+        '  `host unpair` removes this computer from its workspace and deletes its key here. A dedicated install',
+        '                   takes the key over: the home it came from keeps a note instead, and `unpair` there',
+        '                   points at `sudo prohost host unpair --label <id>`, which uses the service\'s key, uninstalls',
+        '                   the service and clears both homes.',
         '  `host logins add` signs in another Claude Code / Codex login in this terminal.',
         '  `host pause` takes no new work until `host resume`; work already going finishes.',
         '  `host migrate` adopts existing agent homes and the desktop app\'s terminal-hosting home, keeping',