@prohost/cli 0.16.4 → 0.16.6

package/CHANGELOG.md

@@ -6,6 +6,58 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.6
+
+- **A hand-off note that can't be written undoes the dedicated install.** The note is part of the
+  takeover: without it the computer's key stayed in both homes, and a plain `host unpair` in the
+  original one would remove the computer under the running service. Now the service is
+  uninstalled and the key the install copied is removed (on Windows its administrators' copy too),
+  and the install fails with what to fix. A service home that already held the key before keeps
+  it, and the install still fails.
+
+## 0.16.5
+
+- **A dedicated install takes the computer's key over.** `sudo prohost host install --dedicated`
+  used to leave a live copy of the key in the home it took the computer from, so an `unpair`
+  there removed the computer under the service and a personal `install` ran it twice. Once the
+  service home has the computer, that home keeps only a note of where it went (no key, written as
+  its owner; `code_host_home` kept for the desktop app). `host status` there still reads paired
+  (that computer, offline here) and reports `handed_to`;
+  `unpair`, `pair` and a personal `install` refuse and name the service. A note that can't be
+  written is reported loudly; a failed install leaves the key where it was.
+- **`sudo prohost host unpair --label <id>`** removes a dedicated service's computer with the
+  service's own key, uninstalls that service and clears both homes; nothing changes when the
+  server refuses.
+- **`sudo prohost host uninstall --label <id>`** gives the key back to the home the service took it
+  from (`prohost host install` runs it there again). `unpair --label` trusts only the service's
+  installed definition (one of our labels; its home must be the account's own folder, no link)
+  and refuses a note that disagrees; a label taken from the note acts only on the service that
+  runs the note's computer. On Windows the note's folders are re-checked (real paths) before,
+  during and after the write (best effort: it narrows a folder swapped in between, it does not
+  close it). A dedicated label starts with `ai.prohost.host`. Root reads a service home's key as
+  the service's account; on Windows a dedicated install keeps an administrators-only copy of the
+  key in `ProgramData\Prohost\services\<label>`, the only place an administrator's unpair /
+  uninstall reads it (one handle: a plain file, nlink 1), and only while the service still
+  publishes that computer; it goes with the service, and a dedicated install handed no computer
+  leaves none behind. Uninstalling a dedicated service removes
+  its published state. `host run` and `host migrate` respect the note.
+- **Desktop:** a hand-off note makes the app treat this computer as dedicated (and records its
+  label), even when the dedicated install ran from a terminal. "Remove this computer" for a
+  computer dedicated that way runs the labelled unpair through the administrator prompt, never
+  deletes the note, and says so when the computer still runs.
+- **Restart a terminal's agent without permission prompts.** `code_thread.restart_requested`
+  relaunches a thread's Claude Code or Codex in its own tmux window and folder (`respawn-pane -k`:
+  the window, its viewers and its size stay), with the flags and `--settings` documents a start that
+  skips prompts gets. It resumes exactly the session the window's hooks recorded (they now write
+  `code-host/state/<terminal>.session`: Claude Code's `session_id`, Codex's `thread-id`, and the
+  login) with `claude --resume <id>` / `codex resume <id>`; a Claude session with no conversation yet
+  starts fresh; only a worktree this host made falls back to `--continue` / `resume --last`. Refused
+  (`409`) with remote control off, a gone window, a shell, an unknown session in a shared folder
+  (`session_unknown`), another or no login (`login_changed`, `login_unavailable`), or past 10 minutes
+  (`restart_expired`); a redelivery of one done is acked as done. Declared as
+  `code_thread_restart_skip_permissions` beside `code_thread_skip_permissions`.
+- Enable disabled macOS services before loading them, and report enable failures instead of claiming the install succeeded.
+
 ## 0.16.4
 
 - **`409 conversation_busy` on claim** (ProhostAI serializes a conversation's turns): the run

package/README.md

@@ -70,7 +70,8 @@ paired that way.
 | `host pair --token <redeem_token>` | Redeems a one-time token from the signed-in desktop app instead (`--token -` reads it from stdin; `$PROHOST_REDEEM_TOKEN` also works). The token is never printed. |
 | `host run [--machine <n>] [--timeout <s>] [--idle-timeout <s>] [--workload coding\|chat]` | The service, in the foreground. |
 | `host install [--label <id>] [--dedicated --service-user <name> [--service-home <dir>] [--claude-token-file <path>]]` / `host uninstall [--label <id>]` | The background service for this OS (below). Safe to re-run: nothing that is already right is touched. |
-| `host unpair` | Remove this computer from its workspace (`DELETE /v1/computers/{id}` with its own key), then delete `computer.json`. Exits 0 only when the server removed it, or had already. |
+| `host unpair` | Remove this computer from its workspace (`DELETE /v1/computers/{id}` with its own key), then delete `computer.json`. Exits 0 only when the server removed it, or had already. In a home that handed its computer to a dedicated service it refuses and names the service. |
+| `sudo prohost host unpair --label <id> [--service-user <name>] [--from-home <dir>]` | Remove a dedicated service's computer: as root / an administrator, with the key in the service's own home; then uninstall that service (stopped, its definition removed) and delete the key there and the hand-off note in the home it came from. Nothing changes when the server refuses. The label must be one of ours with an installed definition; the service's home and account come from that definition only (the home must be the account's own folder, no link), and a note that disagrees with it is refused. `--dedicated` without `--label` takes the label from this home's note, and then acts only when that service runs the note's computer. |
 | `host status [--json] [--label <id>]` | Online, paused, capacity, what is running, AI logins, hardware, recent events. Always exits 0. |
 | `host logins [--json]` | The AI logins found on this machine, with their plan and (locally only) email. |
 | `host logins add --runtime claude_code\|codex [--label <l>]` | A new AI login in its own config directory (`~/.prohost-accounts`), signed in right here (`claude auth login` / `codex login`). |
@@ -241,7 +242,17 @@ runs per `PROHOST_HOME` (`host/service.lock`); a second one refuses to start.
 The systemd unit uses `KillMode=mixed`, so a stop reaches the host first and its
 runs can finish. Re-installing on macOS waits for the previous service to finish
 draining (up to its 10-minute stop timeout) before loading the new one. A dedicated install hands the service user's `PROHOST_HOME` to
-that user (`chown`); on Windows it checks for an elevated prompt first. **Updates drain:**
+that user (`chown`); on Windows it checks for an elevated prompt first. **One key, one
+holder:** once the service home has the computer, the home it was taken from (`--from-home`,
+or `$SUDO_USER`'s) keeps only a note — `{handed_to: {label, service_user, service_home, at},
+computer_id, name, account, code_host_home?}`, no key — written as that home's owner.
+`host status` there reports `handed_to`; `unpair`, `pair` and a personal `install` refuse and
+name the service. The note is part of the takeover: if it can't be written, the install is
+undone (the service uninstalled, the key it copied removed) and fails, so the key is never left in
+both homes; a failed install leaves the key where it was. `sudo prohost host uninstall --label <id>` gives the key back to
+that home (so `prohost host install` runs it there again); `sudo prohost host unpair --label <id>`
+removes the computer. Both read the service's home from its installed definition (root's file),
+never from the note, which the home's owner can edit. **Updates drain:**
 when a newer CLI is installed over the running one (or the service is told to
 stop), it takes no new work, lets the runs going finish, then exits (code 75
 after an update) for the service manager to start the new one. A second
@@ -297,7 +308,10 @@ start it again. `--dry-run` shows what it would do; `--json` prints the report.
   `service` says whether a service runs for this home (`host/service.lock`), how
   many homes it adopted, and — with `--label <id>` of a dedicated service — that
   it is the dedicated service (`activity_file` is then its shared copy).
-  `remote_terminal` says whether remote terminal sessions are on.
+  `remote_terminal` says whether remote terminal sessions are on. `handed_to`
+  (`{label, service_user, service_home}`) is there when this home gave its computer
+  to a dedicated service: it then reads `paired: true` with that computer and
+  `online: false` here — ask the service with `--label`.
 - `host logins --json` → `{logins: [...same shape as status...]}`.
 - `$PROHOST_HOME/host/activity.json` → `{v: 1, busy, running: [...as in status...], updatedAt}`.
 - `$PROHOST_HOME/host/state.json` is the service's own state (0600); read

package/dist/agent/daemon.js

@@ -282,6 +282,18 @@ export function installLaunchdDaemon(spec, options = {}) {
         timeoutMs: options.exitTimeoutMs ?? OLD_JOB_EXIT_TIMEOUT_MS,
         onWaiting: options.onWaiting ?? ((line) => process.stderr.write(`${line}\n`)),
     });
+    // A disabled label cannot load: enabling must succeed before bootstrap.
+    const enable = run('launchctl', ['enable', `${domain}/${spec.label}`]);
+    if (enable.status !== 0) {
+        return {
+            ok: false,
+            plistPath,
+            message: `Wrote ${plistPath}, but \`launchctl enable ${domain}/${spec.label}\` failed` +
+                `${enable.stderr.trim() ? `: ${enable.stderr.trim()}` : ` (exit ${String(enable.status)})`}\n` +
+                `Enable it by hand with: launchctl enable ${domain}/${spec.label}\n` +
+                `Then rerun installation, or load the written plist with: launchctl bootstrap ${domain} ${plistPath}`,
+        };
+    }
     const bootstrap = run('launchctl', ['bootstrap', domain, plistPath]);
     if (bootstrap.status !== 0) {
         return {
@@ -293,7 +305,6 @@ export function installLaunchdDaemon(spec, options = {}) {
                 `Load it by hand with: launchctl bootstrap ${domain} ${plistPath}`,
         };
     }
-    run('launchctl', ['enable', `${domain}/${spec.label}`]);
     return {
         ok: true,
         plistPath,

package/dist/agent/run.js

@@ -53,7 +53,7 @@ import { SessionStore, sessionKeyFor } from './sessionstore.js';
 import { verifySignature } from './signature.js';
 import { VENUE_RUN_TOKEN_CAPABILITY, apiForRun, claudeSupportsVenueSessions, claudeVenueCommand, VENUE_PROGRESS, VENUE_SESSION_FEATURE, VENUE_SESSION_FRAME, VENUE_SESSION_OPEN_FRAME, VENUE_GRANT_CHECK_MS, VENUE_EXPIRY_MARGIN_MS, VENUE_GRANT_ENDED_ERROR, VENUE_GRANT_EXPIRED_ERROR, isVenueRun, venueEnv, venueGrantLive, venueGrantRemainingMs, venueRunFromSession, venueWorkdir, } from './venue.js';
 import { RUN_REPOS_ENV_VAR, WorktreeManager } from './worktrees.js';
-import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, RefusedDeliveryError, REMOTE_TERMINAL_CAPABILITY, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, } from '../codehost/host.js';
+import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, RefusedDeliveryError, REMOTE_TERMINAL_CAPABILITY, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_RESTART_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, } from '../codehost/host.js';
 import { loadSettings as loadCodeHostSettings } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
 import { DEFAULT_WS_URL } from '../listen.js';
@@ -1652,7 +1652,12 @@ export async function runAgentHarness(options) {
             // With it, skipping permission prompts (`skipPermissions` on a start): only while remote control
             // is on, as the host applies it only then; the server records a thread as skipping only so.
             ...(codeHost?.authorized() && codeHost.remoteTerminalAllowed()
-                ? [REMOTE_TERMINAL_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY]
+                ? [
+                    REMOTE_TERMINAL_CAPABILITY,
+                    CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY,
+                    // And relaunching a running thread's agent so (`code_thread.restart_requested`), by the same rule.
+                    ...(codeHost.handleRestart ? [CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY] : []),
+                ]
                 : []),
         ],
         // `--machine` names this machine everywhere, exactly as given: whoever set it never sends the
@@ -2075,7 +2080,8 @@ export async function runAgentHarness(options) {
                 }
                 if (frame.event === EVENT_CODE_THREAD_START_REQUESTED ||
                     frame.event === EVENT_CODE_THREAD_INPUT_REQUESTED ||
-                    frame.event === EVENT_CODE_THREAD_APPROVAL_DECIDED) {
+                    frame.event === EVENT_CODE_THREAD_APPROVAL_DECIDED ||
+                    frame.event === EVENT_CODE_THREAD_RESTART_REQUESTED) {
                     if (!codeHost) {
                         if (!codeHostIgnoredLogged) {
                             codeHostIgnoredLogged = true;
@@ -2115,7 +2121,9 @@ export async function runAgentHarness(options) {
                         ? codeHost.handleStart(data)
                         : frame.event === EVENT_CODE_THREAD_INPUT_REQUESTED
                             ? codeHost.handleInput(data, frame.delivery_id)
-                            : codeHost.handleApproval(data, frame.delivery_id);
+                            : frame.event === EVENT_CODE_THREAD_RESTART_REQUESTED
+                                ? (codeHost.handleRestart?.(data, frame.delivery_id) ?? Promise.resolve(false))
+                                : codeHost.handleApproval(data, frame.delivery_id);
                     // Acknowledged once handled, never before: a start acked and then
                     // lost to a crash or a shutdown would leave its thread starting
                     // forever. A start that ran — or failed, which it reports — is 200;

package/dist/codehost/hooks.d.ts

@@ -133,6 +133,8 @@ export interface HookContext {
 }
 /** Events for one Claude Code hook invocation. Pure apart from the context's readers. */
 export declare function claudeHookEvents(hook: string, input: Record<string, unknown>, ctx: HookContext): Promise<CodeThreadEvent[]>;
+/** The Codex session (`thread-id`) a `notify` payload names, for `codex resume <id>`; `undefined` if none. */
+export declare function codexThreadId(payload: string): string | undefined;
 /** Events for one Codex `notify` call; `payload` is the JSON Codex passes as the last argument. */
 export declare function codexNotifyEvents(payload: string, now: number): CodeThreadEvent[];
 /**

package/dist/codehost/hooks.js

@@ -48,6 +48,7 @@ import { event, EVENT_POST_TIMEOUT_MS, postCodeThreadEvent, readHookConfig } fro
 import { awaitSettlement, beatenDeny, markTurnAnswered, recentPrompt, registerWaiter, settle, toolFingerprint } from './decision.js';
 import { INVOCATION_PROTOCOL_ENV, permissionInvocationIds, recordInvocation, supportsInvocationProtocol } from './invocations.js';
 import { markReady, readyPath } from './ready.js';
+import { recordSession } from './session.js';
 import { codeHostDir, ensurePrivateDir, loadSettings, writePrivateJson } from './settings.js';
 import { isValidId } from './tmux.js';
 export const TERMINAL_ID_ENV = 'PROHOST_TERMINAL_ID';
@@ -426,6 +427,15 @@ export async function claudeHookEvents(hook, input, ctx) {
     }
     return [];
 }
+/** The Codex session (`thread-id`) a `notify` payload names, for `codex resume <id>`; `undefined` if none. */
+export function codexThreadId(payload) {
+    try {
+        return str(asObject(JSON.parse(payload))?.['thread-id']);
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Events for one Codex `notify` call; `payload` is the JSON Codex passes as the last argument. */
 export function codexNotifyEvents(payload, now) {
     let data;
@@ -680,6 +690,8 @@ export async function runHook(args, options = {}) {
             catch {
                 input = {};
             }
+            // Which conversation this window runs: a restart resumes exactly it (`session.ts`).
+            recordSession(terminalId, 'claude_code', input.session_id, env);
             if (name === 'PermissionRequest') {
                 // This host's settings ask the hook to wait for a decision (`--wait`). It waits only while
                 // the owner allows remote control. A window launched before that (no `--wait`) keeps a
@@ -696,7 +708,9 @@ export async function runHook(args, options = {}) {
             events = await claudeHookEvents(name, input, ctx);
         }
         else if (kind === 'codex') {
-            events = codexNotifyEvents(args[args.length - 1] ?? '', ctx.now());
+            const payload = args[args.length - 1] ?? '';
+            recordSession(env[TERMINAL_ID_ENV], 'codex', codexThreadId(payload), env);
+            events = codexNotifyEvents(payload, ctx.now());
         }
     }
     catch {

package/dist/codehost/host.d.ts

@@ -1,8 +1,8 @@
 /**
  * The Code-thread host inside `prohost agent run`: one object the harness
  * starts when this machine's owner has turned hosting on
- * (`prohost agent code-host enable`), and hands the three events it serves —
- * `code_thread.start_requested`, `.input_requested` and `.approval_decided`.
+ * (`prohost agent code-host enable`), and hands the events it serves —
+ * `code_thread.start_requested`, `.input_requested`, `.approval_decided` and `.restart_requested`.
  *
  * Off — the default — the harness never builds one: no tmux, no relay socket,
  * no local server, no host stats, and the events are acknowledged as ignored.
@@ -14,10 +14,11 @@ import type { PtySpawn } from './pty.js';
 import type { PairingIdentity } from './relay.js';
 import type { CodeHostSettings } from './settings.js';
 import { CodeTerminals } from './terminals.js';
-import type { AccountEnvResult, ApprovalRequest, CodeAgent, InputRequest, StartRequest, TmuxRunner } from './terminals.js';
+import type { AccountEnvResult, ApprovalRequest, CodeAgent, InputRequest, RestartRequest, StartRequest, TmuxRunner } from './terminals.js';
 export declare const EVENT_CODE_THREAD_START_REQUESTED = "code_thread.start_requested";
 export declare const EVENT_CODE_THREAD_INPUT_REQUESTED = "code_thread.input_requested";
 export declare const EVENT_CODE_THREAD_APPROVAL_DECIDED = "code_thread.approval_decided";
+export declare const EVENT_CODE_THREAD_RESTART_REQUESTED = "code_thread.restart_requested";
 /**
  * Declared in `runtime_status.capabilities` while this harness hosts threads.
  * Versioned with the contract the server relies on (`remote_terminal`, 409
@@ -52,10 +53,19 @@ export declare const CODE_THREAD_FOLDERS_CAPABILITY = "code_thread_folders";
  * server records a thread as skipping only for a socket that declared it.
  */
 export declare const CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY = "code_thread_skip_permissions";
+/**
+ * Declared beside {@link CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY} (so only while remote control is
+ * on) by a host that handles `code_thread.restart_requested`: it relaunches a thread's Claude Code
+ * or Codex in the same window and folder, continuing its conversation, without permission prompts
+ * (`CodeTerminals.restart`). The server offers the restart only for a thread whose host said so.
+ */
+export declare const CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY = "code_thread_restart_skip_permissions";
 /** `code_thread.start_requested` data (camelCase per the contract), or `null`. */
 export declare function parseStartRequest(data: Record<string, unknown>): StartRequest | null;
 /** `code_thread.input_requested` data, or `null`. */
 export declare function parseInputRequest(data: Record<string, unknown>): InputRequest | null;
+/** `code_thread.restart_requested` data, or `null`. */
+export declare function parseRestartRequest(data: Record<string, unknown>): RestartRequest | null;
 /** What the harness needs from a host; tests fake it. */
 export interface CodeHostLike {
     start(): Promise<void>;
@@ -68,6 +78,8 @@ export interface CodeHostLike {
     /** `deliveryId`: a redelivery of one already acted on is acknowledged without typing again. */
     handleInput(data: Record<string, unknown>, deliveryId?: string): Promise<boolean>;
     handleApproval(data: Record<string, unknown>, deliveryId?: string): Promise<boolean>;
+    /** `code_thread.restart_requested`; a host without it acks the event as ignored. */
+    handleRestart?(data: Record<string, unknown>, deliveryId?: string): Promise<boolean>;
     latestStats(): HostStats | undefined;
     /** The owner's remote-terminal switch as it is on disk now. */
     remoteTerminalAllowed(): boolean;
@@ -115,8 +127,8 @@ export declare function parseApprovalDecision(data: Record<string, unknown>): Ap
  * server hands the reply or decision back instead of counting it delivered).
  */
 export declare class RefusedDeliveryError extends Error {
-    readonly reason: 'remote_terminal_disabled' | 'reply_interrupted' | 'terminal_gone' | 'shell_window' | 'decision_unconfirmed' | 'trust_prompt' | 'prompt_local' | 'prompt_open';
-    constructor(reason: 'remote_terminal_disabled' | 'reply_interrupted' | 'terminal_gone' | 'shell_window' | 'decision_unconfirmed' | 'trust_prompt' | 'prompt_local' | 'prompt_open');
+    readonly reason: 'remote_terminal_disabled' | 'reply_interrupted' | 'terminal_gone' | 'shell_window' | 'decision_unconfirmed' | 'trust_prompt' | 'prompt_local' | 'prompt_open' | 'session_unknown' | 'login_changed' | 'login_unavailable' | 'restart_expired' | 'restart_unconfirmed' | 'agent_exited';
+    constructor(reason: 'remote_terminal_disabled' | 'reply_interrupted' | 'terminal_gone' | 'shell_window' | 'decision_unconfirmed' | 'trust_prompt' | 'prompt_local' | 'prompt_open' | 'session_unknown' | 'login_changed' | 'login_unavailable' | 'restart_expired' | 'restart_unconfirmed' | 'agent_exited');
 }
 export declare class UnreportedOutcomeError extends Error {
     constructor(codeThreadId: string);
@@ -300,6 +312,13 @@ export declare class CodeHost implements CodeHostLike {
     handleStart(data: Record<string, unknown>): Promise<boolean>;
     handleInput(data: Record<string, unknown>, deliveryId?: string): Promise<boolean>;
     handleApproval(data: Record<string, unknown>, deliveryId?: string): Promise<boolean>;
+    /**
+     * Relaunch the thread's agent without permission prompts, continuing its conversation
+     * (`CodeTerminals.restart`). Remote control of this Mac, so held to the switch at this moment
+     * (the harness lets it through `admits` for that); refused before anything is touched otherwise.
+     * A redelivery of one already done is acknowledged as done, without restarting again.
+     */
+    handleRestart(data: Record<string, unknown>, deliveryId?: string): Promise<boolean>;
     /** The terminal's menu state (`menuState`) once a hook that is still deciding has had a moment to finish. */
     private menuSettled;
     /**

package/dist/codehost/host.js

@@ -1,8 +1,8 @@
 /**
  * The Code-thread host inside `prohost agent run`: one object the harness
  * starts when this machine's owner has turned hosting on
- * (`prohost agent code-host enable`), and hands the three events it serves —
- * `code_thread.start_requested`, `.input_requested` and `.approval_decided`.
+ * (`prohost agent code-host enable`), and hands the events it serves —
+ * `code_thread.start_requested`, `.input_requested`, `.approval_decided` and `.restart_requested`.
  *
  * Off — the default — the harness never builds one: no tmux, no relay socket,
  * no local server, no host stats, and the events are acknowledged as ignored.
@@ -29,6 +29,7 @@ import { APPROVAL_DECISIONS, isValidId, socketNameFor, TMUX_CONF } from './tmux.
 export const EVENT_CODE_THREAD_START_REQUESTED = 'code_thread.start_requested';
 export const EVENT_CODE_THREAD_INPUT_REQUESTED = 'code_thread.input_requested';
 export const EVENT_CODE_THREAD_APPROVAL_DECIDED = 'code_thread.approval_decided';
+export const EVENT_CODE_THREAD_RESTART_REQUESTED = 'code_thread.restart_requested';
 /**
  * Declared in `runtime_status.capabilities` while this harness hosts threads.
  * Versioned with the contract the server relies on (`remote_terminal`, 409
@@ -63,6 +64,13 @@ export const CODE_THREAD_FOLDERS_CAPABILITY = 'code_thread_folders';
  * server records a thread as skipping only for a socket that declared it.
  */
 export const CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY = 'code_thread_skip_permissions';
+/**
+ * Declared beside {@link CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY} (so only while remote control is
+ * on) by a host that handles `code_thread.restart_requested`: it relaunches a thread's Claude Code
+ * or Codex in the same window and folder, continuing its conversation, without permission prompts
+ * (`CodeTerminals.restart`). The server offers the restart only for a thread whose host said so.
+ */
+export const CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY = 'code_thread_restart_skip_permissions';
 function text(value) {
     return typeof value === 'string' ? value : undefined;
 }
@@ -97,6 +105,19 @@ export function parseInputRequest(data) {
         return null;
     return { codeThreadId, terminalId, text: value };
 }
+/** `code_thread.restart_requested` data, or `null`. */
+export function parseRestartRequest(data) {
+    const { codeThreadId, terminalId } = data;
+    if (!isValidId(codeThreadId) || !isValidId(terminalId))
+        return null;
+    const requestedAtMs = typeof data.requestedAtMs === 'number' && Number.isFinite(data.requestedAtMs) ? data.requestedAtMs : undefined;
+    return {
+        codeThreadId,
+        terminalId,
+        skipPermissions: data.skipPermissions === true,
+        ...(requestedAtMs !== undefined ? { requestedAtMs } : {}),
+    };
+}
 /** `code_thread.approval_decided` data, or `null`. */
 export function parseApprovalDecision(data) {
     const { codeThreadId, terminalId, approvalId, decision } = data;
@@ -522,6 +543,10 @@ export class CodeHost {
         // reported failed by `handleStart`, never acked 204 and left `starting`.
         if (event === EVENT_CODE_THREAD_START_REQUESTED)
             return true;
+        // A restart checks the switch itself, after its ledger: a redelivery of one already done is
+        // acknowledged as done, never refused (the server would then say the agent still asks).
+        if (event === EVENT_CODE_THREAD_RESTART_REQUESTED)
+            return true;
         return settings.allowRemoteTerminal;
     }
     refusal(event) {
@@ -601,6 +626,59 @@ export class CodeHost {
         this.log(`    ✓ code thread ${request.codeThreadId.slice(0, 12)}: ${request.decision} handed to its hook (approval ${request.approvalId.slice(0, 12)})`);
         return true;
     }
+    /**
+     * Relaunch the thread's agent without permission prompts, continuing its conversation
+     * (`CodeTerminals.restart`). Remote control of this Mac, so held to the switch at this moment
+     * (the harness lets it through `admits` for that); refused before anything is touched otherwise.
+     * A redelivery of one already done is acknowledged as done, without restarting again.
+     */
+    async handleRestart(data, deliveryId) {
+        const request = parseRestartRequest(data);
+        if (!request)
+            return false;
+        // A redelivery waits for any attempt still running (restarts are serialized per terminal), so it
+        // reads that attempt's real outcome below, never a claim taken a moment ago.
+        await this.terminals.settled(request.terminalId);
+        // Done already (its ack was lost): said as it ended, whatever the switch says now.
+        if (deliveryId && this.deliveries.has(deliveryId))
+            return this.repeat(deliveryId);
+        if (!this.settings().allowRemoteTerminal)
+            throw new RefusedDeliveryError('remote_terminal_disabled');
+        const outcome = {};
+        // Claimed right before the relaunch (`CodeTerminals.restart`), never before a check that may refuse
+        // or throw: a claim means the agent was replaced (or may have been), never just "seen".
+        const restarted = await this.terminals.restart(request, outcome, {
+            // Claimed as unconfirmed: until the window is seen running the new process, a repeat (this
+            // daemon died mid-relaunch, a resend) says so and is never answered "done".
+            claim: () => {
+                if (!deliveryId)
+                    return true;
+                // One write: the claim never reaches disk without its "unconfirmed" mark, and a claim
+                // that can't be written relaunches nothing (a later daemon would not know it ran).
+                const claimed = this.deliveries.claimDurably(deliveryId, 'restart_unconfirmed');
+                return claimed === 'claimed' ? true : claimed === 'repeat' ? false : 'unsaved';
+            },
+            confirmed: () => {
+                if (deliveryId)
+                    this.deliveries.confirm(deliveryId);
+            },
+        });
+        if (restarted)
+            return true;
+        if (outcome.repeat && deliveryId)
+            return this.repeat(deliveryId);
+        // Kept claimed (never relaunched twice) and said the same way on every redelivery.
+        if (outcome.refused === 'restart_unconfirmed' || outcome.refused === 'agent_exited') {
+            if (deliveryId)
+                this.deliveries.refuse(deliveryId, outcome.refused);
+            throw new RefusedDeliveryError(outcome.refused);
+        }
+        if (outcome.refused)
+            throw new RefusedDeliveryError(outcome.refused);
+        if (outcome.retry)
+            this.retryLater(outcome.release ? deliveryId : undefined, request.codeThreadId);
+        return false;
+    }
     /** The terminal's menu state (`menuState`) once a hook that is still deciding has had a moment to finish. */
     async menuSettled(terminalId) {
         if (!isValidId(terminalId))
@@ -643,8 +721,12 @@ export class CodeHost {
      */
     repeat(deliveryId) {
         const reason = this.deliveries.refusalFor(deliveryId);
-        if (reason === 'reply_interrupted' || reason === 'decision_unconfirmed')
+        if (reason === 'reply_interrupted' ||
+            reason === 'decision_unconfirmed' ||
+            reason === 'restart_unconfirmed' ||
+            reason === 'agent_exited') {
             throw new RefusedDeliveryError(reason);
+        }
         return true;
     }
 }

package/dist/codehost/ledger.d.ts

@@ -21,8 +21,19 @@ export declare class DeliveryLedger {
     constructor(env?: NodeJS.ProcessEnv);
     /** Whether a prior attempt has an outcome to replay, without claiming a fresh delivery. */
     has(deliveryId: string): boolean;
-    /** True the first time `deliveryId` is claimed (and records it); false for a repeat. */
-    claim(deliveryId: string): boolean;
+    /**
+     * True the first time `deliveryId` is claimed (and records it); false for a repeat.
+     * `refusal` is recorded with the claim in the same write, so no crash or failed write
+     * can leave the claim on disk without it (a repeat would then read as done).
+     */
+    claim(deliveryId: string, refusal?: string): boolean;
+    /**
+     * {@link claim} for an act that must not run twice across a daemon restart (a relaunch):
+     * `'unsaved'` when the claim could not be written, and then it is not kept either, so the
+     * caller does nothing and the delivery is sent again rather than acted on unrecorded.
+     */
+    claimDurably(deliveryId: string, refusal?: string): 'claimed' | 'repeat' | 'unsaved';
+    private record;
     /**
      * Forget a claim that typed nothing (refused before any key): a redelivery is
      * judged afresh, so a refusal whose ack was lost is never answered "done".
@@ -30,6 +41,9 @@ export declare class DeliveryLedger {
     release(deliveryId: string): void;
     /** A claimed delivery that may have typed something and was then refused: a repeat refuses it the same way. */
     refuse(deliveryId: string, reason: string): void;
+    /** A claimed delivery's outcome is known good after all: a repeat answers it as done. */
+    confirm(deliveryId: string): void;
     refusalFor(deliveryId: string): string | undefined;
+    /** False when the write failed: in memory it still dedupes for this process. */
     private save;
 }

package/dist/codehost/ledger.js

@@ -40,20 +40,49 @@ export class DeliveryLedger {
     has(deliveryId) {
         return this.known.has(deliveryId);
     }
-    /** True the first time `deliveryId` is claimed (and records it); false for a repeat. */
-    claim(deliveryId) {
+    /**
+     * True the first time `deliveryId` is claimed (and records it); false for a repeat.
+     * `refusal` is recorded with the claim in the same write, so no crash or failed write
+     * can leave the claim on disk without it (a repeat would then read as done).
+     */
+    claim(deliveryId, refusal) {
+        return this.record(deliveryId, refusal, false) !== 'repeat';
+    }
+    /**
+     * {@link claim} for an act that must not run twice across a daemon restart (a relaunch):
+     * `'unsaved'` when the claim could not be written, and then it is not kept either, so the
+     * caller does nothing and the delivery is sent again rather than acted on unrecorded.
+     */
+    claimDurably(deliveryId, refusal) {
+        return this.record(deliveryId, refusal, true);
+    }
+    record(deliveryId, refusal, durable) {
         if (!deliveryId || this.known.has(deliveryId))
-            return false;
+            return 'repeat';
+        const before = { ids: [...this.ids], refused: new Map(this.refused) };
         this.known.add(deliveryId);
         this.ids.push(deliveryId);
+        if (refusal)
+            this.refused.set(deliveryId, refusal);
         if (this.ids.length > MAX_REMEMBERED_DELIVERIES) {
             for (const dropped of this.ids.splice(0, this.ids.length - MAX_REMEMBERED_DELIVERIES)) {
                 this.known.delete(dropped);
                 this.refused.delete(dropped);
             }
         }
-        this.save();
-        return true;
+        if (this.save())
+            return 'claimed';
+        // Kept in memory it still dedupes this process; a durable claim is undone instead.
+        if (!durable)
+            return 'claimed';
+        this.ids = before.ids;
+        this.known.clear();
+        for (const id of this.ids)
+            this.known.add(id);
+        this.refused.clear();
+        for (const [id, reason] of before.refused)
+            this.refused.set(id, reason);
+        return 'unsaved';
     }
     /**
      * Forget a claim that typed nothing (refused before any key): a redelivery is
@@ -73,9 +102,16 @@ export class DeliveryLedger {
         this.refused.set(deliveryId, reason);
         this.save();
     }
+    /** A claimed delivery's outcome is known good after all: a repeat answers it as done. */
+    confirm(deliveryId) {
+        if (!this.refused.delete(deliveryId))
+            return;
+        this.save();
+    }
     refusalFor(deliveryId) {
         return this.refused.get(deliveryId);
     }
+    /** False when the write failed: in memory it still dedupes for this process. */
     save() {
         try {
             writePrivateJson(deliveryLedgerPath(this.env), {
@@ -83,9 +119,10 @@ export class DeliveryLedger {
                 ids: this.ids,
                 refused: Object.fromEntries(this.refused),
             });
+            return true;
         }
         catch {
-            /* in memory it still dedupes for this process */
+            return false;
         }
     }
 }

package/dist/codehost/ready.d.ts

@@ -16,16 +16,15 @@ export declare function readyPath(terminalId: string, env?: NodeJS.ProcessEnv):
  */
 export declare function markReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean;
 /**
- * Whether Claude Code ran a session in exactly `cwd`, under `configDir`, that it last wrote at or
- * after `sinceMs`: a `projects/<key>/<session>.jsonl` modified since then whose entries name `cwd`
- * itself (read from inside the file: the dash-encoded `<key>` is lossy, `/a-b` and `/a/b` share it).
- *
- * Claude Code writes that transcript only once the folder is trusted (checked against 2.1.314:
- * nothing under `projects/` while the dialog is up; the transcript the moment it is accepted and
- * the first prompt runs). With `sinceMs` the window's start, it is proof, from a file Claude Code
- * owns, that this window's Claude Code got past its dialog. Used only for a window an older build
- * started, which never had a ready mark.
+ * Forget the mark: the window's Claude Code was replaced (a restart), and the new one is past its
+ * dialog only once its own first hook runs. Returns whether no mark is left.
+ */
+export declare function clearReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The transcript files (`<session>.jsonl`) Claude Code keeps for `cwd` under `configDir`: one exists
+ * for a session only once its first prompt ran. Empty when there are none or they can't be read.
  */
+export declare function claudeTranscripts(cwd: string, configDir: string): string[];
 export declare function claudeSessionSince(cwd: string, configDir: string, sinceMs: number): boolean;
 /** `true` past the dialog, `false` not yet, `undefined` when the state can't be read. */
 export declare function isReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean | undefined;