@prohost/cli 0.16.4 → 0.16.6

package/dist/host/command.js

@@ -24,12 +24,12 @@ import { claudeQuotaProvider, codexQuotaProvider } from '../agent/runtime_status
 import { readPipedKey } from '../usage/key-input.js';
 import { CLI_VERSION } from '../version.js';
 import { recommendCapacity } from './capacity.js';
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { addAccount, isValidLabel, loadAccounts, parseAccountRuntime, accountEnv } from '../agent/accounts.js';
 import { revokeComputer } from './api.js';
-import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, hostLockPath, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
+import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, handoffNotice, handoffOf, hostLockPath, SERVICE_LABEL, readHandoff, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
 import { journalPath, readEvents } from './events.js';
-import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
+import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, installedDedicatedService, systemdUnitOf, publishedComputer, publishedComputerId, readServiceCredential, rewriteHomeCredential, windowsServiceCredentialPath, windowsHomesDir, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
 import { LegacyHarnesses } from './legacy.js';
 import { detectLogins } from './logins.js';
 import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
@@ -97,6 +97,7 @@ export function hardwareFacts() {
  */
 export function statusJson(env, now = Date.now(), options = {}) {
     const computer = tryLoadComputer(env);
+    const handoff = options.label ? undefined : readHandoff(env);
     // A dedicated service is reported only when asked for by its `--label`, and then only from what
     // it publishes: unlabelled, status is about this home's own service, whatever else runs on the
     // computer; labelled, nothing of this home's (its pause, its pairing, its lock) is mixed in.
@@ -118,13 +119,18 @@ export function statusJson(env, now = Date.now(), options = {}) {
     const events = readEvents(labelDir ? path.join(labelDir, 'events.json') : journalPath(env), now);
     return {
         // Reporting the dedicated service: its own computer, never this home's (they can differ).
-        paired: labelDir ? sharedComputer !== undefined : computer !== null,
+        // A home that handed its computer to a dedicated service is still that computer's (served
+        // elsewhere, `handed_to`): paired, offline here — never read as "not added", which would invite
+        // a second pairing beside the service that holds the key.
+        paired: labelDir ? sharedComputer !== undefined : computer !== null || handoff !== undefined,
         computer: labelDir
             ? (sharedComputer ?? null)
             : computer
                 ? { id: computer.computer_id, name: (fresh && state?.name) || computer.name, account: computer.account }
-                : null,
-        online: Boolean(fresh && state?.online),
+                : handoff
+                    ? { id: handoff.computer_id, name: handoff.name, account: handoff.account }
+                    : null,
+        online: Boolean(!handoff && fresh && state?.online),
         paused,
         slots: fresh && state ? state.slots : slotsFor(capacity, 0, paused ? 'paused' : null),
         running: fresh && state ? state.running.map(localRunning) : [],
@@ -141,11 +147,19 @@ export function statusJson(env, now = Date.now(), options = {}) {
             ...(labelDir ? { activity_file: path.join(labelDir, 'activity.json') } : {}),
         },
         remote_terminal: Boolean(fresh && state?.remote_terminal),
+        // This home handed its computer to a dedicated service: where to look instead.
+        ...(handoff ? { handed_to: { label: handoff.handed_to.label, service_user: handoff.handed_to.service_user, service_home: handoff.handed_to.service_home } } : {}),
         version: CLI_VERSION,
     };
 }
 function printStatus(json, out) {
     const computer = json.computer;
+    const handedTo = json.handed_to;
+    if (handedTo) {
+        out(`This computer runs as the dedicated service ${handedTo.label}${handedTo.service_user ? ` (user ${handedTo.service_user})` : ''}. ` +
+            `See it with: prohost host status --label ${handedTo.label}`);
+        return;
+    }
     if (!computer) {
         out('This computer is not added to a workspace yet. Run: prohost host pair');
         return;
@@ -285,6 +299,246 @@ async function addLogin(flags, env, out, err, io) {
     out(`✓ Added "${label}". It shows in prohost host logins.`);
     return 0;
 }
+/**
+ * `sudo prohost host unpair --label <label>` (or `--dedicated`, the label read from this home's
+ * hand-off note): remove a dedicated service's computer. As root / an administrator it reads the
+ * key from the service's own home — the one its installed definition names (root's file), never a
+ * path from the note, which the home's owner can edit — removes the computer from its workspace,
+ * uninstalls the service (stopped and its definition removed: without a key it could only fail),
+ * deletes the key there and clears the note in the home it was handed from. Nothing is changed
+ * when the removal is refused. Exits 0 once the computer is removed, even if some local cleanup
+ * could not be done (each such step is reported).
+ */
+async function unpairDedicated(flags, env, out, err, io, platform) {
+    const serviceIo = io.serviceIo ?? {};
+    const run = serviceIo.run ?? defaultServiceRunner;
+    const admin = serviceIo.isAdmin ??
+        (platform === 'win32' ? run('net', ['session']).status === 0 : (serviceIo.uid ?? process.getuid?.() ?? 1) === 0);
+    if (!admin) {
+        err(platform === 'win32'
+            ? '✗ A dedicated service is removed from an administrator prompt.'
+            : '✗ A dedicated service is removed as root: run it with sudo.');
+        return 1;
+    }
+    const fromHome = handedFromHome(flags, env, platform);
+    const note = readHandoff({ ...env, PROHOST_HOME: fromHome });
+    const explicit = str(flags, 'label');
+    // The note is only a hint for the label: everything else comes from what root installed.
+    const label = explicit ?? note?.handed_to.label;
+    if (!label) {
+        err('✗ Which dedicated service? Pass --label <label> (prohost host status --label <label> shows it).');
+        return 1;
+    }
+    if (!SERVICE_LABEL.test(label) || !label.startsWith(LAUNCHD_HOST_LABEL)) {
+        err(`✗ "${label}" is not a label this CLI installs services under.`);
+        return 1;
+    }
+    const installed = installedDedicatedService(platform, label, serviceIo);
+    if (!installed) {
+        err(`✗ No dedicated service ${label} is installed here (no service definition for it): remove the computer on its page in ProhostAI.`);
+        return 1;
+    }
+    const flagUser = str(flags, 'service-user');
+    if (flagUser && installed.user && flagUser !== installed.user) {
+        err(`✗ ${label} runs as ${installed.user}, not ${flagUser}: nothing was changed.`);
+        return 1;
+    }
+    const serviceUser = installed.user ?? flagUser;
+    const serviceHome = installed.home;
+    const noted = note?.handed_to.label === label ? note : undefined;
+    if (noted && path.resolve(noted.handed_to.service_home) !== path.resolve(serviceHome)) {
+        err(`✗ The note in ${fromHome} says ${label} lives in ${noted.handed_to.service_home}, but it is installed with ${serviceHome}: nothing was changed.`);
+        return 1;
+    }
+    // The home the definition names must be the service account's own folder, not a link to elsewhere.
+    const homeProblem = serviceHomeProblem(platform, serviceHome, serviceUser, serviceIo);
+    if (homeProblem) {
+        err(`✗ ${homeProblem}: nothing was changed.`);
+        return 1;
+    }
+    const computer = serviceCredential(platform, serviceHome, serviceUser, serviceIo, label);
+    // Named only by the note: only the service that holds that very computer.
+    if (!explicit && note && computer && computer.computer_id !== note.computer_id) {
+        err(`✗ ${label} runs a different computer than the note in ${fromHome} names: nothing was changed. Pass --label to name the service.`);
+        return 1;
+    }
+    const uninstall = () => {
+        const outcome = uninstallService({
+            platform,
+            dedicated: true,
+            ...(serviceUser ? { serviceUser } : {}),
+            nodePath: process.execPath,
+            scriptPath: scriptPath(),
+            home: serviceHome,
+            pathEnv: env.PATH ?? '',
+            userHome: env.HOME || os.homedir(),
+            label,
+        }, serviceIo);
+        (outcome.ok ? out : err)(`  ${outcome.message}`);
+        return outcome.ok;
+    };
+    if (computer && platform === 'win32' && publishedComputerId({ platform, label }, serviceIo) !== computer.computer_id) {
+        // The copy is an install-time snapshot: the service now runs another computer (it re-paired),
+        // or publishes none. Root never revokes the old one, nor uninstalls the new one, on a guess.
+        err(`✗ ${label} no longer publishes the computer its key on record is for: nothing was changed. ` +
+            'Sign the computer out on its page in ProhostAI (AI Employees › Computers).');
+        return 1;
+    }
+    if (!computer && platform === 'win32') {
+        // No administrators' copy of the key (installed by a CLI before 0.16.5, or never paired): the
+        // key in the account's home is never read by an administrator, so nothing is changed here.
+        err(`✗ ${label} has no administrators' copy of its key (${windowsServiceCredentialPath({ label })}): nothing was changed. ` +
+            `Remove the computer on its page in ProhostAI, then: prohost host uninstall --label ${label} --dedicated`);
+        return 1;
+    }
+    if (!computer) {
+        // Nothing to remove it with: the service can't run either. Only a service named on purpose is
+        // uninstalled (never one picked by the note alone); its note goes with it.
+        err(`✗ ${serviceHome} holds no computer key for ${label}: remove the computer on its page in ProhostAI.`);
+        if (explicit) {
+            uninstall();
+            if (noted)
+                clearHandedHome(platform, fromHome, 'the note', serviceIo, err);
+        }
+        else {
+            err(`  To uninstall it anyway: sudo prohost host unpair --label ${label}`);
+        }
+        return 1;
+    }
+    const revoked = await revokeComputer({ baseUrl: computer.base_url, apiKey: computer.api_key, fetchImpl: io.fetchImpl }, computer.computer_id);
+    if (revoked.result === 'failed') {
+        err(`✗ ProhostAI did not remove this computer (${revoked.status === 0 ? revoked.error ?? 'no answer' : `HTTP ${revoked.status}`}). ` +
+            'Nothing was changed; try again, or remove it on its page in ProhostAI.');
+        return 1;
+    }
+    if (platform === 'win32' && revoked.status === 401) {
+        // The administrators' copy is an install-time snapshot: a key refused may only mean it was
+        // re-paired since, and the service's live key is never read here. Never cleaned up on a guess.
+        err(`✗ ProhostAI no longer accepts the key on record for ${label} (re-paired since it was installed?): nothing was changed. ` +
+            `Remove the computer on its page in ProhostAI, then: prohost host uninstall --label ${label} --dedicated`);
+        return 1;
+    }
+    out(revoked.result === 'revoked' ? `✓ Removed "${computer.name}" from its workspace.` : `✓ "${computer.name}" was already removed from its workspace.`);
+    let clean = uninstall();
+    clean = clearHandedHome(platform, serviceHome, 'its key', serviceIo, err) && clean;
+    if (platform === 'win32') {
+        try {
+            (serviceIo.removeFile ?? ((f) => rmSync(f, { force: true })))(windowsServiceCredentialPath({ label }));
+        }
+        catch (e) {
+            clean = false;
+            err(`  ✗ Could not delete ${windowsServiceCredentialPath({ label })} (${e instanceof Error ? e.message : String(e)}): delete it yourself.`);
+        }
+    }
+    // The home it was handed from: its note, or — installed by a CLI before 0.16.5 — its own copy of this key.
+    const fromCopy = tryLoadComputer({ ...env, PROHOST_HOME: fromHome });
+    if ((noted || fromCopy?.computer_id === computer.computer_id) && path.resolve(fromHome) !== path.resolve(serviceHome)) {
+        clean = clearHandedHome(platform, fromHome, noted ? 'the note' : 'the old copy of its key', serviceIo, err) && clean;
+    }
+    out(clean ? `  ${label} is uninstalled and this computer's key is gone.` : `  The computer is removed; finish the steps above by hand.`);
+    return 0;
+}
+/**
+ * What is wrong with the service home an installed definition names, if anything: on macOS / Linux
+ * it must be a real folder (no link) owned by the service account; on Windows, the administrators'
+ * folder for it (`windowsHomesDir`), no junction.
+ */
+function serviceHomeProblem(platform, home, user, serviceIo) {
+    if (platform === 'win32') {
+        const parent = path.win32.resolve(path.win32.dirname(home));
+        if (parent !== path.win32.resolve(windowsHomesDir()))
+            return `${home} is not a dedicated service home (${windowsHomesDir()})`;
+        const isSymlink = serviceIo.isSymlink ?? ((f) => {
+            try {
+                return lstatSync(f).isSymbolicLink();
+            }
+            catch {
+                return false;
+            }
+        });
+        return isSymlink(home) ? `${home} is a link or junction` : undefined;
+    }
+    const owner = serviceIo.ownerOf?.(home) ?? (() => {
+        try {
+            const stat = lstatSync(home);
+            return { uid: stat.uid, link: stat.isSymbolicLink() };
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!owner)
+        return `${home} is not there`;
+    if (owner.link)
+        return `${home} is a link`;
+    if (!user)
+        return `${home}: the service's account is unknown`;
+    const id = (serviceIo.run ?? defaultServiceRunner)('id', ['-u', user]);
+    if (id.status !== 0 || Number.parseInt(id.stdout.trim(), 10) !== owner.uid)
+        return `${home} is not owned by ${user}`;
+    return undefined;
+}
+/** A dedicated service home's key, read as `readServiceCredential` reads it (never through the account's links). */
+function serviceCredential(platform, home, user, serviceIo, label) {
+    const text = readServiceCredential(platform, home, user, serviceIo, label);
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether the service manager still has `spec`'s dedicated service (loaded / active / a task). */
+export function serviceStillLoaded(spec, serviceIo, pidAlive = processAlive) {
+    const run = serviceIo.run ?? defaultServiceRunner;
+    try {
+        if (spec.platform === 'darwin')
+            return run('launchctl', ['print', `system/${spec.label}`]).status === 0;
+        if (spec.platform === 'win32') {
+            if (run('schtasks', ['/Query', '/TN', windowsTaskOf(spec)]).status === 0)
+                return true;
+            // Deleting a task does not stop what it started: the host's own lock names a live process.
+            // Only "no such file" means no lock; any other read error is an unknown, so still there (fail closed).
+            const lock = (serviceIo.readFile ?? ((f) => {
+                try {
+                    return readFileSync(f, 'utf8');
+                }
+                catch (e) {
+                    if (e.code === 'ENOENT')
+                        return undefined;
+                    throw e;
+                }
+            }))(path.win32.join(spec.home, 'host', 'service.lock'));
+            const pid = lock ? JSON.parse(lock).pid : undefined;
+            return typeof pid === 'number' && Number.isInteger(pid) && pid > 0 && pidAlive(pid);
+        }
+        return run('systemctl', ['is-active', '--quiet', systemdUnitOf(spec)]).status === 0;
+    }
+    catch {
+        return true;
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
+}
+/** The home a dedicated install took its computer from: `--from-home`, else (under sudo `$PROHOST_HOME` is root's) `$SUDO_USER`'s. */
+function handedFromHome(flags, env, platform) {
+    return str(flags, 'from-home') ?? (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : prohostHome(env));
+}
+function clearHandedHome(platform, home, what, serviceIo, err) {
+    const problem = rewriteHomeCredential(platform, home, undefined, serviceIo);
+    if (problem)
+        err(`  ✗ Could not delete ${what} in ${home} (${problem}): delete ${path.join(home, 'host', 'computer.json')} yourself.`);
+    return !problem;
+}
 export async function runHost(subcommand, flags, printHelp, io = {}) {
     const env = io.env ?? process.env;
     const out = io.out ?? ((line) => process.stdout.write(`${line}\n`));
@@ -292,6 +546,13 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
     const platform = io.platform ?? process.platform;
     switch (subcommand) {
         case 'pair': {
+            const handedOff = readHandoff(env);
+            if (handedOff) {
+                const result = { version: 1, outcome: 'handed_off', computer_id: handedOff.computer_id, account: handedOff.account, message: handoffNotice(handedOff) };
+                writeHostPairResult(result, env, err);
+                err(`✗ ${result.message}`);
+                return 1;
+            }
             const baseUrl = str(flags, 'base-url') ?? env.PROHOST_BASE_URL ?? DEFAULT_API_BASE_URL;
             const problem = baseUrlProblem(baseUrl);
             if (problem) {
@@ -341,6 +602,12 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
             }
         }
         case 'run': {
+            const handedOff = readHandoff(env);
+            if (handedOff) {
+                // The dedicated service runs this computer (and any homes adopted here are its business now).
+                err(`✗ ${handoffNotice(handedOff)}`);
+                return 1;
+            }
             const computer = tryLoadComputer(env);
             const adopted = loadAdopted(env);
             if (!computer && !adopted?.homes.length) {
@@ -444,17 +711,65 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 // A dedicated service is labelled after its own home: without --label,
                 // every one this computer publishes state for is looked at too.
                 const labels = new Set([spec.label]);
-                const admin = platform === 'win32' ? dedicated : (io.serviceIo?.uid ?? process.getuid?.() ?? 1) === 0;
+                // Elevated, whatever the flags say (on Windows an administrator prompt, as unpair checks it).
+                const admin = io.serviceIo?.isAdmin ??
+                    (platform === 'win32'
+                        ? dedicated || (io.serviceIo?.run ?? defaultServiceRunner)('net', ['session']).status === 0
+                        : (io.serviceIo?.uid ?? process.getuid?.() ?? 1) === 0);
                 if (!str(flags, 'label') && (admin || dedicated)) {
                     for (const dir of sharedDirs(io.sharedBase ?? sharedBase(platform)))
                         labels.add(path.basename(dir));
                 }
-                const outcomes = [...labels].map((label) => uninstallService({ ...spec, label }, io.serviceIo));
+                // A home that handed its computer to one of these services gets the key back once that
+                // service is gone (the mirror of install): `prohost host install` runs it there again.
+                const fromHome = admin ? handedFromHome(flags, env, platform) : undefined;
+                const note = fromHome ? readHandoff({ ...env, PROHOST_HOME: fromHome }) : undefined;
+                const handedTo = note && labels.has(note.handed_to.label) ? installedDedicatedService(platform, note.handed_to.label, io.serviceIo) : undefined;
+                // Read before the service goes (on Windows its administrators' copy goes with it), and only
+                // from the home the definition names when it is the service account's own folder.
+                const handedKey = note && handedTo && !serviceHomeProblem(platform, handedTo.home, handedTo.user, io.serviceIo ?? {})
+                    ? serviceCredential(platform, handedTo.home, handedTo.user, io.serviceIo ?? {}, note.handed_to.label)
+                    : null;
+                // Windows reads the administrators' copy (an install-time snapshot): it is given back while the
+                // service publishes that same computer, or publishes none yet (never started, failed early)
+                // and the copy is for the computer the note names. Another computer published: never.
+                // A state that can't be read is not "none published": then nothing is given back.
+                const published = platform === 'win32' && note ? publishedComputer({ platform, label: note.handed_to.label }, io.serviceIo) : undefined;
+                const handedKeyLive = handedKey &&
+                    (platform !== 'win32' ||
+                        (published?.kind === 'none' ? handedKey.computer_id === note?.computer_id : published?.kind === 'published' && published.id === handedKey.computer_id))
+                    ? handedKey
+                    : null;
+                const outcomes = [...labels].map((label) => ({ label, ...uninstallService({ ...spec, label }, io.serviceIo) }));
                 const removed = outcomes.filter((o) => !o.message.startsWith('No host service'));
                 const shown = removed.length > 0 ? removed : outcomes.slice(0, 1);
                 for (const o of shown)
                     (o.ok ? out : err)(o.message);
-                return shown.every((o) => o.ok) ? 0 : 1;
+                let ok = shown.every((o) => o.ok);
+                if (note && fromHome && outcomes.some((o) => o.label === note.handed_to.label && o.ok)) {
+                    const key = handedKeyLive;
+                    if (key && key.computer_id === note.computer_id && handedTo) {
+                        const problem = rewriteHomeCredential(platform, fromHome, `${JSON.stringify(key, null, 2)}\n`, io.serviceIo);
+                        if (problem) {
+                            ok = false;
+                            err(`  ✗ Could not give the computer's key back to ${fromHome} (${problem}); it stays in ${handedTo.home}.`);
+                        }
+                        else {
+                            // On Windows the (administrators') service home keeps its copy: a later dedicated
+                            // install finds that home and writes nothing into it, so it must still hold the key.
+                            if (platform !== 'win32')
+                                clearHandedHome(platform, handedTo.home, 'its key', io.serviceIo ?? {}, err);
+                            out(`  The computer's key is back in ${fromHome}: prohost host install runs it there (prohost host unpair removes it).`);
+                            if (platform === 'win32')
+                                out(`  To install it as a dedicated service again, first remove the folder ${handedTo.home}.`);
+                        }
+                    }
+                    else {
+                        clearHandedHome(platform, fromHome, 'the note', io.serviceIo ?? {}, err);
+                        out(`  ${fromHome} no longer points at ${note.handed_to.label}. Its key was not found: add the computer again with prohost host pair, or remove it on its page in ProhostAI.`);
+                    }
+                }
+                return ok ? 0 : 1;
             }
             // 0.16.0 put a Windows dedicated service's home in the account's profile, under another
             // label: replacing it here would leave two services on one key. Its owner removes it first.
@@ -469,12 +784,23 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     return 1;
                 }
             }
+            // A home whose computer went to a dedicated service has no key to run a service of its own on.
+            const ownHandoff = dedicated ? undefined : readHandoff(env);
+            if (ownHandoff) {
+                err(`✗ ${handoffNotice(ownHandoff)}`);
+                return 1;
+            }
             // The invoking user's home: under sudo, $PROHOST_HOME and $HOME are root's.
             const adoptFrom = str(flags, 'from-home') ??
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
+            // The key this install takes over, read before it runs: only a copy it really made is retired.
+            const handedFrom = dedicated && path.resolve(adoptFrom) !== path.resolve(home) ? tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom }) : null;
+            // Whether the service home already held a key before this install (then it copies none).
+            const serviceHadKey = handedFrom ? serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label) !== null : false;
             const outcome = installService(spec, io.serviceIo, {
                 ...(tokenFile ? { claudeTokenFile: tokenFile } : {}),
                 ...(dedicated ? { adoptFrom } : {}),
+                ...(dedicated && readHandoff({ ...env, PROHOST_HOME: adoptFrom })?.handed_to.label === spec.label ? { handedOffHere: true } : {}),
             });
             (outcome.ok ? out : err)(outcome.message);
             if (outcome.ok && !tryLoadComputer({ ...env, PROHOST_HOME: home })) {
@@ -482,9 +808,88 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     ? `  ! ${home} has no computer yet (none in ${adoptFrom}): pair as yourself, then run this again — or pass --from-home <your PROHOST_HOME>.`
                     : `  This home (${home}) has no computer yet: run prohost host pair.`);
             }
+            if (outcome.ok && dedicated && handedFrom) {
+                // One key, one holder: the home it came from keeps a note of where the computer went, never
+                // the key — so an `unpair`, `pair` or personal `install` there can't revoke or run it twice.
+                const serviceHas = serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label);
+                if (serviceHas && serviceHas.computer_id === handedFrom.computer_id && serviceHas.api_key !== handedFrom.api_key) {
+                    // Re-paired since the service got its copy: it holds an older key (no longer valid).
+                    // This home's key is the live one, so it stays here.
+                    err(`  ! The service in ${home} holds an older key for this computer than ${adoptFrom} (re-paired since?). ` +
+                        `This home keeps its key. To move it over: sudo prohost host uninstall --label ${spec.label}, ` +
+                        (platform === 'win32'
+                            ? // An existing administrators' home is never written into: the whole folder goes.
+                                `remove the folder ${home}, then install again.`
+                            : `delete ${path.join(home, 'host', 'computer.json')}, then install again.`));
+                }
+                else if (serviceHas?.computer_id === handedFrom.computer_id) {
+                    const note = handoffOf(handedFrom, {
+                        label: spec.label,
+                        service_user: serviceUser ?? null,
+                        service_home: home,
+                        at: new Date((io.now ?? Date.now)()).toISOString(),
+                    });
+                    const problem = rewriteHomeCredential(platform, adoptFrom, `${JSON.stringify(note, null, 2)}\n`, io.serviceIo);
+                    if (problem) {
+                        // The note is part of the takeover: without it the key would live in both homes, and an
+                        // `unpair` here would remove the computer under the service. What this install did is undone.
+                        err(`  ✗ Could not leave the hand-off note in ${adoptFrom} (${problem}).`);
+                        // What the original home holds now decides the undo (on Windows a rename can land before a
+                        // later check fails): its key still there → undo; the note there after all → handed over;
+                        // neither → the service keeps the only key.
+                        const sourceKey = tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom });
+                        const sourceNote = readHandoff({ ...env, PROHOST_HOME: adoptFrom });
+                        const handedAnyway = !sourceKey && sourceNote?.handed_to.label === spec.label && sourceNote?.computer_id === handedFrom.computer_id;
+                        if (handedAnyway) {
+                            err(`  ! The note is in place after all: the computer's key is the service's alone. Check ${path.join(adoptFrom, 'host', 'computer.json')}.`);
+                        }
+                        else if (sourceKey?.computer_id !== handedFrom.computer_id) {
+                            err(`  ✗ ${adoptFrom} no longer holds this computer's key, so ${spec.label} keeps it: check ${path.join(adoptFrom, 'host', 'computer.json')}, never delete ${home}.`);
+                            return 1;
+                        }
+                        else if (!serviceHadKey) {
+                            const undone = (() => {
+                                try {
+                                    return uninstallService(spec, io.serviceIo);
+                                }
+                                catch (e) {
+                                    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+                                }
+                            })();
+                            // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
+                            // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
+                            const serviceGone = undone.ok && undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
+                            const keyGone = serviceGone && !rewriteHomeCredential(platform, home, undefined, io.serviceIo);
+                            if (keyGone && platform === 'win32') {
+                                try {
+                                    (io.serviceIo?.removeFile ?? ((f) => rmSync(f, { force: true })))(windowsServiceCredentialPath(spec));
+                                }
+                                catch {
+                                    /* reported below with the rest */
+                                }
+                            }
+                            err(serviceGone && keyGone
+                                ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
+                                    (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
+                                : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                            return 1;
+                        }
+                        else {
+                            err(`  ✗ ${home} already held this key before this install, so ${adoptFrom} still does too: never run \`prohost host unpair\` from that home. ` +
+                                `Fix the problem above, then install again.`);
+                        }
+                        if (!handedAnyway)
+                            return 1;
+                    }
+                    else {
+                        out(`  The computer's key is the service's alone now: ${adoptFrom} keeps a note of where it went.`);
+                    }
+                }
+            }
             if (outcome.ok && dedicated) {
                 out(`  Its status, for anyone on this computer: ${sharedDirFor(spec)}`);
                 out(`  Remove it with: sudo prohost host uninstall --label ${spec.label}`);
+                out(`  Remove the computer from its workspace too: sudo prohost host unpair --label ${spec.label}`);
                 // The personal service of the home it took the computer from runs on the same key.
                 const personal = personalServiceOf(platform, adoptFrom, env.SUDO_USER);
                 if (personal && (io.serviceIo?.exists ?? existsSync)(personal.file)) {
@@ -495,6 +900,14 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
             return outcome.ok ? 0 : 1;
         }
         case 'unpair': {
+            const labelFlag = str(flags, 'label');
+            if (labelFlag || flags.dedicated === true)
+                return unpairDedicated(flags, env, out, err, io, platform);
+            const handedOff = readHandoff(env);
+            if (handedOff) {
+                err(`✗ ${handoffNotice(handedOff)}`);
+                return 1;
+            }
             const computer = tryLoadComputer(env);
             if (!computer) {
                 out('This computer is not added to a workspace. Nothing to remove.');

package/dist/host/computer.d.ts

@@ -78,6 +78,37 @@ export interface ComputerCredentials {
 }
 export declare class ComputerMissingError extends Error {
 }
+/**
+ * What a home keeps once a dedicated install has taken its computer over (`host install
+ * --dedicated`): no key — the dedicated service holds the only one — just where it went, so
+ * `host status` / `unpair` / `pair` / `install` here explain instead of acting on a copy of it.
+ * `code_host_home` stays for the desktop app, which reads it from this file.
+ */
+export interface ComputerHandoff {
+    version: 1;
+    handed_to: {
+        label: string;
+        service_user: string | null;
+        service_home: string;
+        at: string;
+    };
+    computer_id: string;
+    name: string;
+    account: ProhostAccount;
+    base_url?: string;
+    code_host_home?: string;
+}
+export declare function handoffOf(credentials: ComputerCredentials, to: ComputerHandoff['handed_to']): ComputerHandoff;
+/** A service label (launchd label, systemd unit, Windows task): the one rule, never a path. */
+export declare const SERVICE_LABEL: RegExp;
+/**
+ * This home's hand-off note, when its computer went to a dedicated service. The note is the home
+ * owner's file: its label is checked like any label, and nothing run as an administrator takes a
+ * path from it.
+ */
+export declare function readHandoff(env?: NodeJS.ProcessEnv): ComputerHandoff | undefined;
+/** How to reach the dedicated service a home handed its computer to — the one line every refusal here says. */
+export declare function handoffNotice(handoff: ComputerHandoff): string;
 export declare function saveComputer(credentials: ComputerCredentials, env?: NodeJS.ProcessEnv): string;
 export declare function loadComputer(env?: NodeJS.ProcessEnv): ComputerCredentials;
 /** The `claude setup-token` token a dedicated install put in this home (`host/claude-oauth-token`). */

package/dist/host/computer.js

@@ -209,6 +209,39 @@ export function readObject(file) {
 }
 export class ComputerMissingError extends Error {
 }
+export function handoffOf(credentials, to) {
+    return {
+        version: 1,
+        handed_to: to,
+        computer_id: credentials.computer_id,
+        name: credentials.name,
+        account: credentials.account,
+        base_url: credentials.base_url,
+        ...(credentials.code_host_home ? { code_host_home: credentials.code_host_home } : {}),
+    };
+}
+/** A service label (launchd label, systemd unit, Windows task): the one rule, never a path. */
+export const SERVICE_LABEL = /^[A-Za-z0-9][A-Za-z0-9.-]{0,127}$/;
+/**
+ * This home's hand-off note, when its computer went to a dedicated service. The note is the home
+ * owner's file: its label is checked like any label, and nothing run as an administrator takes a
+ * path from it.
+ */
+export function readHandoff(env = process.env) {
+    const raw = readObject(computerPath(env));
+    const to = raw?.handed_to;
+    if (!raw || typeof raw.api_key === 'string' || !to || typeof to.label !== 'string' || typeof to.service_home !== 'string')
+        return undefined;
+    if (!SERVICE_LABEL.test(to.label))
+        return undefined;
+    return raw;
+}
+/** How to reach the dedicated service a home handed its computer to — the one line every refusal here says. */
+export function handoffNotice(handoff) {
+    const { label, service_user: user } = handoff.handed_to;
+    return (`This computer ("${handoff.name}") runs as the dedicated service ${label}${user ? ` (user ${user})` : ''}; this home no longer holds its key. ` +
+        `See it with: prohost host status --label ${label} — remove it as an administrator with: sudo prohost host unpair --label ${label}`);
+}
 export function saveComputer(credentials, env = process.env) {
     const file = computerPath(env);
     writePrivateFile(file, credentials);
@@ -219,6 +252,9 @@ export function loadComputer(env = process.env) {
     const raw = readObject(file);
     if (!raw)
         throw new ComputerMissingError(`This computer isn't added yet (no ${file}). Run: prohost host pair`);
+    const handoff = readHandoff(env);
+    if (handoff)
+        throw new ComputerMissingError(handoffNotice(handoff));
     if (typeof raw.api_key !== 'string' || !raw.api_key || typeof raw.computer_id !== 'string' || !raw.computer_id) {
         throw new ComputerMissingError(`${file} has no computer key. Add the computer again: prohost host pair`);
     }