@prohost/cli 0.16.4 → 0.16.6

package/dist/host/install.d.ts

@@ -100,6 +100,13 @@ export declare function buildWindowsWrapper(spec: ServiceSpec): string;
 export declare function windowsWrapperPath(spec: ServiceSpec): string;
 /** Where a Windows dedicated install keeps its task definition and wrapper: administrators write, the account reads. */
 export declare function windowsServiceDir(spec: Pick<ServiceSpec, 'label'>): string;
+/**
+ * The administrators' copy of a Windows dedicated service's key (`services\<label>`: the account
+ * may read it, never change it) — what an administrator's `unpair` / `uninstall` reads. Written
+ * when an install creates the service's home; a home installed before 0.16.5 has none, and is
+ * then never handed a note nor unpaired by label (its computer is removed on its page).
+ */
+export declare function windowsServiceCredentialPath(spec: Pick<ServiceSpec, 'label'>): string;
 /** Task Scheduler XML: at logon (personal) or at boot as the service user via S4U (dedicated). */
 export declare function buildWindowsTaskXml(spec: ServiceSpec, currentUser: string): string;
 export interface InstallOutcome {
@@ -126,6 +133,19 @@ export interface InstallIo {
         link: boolean;
     } | undefined;
     removeFile?: (file: string) => void;
+    /** Rename `from` over `to` (Windows hand-off note: a fresh file, then renamed into place). */
+    rename?: (from: string, to: string) => void;
+    /** The real path of a folder, links resolved (Windows hand-off note: checked before and after). */
+    realpath?: (file: string) => string;
+    /**
+     * Open a file once and read it through that handle, with what `fstat` says about the very file
+     * opened (Windows service key: no re-open between the check and the read). Undefined: not there.
+     */
+    readHandle?: (file: string) => {
+        isFile: boolean;
+        nlink: number;
+        text: string;
+    } | undefined;
     exists?: (file: string) => boolean;
     mkdir?: (dir: string, mode: number) => void;
     /** Seams for waiting on a re-install's previous service to stop (macOS). */
@@ -138,6 +158,11 @@ export interface DedicatedSetup {
     claudeTokenFile?: string;
     /** The invoking user's `PROHOST_HOME`: its computer credential is copied into the service home if that has none. */
     adoptFrom?: string;
+    /**
+     * That home already handed its computer to this very service (its note names this label): a
+     * reinstall, whose administrators' key copy (Windows) is kept although no credential is handed.
+     */
+    handedOffHere?: boolean;
 }
 /** Validate a spec before anything is written. */
 export declare function specProblem(spec: ServiceSpec, io?: InstallIo, setup?: DedicatedSetup): string | undefined;
@@ -145,6 +170,45 @@ export declare function specProblem(spec: ServiceSpec, io?: InstallIo, setup?: D
 export declare function windowsHomesDir(): string;
 /** Where a Windows dedicated install keeps the Claude token: an administrators' folder the account may only read. */
 export declare function windowsTokenPath(spec: Pick<ServiceSpec, 'label'>): string;
+/**
+ * The home (and account) an installed dedicated service runs with, read from its definition —
+ * root's / the administrators' own file (`/Library/LaunchDaemons`, `/etc/systemd/system`,
+ * `ProgramData\\Prohost\\services`) — or undefined when none is installed under `label`. What
+ * an administrator's `unpair` / `uninstall` trusts, never a note in an account's home.
+ */
+export declare function installedDedicatedService(platform: NodeJS.Platform, label: string, io?: InstallIo): {
+    home: string;
+    user?: string;
+} | undefined;
+/**
+ * A dedicated service home's `computer.json` text, when it holds a key, read the safe way for an
+ * administrator: on macOS / Linux as the service's account (`sudo -u` / `runuser … cat`), so a link
+ * the account planted at `host` or `computer.json` reaches only what that account may read itself;
+ * on Windows from the service's administrators-only copy, never from the account's home.
+ */
+export declare function readServiceCredential(platform: NodeJS.Platform, home: string, user: string | undefined, io?: InstallIo, label?: string): string | undefined;
+/**
+ * What a dedicated service last published about its computer (`hosts\\<label>\\state.json`): its id,
+ * `none` when it has published nothing yet (no file, or the `{}` an install starts it with), or
+ * `unreadable` (a read error or JSON that does not parse, even after a retry) — never taken as none.
+ */
+export declare function publishedComputer(spec: Pick<ServiceSpec, 'platform' | 'label'>, io?: InstallIo): {
+    kind: 'published';
+    id: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'unreadable';
+};
+/** The computer id a dedicated service last published, if it did (see `publishedComputer`). */
+export declare function publishedComputerId(spec: Pick<ServiceSpec, 'platform' | 'label'>, io?: InstallIo): string | undefined;
+/**
+ * Write (`content`) or remove (`undefined`) `<home>/host/computer.json` in a home another user
+ * owns — the one a dedicated install took its computer from. As root on macOS / Linux it is done
+ * as the folder's owner (root never writes through a path an account controls); anyone else, and
+ * an administrator on Windows, writes it directly. Returns what went wrong, if anything.
+ */
+export declare function rewriteHomeCredential(platform: NodeJS.Platform, home: string, content: string | undefined, io?: InstallIo): string | undefined;
 /**
  * Create or take over the ProgramData folders a Windows dedicated install
  * uses, top-down: each one is checked for a junction, owned by

package/dist/host/install.js

@@ -20,11 +20,12 @@
  */
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { buildLaunchdPlist, waitUntilUnloaded } from '../agent/daemon.js';
 import { TERMINAL_SESSIONS_ENV } from '../codehost/settings.js';
+import { SERVICE_LABEL, readSharedObject } from './computer.js';
 export const LAUNCHD_HOST_LABEL = 'ai.prohost.host';
 export const SYSTEMD_HOST_UNIT = 'prohost-host.service';
 export const WINDOWS_TASK_NAME = '\\ProhostAI\\Host';
@@ -46,7 +47,7 @@ export const defaultServiceRunner = (command, args, input) => {
     return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? result.error?.message ?? '' };
 };
 const SERVICE_USER = /^[A-Za-z0-9._-][A-Za-z0-9._ -]{0,63}$/;
-const LABEL = /^[A-Za-z0-9][A-Za-z0-9.-]{0,127}$/;
+const LABEL = SERVICE_LABEL;
 /** Paths for the OS the service is for (tests build every OS's files on one). */
 function joinFor(platform) {
     return platform === 'win32' ? path.win32.join : path.posix.join;
@@ -197,6 +198,15 @@ export function windowsWrapperPath(spec) {
 export function windowsServiceDir(spec) {
     return path.win32.join('C:\\ProgramData\\Prohost\\services', labelOf(spec));
 }
+/**
+ * The administrators' copy of a Windows dedicated service's key (`services\<label>`: the account
+ * may read it, never change it) — what an administrator's `unpair` / `uninstall` reads. Written
+ * when an install creates the service's home; a home installed before 0.16.5 has none, and is
+ * then never handed a note nor unpaired by label (its computer is removed on its page).
+ */
+export function windowsServiceCredentialPath(spec) {
+    return path.win32.join(windowsServiceDir(spec), 'computer.json');
+}
 /** Task Scheduler XML: at logon (personal) or at boot as the service user via S4U (dedicated). */
 export function buildWindowsTaskXml(spec, currentUser) {
     const user = xmlEscape(spec.dedicated && spec.serviceUser ? spec.serviceUser : currentUser);
@@ -267,7 +277,12 @@ function failed(step, outcome) {
 /** Validate a spec before anything is written. */
 export function specProblem(spec, io = {}, setup = {}) {
     if (spec.label !== undefined && !LABEL.test(spec.label)) {
-        return `"${spec.label}" is not a usable label (letters, digits, "." and "-", like ai.prohost.desktop.host).`;
+        return `"${spec.label}" is not a usable label (letters, digits, "." and "-", like ai.prohost.host.office).`;
+    }
+    // A dedicated service is one root may later remove by its label (`host unpair --label`), which
+    // only ever acts on ours: the label says so.
+    if (spec.dedicated && spec.label !== undefined && !spec.label.startsWith(LAUNCHD_HOST_LABEL)) {
+        return `A dedicated service's label starts with ${LAUNCHD_HOST_LABEL} (for example ${LAUNCHD_HOST_LABEL}.office), not "${spec.label}".`;
     }
     if (setup.claudeTokenFile && !spec.dedicated)
         return '--claude-token-file is for a dedicated install (--dedicated).';
@@ -359,6 +374,247 @@ function mkdirOnce(dir) {
         throw err;
     }
 }
+/**
+ * The home (and account) an installed dedicated service runs with, read from its definition —
+ * root's / the administrators' own file (`/Library/LaunchDaemons`, `/etc/systemd/system`,
+ * `ProgramData\\Prohost\\services`) — or undefined when none is installed under `label`. What
+ * an administrator's `unpair` / `uninstall` trusts, never a note in an account's home.
+ */
+export function installedDedicatedService(platform, label, io = {}) {
+    if (!LABEL.test(label))
+        return undefined;
+    const read = reader(io);
+    const unxml = (v) => v.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, '&');
+    if (platform === 'darwin') {
+        const plist = read(path.join('/Library/LaunchDaemons', `${label}.plist`));
+        const home = plist && /<key>WorkingDirectory<\/key>\s*<string>([^<]*)<\/string>/.exec(plist)?.[1];
+        const user = plist && /<key>UserName<\/key>\s*<string>([^<]*)<\/string>/.exec(plist)?.[1];
+        return home ? { home: unxml(home), ...(user ? { user: unxml(user) } : {}) } : undefined;
+    }
+    if (platform === 'linux') {
+        const unit = read(path.join('/etc/systemd/system', systemdUnitOf({ label })));
+        const quoted = unit && /^WorkingDirectory="((?:[^"\\]|\\.)*)"$/m.exec(unit)?.[1];
+        const user = unit && /^User=(\S+)$/m.exec(unit)?.[1];
+        const home = quoted?.replace(/%%/g, '%').replace(/\\(.)/g, '$1');
+        return home ? { home, ...(user ? { user } : {}) } : undefined;
+    }
+    if (platform === 'win32') {
+        const wrapper = read(path.win32.join(windowsServiceDir({ label }), 'host-service.cmd'));
+        const home = wrapper && /^set "PROHOST_HOME=([^"\r\n]*)"\r?$/m.exec(wrapper)?.[1];
+        return home ? { home: home.replace(/%%/g, '%') } : undefined;
+    }
+    return undefined;
+}
+/**
+ * A dedicated service home's `computer.json` text, when it holds a key, read the safe way for an
+ * administrator: on macOS / Linux as the service's account (`sudo -u` / `runuser … cat`), so a link
+ * the account planted at `host` or `computer.json` reaches only what that account may read itself;
+ * on Windows from the service's administrators-only copy, never from the account's home.
+ */
+export function readServiceCredential(platform, home, user, io = {}, label) {
+    const join = joinFor(platform);
+    const dir = join(home, 'host');
+    const file = join(dir, 'computer.json');
+    const uid = io.uid ?? process.getuid?.() ?? 1;
+    if (platform === 'win32') {
+        // Never from the account's home (it can swap a junction in there while an administrator opens
+        // a path, and Windows can't read as the account): from the copy the install put in the
+        // service's administrators-only folder (`windowsServiceCredentialPath`), read through one handle.
+        if (!label)
+            return undefined;
+        const opened = (() => {
+            try {
+                return (io.readHandle ?? readThroughHandle)(windowsServiceCredentialPath({ label }));
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        if (!opened || !opened.isFile || opened.nlink !== 1)
+            return undefined;
+        return keyedCredential(opened.text);
+    }
+    if (uid !== 0 || !user)
+        return keyedCredential(reader(io)(file));
+    const read = asUser(io.run ?? defaultServiceRunner, platform, user, 'cat "$1"', [file]);
+    return read.status === 0 ? keyedCredential(read.stdout) : undefined;
+}
+/**
+ * What a dedicated service last published about its computer (`hosts\\<label>\\state.json`): its id,
+ * `none` when it has published nothing yet (no file, or the `{}` an install starts it with), or
+ * `unreadable` (a read error or JSON that does not parse, even after a retry) — never taken as none.
+ */
+export function publishedComputer(spec, io = {}) {
+    const file = joinFor(spec.platform)(sharedDirFor(spec), 'state.json');
+    const parse = () => {
+        if (io.readFile) {
+            const text = io.readFile(file);
+            return text === undefined ? null : JSON.parse(text);
+        }
+        if (!(io.exists ?? existsSync)(file))
+            return null;
+        // The service rewrites it in place: a read caught mid-write is tried again (`readSharedObject`).
+        const state = readSharedObject(file);
+        if (state === undefined)
+            throw new Error('unreadable');
+        return state;
+    };
+    let state;
+    try {
+        state = parse();
+    }
+    catch {
+        return { kind: 'unreadable' };
+    }
+    if (state === null)
+        return { kind: 'none' };
+    if (typeof state !== 'object' || Array.isArray(state))
+        return { kind: 'unreadable' };
+    const id = state.computer?.id;
+    return typeof id === 'string' && id ? { kind: 'published', id } : { kind: 'none' };
+}
+/** The computer id a dedicated service last published, if it did (see `publishedComputer`). */
+export function publishedComputerId(spec, io = {}) {
+    const published = publishedComputer(spec, io);
+    return published.kind === 'published' ? published.id : undefined;
+}
+/** One open: `fstat` and the text read through the same descriptor. */
+function readThroughHandle(file) {
+    let fd;
+    try {
+        fd = openSync(file, 'r');
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const stat = fstatSync(fd);
+        return { isFile: stat.isFile(), nlink: stat.nlink, text: stat.isFile() ? readFileSync(fd, 'utf8') : '' };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** `computer.json`'s text when it holds a computer key — never a hand-off note (`ComputerHandoff`), which is copied nowhere. */
+function keyedCredential(text) {
+    if (!text)
+        return undefined;
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed.api_key === 'string' && parsed.api_key && typeof parsed.computer_id === 'string' ? text : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Write (`content`) or remove (`undefined`) `<home>/host/computer.json` in a home another user
+ * owns — the one a dedicated install took its computer from. As root on macOS / Linux it is done
+ * as the folder's owner (root never writes through a path an account controls); anyone else, and
+ * an administrator on Windows, writes it directly. Returns what went wrong, if anything.
+ */
+export function rewriteHomeCredential(platform, home, content, io = {}) {
+    const join = joinFor(platform);
+    const dir = join(home, 'host');
+    const file = join(dir, 'computer.json');
+    const run = io.run ?? defaultServiceRunner;
+    const uid = io.uid ?? process.getuid?.() ?? 1;
+    if (platform === 'win32') {
+        // An administrator in someone else's home: never through a junction or link the account
+        // could have put there (`isSymlink` is true for both), and a fresh file renamed into place.
+        // Windows offers no owner-run write here the way `sudo -u` does elsewhere: the folders' real
+        // paths are checked before the write, between it and the rename, and after. That narrows a
+        // folder swapped in between, it does not close it (best effort; a delete has one check).
+        const isSymlink = io.isSymlink ?? ((f) => {
+            try {
+                return lstatSync(f).isSymbolicLink();
+            }
+            catch {
+                return false;
+            }
+        });
+        const linked = [home, dir, file, `${file}.handoff`].find((f) => isSymlink(f));
+        if (linked)
+            return `${linked} is a link or junction`;
+        // The folders are where they say they are: checked right before the write and again after it.
+        const real = io.realpath ?? ((f) => realpathSync.native(f));
+        const inPlace = () => {
+            try {
+                const realHome = real(home);
+                if (path.win32.resolve(realHome).toLowerCase() !== path.win32.resolve(home).toLowerCase())
+                    return `${home} resolves to ${realHome}`;
+                const realDir = real(dir);
+                if (path.win32.resolve(realDir).toLowerCase() !== path.win32.join(path.win32.resolve(realHome), 'host').toLowerCase())
+                    return `${dir} resolves to ${realDir}`;
+                return undefined;
+            }
+            catch (e) {
+                return e instanceof Error ? e.message : String(e);
+            }
+        };
+        const before = inPlace();
+        if (before)
+            return before;
+        try {
+            const remove = io.removeFile ?? ((f) => rmSync(f, { force: true }));
+            if (content === undefined) {
+                remove(file);
+                return undefined;
+            }
+            remove(`${file}.handoff`);
+            writer(io)(`${file}.handoff`, content, 0o600, 'wx');
+            const between = inPlace();
+            if (between)
+                return `${between} (moved while writing: nothing renamed)`;
+            (io.rename ?? renameSync)(`${file}.handoff`, file);
+            const after = inPlace();
+            if (after)
+                return `${after} (moved while writing: check ${file} by hand)`;
+            return undefined;
+        }
+        catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+    if (uid !== 0) {
+        try {
+            if (content === undefined)
+                (io.removeFile ?? ((f) => rmSync(f, { force: true })))(file);
+            else
+                writer(io)(file, content, 0o600);
+            return undefined;
+        }
+        catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+    const owner = io.ownerOf?.(dir) ?? ownerOf(dir);
+    if (!owner)
+        return `${dir} is not there`;
+    if (owner.link)
+        return `${dir} is a link`;
+    if (owner.uid === 0) {
+        try {
+            if (content === undefined)
+                rmSync(file, { force: true });
+            else
+                writer(io)(file, content, 0o600);
+            return undefined;
+        }
+        catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+    const name = run('id', ['-nu', String(owner.uid)]);
+    const user = name.stdout.trim();
+    if (name.status !== 0 || !user)
+        return failed(`finding the owner of ${dir}`, name);
+    const done = content === undefined
+        ? asUser(run, platform, user, 'rm -f "$1"', [file])
+        : // A fresh file beside it (noclobber), then renamed over: never written through.
+            asUser(run, platform, user, 'rm -f "$1.handoff" && set -C && cat > "$1.handoff" && mv -f "$1.handoff" "$1"', [file], content);
+    return done.status === 0 ? undefined : failed(`${content === undefined ? 'removing' : 'rewriting'} ${file} as ${user}`, done);
+}
 function ownerOf(file) {
     try {
         const stat = lstatSync(file);
@@ -487,7 +743,7 @@ function prepareDedicated(spec, io, setup) {
         return problem;
     const hostDir = join(spec.home, 'host');
     const credential = setup.adoptFrom && path.resolve(setup.adoptFrom) !== path.resolve(spec.home)
-        ? read(join(setup.adoptFrom, 'host', 'computer.json'))
+        ? keyedCredential(read(join(setup.adoptFrom, 'host', 'computer.json')))
         : undefined;
     let token;
     if (setup.claudeTokenFile) {
@@ -517,6 +773,13 @@ function prepareDedicated(spec, io, setup) {
         // in one step with no access for the account, filled, and only then opened to it — so it can
         // never swap a path in it while an administrator writes there. An existing one is never
         // written into; a --service-home elsewhere is the account's own business.
+        // No computer handed to this install (and not a reinstall of the one handed to it before): no
+        // administrators' copy of an older one may outlive it.
+        if (!credential && !setup.handedOffHere) {
+            const copy = windowsServiceCredentialPath(spec);
+            if (exists(copy))
+                remove(copy);
+        }
         if (path.win32.resolve(path.win32.dirname(spec.home)) === path.win32.resolve(windowsHomesDir())) {
             const made = (io.mkdirOnce ?? mkdirOnce)(spec.home);
             if (made === 'exists') {
@@ -525,6 +788,13 @@ function prepareDedicated(spec, io, setup) {
                 const owner = windowsOwner(run, spec.home);
                 if (!/\\(Administrators|SYSTEM)$/i.test(owner))
                     return `${spec.home} is owned by ${owner || 'someone else'}: remove it, then install again.`;
+                // A computer handed to a home that already exists but has no administrators' copy of its key
+                // (uninstalled before, or installed before 0.16.5): nothing here could vouch for the key in
+                // it, so it would run without the hand-off. A fresh home gets both.
+                // (A copy that is there but holds no usable key, e.g. an interrupted write, counts as none.)
+                if (credential && !setup.handedOffHere && !keyedCredential(read(windowsServiceCredentialPath(spec)))) {
+                    return `${spec.home} is left from an earlier install and has no administrators' copy of its key: remove that folder, then install again.`;
+                }
             }
             else {
                 for (const args of [
@@ -536,8 +806,14 @@ function prepareDedicated(spec, io, setup) {
                         return failed(`icacls ${args.slice(0, 2).join(' ')}`, out);
                 }
                 mkdir(hostDir, 0o700);
-                if (credential)
+                if (credential) {
                     write(join(hostDir, 'computer.json'), credential, 0o600, 'wx');
+                    // The administrators' copy, in the folder just claimed: what root-level commands read.
+                    const copy = windowsServiceCredentialPath(spec);
+                    if (exists(copy))
+                        remove(copy);
+                    write(copy, credential, 0o600, 'wx');
+                }
             }
             // The account may now use its home.
             const open = run('icacls', [spec.home, '/grant', `${user}:(OI)(CI)M`]);
@@ -654,8 +930,13 @@ export function installService(spec, io = {}, setup = {}) {
         const plist = buildHostPlist(spec);
         const loaded = run('launchctl', ['print', `${domain}/${label}`]).status === 0;
         // Re-running it changes nothing that is already right: the service keeps
-        // working through every app update that didn't move it.
+        // working through every app update that didn't move it. Enablement is
+        // persistent state separate from whether launchd currently has the job
+        // loaded, so repair it before returning through this fast path.
         if (loaded && read(file) === plist) {
+            const enable = run('launchctl', ['enable', `${domain}/${label}`]);
+            if (enable.status !== 0)
+                return { ok: false, file, message: `Wrote ${file}, but ${failed('launchctl enable', enable)}` };
             return { ok: true, file, message: `✓ ${label} is installed and running (${file})\n  logs: ${logs}` };
         }
         write(file, plist, spec.dedicated ? 0o644 : 0o600);
@@ -673,12 +954,15 @@ export function installService(spec, io = {}, setup = {}) {
                 timeoutMs: RESTART_WAIT_MS,
                 onWaiting: (line) => process.stderr.write(`${line.replace('agent', 'host service')}\n`),
             });
+        // A disabled label cannot load: enabling must succeed before bootstrap.
+        const enable = run('launchctl', ['enable', `${domain}/${label}`]);
+        if (enable.status !== 0)
+            return { ok: false, file, message: `Wrote ${file}, but ${failed('launchctl enable', enable)}` };
         const boot = run('launchctl', ['bootstrap', domain, file]);
         if (boot.status !== 0) {
             const still = oldGone ? '' : ` (the previous host service was still finishing its runs after ${RESTART_WAIT_MS / 1000}s)`;
             return { ok: false, file, message: `Wrote ${file}, but ${failed('launchctl bootstrap', boot)}${still}` };
         }
-        run('launchctl', ['enable', `${domain}/${label}`]);
         return { ok: true, file, message: `✓ Installed ${label} (${file})\n  logs: ${logs}` };
     }
     if (spec.platform === 'linux') {
@@ -768,6 +1052,32 @@ export function uninstallService(spec, io = {}) {
             if (exists(file))
                 remove(file);
         }
+        // The administrators' copy of its key goes with the service: a reinstall never finds an old one.
+        const copy = windowsServiceCredentialPath(spec);
+        if (out.status === 0 && exists(copy)) {
+            try {
+                remove(copy);
+            }
+            catch (e) {
+                notes.push(`could not delete ${copy} (${e instanceof Error ? e.message : String(e)}): delete it yourself`);
+            }
+        }
+    }
+    // A dedicated service gone: its published state goes too, so nothing (the desktop's note check)
+    // reads a service that ran once as one that is installed.
+    // (Windows: a task by that label, removed with or without --dedicated; only a dedicated one publishes state.)
+    const dedicatedGone = spec.platform === 'win32'
+        ? removed.length > 0
+        : removed.some((file) => file === serviceFilePath({ ...spec, dedicated: true }));
+    if (dedicatedGone) {
+        const state = joinFor(spec.platform)(sharedDirFor(spec), 'state.json');
+        try {
+            if (exists(state))
+                remove(state);
+        }
+        catch {
+            /* the next install rewrites it */
+        }
     }
     if (removed.length === 0 && notes.length === 0) {
         return { ok: true, message: 'No host service was installed. Nothing to remove.' };

package/dist/host/migrate.js

@@ -49,7 +49,7 @@ import { loadCredentials, prohostHome } from '../agent/credentials.js';
 import { LAUNCHD_LABEL_PREFIX } from '../agent/daemon.js';
 import { resolveAgentAccount } from '../agent/accounts.js';
 import { PAIRING_ADOPT_PATH, callJson } from './api.js';
-import { machineFacts } from './computer.js';
+import { handoffNotice, machineFacts, readHandoff } from './computer.js';
 import { credentialsFrom } from './pair.js';
 import { isCodexExec } from '../agent/codex.js';
 import { SessionStore } from '../agent/sessionstore.js';
@@ -328,6 +328,10 @@ export async function adoptComputer(options) {
     const env = options.env ?? process.env;
     if (tryLoadComputer(env))
         return { status: 'already_paired' };
+    // Handed to a dedicated service: never a second key over its note.
+    const handedOff = readHandoff(env);
+    if (handedOff)
+        return { status: 'not_adopted', reason: handoffNotice(handedOff) };
     let facts;
     try {
         facts = options.facts ?? machineFacts({ env, name: options.name });

package/dist/host/pair.d.ts

@@ -21,7 +21,7 @@
  */
 import type { ProhostAccount } from '../agent/credentials.js';
 import type { ComputerCredentials, MachineFacts } from './computer.js';
-export declare const HOST_PAIR_OUTCOMES: readonly ["paired", "expired", "token_rejected", "workspace_unconfirmed", "declined", "rate_limited", "unreachable", "invalid_arguments", "failed"];
+export declare const HOST_PAIR_OUTCOMES: readonly ["paired", "expired", "token_rejected", "workspace_unconfirmed", "declined", "rate_limited", "unreachable", "invalid_arguments", "handed_off", "failed"];
 export type HostPairOutcome = (typeof HOST_PAIR_OUTCOMES)[number];
 export interface HostPairResult {
     version: 1;

package/dist/host/pair.js

@@ -38,6 +38,8 @@ export const HOST_PAIR_OUTCOMES = [
     'rate_limited',
     'unreachable',
     'invalid_arguments',
+    /** This home handed its computer to a dedicated service (`host install --dedicated`): it pairs nothing. */
+    'handed_off',
     'failed',
 ];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/host/service.js

@@ -38,7 +38,7 @@ import { HeartbeatLoop } from '../agent/heartbeat.js';
 import { executeHostedRun } from '../agent/run.js';
 import { SessionStore, sessionKeyFor } from '../agent/sessionstore.js';
 import { verifySignature } from '../agent/signature.js';
-import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, REMOTE_TERMINAL_CAPABILITY, RefusedDeliveryError, } from '../codehost/host.js';
+import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_RESTART_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, REMOTE_TERMINAL_CAPABILITY, RefusedDeliveryError, } from '../codehost/host.js';
 import { HostStatsSampler } from '../codehost/host_stats.js';
 import { TERMINAL_SESSIONS_ENV, loadSettings as loadCodeHostSettings, recordServiceSwitch } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
@@ -248,8 +248,12 @@ async function serveHost(options) {
         if (codeHost?.authorized() && config.terminal_sessions_enabled) {
             caps.push(CODE_THREADS_CAPABILITY, CODE_THREAD_FOLDERS_CAPABILITY, codeHost.instanceCapability());
             caps.push(...(codeHost.agentCapabilities?.() ?? []));
-            if (codeHost.remoteTerminalAllowed())
+            if (codeHost.remoteTerminalAllowed()) {
                 caps.push(REMOTE_TERMINAL_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY);
+                // Relaunching a running thread's agent without prompts (`code_thread.restart_requested`): the same rule.
+                if (codeHost.handleRestart)
+                    caps.push(CODE_THREAD_RESTART_SKIP_PERMISSIONS_CAPABILITY);
+            }
         }
         return caps;
     }
@@ -972,7 +976,8 @@ async function serveHost(options) {
                 }
                 if (frame.event === EVENT_CODE_THREAD_START_REQUESTED ||
                     frame.event === EVENT_CODE_THREAD_INPUT_REQUESTED ||
-                    frame.event === EVENT_CODE_THREAD_APPROVAL_DECIDED) {
+                    frame.event === EVENT_CODE_THREAD_APPROVAL_DECIDED ||
+                    frame.event === EVENT_CODE_THREAD_RESTART_REQUESTED) {
                     if (!codeHost || !config.terminal_sessions_enabled) {
                         ack(ACK_IGNORED);
                         return;
@@ -1004,7 +1009,9 @@ async function serveHost(options) {
                         ? codeHost.handleStart(data)
                         : frame.event === EVENT_CODE_THREAD_INPUT_REQUESTED
                             ? codeHost.handleInput(data, frame.delivery_id)
-                            : codeHost.handleApproval(data, frame.delivery_id);
+                            : frame.event === EVENT_CODE_THREAD_RESTART_REQUESTED
+                                ? (codeHost.handleRestart?.(data, frame.delivery_id) ?? Promise.resolve(false))
+                                : codeHost.handleApproval(data, frame.delivery_id);
                     background.push(handled
                         .then((ok) => {
                         ack(starting || ok ? ACK_ACCEPTED : ACK_IGNORED);

package/dist/index.js

@@ -33,6 +33,7 @@ function printHelp() {
         '  prohost host pair [--name <name>] [--token <redeem-token>|-] [--expect-account <workspace-id>]',
         '                    Add this computer to a workspace (prints a code to enter in ProhostAI)',
         '  prohost host unpair                  Remove this computer from its workspace (revokes its key)',
+        '  sudo prohost host unpair --label <id> [--service-user <name>]   Remove a dedicated service\'s computer and uninstall it',
         '  prohost host run                     One service for every AI employee placed on this computer',
         '  prohost host install [--label <id>] [--dedicated --service-user <name> [--service-home <dir>]',
         '                       [--claude-token-file <path>] [--remote-terminal|--no-remote-terminal]] | uninstall [--label <id>]',
@@ -81,7 +82,10 @@ function printHelp() {
         '                   or one derived from $PROHOST_HOME. Re-running install changes nothing that is right.',
         '  Under the ProhostAI desktop app, host install keeps ELECTRON_RUN_AS_NODE=1 in the service it writes',
         '                   (and the PATH it was launched with), so the service runs the CLI, never the app.',
-        '  `host unpair` removes this computer from its workspace and deletes its key here.',
+        '  `host unpair` removes this computer from its workspace and deletes its key here. A dedicated install',
+        '                   takes the key over: the home it came from keeps a note instead, and `unpair` there',
+        '                   points at `sudo prohost host unpair --label <id>`, which uses the service\'s key, uninstalls',
+        '                   the service and clears both homes.',
         '  `host logins add` signs in another Claude Code / Codex login in this terminal.',
         '  `host pause` takes no new work until `host resume`; work already going finishes.',
         '  `host migrate` adopts existing agent homes and the desktop app\'s terminal-hosting home, keeping',

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.4";
+export declare const CLI_VERSION = "0.16.6";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.4";
+export declare const USER_AGENT = "prohost-cli/0.16.6";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.4';
+export const CLI_VERSION = '0.16.6';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",