@prohost/cli 0.16.5 → 0.16.6

package/CHANGELOG.md

@@ -6,6 +6,15 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.6
+
+- **A hand-off note that can't be written undoes the dedicated install.** The note is part of the
+  takeover: without it the computer's key stayed in both homes, and a plain `host unpair` in the
+  original one would remove the computer under the running service. Now the service is
+  uninstalled and the key the install copied is removed (on Windows its administrators' copy too),
+  and the install fails with what to fix. A service home that already held the key before keeps
+  it, and the install still fails.
+
 ## 0.16.5
 
 - **A dedicated install takes the computer's key over.** `sudo prohost host install --dedicated`

package/README.md

@@ -247,9 +247,9 @@ holder:** once the service home has the computer, the home it was taken from (`-
 or `$SUDO_USER`'s) keeps only a note — `{handed_to: {label, service_user, service_home, at},
 computer_id, name, account, code_host_home?}`, no key — written as that home's owner.
 `host status` there reports `handed_to`; `unpair`, `pair` and a personal `install` refuse and
-name the service. If the note can't be written the install says so loudly (the key is then
-still in both homes: delete the old one by hand, never `unpair` from it). A failed install
-leaves the key where it was. `sudo prohost host uninstall --label <id>` gives the key back to
+name the service. The note is part of the takeover: if it can't be written, the install is
+undone (the service uninstalled, the key it copied removed) and fails, so the key is never left in
+both homes; a failed install leaves the key where it was. `sudo prohost host uninstall --label <id>` gives the key back to
 that home (so `prohost host install` runs it there again); `sudo prohost host unpair --label <id>`
 removes the computer. Both read the service's home from its installed definition (root's file),
 never from the note, which the home's owner can edit. **Updates drain:**

package/dist/host/command.d.ts

@@ -11,7 +11,7 @@
  *     prohost host pause | resume
  *     prohost host migrate [--from <home>]… [--home <dir,…>] [--keep-services] [--dry-run] [--json]
  */
-import type { InstallIo } from './install.js';
+import type { InstallIo, ServiceSpec } from './install.js';
 import type { LoginInfo } from './logins.js';
 import { runMigrate } from './migrate.js';
 type Flags = Record<string, string | boolean>;
@@ -63,5 +63,7 @@ export declare function statusJson(env: NodeJS.ProcessEnv, now?: number, options
 export declare function signInSpawn(command: string, args: string[], platform?: NodeJS.Platform): [string, string[], {
     windowsVerbatimArguments?: boolean;
 }];
+/** Whether the service manager still has `spec`'s dedicated service (loaded / active / a task). */
+export declare function serviceStillLoaded(spec: ServiceSpec, serviceIo: InstallIo, pidAlive?: (pid: number) => boolean): boolean;
 export declare function runHost(subcommand: string | undefined, flags: Flags, printHelp: () => void, io?: HostIo): Promise<number>;
 export {};

package/dist/host/command.js

@@ -29,7 +29,7 @@ import { addAccount, isValidLabel, loadAccounts, parseAccountRuntime, accountEnv
 import { revokeComputer } from './api.js';
 import { readSharedObject, acquireHostLock, clearComputer, computerOs, controlPath, handoffNotice, handoffOf, hostLockPath, SERVICE_LABEL, readHandoff, readObject, statePath, tryLoadComputer, writePrivateFile, } from './computer.js';
 import { journalPath, readEvents } from './events.js';
-import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, installedDedicatedService, publishedComputer, publishedComputerId, readServiceCredential, rewriteHomeCredential, windowsServiceCredentialPath, windowsHomesDir, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
+import { LAUNCHD_HOST_LABEL, defaultLabel, defaultServiceRunner, installService, installedDedicatedService, systemdUnitOf, publishedComputer, publishedComputerId, readServiceCredential, rewriteHomeCredential, windowsServiceCredentialPath, windowsHomesDir, windowsTaskOf, serviceFilePath, serviceUserHome, sharedBase, sharedDirFor, uninstallService, } from './install.js';
 import { LegacyHarnesses } from './legacy.js';
 import { detectLogins } from './logins.js';
 import { adoptComputer, loadAdopted, runMigrate } from './migrate.js';
@@ -490,6 +490,45 @@ function serviceCredential(platform, home, user, serviceIo, label) {
         return null;
     }
 }
+/** Whether the service manager still has `spec`'s dedicated service (loaded / active / a task). */
+export function serviceStillLoaded(spec, serviceIo, pidAlive = processAlive) {
+    const run = serviceIo.run ?? defaultServiceRunner;
+    try {
+        if (spec.platform === 'darwin')
+            return run('launchctl', ['print', `system/${spec.label}`]).status === 0;
+        if (spec.platform === 'win32') {
+            if (run('schtasks', ['/Query', '/TN', windowsTaskOf(spec)]).status === 0)
+                return true;
+            // Deleting a task does not stop what it started: the host's own lock names a live process.
+            // Only "no such file" means no lock; any other read error is an unknown, so still there (fail closed).
+            const lock = (serviceIo.readFile ?? ((f) => {
+                try {
+                    return readFileSync(f, 'utf8');
+                }
+                catch (e) {
+                    if (e.code === 'ENOENT')
+                        return undefined;
+                    throw e;
+                }
+            }))(path.win32.join(spec.home, 'host', 'service.lock'));
+            const pid = lock ? JSON.parse(lock).pid : undefined;
+            return typeof pid === 'number' && Number.isInteger(pid) && pid > 0 && pidAlive(pid);
+        }
+        return run('systemctl', ['is-active', '--quiet', systemdUnitOf(spec)]).status === 0;
+    }
+    catch {
+        return true;
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
+}
 /** The home a dedicated install took its computer from: `--from-home`, else (under sudo `$PROHOST_HOME` is root's) `$SUDO_USER`'s. */
 function handedFromHome(flags, env, platform) {
     return str(flags, 'from-home') ?? (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : prohostHome(env));
@@ -756,6 +795,8 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
             // The key this install takes over, read before it runs: only a copy it really made is retired.
             const handedFrom = dedicated && path.resolve(adoptFrom) !== path.resolve(home) ? tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom }) : null;
+            // Whether the service home already held a key before this install (then it copies none).
+            const serviceHadKey = handedFrom ? serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label) !== null : false;
             const outcome = installService(spec, io.serviceIo, {
                 ...(tokenFile ? { claudeTokenFile: tokenFile } : {}),
                 ...(dedicated ? { adoptFrom } : {}),
@@ -790,8 +831,55 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     });
                     const problem = rewriteHomeCredential(platform, adoptFrom, `${JSON.stringify(note, null, 2)}\n`, io.serviceIo);
                     if (problem) {
-                        err(`  ✗ The service has the computer, but its key is still in ${adoptFrom} too (${problem}). ` +
-                            `Delete ${path.join(adoptFrom, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from that home: it would remove the computer.`);
+                        // The note is part of the takeover: without it the key would live in both homes, and an
+                        // `unpair` here would remove the computer under the service. What this install did is undone.
+                        err(`  ✗ Could not leave the hand-off note in ${adoptFrom} (${problem}).`);
+                        // What the original home holds now decides the undo (on Windows a rename can land before a
+                        // later check fails): its key still there → undo; the note there after all → handed over;
+                        // neither → the service keeps the only key.
+                        const sourceKey = tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom });
+                        const sourceNote = readHandoff({ ...env, PROHOST_HOME: adoptFrom });
+                        const handedAnyway = !sourceKey && sourceNote?.handed_to.label === spec.label && sourceNote?.computer_id === handedFrom.computer_id;
+                        if (handedAnyway) {
+                            err(`  ! The note is in place after all: the computer's key is the service's alone. Check ${path.join(adoptFrom, 'host', 'computer.json')}.`);
+                        }
+                        else if (sourceKey?.computer_id !== handedFrom.computer_id) {
+                            err(`  ✗ ${adoptFrom} no longer holds this computer's key, so ${spec.label} keeps it: check ${path.join(adoptFrom, 'host', 'computer.json')}, never delete ${home}.`);
+                            return 1;
+                        }
+                        else if (!serviceHadKey) {
+                            const undone = (() => {
+                                try {
+                                    return uninstallService(spec, io.serviceIo);
+                                }
+                                catch (e) {
+                                    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+                                }
+                            })();
+                            // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
+                            // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
+                            const serviceGone = undone.ok && undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
+                            const keyGone = serviceGone && !rewriteHomeCredential(platform, home, undefined, io.serviceIo);
+                            if (keyGone && platform === 'win32') {
+                                try {
+                                    (io.serviceIo?.removeFile ?? ((f) => rmSync(f, { force: true })))(windowsServiceCredentialPath(spec));
+                                }
+                                catch {
+                                    /* reported below with the rest */
+                                }
+                            }
+                            err(serviceGone && keyGone
+                                ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
+                                    (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
+                                : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                            return 1;
+                        }
+                        else {
+                            err(`  ✗ ${home} already held this key before this install, so ${adoptFrom} still does too: never run \`prohost host unpair\` from that home. ` +
+                                `Fix the problem above, then install again.`);
+                        }
+                        if (!handedAnyway)
+                            return 1;
                     }
                     else {
                         out(`  The computer's key is the service's alone now: ${adoptFrom} keeps a note of where it went.`);

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.5";
+export declare const CLI_VERSION = "0.16.6";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.5";
+export declare const USER_AGENT = "prohost-cli/0.16.6";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.5';
+export const CLI_VERSION = '0.16.6';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.5",
+  "version": "0.16.6",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",