@prohost/cli 0.16.6 → 0.16.7

package/CHANGELOG.md

@@ -6,6 +6,22 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.7
+
+- **An undo whose cleanup fails says so.** When a dedicated install undoes itself (its hand-off
+  note could not be written) but a copy of the key it made can't be removed — on Windows the
+  administrators' copy — it reports a partial undo naming each leftover file, instead of "Undone".
+- README: the one-key guarantee names its exception (a service home that already held the key).
+- **Status reports with a terminal session are accepted again.** A live terminal went into
+  `running` with its runtime (`claude_code`) as `agent_id` and `started_at: ''`, which the server
+  refuses (422) for the whole report, so the computer showed offline. A terminal entry now sends
+  `agent_id: null`, `runtime`, and `started_at: null`; every string is clipped to the server's
+  limits.
+- **A refused status says why.** The server's reason (a 422 names the field) is logged, secrets
+  blanked, at the first refusal and again every 10 minutes with a count while it lasts.
+- The status body is pinned by a contract fixture (`shared/computers/tests/fixtures/cli_status_report.json`)
+  that the server's tests validate with `StatusReport`.
+
 ## 0.16.6
 
 - **A hand-off note that can't be written undoes the dedicated install.** The note is part of the
@@ -56,6 +72,15 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
   (`session_unknown`), another or no login (`login_changed`, `login_unavailable`), or past 10 minutes
   (`restart_expired`); a redelivery of one done is acked as done. Declared as
   `code_thread_restart_skip_permissions` beside `code_thread_skip_permissions`.
+- **A restarted Claude Code is ready for replies only once its own hook runs.** Each launch in a
+  thread's window now has an id (`PROHOST_LAUNCH_ID` in the agent's environment, which its hooks
+  inherit), recorded in `code-host/state/<terminal>.launch` as pending until the new process's own
+  first hook runs; meanwhile no other hook marks the window ready. A hook of the replaced process
+  that finishes after the restart can no longer mark the new one past its first-run screens, so a
+  relayed reply never types into its bypass confirmation, however late that hook runs. A launch the
+  daemon couldn't confirm stays pending (replies wait) until its own hook runs or the window is
+  restarted again. A start or restart whose launch can't be recorded launches nothing. Windows an
+  older build started keep the old rule.
 - Enable disabled macOS services before loading them, and report enable failures instead of claiming the install succeeded.
 
 ## 0.16.4

package/README.md

@@ -248,8 +248,12 @@ or `$SUDO_USER`'s) keeps only a note — `{handed_to: {label, service_user, serv
 computer_id, name, account, code_host_home?}`, no key — written as that home's owner.
 `host status` there reports `handed_to`; `unpair`, `pair` and a personal `install` refuse and
 name the service. The note is part of the takeover: if it can't be written, the install is
-undone (the service uninstalled, the key it copied removed) and fails, so the key is never left in
-both homes; a failed install leaves the key where it was. `sudo prohost host uninstall --label <id>` gives the key back to
+undone (the service uninstalled, the key it copied removed) and fails, so it never leaves a second
+copy of the key behind. One exception: when the service home already held the key before this
+install (an older setup that copied it), that copy stays, so the key is in both homes until the
+note can be written — never run `prohost host unpair` from the original home meanwhile; `sudo
+prohost host uninstall --label <id>` then removes the service. A failed install leaves the key
+where it was. `sudo prohost host uninstall --label <id>` gives the key back to
 that home (so `prohost host install` runs it there again); `sudo prohost host unpair --label <id>`
 removes the computer. Both read the service's home from its installed definition (root's file),
 never from the note, which the home's owner can edit. **Updates drain:**

package/dist/codehost/filelock.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A lock between processes on this Mac: a file beside what it guards, made by hard-linking a private
+ * file that already holds its owner's token (so a lock is never seen without one). Its holder
+ * releases it only while the file still holds that token, so it never removes a lock another
+ * process holds now. A lock left by a process that died holding it is taken over once it is
+ * `staleMs` old (see {@link takeOverStale}); with `liveHolders`, a lock whose holder still runs is
+ * never taken over, however old (a Mac asleep makes any lock look old).
+ */
+/** Whether the lock at `file` was left by a holder that died. */
+type StaleJudge = (file: string, nowMs: number) => boolean;
+/**
+ * When process `pid` started, in whole seconds, or `undefined` if that can't be told. From its
+ * elapsed time (`ps -o etime`), never a printed date: no time zone to get wrong.
+ */
+export declare function processStartSec(pid: number, nowMs?: number): number | undefined;
+/**
+ * Remove a stale lock without ever removing a live one: it is moved aside atomically first, then
+ * judged again. A file that is no longer stale is another process's fresh lock (it took over the
+ * same stale one a moment earlier) and is linked back, unless a lock exists again. Judged by age or
+ * holder, never by inode: Linux reuses a deleted file's inode for the next one made.
+ */
+export declare function takeOverStale(lock: string, staleMs: number, nowMs?: number, stale?: StaleJudge, judged?: string): void;
+export interface FileLockOptions {
+    /** A lock older than this was left by a holder that died (with `liveHolders`: see {@link holderGone}). */
+    staleMs: number;
+    /** Never take over a lock whose holder still runs, however old it is. */
+    liveHolders?: boolean;
+    /** How long to wait for another holder before giving up. */
+    waitMs: number;
+    now?: () => number;
+    /** When a process started (seconds); `ps` by default. */
+    processStart?: (pid: number) => number | undefined;
+}
+/**
+ * Run `work` holding `lock`. Returns `{ ok: false }` when another process holds it past
+ * `waitMs` (the caller says what that means); errors creating the lock's folder or file throw.
+ */
+export declare function withFileLock<T>(lock: string, work: () => T, options: FileLockOptions): {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+};
+export {};

package/dist/codehost/filelock.js

@@ -0,0 +1,239 @@
+/**
+ * A lock between processes on this Mac: a file beside what it guards, made by hard-linking a private
+ * file that already holds its owner's token (so a lock is never seen without one). Its holder
+ * releases it only while the file still holds that token, so it never removes a lock another
+ * process holds now. A lock left by a process that died holding it is taken over once it is
+ * `staleMs` old (see {@link takeOverStale}); with `liveHolders`, a lock whose holder still runs is
+ * never taken over, however old (a Mac asleep makes any lock look old).
+ */
+import { execFileSync } from 'node:child_process';
+import { linkSync, readdirSync, readFileSync, renameSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { ensurePrivateDir } from './settings.js';
+const olderThan = (staleMs) => (file, nowMs) => nowMs - statSync(file).mtimeMs > staleMs;
+let ownStart;
+/**
+ * When this process started, in whole seconds, as `ps` tells it (the same source a waiter checks it
+ * against, so a clock correction since can't set them apart); asked once per process. `0` (none)
+ * when `ps` can't tell: such a lock is then judged by its holder's pid alone.
+ */
+function ownStartSec() {
+    ownStart ??= processStartSec(process.pid) ?? 0;
+    return ownStart;
+}
+/** `<pid>.<start seconds>.<random>`: who holds the lock, and (with `withStart`) which incarnation of that pid. */
+function newToken(withStart) {
+    return `${process.pid}.${withStart ? ownStartSec() : 0}.${Math.random().toString(16).slice(2)}`;
+}
+/** The holder named in the lock at `file`, or `undefined` if its token can't be read. */
+function holderOf(file) {
+    try {
+        const [pidText, startText] = readFileSync(file, 'utf8').split('.');
+        const pid = Number.parseInt(pidText ?? '', 10);
+        if (!Number.isInteger(pid) || pid <= 0)
+            return undefined;
+        const startSec = Number.parseInt(startText ?? '', 10);
+        return { pid, startSec: Number.isInteger(startSec) && startSec > 0 ? startSec : undefined };
+    }
+    catch {
+        return undefined;
+    }
+}
+function readToken(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function running(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/** `[[dd-]hh:]mm:ss`, as `ps -o etime` prints it, in seconds. */
+function elapsedSec(text) {
+    const match = /^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/.exec(text.trim());
+    if (!match)
+        return undefined;
+    const [, days, hours, minutes, seconds] = match;
+    return ((Number(days ?? 0) * 24 + Number(hours ?? 0)) * 60 + Number(minutes)) * 60 + Number(seconds);
+}
+/**
+ * When process `pid` started, in whole seconds, or `undefined` if that can't be told. From its
+ * elapsed time (`ps -o etime`), never a printed date: no time zone to get wrong.
+ */
+export function processStartSec(pid, nowMs = Date.now()) {
+    try {
+        const out = execFileSync('ps', ['-o', 'etime=', '-p', String(pid)], {
+            encoding: 'utf8',
+            timeout: 1_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const elapsed = elapsedSec(out);
+        return elapsed === undefined ? undefined : Math.round(nowMs / 1000) - elapsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** When this Mac last booted, in ms. */
+const bootedAtMs = () => Date.now() - os.uptime() * 1000;
+/**
+ * Stale only once its holder is gone. A holder that still runs (suspended, say, while the Mac slept)
+ * keeps its lock. Gone: a lock from before the last boot; a holder pid that runs no process; or, for
+ * a lock past `staleMs`, a pid that now belongs to another process (it started at another time). A
+ * lock whose token can't be read is judged by age.
+ */
+const holderGone = (staleMs, startOf) => (file, nowMs) => {
+    const { mtimeMs } = statSync(file);
+    if (mtimeMs < bootedAtMs() - 60_000)
+        return true;
+    const holder = holderOf(file);
+    if (holder === undefined)
+        return nowMs - mtimeMs > staleMs;
+    if (!running(holder.pid))
+        return true;
+    if (nowMs - mtimeMs <= staleMs || holder.startSec === undefined)
+        return false;
+    // Old, and its pid runs: the same process only if it started when the holder did.
+    const started = startOf(holder.pid);
+    return started !== undefined && Math.abs(started - holder.startSec) > 2;
+};
+/**
+ * Remove a stale lock without ever removing a live one: it is moved aside atomically first, then
+ * judged again. A file that is no longer stale is another process's fresh lock (it took over the
+ * same stale one a moment earlier) and is linked back, unless a lock exists again. Judged by age or
+ * holder, never by inode: Linux reuses a deleted file's inode for the next one made.
+ */
+export function takeOverStale(lock, staleMs, nowMs = Date.now(), stale = olderThan(staleMs), judged) {
+    const aside = `${lock}.${process.pid}.${Math.random().toString(16).slice(2)}.stale`;
+    try {
+        renameSync(lock, aside);
+    }
+    catch {
+        return; // someone else moved or released it
+    }
+    try {
+        // Not the lock that was judged (`judged`: its token then): a successor took the path meanwhile,
+        // and its lock goes straight back, unjudged.
+        if ((judged !== undefined && readToken(aside) !== judged) || !stale(aside, nowMs)) {
+            try {
+                linkSync(aside, lock);
+            }
+            catch {
+                /* a newer lock is there: that one stands */
+            }
+        }
+    }
+    finally {
+        rmSync(aside, { force: true });
+    }
+}
+/**
+ * Drafts (`<lock>.<token>.tmp`) a holder left behind when it died between writing one and removing
+ * it: removed once older than `staleMs` and their writer runs no more. Run by a holder, after it
+ * has the lock, so the state folder never fills up with them.
+ */
+function sweepDrafts(lock, staleMs, nowMs) {
+    const dir = path.dirname(lock);
+    const prefix = `${path.basename(lock)}.`;
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (!name.startsWith(prefix) || !(name.endsWith('.tmp') || name.endsWith('.stale')))
+            continue;
+        const file = path.join(dir, name);
+        try {
+            if (nowMs - statSync(file).mtimeMs <= staleMs)
+                continue;
+            const pid = Number.parseInt(name.slice(prefix.length).split('.')[0] ?? '', 10);
+            if (Number.isInteger(pid) && pid > 0 && running(pid))
+                continue;
+            rmSync(file, { force: true });
+        }
+        catch {
+            /* gone meanwhile */
+        }
+    }
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Run `work` holding `lock`. Returns `{ ok: false }` when another process holds it past
+ * `waitMs` (the caller says what that means); errors creating the lock's folder or file throw.
+ */
+export function withFileLock(lock, work, options) {
+    ensurePrivateDir(path.dirname(lock));
+    const now = options.now ?? Date.now;
+    const deadline = now() + options.waitMs;
+    const stale = options.liveHolders
+        ? holderGone(options.staleMs, options.processStart ?? processStartSec)
+        : olderThan(options.staleMs);
+    // Released only while the file is still this one: never a lock another process holds now.
+    const token = newToken(options.liveHolders === true);
+    // The token is written first, privately; the lock appears only as a link to it, whole.
+    const draft = `${lock}.${token}.tmp`;
+    writeFileSync(draft, token, { mode: 0o600, flag: 'wx' });
+    try {
+        for (;;) {
+            try {
+                linkSync(draft, lock);
+                // The link carries the draft's age: made fresh now, then checked still ours (a waiter that
+                // judged it by that age a moment earlier may have taken it over; then this one tries again).
+                const at = new Date(now());
+                utimesSync(lock, at, at);
+                if (readFileSync(lock, 'utf8') === token)
+                    break;
+                continue;
+            }
+            catch (err) {
+                if (err.code === 'ENOENT')
+                    continue; // taken over meanwhile
+                if (err.code !== 'EEXIST')
+                    throw err;
+            }
+            try {
+                const judged = readToken(lock);
+                if (stale(lock, now())) {
+                    takeOverStale(lock, options.staleMs, now(), stale, judged);
+                    continue;
+                }
+            }
+            catch {
+                continue; // released between the link and the stat: try again at once
+            }
+            if (now() >= deadline)
+                return { ok: false };
+            sleepSync(10 + Math.floor(Math.random() * 20));
+        }
+    }
+    finally {
+        rmSync(draft, { force: true });
+    }
+    sweepDrafts(lock, options.staleMs, now());
+    try {
+        return { ok: true, value: work() };
+    }
+    finally {
+        try {
+            if (readFileSync(lock, 'utf8') === token)
+                rmSync(lock, { force: true });
+        }
+        catch {
+            /* already gone */
+        }
+    }
+}

package/dist/codehost/folders.d.ts

@@ -65,19 +65,14 @@ export declare const TOUCH_LOCK_WAIT_MS = 100;
 export declare class FoldersBusyError extends Error {
     constructor();
 }
-/**
- * Remove a stale lock without ever removing a live one: it is moved aside atomically first, then
- * judged by its age again. A file that is no longer stale is another process's fresh lock (it took
- * over the same stale one a moment earlier) and is linked back, unless a lock exists again. Judged
- * by age, never by inode: Linux reuses a deleted file's inode for the next one made.
- */
+/** {@link takeOverStale} for the folders lock (its stale age). */
 export declare function takeOverStale(lock: string, nowMs?: number): void;
 /**
  * Run `work` (a read-modify-write of `folders.json`) holding the list's lock: `folders.json.lock`,
- * created exclusively. The desktop app's `folders add`, a second `folders add` and the daemon
- * moving a started folder to the front are separate processes; without it, two that read the same
- * list each write it back without the other's folder. A lock left by a process that died is taken
- * over once it is {@link FOLDERS_LOCK_STALE_MS} old.
+ * created exclusively ({@link withFileLock}). The desktop app's `folders add`, a second `folders add`
+ * and the daemon moving a started folder to the front are separate processes; without it, two that
+ * read the same list each write it back without the other's folder. A lock left by a process that
+ * died is taken over once it is {@link FOLDERS_LOCK_STALE_MS} old.
  *
  * @throws FoldersBusyError when another process holds it past {@link FOLDERS_LOCK_WAIT_MS}.
  */

package/dist/codehost/folders.js

@@ -19,10 +19,11 @@
  * segments: a symlink inside an opened folder that points out of it does not
  * count as inside.
  */
-import { closeSync, linkSync, openSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeSync } from 'node:fs';
+import { realpathSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { codeHostDir, ensurePrivateDir, readJsonObject, writePrivateJson } from './settings.js';
+import { takeOverStale as takeOverStaleLock, withFileLock } from './filelock.js';
+import { codeHostDir, readJsonObject, writePrivateJson } from './settings.js';
 export const FOLDERS_VERSION = 1;
 export const MAX_OPENED_FOLDERS = 50;
 /** The server's bound on a start's `folder` (CONTRACT: ≤ 1024 chars). */
@@ -109,93 +110,28 @@ export class FoldersBusyError extends Error {
         super('The opened-folders list is busy (another prohost is changing it). Try again.');
     }
 }
-/**
- * Remove a stale lock without ever removing a live one: it is moved aside atomically first, then
- * judged by its age again. A file that is no longer stale is another process's fresh lock (it took
- * over the same stale one a moment earlier) and is linked back, unless a lock exists again. Judged
- * by age, never by inode: Linux reuses a deleted file's inode for the next one made.
- */
+/** {@link takeOverStale} for the folders lock (its stale age). */
 export function takeOverStale(lock, nowMs = Date.now()) {
-    const aside = `${lock}.${process.pid}.${Math.random().toString(16).slice(2)}.stale`;
-    try {
-        renameSync(lock, aside);
-    }
-    catch {
-        return; // someone else moved or released it
-    }
-    try {
-        if (nowMs - statSync(aside).mtimeMs <= FOLDERS_LOCK_STALE_MS) {
-            try {
-                linkSync(aside, lock);
-            }
-            catch {
-                /* a newer lock is there: that one stands */
-            }
-        }
-    }
-    finally {
-        rmSync(aside, { force: true });
-    }
-}
-function sleepSync(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    takeOverStaleLock(lock, FOLDERS_LOCK_STALE_MS, nowMs);
 }
 /**
  * Run `work` (a read-modify-write of `folders.json`) holding the list's lock: `folders.json.lock`,
- * created exclusively. The desktop app's `folders add`, a second `folders add` and the daemon
- * moving a started folder to the front are separate processes; without it, two that read the same
- * list each write it back without the other's folder. A lock left by a process that died is taken
- * over once it is {@link FOLDERS_LOCK_STALE_MS} old.
+ * created exclusively ({@link withFileLock}). The desktop app's `folders add`, a second `folders add`
+ * and the daemon moving a started folder to the front are separate processes; without it, two that
+ * read the same list each write it back without the other's folder. A lock left by a process that
+ * died is taken over once it is {@link FOLDERS_LOCK_STALE_MS} old.
  *
  * @throws FoldersBusyError when another process holds it past {@link FOLDERS_LOCK_WAIT_MS}.
  */
 export function withFoldersLock(env, work, options = {}) {
-    const lock = `${foldersPath(env)}.lock`;
-    ensurePrivateDir(path.dirname(lock));
-    const now = options.now ?? Date.now;
-    const deadline = now() + (options.waitMs ?? FOLDERS_LOCK_WAIT_MS);
-    // Released only while the file is still this one: never a lock another process holds now.
-    const token = `${process.pid}.${Math.random().toString(16).slice(2)}`;
-    for (;;) {
-        try {
-            const fd = openSync(lock, 'wx', 0o600);
-            try {
-                writeSync(fd, token);
-            }
-            finally {
-                closeSync(fd);
-            }
-            break;
-        }
-        catch (err) {
-            if (err.code !== 'EEXIST')
-                throw err;
-        }
-        try {
-            if (now() - statSync(lock).mtimeMs > FOLDERS_LOCK_STALE_MS) {
-                takeOverStale(lock, now());
-                continue;
-            }
-        }
-        catch {
-            continue; // released between the open and the stat: try again at once
-        }
-        if (now() >= deadline)
-            throw new FoldersBusyError();
-        sleepSync(10 + Math.floor(Math.random() * 20));
-    }
-    try {
-        return work();
-    }
-    finally {
-        try {
-            if (readFileSync(lock, 'utf8') === token)
-                rmSync(lock, { force: true });
-        }
-        catch {
-            /* already gone */
-        }
-    }
+    const held = withFileLock(`${foldersPath(env)}.lock`, work, {
+        staleMs: FOLDERS_LOCK_STALE_MS,
+        waitMs: options.waitMs ?? FOLDERS_LOCK_WAIT_MS,
+        now: options.now,
+    });
+    if (!held.ok)
+        throw new FoldersBusyError();
+    return held.value;
 }
 /** `folder` (a realpath) at the front, opened now; the oldest past the cap drops off. */
 function upsertFront(folder, env, now, waitMs) {

package/dist/codehost/ready.d.ts

@@ -8,23 +8,86 @@
  * screen, is what lets a relayed reply be typed: before it, the dialog may be
  * up or about to be drawn, and an Enter would answer it. The mark is a file,
  * so it outlives a daemon restart.
+ *
+ * A window's Claude Code can be replaced (a restart), and a hook of the old one
+ * may still be running when it is: one that writes the mark after the restart
+ * dropped it would say the new process is past screens it hasn't reached. So
+ * each launch has an id ({@link LAUNCH_ENV} in the process's environment, which
+ * its hooks inherit), recorded in `<state>/<terminal>.launch` as pending until
+ * the new process's own first hook runs; meanwhile no other hook marks the
+ * window, however late it runs. A launch the daemon couldn't confirm stays
+ * pending (no reply types) until its own hook runs or the window is restarted
+ * again. A window with no launch record (one an older build started) is judged
+ * by the mark alone, as before.
+ */
+/** The launch id a window's agent process runs under, in its environment (and so its hooks'). */
+export declare const LAUNCH_ENV = "PROHOST_LAUNCH_ID";
+/**
+ * `<state>/<terminal>.launch`: the launch the window runs (`launch`; `null` for a process with no
+ * launch id, such as one an older build started), and `next`, one about to replace it whose own
+ * hook hasn't run yet. `gen` changes with every write, and a mark counts only for the `gen` it was
+ * written under, so a mark whose writer looked before a launch began never counts after it.
  */
+interface LaunchRecord {
+    launch: string | null;
+    next?: string;
+    gen: number;
+}
 export declare function readyPath(terminalId: string, env?: NodeJS.ProcessEnv): string;
+export declare function launchPath(terminalId: string, env?: NodeJS.ProcessEnv): string;
 /**
- * Mark the terminal's Claude Code past its trust dialog (a hook ran). Atomic (`writePrivateJson`).
- * Returns whether it is marked afterwards; `false` means the write failed, and the caller says so.
+ * The launch the window runs now: its id, `null` for a process with no launch id or a window with no
+ * launch record, or `undefined` when the record can't be read.
+ */
+export declare function currentLaunch(terminalId: string, env?: NodeJS.ProcessEnv): string | null | undefined;
+/** The launch waiting for its first hook, if one is. */
+export declare function pendingLaunch(terminalId: string, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * A hook of launch `launch` ran in the window (by default the caller's own, from its environment):
+ * mark the window past its trust dialog. Atomic (`writePrivateJson`).
+ *
+ * - The pending launch's own hook proves it runs: it becomes the window's launch, and is marked.
+ * - While a launch is pending, any other hook is of a process being replaced: it has no say, however
+ *   late it runs (a hook suspended while the Mac slept may resume long after).
+ * - With nothing pending, a hook of another launch is of the process the window runs (an older
+ *   build relaunched it since): its launch becomes the window's.
+ *
+ * Returns whether the window is marked afterwards, or that the hook had no say; `false` means the
+ * state couldn't be read or written, and the caller says so.
  */
-export declare function markReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean;
+export declare function markReady(terminalId: string, env?: NodeJS.ProcessEnv, launch?: string | null, now?: number): boolean;
 /**
- * Forget the mark: the window's Claude Code was replaced (a restart), and the new one is past its
- * dialog only once its own first hook runs. Returns whether no mark is left.
+ * Forget the mark: the window's Claude Code is being replaced, and the new one is past its dialog
+ * only once its own first hook runs. Returns whether no mark is left.
  */
 export declare function clearReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Launch `launch` is about to run in the window (a start or a restart): pending until its own first
+ * hook runs, and no other hook marks the window meanwhile. Recorded first, then the old mark dropped.
+ * Returns whether both were done; on `false` the caller must not launch.
+ */
+export declare function beginLaunch(terminalId: string, launch: string, env?: NodeJS.ProcessEnv, now?: number): boolean;
+/** What {@link restoreLaunch} puts back: the window's launch record and readiness before {@link beginLaunch}. */
+export interface LaunchState {
+    record: LaunchRecord | null | undefined;
+    ready: boolean | undefined;
+}
+export declare function launchState(terminalId: string, env?: NodeJS.ProcessEnv): LaunchState;
+/**
+ * The new launch never ran (nothing was replaced): the window's old process keeps its launch and,
+ * if it had it, its readiness. If that can't be written, the launch stays pending (no reply types)
+ * until the window is restarted again.
+ */
+export declare function restoreLaunch(terminalId: string, state: LaunchState, env?: NodeJS.ProcessEnv, now?: number): void;
 /**
  * The transcript files (`<session>.jsonl`) Claude Code keeps for `cwd` under `configDir`: one exists
  * for a session only once its first prompt ran. Empty when there are none or they can't be read.
  */
 export declare function claudeTranscripts(cwd: string, configDir: string): string[];
 export declare function claudeSessionSince(cwd: string, configDir: string, sinceMs: number): boolean;
-/** `true` past the dialog, `false` not yet, `undefined` when the state can't be read. */
+/**
+ * `true` past the dialog (a hook of the launch the window runs now ran, and no other launch is
+ * pending), `false` not yet, `undefined` when the state can't be read.
+ */
 export declare function isReady(terminalId: string, env?: NodeJS.ProcessEnv): boolean | undefined;
+export {};

package/dist/codehost/ready.js

@@ -8,27 +8,151 @@
  * screen, is what lets a relayed reply be typed: before it, the dialog may be
  * up or about to be drawn, and an Enter would answer it. The mark is a file,
  * so it outlives a daemon restart.
+ *
+ * A window's Claude Code can be replaced (a restart), and a hook of the old one
+ * may still be running when it is: one that writes the mark after the restart
+ * dropped it would say the new process is past screens it hasn't reached. So
+ * each launch has an id ({@link LAUNCH_ENV} in the process's environment, which
+ * its hooks inherit), recorded in `<state>/<terminal>.launch` as pending until
+ * the new process's own first hook runs; meanwhile no other hook marks the
+ * window, however late it runs. A launch the daemon couldn't confirm stays
+ * pending (no reply types) until its own hook runs or the window is restarted
+ * again. A window with no launch record (one an older build started) is judged
+ * by the mark alone, as before.
  */
-import { closeSync, openSync, readdirSync, readSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { closeSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { withFileLock } from './filelock.js';
 import { codeHostDir, writePrivateJson } from './settings.js';
 import { isValidId } from './tmux.js';
+/** The launch id a window's agent process runs under, in its environment (and so its hooks'). */
+export const LAUNCH_ENV = 'PROHOST_LAUNCH_ID';
 export function readyPath(terminalId, env = process.env) {
     if (!isValidId(terminalId))
         throw new Error('invalid terminal id');
     return path.join(codeHostDir(env), 'state', `${terminalId}.ready`);
 }
+export function launchPath(terminalId, env = process.env) {
+    if (!isValidId(terminalId))
+        throw new Error('invalid terminal id');
+    return path.join(codeHostDir(env), 'state', `${terminalId}.launch`);
+}
+/** The window's launch record: `null` with none (an older build's window), `undefined` when it can't be read. */
+function readLaunch(terminalId, env) {
+    let raw;
+    try {
+        raw = readFileSync(launchPath(terminalId, env), 'utf8');
+    }
+    catch (err) {
+        return err.code === 'ENOENT' ? null : undefined;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        const launch = parsed.launch;
+        if (!(launch === null || typeof launch === 'string') || typeof parsed.gen !== 'number')
+            return undefined;
+        if (parsed.next !== undefined && typeof parsed.next !== 'string')
+            return undefined;
+        return { launch, gen: parsed.gen, ...(parsed.next !== undefined ? { next: parsed.next } : {}) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A lock whose token can't be read (its holder died writing it) and older than this is stale. */
+const LAUNCH_LOCK_STALE_MS = 10_000;
+/** How long a writer waits for the lock before it gives up (and says so). */
+const LAUNCH_LOCK_WAIT_MS = 1_000;
+/**
+ * `fn` holding the window's launch lock (`<terminal>.launch.lock`, {@link withFileLock}): hooks and
+ * the daemon are separate processes, and every read-then-write of the record goes through it, so a
+ * hook's promotion never overwrites a launch the daemon began after the hook read the record.
+ * `fallback` when the lock can't be had.
+ */
+function withLaunchLock(terminalId, env, fallback, fn) {
+    try {
+        // A holder that still runs keeps it, however long it is suspended: taken over, it would write
+        // over its successor's record on waking.
+        const held = withFileLock(`${launchPath(terminalId, env)}.lock`, fn, {
+            staleMs: LAUNCH_LOCK_STALE_MS,
+            waitMs: LAUNCH_LOCK_WAIT_MS,
+            liveHolders: true,
+        });
+        return held.ok ? held.value : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** A gen that is new: never equal to the one it replaces, even within one millisecond. */
+function nextGen(previous, now) {
+    return previous && now <= previous.gen ? previous.gen + 1 : now;
+}
+/**
+ * The launch the window runs now: its id, `null` for a process with no launch id or a window with no
+ * launch record, or `undefined` when the record can't be read.
+ */
+export function currentLaunch(terminalId, env = process.env) {
+    const record = readLaunch(terminalId, env);
+    return record === undefined ? undefined : (record?.launch ?? null);
+}
+/** The launch waiting for its first hook, if one is. */
+export function pendingLaunch(terminalId, env = process.env) {
+    return readLaunch(terminalId, env)?.next;
+}
 /**
- * Mark the terminal's Claude Code past its trust dialog (a hook ran). Atomic (`writePrivateJson`).
- * Returns whether it is marked afterwards; `false` means the write failed, and the caller says so.
+ * A hook of launch `launch` ran in the window (by default the caller's own, from its environment):
+ * mark the window past its trust dialog. Atomic (`writePrivateJson`).
+ *
+ * - The pending launch's own hook proves it runs: it becomes the window's launch, and is marked.
+ * - While a launch is pending, any other hook is of a process being replaced: it has no say, however
+ *   late it runs (a hook suspended while the Mac slept may resume long after).
+ * - With nothing pending, a hook of another launch is of the process the window runs (an older
+ *   build relaunched it since): its launch becomes the window's.
+ *
+ * Returns whether the window is marked afterwards, or that the hook had no say; `false` means the
+ * state couldn't be read or written, and the caller says so.
  */
-export function markReady(terminalId, env = process.env) {
+export function markReady(terminalId, env = process.env, launch = env[LAUNCH_ENV] || null, now = Date.now()) {
     if (!isValidId(terminalId))
         return false;
-    if (isReady(terminalId, env) === true)
+    // Most hooks find their window marked already: nothing to write, so no lock to take. That
+    // includes a window an older build started (no record), whose hooks run this build after an upgrade.
+    const record = readLaunch(terminalId, env);
+    const current = record === null || (record !== undefined && record.next === undefined && record.launch === launch);
+    if (current && isReady(terminalId, env) === true)
         return true;
+    return withLaunchLock(terminalId, env, false, () => markReadyLocked(terminalId, env, launch, now));
+}
+function markReadyLocked(terminalId, env, launch, now) {
+    const record = readLaunch(terminalId, env);
+    if (record === undefined)
+        return false;
     try {
-        writePrivateJson(readyPath(terminalId, env), Date.now());
+        if (record === null) {
+            // A window an older build started: the mark alone, as it always was.
+            if (isReady(terminalId, env) === true)
+                return true;
+            writePrivateJson(readyPath(terminalId, env), { launch, at: now });
+            return true;
+        }
+        let current = record;
+        if (record.next !== undefined) {
+            // Pending: only its own hook settles it (or the daemon, knowing nothing was replaced).
+            if (launch !== record.next)
+                return true;
+            current = { launch, gen: nextGen(record, now) };
+        }
+        else if (launch !== record.launch) {
+            // Nothing pending, and a hook of another launch: the window runs it (an older build relaunched
+            // it since), and a hook runs only once it is past its screens.
+            current = { launch, gen: nextGen(record, now) };
+        }
+        if (current !== record)
+            writePrivateJson(launchPath(terminalId, env), current);
+        else if (isReady(terminalId, env) === true)
+            return true;
+        writePrivateJson(readyPath(terminalId, env), { launch: current.launch, gen: current.gen, at: now });
         return true;
     }
     catch {
@@ -36,8 +160,8 @@ export function markReady(terminalId, env = process.env) {
     }
 }
 /**
- * Forget the mark: the window's Claude Code was replaced (a restart), and the new one is past its
- * dialog only once its own first hook runs. Returns whether no mark is left.
+ * Forget the mark: the window's Claude Code is being replaced, and the new one is past its dialog
+ * only once its own first hook runs. Returns whether no mark is left.
  */
 export function clearReady(terminalId, env = process.env) {
     if (!isValidId(terminalId))
@@ -50,6 +174,65 @@ export function clearReady(terminalId, env = process.env) {
         return false;
     }
 }
+/**
+ * Launch `launch` is about to run in the window (a start or a restart): pending until its own first
+ * hook runs, and no other hook marks the window meanwhile. Recorded first, then the old mark dropped.
+ * Returns whether both were done; on `false` the caller must not launch.
+ */
+export function beginLaunch(terminalId, launch, env = process.env, now = Date.now()) {
+    if (!isValidId(terminalId) || launch === '')
+        return false;
+    return withLaunchLock(terminalId, env, false, () => {
+        const record = readLaunch(terminalId, env);
+        if (record === undefined)
+            return false;
+        try {
+            writePrivateJson(launchPath(terminalId, env), { launch: record?.launch ?? null, next: launch, gen: nextGen(record, now) });
+        }
+        catch {
+            return false;
+        }
+        return clearReady(terminalId, env);
+    });
+}
+export function launchState(terminalId, env = process.env) {
+    return { record: readLaunch(terminalId, env), ready: isReady(terminalId, env) };
+}
+/**
+ * The new launch never ran (nothing was replaced): the window's old process keeps its launch and,
+ * if it had it, its readiness. If that can't be written, the launch stays pending (no reply types)
+ * until the window is restarted again.
+ */
+export function restoreLaunch(terminalId, state, env = process.env, now = Date.now()) {
+    const before = state.record;
+    if (before === undefined)
+        return;
+    withLaunchLock(terminalId, env, undefined, () => restoreLocked(terminalId, before, state.ready === true, env, now));
+}
+function restoreLocked(terminalId, previous, ready, env, now) {
+    try {
+        if (previous === null) {
+            rmSync(launchPath(terminalId, env), { force: true });
+            if (ready)
+                writePrivateJson(readyPath(terminalId, env), { launch: null, at: now });
+            return;
+        }
+        const pending = readLaunch(terminalId, env);
+        // Exactly as it was, a launch still pending included: a failed attempt never lifts its protection.
+        const record = {
+            launch: previous.launch,
+            ...(previous.next !== undefined ? { next: previous.next } : {}),
+            gen: nextGen(pending ?? previous, now),
+        };
+        writePrivateJson(launchPath(terminalId, env), record);
+        if (ready && record.next === undefined) {
+            writePrivateJson(readyPath(terminalId, env), { launch: record.launch, gen: record.gen, at: now });
+        }
+    }
+    catch {
+        /* left pending (see above): fails closed */
+    }
+}
 /** How much of a transcript is read looking for its folder (its first entries carry `cwd`). */
 const TRANSCRIPT_HEAD_BYTES = 256 * 1024;
 /**
@@ -129,13 +312,31 @@ export function claudeSessionSince(cwd, configDir, sinceMs) {
         }
     });
 }
-/** `true` past the dialog, `false` not yet, `undefined` when the state can't be read. */
+/**
+ * `true` past the dialog (a hook of the launch the window runs now ran, and no other launch is
+ * pending), `false` not yet, `undefined` when the state can't be read.
+ */
 export function isReady(terminalId, env = process.env) {
+    let raw;
     try {
-        statSync(readyPath(terminalId, env));
-        return true;
+        raw = readFileSync(readyPath(terminalId, env), 'utf8');
     }
     catch (err) {
         return err.code === 'ENOENT' ? false : undefined;
     }
+    const record = readLaunch(terminalId, env);
+    if (record === undefined)
+        return undefined;
+    if (record === null)
+        return true;
+    let mark = {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object')
+            mark = parsed;
+    }
+    catch {
+        /* an unreadable mark marks nothing */
+    }
+    return record.next === undefined && mark.gen === record.gen && (mark.launch ?? null) === record.launch;
 }

package/dist/codehost/terminals.js

@@ -35,7 +35,7 @@ import { readHistory } from './history.js';
 import { loginOf, readSession } from './session.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
-import { claudeSessionSince, claudeTranscripts, clearReady, isReady, markReady } from './ready.js';
+import { beginLaunch, claudeSessionSince, claudeTranscripts, currentLaunch, isReady, LAUNCH_ENV, launchState, markReady, restoreLaunch, } from './ready.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
 import { noteInputTakeover } from './sizing.js';
 import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, respawnPaneArgs, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
@@ -443,7 +443,10 @@ export class CodeTerminals {
     adoptReadiness(record, configDir, startedAtMs) {
         if (!(this.options.claudeSessionSince ?? claudeSessionSince)(record.cwd, configDir, startedAtMs))
             return;
-        if (markReady(record.terminalId, { PROHOST_HOME: this.options.home })) {
+        // The evidence is about the process the window runs now: its launch, if it has one, is marked.
+        const env = { PROHOST_HOME: this.options.home };
+        const launch = currentLaunch(record.terminalId, env);
+        if (launch !== undefined && markReady(record.terminalId, env, launch)) {
             this.log(`    ⚙ code thread ${record.codeThreadId.slice(0, 12)}: adopted past Claude Code's trust dialog (its session exists)`);
         }
     }
@@ -526,6 +529,12 @@ export class CodeTerminals {
         const command = agentCommandLine(request.agent, { ...this.options.hookFiles, hasGoal: goal.length > 0, skipPermissions: skips });
         // A shell thread's shell waits for its first viewer's size to settle (`sizing.ts`): one prompt.
         const held = request.agent === 'shell';
+        // Its own launch (`ready.ts`): only this process's hooks mark it past its first-run screens. One
+        // that can't be recorded is a window no reply could ever be typed into: the start fails instead.
+        const launch = randomBytes(8).toString('hex');
+        if (request.agent === 'claude_code' && !beginLaunch(request.terminalId, launch, { PROHOST_HOME: this.options.home })) {
+            return fail("this Mac's code-host state can't be written ($PROHOST_HOME/code-host/state)");
+        }
         const created = await this.tmux(newWindowArgs({
             name,
             cwd: checkout.path,
@@ -534,6 +543,7 @@ export class CodeTerminals {
                 PROHOST_HOME: this.options.home,
                 [TERMINAL_ID_ENV]: request.terminalId,
                 [CODE_THREAD_ID_ENV]: request.codeThreadId,
+                [LAUNCH_ENV]: launch,
                 ...(goal ? { [GOAL_ENV]: goal } : {}),
             },
             command: held ? holdCommand(name, command) : command,
@@ -718,8 +728,9 @@ export class CodeTerminals {
         const token = randomBytes(8).toString('hex');
         const command = `tmux set-option -wu ${EXITED_OPTION} 2>/dev/null; tmux set-option -w ${RELAUNCH_OPTION} ${token} 2>/dev/null; ` +
             agentCommandLine(agent, { ...this.options.hookFiles, hasGoal: false, skipPermissions: request.skipPermissions, resume });
-        // Like a new window: replies wait for the new Claude Code's first hook (`ready.ts`). Dropped before
-        // the old process goes, so that hook's mark is never wiped after it was written.
+        // Like a new window: replies wait for the new Claude Code's first hook (`ready.ts`). Its launch is
+        // recorded (and the old mark dropped) before the old process goes, so that hook's mark is never
+        // wiped after it was written, and a late hook of the old process can't mark the new one.
         // The switch once more, as late as it can be: nothing awaits between here and `respawn-pane`, so a
         // `remote off` that landed during the looks above stops it before anything is claimed or touched.
         if (request.skipPermissions && !this.canType())
@@ -736,9 +747,15 @@ export class CodeTerminals {
             return false;
         }
         const before = this.panePids.get(record.terminalId);
-        const wasReady = agent === 'claude_code' && this.isReady(record.terminalId) === true;
-        if (agent === 'claude_code')
-            clearReady(record.terminalId, env);
+        const previous = agent === 'claude_code' ? launchState(record.terminalId, env) : undefined;
+        if (previous && !beginLaunch(record.terminalId, token, env)) {
+            // Nothing was replaced, and nothing may be until the new launch can be told from the old one.
+            restoreLaunch(record.terminalId, previous, env);
+            this.log(`    ! code thread ${short} not restarted yet: its launch could not be recorded`);
+            outcome.retry = true;
+            outcome.release = true;
+            return false;
+        }
         // The restart's own `stop` is stamped now, before the new pane exists: any hook the new agent
         // sends is strictly newer and wins under the server's host-event ordering, never this one.
         const stopAt = this.now();
@@ -750,13 +767,14 @@ export class CodeTerminals {
                 PROHOST_HOME: this.options.home,
                 [TERMINAL_ID_ENV]: record.terminalId,
                 [CODE_THREAD_ID_ENV]: record.codeThreadId,
+                [LAUNCH_ENV]: token,
             },
             command,
         }));
         if (!respawned.ok && !respawned.uncertain) {
-            // Nothing was replaced: the old process (and its readiness) stays, and it is worth sending again.
-            if (wasReady)
-                markReady(record.terminalId, env);
+            // Nothing was replaced: the old process (its launch and readiness) stays, and it is worth sending again.
+            if (previous)
+                restoreLaunch(record.terminalId, previous, env);
             this.log(`    ! code thread ${short} not restarted: tmux said ${respawned.stderr.trim()}`);
             outcome.retry = true;
             outcome.release = true;
@@ -767,9 +785,9 @@ export class CodeTerminals {
         // prompts are off.
         const after = await this.panePidNow(record.terminalId);
         if (after !== undefined && after === before) {
-            // The same process still runs: nothing was replaced. It keeps its readiness, and is sent again.
-            if (wasReady)
-                markReady(record.terminalId, env);
+            // The same process still runs: nothing was replaced. It keeps its launch and readiness, and is sent again.
+            if (previous)
+                restoreLaunch(record.terminalId, previous, env);
             this.log(`    ! code thread ${short} not restarted: its window still runs the same process`);
             outcome.retry = true;
             outcome.release = true;

package/dist/host/api.js

@@ -36,7 +36,7 @@ export async function callJson(options, path, body, method = 'POST') {
             parsed = undefined;
         }
         const ok = response.status >= 200 && response.status < 300;
-        return { status: response.status, body: parsed, ...(ok ? {} : { error: text.slice(0, 300) }) };
+        return { status: response.status, body: parsed, ...(ok ? {} : { error: text.slice(0, 500) }) };
     }
     catch (err) {
         if (controller.signal.aborted)

package/dist/host/command.d.ts

@@ -65,5 +65,10 @@ export declare function signInSpawn(command: string, args: string[], platform?:
 }];
 /** Whether the service manager still has `spec`'s dedicated service (loaded / active / a task). */
 export declare function serviceStillLoaded(spec: ServiceSpec, serviceIo: InstallIo, pidAlive?: (pid: number) => boolean): boolean;
+/**
+ * Remove every copy of the key a dedicated install made (the service home's, and on Windows the
+ * administrators' copy), each attempted on its own: the files that are still there, named.
+ */
+export declare function removeCopiedKeys(spec: ServiceSpec, serviceIo: InstallIo): string[];
 export declare function runHost(subcommand: string | undefined, flags: Flags, printHelp: () => void, io?: HostIo): Promise<number>;
 export {};

package/dist/host/command.js

@@ -529,6 +529,26 @@ function processAlive(pid) {
         return e.code === 'EPERM';
     }
 }
+/**
+ * Remove every copy of the key a dedicated install made (the service home's, and on Windows the
+ * administrators' copy), each attempted on its own: the files that are still there, named.
+ */
+export function removeCopiedKeys(spec, serviceIo) {
+    const leftover = [];
+    const homeKey = (spec.platform === 'win32' ? path.win32 : path.posix).join(spec.home, 'host', 'computer.json');
+    if (rewriteHomeCredential(spec.platform, spec.home, undefined, serviceIo))
+        leftover.push(homeKey);
+    if (spec.platform === 'win32') {
+        const copy = windowsServiceCredentialPath(spec);
+        try {
+            (serviceIo.removeFile ?? ((f) => rmSync(f, { force: true })))(copy);
+        }
+        catch {
+            leftover.push(copy);
+        }
+    }
+    return leftover;
+}
 /** The home a dedicated install took its computer from: `--from-home`, else (under sudo `$PROHOST_HOME` is root's) `$SUDO_USER`'s. */
 function handedFromHome(flags, env, platform) {
     return str(flags, 'from-home') ?? (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : prohostHome(env));
@@ -858,20 +878,16 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                             })();
                             // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
                             // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
-                            const serviceGone = undone.ok && undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
-                            const keyGone = serviceGone && !rewriteHomeCredential(platform, home, undefined, io.serviceIo);
-                            if (keyGone && platform === 'win32') {
-                                try {
-                                    (io.serviceIo?.removeFile ?? ((f) => rmSync(f, { force: true })))(windowsServiceCredentialPath(spec));
-                                }
-                                catch {
-                                    /* reported below with the rest */
-                                }
-                            }
-                            err(serviceGone && keyGone
+                            // (Not `undone.ok`: on Windows uninstall reports a key copy it couldn't remove as not ok
+                            // although the task is gone — that copy is named by removeCopiedKeys below.)
+                            const serviceGone = undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
+                            const leftover = serviceGone ? removeCopiedKeys(spec, io.serviceIo ?? {}) : [];
+                            err(serviceGone && leftover.length === 0
                                 ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
                                     (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
-                                : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                                : serviceGone
+                                    ? `  ✗ Partly undone: ${spec.label} is uninstalled, but its key is still in ${leftover.join(' and ')}: delete it yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`
+                                    : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
                             return 1;
                         }
                         else {

package/dist/host/service.d.ts

@@ -117,6 +117,10 @@ export interface HostServiceResult {
  * sends its frame first (it does when the earlier turn ends): 30 s, doubling, at most 2 min.
  */
 export declare function busyBackoffMs(waits: number): number;
+/** A refused status is logged again at most this often while refusals continue. */
+export declare const STATUS_FAILURE_LOG_MS: number;
+/** A server's error text with anything shaped like a key or token blanked out. */
+export declare function redactSecrets(text: string): string;
 /** The CLI's own entry file: when it changes on disk, an update was installed. */
 export declare function entrypointStamp(entry?: string): () => boolean;
 export declare function runHostService(options: HostServiceOptions): Promise<HostServiceResult>;

package/dist/host/service.js

@@ -89,6 +89,16 @@ const SAFE_ID = /^[A-Za-z0-9-]{1,64}$/;
 export function busyBackoffMs(waits) {
     return Math.min(30_000 * 2 ** waits, 120_000);
 }
+/** A refused status is logged again at most this often while refusals continue. */
+export const STATUS_FAILURE_LOG_MS = 10 * 60_000;
+/** A server's error text with anything shaped like a key or token blanked out. */
+export function redactSecrets(text) {
+    return text
+        .replace(/\b(pk|sk|rk|whsec)_[A-Za-z0-9_-]{8,}/g, '$1_…')
+        .replace(/\bsk-ant-[A-Za-z0-9_-]{8,}/g, 'sk-ant-…')
+        .replace(/\bgh[pousr]_[A-Za-z0-9]{8,}/g, 'gh…')
+        .replace(/\b(Bearer|token)\s+[A-Za-z0-9._-]{12,}/gi, '$1 …');
+}
 function timestamp() {
     return new Date().toISOString().slice(11, 19);
 }
@@ -260,12 +270,15 @@ async function serveHost(options) {
     // ── What is running ──────────────────────────────────────────────────────
     function runningEntries() {
         const runs = [...active.values()].map((run) => ({ ...run.entry, peak_mem_mb: peak.peakMb(run.entry.run_id) }));
+        // A terminal session is no employee's: no employee id (its runtime instead), and no start time
+        // this host knows (`started_at: null`, never '' — the server reads both as typed values).
         const terms = (codeHost?.liveTerminals?.() ?? []).map((t) => ({
             run_id: t.terminalId,
-            agent_id: t.agent,
+            agent_id: null,
+            runtime: t.agent,
             conversation_key: `code_thread:${t.codeThreadId}`,
             kind: 'terminal',
-            started_at: '',
+            started_at: null,
         }));
         return [...runs, ...terms];
     }
@@ -326,6 +339,8 @@ async function serveHost(options) {
     let statusTimer;
     let statusInFlight;
     let statusFailures = 0;
+    /** When a refused status was last logged: a repeat is logged again (with its count) at most this often. */
+    let statusFailureLoggedAt = 0;
     function statusChanged() {
         writeLocalState();
         if (statusTimer)
@@ -374,8 +389,14 @@ async function serveHost(options) {
                 return;
             }
             statusFailures += 1;
-            if (statusFailures === 1)
-                log(`${timestamp()} ! status not accepted (${response.status || response.error})`);
+            // The server's reason (a 422 names the field), at the first refusal and then every 10 minutes
+            // while it lasts, with how many there were — never only once and then silence.
+            if (statusFailures === 1 || now() - statusFailureLoggedAt >= STATUS_FAILURE_LOG_MS) {
+                statusFailureLoggedAt = now();
+                const why = redactSecrets(response.error ?? '').replace(/\s+/g, ' ').trim().slice(0, 500);
+                log(`${timestamp()} ! status not accepted (${response.status || 'no answer'}${statusFailures > 1 ? `, ${statusFailures} times in a row` : ''})` +
+                    (why ? `: ${why}` : ''));
+            }
         })().finally(() => {
             statusInFlight = undefined;
         });

package/dist/host/status.d.ts

@@ -34,13 +34,17 @@ export declare function parseConfig(body: Record<string, unknown> | undefined, p
 /** One run going on this computer. */
 export interface RunningEntry {
     run_id: string;
-    agent_id: string;
+    /** The employee's id (a UUID); null for a terminal session, which is no employee's. */
+    agent_id: string | null;
+    /** A terminal session's agent runtime (`claude_code`, `codex`, …). */
+    runtime?: string;
     agent_name?: string;
     agent_avatar_url?: string;
     title?: string;
     conversation_key?: string;
     kind: 'employee' | 'terminal';
-    started_at: string;
+    /** ISO-8601, or null when it isn't known (a terminal session). */
+    started_at: string | null;
     peak_mem_mb?: number;
     started_by_user_id?: string;
 }

package/dist/host/status.js

@@ -69,16 +69,32 @@ export function hostStatsBody(stats) {
         battery_pct: stats?.batteryPct ?? null,
     };
 }
+function clip(value, max) {
+    if (value === null || value === undefined)
+        return null;
+    // By code point, as the server counts (`len()` of a Python str): never half a surrogate pair,
+    // which it would refuse as invalid Unicode.
+    const points = Array.from(value);
+    return points.length > max ? points.slice(0, max).join('') : value;
+}
 /** A login as the status body names it: no email, no directory. */
 export function loginBody(login, conversations) {
     return {
         account_key: login.account_key,
-        label: login.label,
-        runtime: login.runtime,
-        subscription_type: login.subscription_type,
-        plan_label: login.plan_label,
+        label: clip(login.label, 120) || 'login',
+        runtime: clip(login.runtime, 40),
+        subscription_type: clip(login.subscription_type, 40),
+        plan_label: clip(login.plan_label, 80),
         auth_state: login.auth_state,
-        quota_windows: login.quota_windows.map((w) => ({ ...w })),
+        quota_windows: login.quota_windows
+            .filter((w) => typeof w.kind === 'string' && w.kind.length > 0)
+            .slice(0, 16)
+            .map((w) => ({
+            kind: clip(w.kind, 40),
+            used_percent: Math.min(100, Math.max(0, w.used_percent)),
+            resets_at: w.resets_at,
+            ...(w.model_label ? { model_label: clip(w.model_label, 40) } : {}),
+        })),
         conversations,
     };
 }
@@ -89,11 +105,13 @@ export function buildStatusBody(inputs) {
         slots: { ...inputs.slots },
         logins: inputs.logins.map((login) => loginBody(login, inputs.conversationsPerLogin.get(login.account_key) ?? 0)),
         running: inputs.running.map((entry) => ({
-            run_id: entry.run_id,
+            run_id: clip(entry.run_id, 128),
             agent_id: entry.agent_id,
-            conversation_key: entry.conversation_key ?? null,
+            ...(entry.runtime ? { runtime: clip(entry.runtime, 40) } : {}),
+            conversation_key: clip(entry.conversation_key, 256),
             kind: entry.kind,
-            started_at: entry.started_at,
+            // Never '' (the server reads it as a date): a time, or null.
+            started_at: entry.started_at || null,
             peak_mem_mb: entry.peak_mem_mb ?? null,
             ...(entry.started_by_user_id ? { started_by_user_id: entry.started_by_user_id } : {}),
         })),

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.6";
+export declare const CLI_VERSION = "0.16.7";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.6";
+export declare const USER_AGENT = "prohost-cli/0.16.7";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.6';
+export const CLI_VERSION = '0.16.7';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.6",
+  "version": "0.16.7",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",