@prohost/cli 0.16.6 → 0.16.8

package/dist/codehost/ready.js

@@ -8,27 +8,151 @@
  * screen, is what lets a relayed reply be typed: before it, the dialog may be
  * up or about to be drawn, and an Enter would answer it. The mark is a file,
  * so it outlives a daemon restart.
+ *
+ * A window's Claude Code can be replaced (a restart), and a hook of the old one
+ * may still be running when it is: one that writes the mark after the restart
+ * dropped it would say the new process is past screens it hasn't reached. So
+ * each launch has an id ({@link LAUNCH_ENV} in the process's environment, which
+ * its hooks inherit), recorded in `<state>/<terminal>.launch` as pending until
+ * the new process's own first hook runs; meanwhile no other hook marks the
+ * window, however late it runs. A launch the daemon couldn't confirm stays
+ * pending (no reply types) until its own hook runs or the window is restarted
+ * again. A window with no launch record (one an older build started) is judged
+ * by the mark alone, as before.
  */
-import { closeSync, openSync, readdirSync, readSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { closeSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { withFileLock } from './filelock.js';
 import { codeHostDir, writePrivateJson } from './settings.js';
 import { isValidId } from './tmux.js';
+/** The launch id a window's agent process runs under, in its environment (and so its hooks'). */
+export const LAUNCH_ENV = 'PROHOST_LAUNCH_ID';
 export function readyPath(terminalId, env = process.env) {
     if (!isValidId(terminalId))
         throw new Error('invalid terminal id');
     return path.join(codeHostDir(env), 'state', `${terminalId}.ready`);
 }
+export function launchPath(terminalId, env = process.env) {
+    if (!isValidId(terminalId))
+        throw new Error('invalid terminal id');
+    return path.join(codeHostDir(env), 'state', `${terminalId}.launch`);
+}
+/** The window's launch record: `null` with none (an older build's window), `undefined` when it can't be read. */
+function readLaunch(terminalId, env) {
+    let raw;
+    try {
+        raw = readFileSync(launchPath(terminalId, env), 'utf8');
+    }
+    catch (err) {
+        return err.code === 'ENOENT' ? null : undefined;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        const launch = parsed.launch;
+        if (!(launch === null || typeof launch === 'string') || typeof parsed.gen !== 'number')
+            return undefined;
+        if (parsed.next !== undefined && typeof parsed.next !== 'string')
+            return undefined;
+        return { launch, gen: parsed.gen, ...(parsed.next !== undefined ? { next: parsed.next } : {}) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A lock whose token can't be read (its holder died writing it) and older than this is stale. */
+const LAUNCH_LOCK_STALE_MS = 10_000;
+/** How long a writer waits for the lock before it gives up (and says so). */
+const LAUNCH_LOCK_WAIT_MS = 1_000;
+/**
+ * `fn` holding the window's launch lock (`<terminal>.launch.lock`, {@link withFileLock}): hooks and
+ * the daemon are separate processes, and every read-then-write of the record goes through it, so a
+ * hook's promotion never overwrites a launch the daemon began after the hook read the record.
+ * `fallback` when the lock can't be had.
+ */
+function withLaunchLock(terminalId, env, fallback, fn) {
+    try {
+        // A holder that still runs keeps it, however long it is suspended: taken over, it would write
+        // over its successor's record on waking.
+        const held = withFileLock(`${launchPath(terminalId, env)}.lock`, fn, {
+            staleMs: LAUNCH_LOCK_STALE_MS,
+            waitMs: LAUNCH_LOCK_WAIT_MS,
+            liveHolders: true,
+        });
+        return held.ok ? held.value : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** A gen that is new: never equal to the one it replaces, even within one millisecond. */
+function nextGen(previous, now) {
+    return previous && now <= previous.gen ? previous.gen + 1 : now;
+}
+/**
+ * The launch the window runs now: its id, `null` for a process with no launch id or a window with no
+ * launch record, or `undefined` when the record can't be read.
+ */
+export function currentLaunch(terminalId, env = process.env) {
+    const record = readLaunch(terminalId, env);
+    return record === undefined ? undefined : (record?.launch ?? null);
+}
+/** The launch waiting for its first hook, if one is. */
+export function pendingLaunch(terminalId, env = process.env) {
+    return readLaunch(terminalId, env)?.next;
+}
 /**
- * Mark the terminal's Claude Code past its trust dialog (a hook ran). Atomic (`writePrivateJson`).
- * Returns whether it is marked afterwards; `false` means the write failed, and the caller says so.
+ * A hook of launch `launch` ran in the window (by default the caller's own, from its environment):
+ * mark the window past its trust dialog. Atomic (`writePrivateJson`).
+ *
+ * - The pending launch's own hook proves it runs: it becomes the window's launch, and is marked.
+ * - While a launch is pending, any other hook is of a process being replaced: it has no say, however
+ *   late it runs (a hook suspended while the Mac slept may resume long after).
+ * - With nothing pending, a hook of another launch is of the process the window runs (an older
+ *   build relaunched it since): its launch becomes the window's.
+ *
+ * Returns whether the window is marked afterwards, or that the hook had no say; `false` means the
+ * state couldn't be read or written, and the caller says so.
  */
-export function markReady(terminalId, env = process.env) {
+export function markReady(terminalId, env = process.env, launch = env[LAUNCH_ENV] || null, now = Date.now()) {
     if (!isValidId(terminalId))
         return false;
-    if (isReady(terminalId, env) === true)
+    // Most hooks find their window marked already: nothing to write, so no lock to take. That
+    // includes a window an older build started (no record), whose hooks run this build after an upgrade.
+    const record = readLaunch(terminalId, env);
+    const current = record === null || (record !== undefined && record.next === undefined && record.launch === launch);
+    if (current && isReady(terminalId, env) === true)
         return true;
+    return withLaunchLock(terminalId, env, false, () => markReadyLocked(terminalId, env, launch, now));
+}
+function markReadyLocked(terminalId, env, launch, now) {
+    const record = readLaunch(terminalId, env);
+    if (record === undefined)
+        return false;
     try {
-        writePrivateJson(readyPath(terminalId, env), Date.now());
+        if (record === null) {
+            // A window an older build started: the mark alone, as it always was.
+            if (isReady(terminalId, env) === true)
+                return true;
+            writePrivateJson(readyPath(terminalId, env), { launch, at: now });
+            return true;
+        }
+        let current = record;
+        if (record.next !== undefined) {
+            // Pending: only its own hook settles it (or the daemon, knowing nothing was replaced).
+            if (launch !== record.next)
+                return true;
+            current = { launch, gen: nextGen(record, now) };
+        }
+        else if (launch !== record.launch) {
+            // Nothing pending, and a hook of another launch: the window runs it (an older build relaunched
+            // it since), and a hook runs only once it is past its screens.
+            current = { launch, gen: nextGen(record, now) };
+        }
+        if (current !== record)
+            writePrivateJson(launchPath(terminalId, env), current);
+        else if (isReady(terminalId, env) === true)
+            return true;
+        writePrivateJson(readyPath(terminalId, env), { launch: current.launch, gen: current.gen, at: now });
         return true;
     }
     catch {
@@ -36,8 +160,8 @@ export function markReady(terminalId, env = process.env) {
     }
 }
 /**
- * Forget the mark: the window's Claude Code was replaced (a restart), and the new one is past its
- * dialog only once its own first hook runs. Returns whether no mark is left.
+ * Forget the mark: the window's Claude Code is being replaced, and the new one is past its dialog
+ * only once its own first hook runs. Returns whether no mark is left.
  */
 export function clearReady(terminalId, env = process.env) {
     if (!isValidId(terminalId))
@@ -50,6 +174,65 @@ export function clearReady(terminalId, env = process.env) {
         return false;
     }
 }
+/**
+ * Launch `launch` is about to run in the window (a start or a restart): pending until its own first
+ * hook runs, and no other hook marks the window meanwhile. Recorded first, then the old mark dropped.
+ * Returns whether both were done; on `false` the caller must not launch.
+ */
+export function beginLaunch(terminalId, launch, env = process.env, now = Date.now()) {
+    if (!isValidId(terminalId) || launch === '')
+        return false;
+    return withLaunchLock(terminalId, env, false, () => {
+        const record = readLaunch(terminalId, env);
+        if (record === undefined)
+            return false;
+        try {
+            writePrivateJson(launchPath(terminalId, env), { launch: record?.launch ?? null, next: launch, gen: nextGen(record, now) });
+        }
+        catch {
+            return false;
+        }
+        return clearReady(terminalId, env);
+    });
+}
+export function launchState(terminalId, env = process.env) {
+    return { record: readLaunch(terminalId, env), ready: isReady(terminalId, env) };
+}
+/**
+ * The new launch never ran (nothing was replaced): the window's old process keeps its launch and,
+ * if it had it, its readiness. If that can't be written, the launch stays pending (no reply types)
+ * until the window is restarted again.
+ */
+export function restoreLaunch(terminalId, state, env = process.env, now = Date.now()) {
+    const before = state.record;
+    if (before === undefined)
+        return;
+    withLaunchLock(terminalId, env, undefined, () => restoreLocked(terminalId, before, state.ready === true, env, now));
+}
+function restoreLocked(terminalId, previous, ready, env, now) {
+    try {
+        if (previous === null) {
+            rmSync(launchPath(terminalId, env), { force: true });
+            if (ready)
+                writePrivateJson(readyPath(terminalId, env), { launch: null, at: now });
+            return;
+        }
+        const pending = readLaunch(terminalId, env);
+        // Exactly as it was, a launch still pending included: a failed attempt never lifts its protection.
+        const record = {
+            launch: previous.launch,
+            ...(previous.next !== undefined ? { next: previous.next } : {}),
+            gen: nextGen(pending ?? previous, now),
+        };
+        writePrivateJson(launchPath(terminalId, env), record);
+        if (ready && record.next === undefined) {
+            writePrivateJson(readyPath(terminalId, env), { launch: record.launch, gen: record.gen, at: now });
+        }
+    }
+    catch {
+        /* left pending (see above): fails closed */
+    }
+}
 /** How much of a transcript is read looking for its folder (its first entries carry `cwd`). */
 const TRANSCRIPT_HEAD_BYTES = 256 * 1024;
 /**
@@ -129,13 +312,31 @@ export function claudeSessionSince(cwd, configDir, sinceMs) {
         }
     });
 }
-/** `true` past the dialog, `false` not yet, `undefined` when the state can't be read. */
+/**
+ * `true` past the dialog (a hook of the launch the window runs now ran, and no other launch is
+ * pending), `false` not yet, `undefined` when the state can't be read.
+ */
 export function isReady(terminalId, env = process.env) {
+    let raw;
     try {
-        statSync(readyPath(terminalId, env));
-        return true;
+        raw = readFileSync(readyPath(terminalId, env), 'utf8');
     }
     catch (err) {
         return err.code === 'ENOENT' ? false : undefined;
     }
+    const record = readLaunch(terminalId, env);
+    if (record === undefined)
+        return undefined;
+    if (record === null)
+        return true;
+    let mark = {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object')
+            mark = parsed;
+    }
+    catch {
+        /* an unreadable mark marks nothing */
+    }
+    return record.next === undefined && mark.gen === record.gen && (mark.launch ?? null) === record.launch;
 }

package/dist/codehost/terminals.js

@@ -35,7 +35,7 @@ import { readHistory } from './history.js';
 import { loginOf, readSession } from './session.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
-import { claudeSessionSince, claudeTranscripts, clearReady, isReady, markReady } from './ready.js';
+import { beginLaunch, claudeSessionSince, claudeTranscripts, currentLaunch, isReady, LAUNCH_ENV, launchState, markReady, restoreLaunch, } from './ready.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
 import { noteInputTakeover } from './sizing.js';
 import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, respawnPaneArgs, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
@@ -443,7 +443,10 @@ export class CodeTerminals {
     adoptReadiness(record, configDir, startedAtMs) {
         if (!(this.options.claudeSessionSince ?? claudeSessionSince)(record.cwd, configDir, startedAtMs))
             return;
-        if (markReady(record.terminalId, { PROHOST_HOME: this.options.home })) {
+        // The evidence is about the process the window runs now: its launch, if it has one, is marked.
+        const env = { PROHOST_HOME: this.options.home };
+        const launch = currentLaunch(record.terminalId, env);
+        if (launch !== undefined && markReady(record.terminalId, env, launch)) {
             this.log(`    ⚙ code thread ${record.codeThreadId.slice(0, 12)}: adopted past Claude Code's trust dialog (its session exists)`);
         }
     }
@@ -526,6 +529,12 @@ export class CodeTerminals {
         const command = agentCommandLine(request.agent, { ...this.options.hookFiles, hasGoal: goal.length > 0, skipPermissions: skips });
         // A shell thread's shell waits for its first viewer's size to settle (`sizing.ts`): one prompt.
         const held = request.agent === 'shell';
+        // Its own launch (`ready.ts`): only this process's hooks mark it past its first-run screens. One
+        // that can't be recorded is a window no reply could ever be typed into: the start fails instead.
+        const launch = randomBytes(8).toString('hex');
+        if (request.agent === 'claude_code' && !beginLaunch(request.terminalId, launch, { PROHOST_HOME: this.options.home })) {
+            return fail("this Mac's code-host state can't be written ($PROHOST_HOME/code-host/state)");
+        }
         const created = await this.tmux(newWindowArgs({
             name,
             cwd: checkout.path,
@@ -534,6 +543,7 @@ export class CodeTerminals {
                 PROHOST_HOME: this.options.home,
                 [TERMINAL_ID_ENV]: request.terminalId,
                 [CODE_THREAD_ID_ENV]: request.codeThreadId,
+                [LAUNCH_ENV]: launch,
                 ...(goal ? { [GOAL_ENV]: goal } : {}),
             },
             command: held ? holdCommand(name, command) : command,
@@ -718,8 +728,9 @@ export class CodeTerminals {
         const token = randomBytes(8).toString('hex');
         const command = `tmux set-option -wu ${EXITED_OPTION} 2>/dev/null; tmux set-option -w ${RELAUNCH_OPTION} ${token} 2>/dev/null; ` +
             agentCommandLine(agent, { ...this.options.hookFiles, hasGoal: false, skipPermissions: request.skipPermissions, resume });
-        // Like a new window: replies wait for the new Claude Code's first hook (`ready.ts`). Dropped before
-        // the old process goes, so that hook's mark is never wiped after it was written.
+        // Like a new window: replies wait for the new Claude Code's first hook (`ready.ts`). Its launch is
+        // recorded (and the old mark dropped) before the old process goes, so that hook's mark is never
+        // wiped after it was written, and a late hook of the old process can't mark the new one.
         // The switch once more, as late as it can be: nothing awaits between here and `respawn-pane`, so a
         // `remote off` that landed during the looks above stops it before anything is claimed or touched.
         if (request.skipPermissions && !this.canType())
@@ -736,9 +747,15 @@ export class CodeTerminals {
             return false;
         }
         const before = this.panePids.get(record.terminalId);
-        const wasReady = agent === 'claude_code' && this.isReady(record.terminalId) === true;
-        if (agent === 'claude_code')
-            clearReady(record.terminalId, env);
+        const previous = agent === 'claude_code' ? launchState(record.terminalId, env) : undefined;
+        if (previous && !beginLaunch(record.terminalId, token, env)) {
+            // Nothing was replaced, and nothing may be until the new launch can be told from the old one.
+            restoreLaunch(record.terminalId, previous, env);
+            this.log(`    ! code thread ${short} not restarted yet: its launch could not be recorded`);
+            outcome.retry = true;
+            outcome.release = true;
+            return false;
+        }
         // The restart's own `stop` is stamped now, before the new pane exists: any hook the new agent
         // sends is strictly newer and wins under the server's host-event ordering, never this one.
         const stopAt = this.now();
@@ -750,13 +767,14 @@ export class CodeTerminals {
                 PROHOST_HOME: this.options.home,
                 [TERMINAL_ID_ENV]: record.terminalId,
                 [CODE_THREAD_ID_ENV]: record.codeThreadId,
+                [LAUNCH_ENV]: token,
             },
             command,
         }));
         if (!respawned.ok && !respawned.uncertain) {
-            // Nothing was replaced: the old process (and its readiness) stays, and it is worth sending again.
-            if (wasReady)
-                markReady(record.terminalId, env);
+            // Nothing was replaced: the old process (its launch and readiness) stays, and it is worth sending again.
+            if (previous)
+                restoreLaunch(record.terminalId, previous, env);
             this.log(`    ! code thread ${short} not restarted: tmux said ${respawned.stderr.trim()}`);
             outcome.retry = true;
             outcome.release = true;
@@ -767,9 +785,9 @@ export class CodeTerminals {
         // prompts are off.
         const after = await this.panePidNow(record.terminalId);
         if (after !== undefined && after === before) {
-            // The same process still runs: nothing was replaced. It keeps its readiness, and is sent again.
-            if (wasReady)
-                markReady(record.terminalId, env);
+            // The same process still runs: nothing was replaced. It keeps its launch and readiness, and is sent again.
+            if (previous)
+                restoreLaunch(record.terminalId, previous, env);
             this.log(`    ! code thread ${short} not restarted: its window still runs the same process`);
             outcome.retry = true;
             outcome.release = true;

package/dist/host/api.js

@@ -36,7 +36,7 @@ export async function callJson(options, path, body, method = 'POST') {
             parsed = undefined;
         }
         const ok = response.status >= 200 && response.status < 300;
-        return { status: response.status, body: parsed, ...(ok ? {} : { error: text.slice(0, 300) }) };
+        return { status: response.status, body: parsed, ...(ok ? {} : { error: text.slice(0, 500) }) };
     }
     catch (err) {
         if (controller.signal.aborted)

package/dist/host/command.d.ts

@@ -65,5 +65,10 @@ export declare function signInSpawn(command: string, args: string[], platform?:
 }];
 /** Whether the service manager still has `spec`'s dedicated service (loaded / active / a task). */
 export declare function serviceStillLoaded(spec: ServiceSpec, serviceIo: InstallIo, pidAlive?: (pid: number) => boolean): boolean;
+/**
+ * Remove every copy of the key a dedicated install made (the service home's, and on Windows the
+ * administrators' copy), each attempted on its own: the files that are still there, named.
+ */
+export declare function removeCopiedKeys(spec: ServiceSpec, serviceIo: InstallIo): string[];
 export declare function runHost(subcommand: string | undefined, flags: Flags, printHelp: () => void, io?: HostIo): Promise<number>;
 export {};

package/dist/host/command.js

@@ -520,6 +520,21 @@ export function serviceStillLoaded(spec, serviceIo, pidAlive = processAlive) {
         return true;
     }
 }
+/** How long a give-back waits for an uninstalled service to finish stopping. */
+const GIVE_BACK_WAIT_MS = 30_000;
+/** Whether `spec`'s service is gone, waiting up to {@link GIVE_BACK_WAIT_MS} for it to stop. */
+function waitUntilGone(spec, serviceIo) {
+    const now = serviceIo.now ?? Date.now;
+    const sleep = serviceIo.sleep ?? ((ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms));
+    const deadline = now() + GIVE_BACK_WAIT_MS;
+    for (;;) {
+        if (!serviceStillLoaded(spec, serviceIo))
+            return true;
+        if (now() >= deadline)
+            return false;
+        sleep(500);
+    }
+}
 function processAlive(pid) {
     try {
         process.kill(pid, 0);
@@ -529,6 +544,26 @@ function processAlive(pid) {
         return e.code === 'EPERM';
     }
 }
+/**
+ * Remove every copy of the key a dedicated install made (the service home's, and on Windows the
+ * administrators' copy), each attempted on its own: the files that are still there, named.
+ */
+export function removeCopiedKeys(spec, serviceIo) {
+    const leftover = [];
+    const homeKey = (spec.platform === 'win32' ? path.win32 : path.posix).join(spec.home, 'host', 'computer.json');
+    if (rewriteHomeCredential(spec.platform, spec.home, undefined, serviceIo))
+        leftover.push(homeKey);
+    if (spec.platform === 'win32') {
+        const copy = windowsServiceCredentialPath(spec);
+        try {
+            (serviceIo.removeFile ?? ((f) => rmSync(f, { force: true })))(copy);
+        }
+        catch {
+            leftover.push(copy);
+        }
+    }
+    return leftover;
+}
 /** The home a dedicated install took its computer from: `--from-home`, else (under sudo `$PROHOST_HOME` is root's) `$SUDO_USER`'s. */
 function handedFromHome(flags, env, platform) {
     return str(flags, 'from-home') ?? (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : prohostHome(env));
@@ -746,7 +781,18 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 for (const o of shown)
                     (o.ok ? out : err)(o.message);
                 let ok = shown.every((o) => o.ok);
-                if (note && fromHome && outcomes.some((o) => o.label === note.handed_to.label && o.ok)) {
+                // The key goes back at once: the service's definition is gone, so a later run could never
+                // find it again, and a key left only in its home (an interrupted wait, say) would be stranded.
+                // Uninstall ignores a stop that failed (`launchctl bootout`, `systemctl disable --now`), so the
+                // service may still be draining its runs on the old copy: that is waited for (bounded) only
+                // afterwards, to say so.
+                const handedSpec = note && handedTo ? { ...spec, label: note.handed_to.label, home: handedTo.home } : undefined;
+                // Its definition removed (its task deleted), whatever else failed after: on Windows a copy of
+                // the key that couldn't be deleted makes uninstall report not ok, yet the task is gone, and
+                // no later run could find the key again. Those failures still fail this command (`ok`).
+                const definitionGone = (o) => o.ok || o.message.includes('✓ Removed');
+                const handedOutcome = note ? outcomes.find((o) => o.label === note.handed_to.label && definitionGone(o)) : undefined;
+                if (note && fromHome && handedOutcome) {
                     const key = handedKeyLive;
                     if (key && key.computer_id === note.computer_id && handedTo) {
                         const problem = rewriteHomeCredential(platform, fromHome, `${JSON.stringify(key, null, 2)}\n`, io.serviceIo);
@@ -757,17 +803,28 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                         else {
                             // On Windows the (administrators') service home keeps its copy: a later dedicated
                             // install finds that home and writes nothing into it, so it must still hold the key.
-                            if (platform !== 'win32')
-                                clearHandedHome(platform, handedTo.home, 'its key', io.serviceIo ?? {}, err);
+                            const cleared = platform === 'win32' || clearHandedHome(platform, handedTo.home, 'its key', io.serviceIo ?? {}, err);
+                            if (!cleared) {
+                                // Back here, and still there: the same key in two homes. Not done until that copy goes.
+                                ok = false;
+                                err(`  ✗ The key is back in ${fromHome} but also still in ${handedTo.home}: delete that copy before using either.`);
+                            }
                             out(`  The computer's key is back in ${fromHome}: prohost host install runs it there (prohost host unpair removes it).`);
                             if (platform === 'win32')
                                 out(`  To install it as a dedicated service again, first remove the folder ${handedTo.home}.`);
                         }
                     }
                     else {
-                        clearHandedHome(platform, fromHome, 'the note', io.serviceIo ?? {}, err);
+                        if (!clearHandedHome(platform, fromHome, 'the note', io.serviceIo ?? {}, err))
+                            ok = false;
                         out(`  ${fromHome} no longer points at ${note.handed_to.label}. Its key was not found: add the computer again with prohost host pair, or remove it on its page in ProhostAI.`);
                     }
+                    // Only now (the key is where it belongs): whether the service really stopped, bounded.
+                    if (handedSpec && !waitUntilGone(handedSpec, io.serviceIo ?? {})) {
+                        ok = false;
+                        err(`  ! ${note.handed_to.label} was still stopping after ${GIVE_BACK_WAIT_MS / 1000}s: wait until it has exited ` +
+                            `(${platform === 'darwin' ? `sudo launchctl print system/${note.handed_to.label}` : platform === 'win32' ? 'Task Manager' : `systemctl status ${systemdUnitOf(handedSpec)}`}) before running this computer from ${fromHome}.`);
+                    }
                 }
                 return ok ? 0 : 1;
             }
@@ -795,8 +852,17 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
             // The key this install takes over, read before it runs: only a copy it really made is retired.
             const handedFrom = dedicated && path.resolve(adoptFrom) !== path.resolve(home) ? tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom }) : null;
-            // Whether the service home already held a key before this install (then it copies none).
-            const serviceHadKey = handedFrom ? serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label) !== null : false;
+            // The key the service home already holds, read before this install (then it copies none in).
+            const serviceBefore = handedFrom ? serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label) : null;
+            // Another computer's: installing would restart that computer under this label and leave this
+            // one's key where it is, reported as a takeover. Refused before anything is installed.
+            if (handedFrom && serviceBefore && serviceBefore.computer_id !== handedFrom.computer_id) {
+                err(`✗ ${home} already holds the key of another computer ("${serviceBefore.name}", ${serviceBefore.computer_id}), not ` +
+                    `${adoptFrom}'s ("${handedFrom.name}"): nothing was installed. Remove that computer first ` +
+                    `(sudo prohost host unpair --label ${spec.label}), then install again.`);
+                return 1;
+            }
+            const serviceHadKey = serviceBefore !== null;
             const outcome = installService(spec, io.serviceIo, {
                 ...(tokenFile ? { claudeTokenFile: tokenFile } : {}),
                 ...(dedicated ? { adoptFrom } : {}),
@@ -808,6 +874,38 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     ? `  ! ${home} has no computer yet (none in ${adoptFrom}): pair as yourself, then run this again — or pass --from-home <your PROHOST_HOME>.`
                     : `  This home (${home}) has no computer yet: run prohost host pair.`);
             }
+            // Undo this install (it copied a key in): the service uninstalled, every copy of the key it made
+            // removed, and the original home keeps its key. Returns the exit code.
+            const undoInstall = (options = { removeKeys: true }) => {
+                const undone = (() => {
+                    try {
+                        return uninstallService(spec, io.serviceIo);
+                    }
+                    catch (e) {
+                        return { ok: false, message: e instanceof Error ? e.message : String(e) };
+                    }
+                })();
+                // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
+                // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
+                // (Not `undone.ok`: on Windows uninstall reports a key copy it couldn't remove as not ok
+                // although the task is gone — that copy is named by removeCopiedKeys below.)
+                const serviceGone = undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
+                if (!options.removeKeys) {
+                    // Which file this install copied can't be told from one it didn't: no credential is deleted.
+                    err(serviceGone
+                        ? `  ✗ ${spec.label} is uninstalled. Check ${path.join(home, 'host', 'computer.json')} before installing again; ${adoptFrom} keeps its key.`
+                        : `  ✗ Could not uninstall ${spec.label}: remove it (sudo prohost host uninstall --label ${spec.label}), then check ${path.join(home, 'host', 'computer.json')}.`);
+                    return 1;
+                }
+                const leftover = serviceGone ? removeCopiedKeys(spec, io.serviceIo ?? {}) : [];
+                err(serviceGone && leftover.length === 0
+                    ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
+                        (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
+                    : serviceGone
+                        ? `  ✗ Partly undone: ${spec.label} is uninstalled, but its key is still in ${leftover.join(' and ')}: delete it yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`
+                        : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                return 1;
+            };
             if (outcome.ok && dedicated && handedFrom) {
                 // One key, one holder: the home it came from keeps a note of where the computer went, never
                 // the key — so an `unpair`, `pair` or personal `install` there can't revoke or run it twice.
@@ -848,31 +946,7 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                             return 1;
                         }
                         else if (!serviceHadKey) {
-                            const undone = (() => {
-                                try {
-                                    return uninstallService(spec, io.serviceIo);
-                                }
-                                catch (e) {
-                                    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-                                }
-                            })();
-                            // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
-                            // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
-                            const serviceGone = undone.ok && undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
-                            const keyGone = serviceGone && !rewriteHomeCredential(platform, home, undefined, io.serviceIo);
-                            if (keyGone && platform === 'win32') {
-                                try {
-                                    (io.serviceIo?.removeFile ?? ((f) => rmSync(f, { force: true })))(windowsServiceCredentialPath(spec));
-                                }
-                                catch {
-                                    /* reported below with the rest */
-                                }
-                            }
-                            err(serviceGone && keyGone
-                                ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
-                                    (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
-                                : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
-                            return 1;
+                            return undoInstall();
                         }
                         else {
                             err(`  ✗ ${home} already held this key before this install, so ${adoptFrom} still does too: never run \`prohost host unpair\` from that home. ` +
@@ -885,6 +959,20 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                         out(`  The computer's key is the service's alone now: ${adoptFrom} keeps a note of where it went.`);
                     }
                 }
+                else if (!serviceHadKey) {
+                    // The copy this install made isn't there afterwards (or can't be read, or is another
+                    // computer's): no takeover happened, and the service must not run on whatever it holds.
+                    // Uninstalled; its files are left for a person to judge.
+                    err(`  ✗ ${spec.label} was installed, but ${home} does not hold ${adoptFrom}'s key afterwards ` +
+                        (serviceHas ? `(it holds ${serviceHas.computer_id}).` : "(it can't be read)."));
+                    return undoInstall({ removeKeys: false });
+                }
+                else {
+                    // It held this computer's key before the install and can't be read now: never reported done.
+                    err(`  ✗ ${home} held this computer's key before this install, but it can't be read now: check ` +
+                        `${path.join(home, 'host', 'computer.json')}, and never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                    return 1;
+                }
             }
             if (outcome.ok && dedicated) {
                 out(`  Its status, for anyone on this computer: ${sharedDirFor(spec)}`);

package/dist/host/install.js

@@ -1048,9 +1048,17 @@ export function uninstallService(spec, io = {}) {
         const out = run('schtasks', ['/Delete', '/TN', task, '/F']);
         if (out.status === 0)
             removed.push(task);
-        for (const file of [serviceFilePath(spec), windowsWrapperPath(spec)]) {
-            if (exists(file))
-                remove(file);
+        // A delete that failed while the task is still there is a failure, never "nothing installed":
+        // the task can start again on its key. Its files stay, so a later uninstall still finds it.
+        const stillThere = out.status !== 0 && run('schtasks', ['/Query', '/TN', task]).status === 0;
+        if (stillThere) {
+            notes.push(`could not delete the task ${task} (${(out.stderr || out.stdout || `exit ${out.status}`).trim()}): it is still installed`);
+        }
+        else {
+            for (const file of [serviceFilePath(spec), windowsWrapperPath(spec)]) {
+                if (exists(file))
+                    remove(file);
+            }
         }
         // The administrators' copy of its key goes with the service: a reinstall never finds an old one.
         const copy = windowsServiceCredentialPath(spec);

package/dist/host/service.d.ts

@@ -117,6 +117,10 @@ export interface HostServiceResult {
  * sends its frame first (it does when the earlier turn ends): 30 s, doubling, at most 2 min.
  */
 export declare function busyBackoffMs(waits: number): number;
+/** A refused status is logged again at most this often while refusals continue. */
+export declare const STATUS_FAILURE_LOG_MS: number;
+/** A server's error text with anything shaped like a key or token blanked out. */
+export declare function redactSecrets(text: string): string;
 /** The CLI's own entry file: when it changes on disk, an update was installed. */
 export declare function entrypointStamp(entry?: string): () => boolean;
 export declare function runHostService(options: HostServiceOptions): Promise<HostServiceResult>;