@prohost/cli 0.16.7 → 0.16.8

package/CHANGELOG.md

@@ -6,6 +6,27 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.16.8
+
+- **A dedicated install never takes over a service home that holds another computer.** When the
+  service home already held a different computer's key, the install restarted that computer under
+  the label, left the invoking home's key where it was, and reported a takeover. It is now refused
+  before anything is installed, naming the computer it holds.
+- **A copy that isn't there afterwards is no takeover.** When the key the install copied into the
+  service home can't be read back as that computer's, the service is uninstalled and the command
+  fails, naming the file to check (no credential is deleted: which file this install wrote can't be
+  told from one it didn't). The invoking home keeps its key.
+- **`uninstall` says when a service is still stopping after it gives the key back.** The key goes
+  back at once, as before (the service's definition is already gone, so a later run could never
+  find it again). A stop that failed or is still draining (`launchctl bootout`, `systemctl disable
+  --now`) is then waited for up to 30 s, and a service still stopping fails the command with what
+  to wait for before running the computer from that home. A service copy that can't be deleted
+  after the give-back fails the command instead of leaving the key in two homes behind a success.
+- **Windows: a scheduled task that couldn't be deleted is a failure.** `uninstall` reported it as
+  "No host service was installed" and removed its files, so the key went back while the task could
+  start again on it. It now fails, keeps the task's files (a later uninstall still finds it), and
+  gives nothing back.
+
 ## 0.16.7
 
 - **An undo whose cleanup fails says so.** When a dedicated install undoes itself (its hand-off

package/dist/host/command.js

@@ -520,6 +520,21 @@ export function serviceStillLoaded(spec, serviceIo, pidAlive = processAlive) {
         return true;
     }
 }
+/** How long a give-back waits for an uninstalled service to finish stopping. */
+const GIVE_BACK_WAIT_MS = 30_000;
+/** Whether `spec`'s service is gone, waiting up to {@link GIVE_BACK_WAIT_MS} for it to stop. */
+function waitUntilGone(spec, serviceIo) {
+    const now = serviceIo.now ?? Date.now;
+    const sleep = serviceIo.sleep ?? ((ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms));
+    const deadline = now() + GIVE_BACK_WAIT_MS;
+    for (;;) {
+        if (!serviceStillLoaded(spec, serviceIo))
+            return true;
+        if (now() >= deadline)
+            return false;
+        sleep(500);
+    }
+}
 function processAlive(pid) {
     try {
         process.kill(pid, 0);
@@ -766,7 +781,18 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 for (const o of shown)
                     (o.ok ? out : err)(o.message);
                 let ok = shown.every((o) => o.ok);
-                if (note && fromHome && outcomes.some((o) => o.label === note.handed_to.label && o.ok)) {
+                // The key goes back at once: the service's definition is gone, so a later run could never
+                // find it again, and a key left only in its home (an interrupted wait, say) would be stranded.
+                // Uninstall ignores a stop that failed (`launchctl bootout`, `systemctl disable --now`), so the
+                // service may still be draining its runs on the old copy: that is waited for (bounded) only
+                // afterwards, to say so.
+                const handedSpec = note && handedTo ? { ...spec, label: note.handed_to.label, home: handedTo.home } : undefined;
+                // Its definition removed (its task deleted), whatever else failed after: on Windows a copy of
+                // the key that couldn't be deleted makes uninstall report not ok, yet the task is gone, and
+                // no later run could find the key again. Those failures still fail this command (`ok`).
+                const definitionGone = (o) => o.ok || o.message.includes('✓ Removed');
+                const handedOutcome = note ? outcomes.find((o) => o.label === note.handed_to.label && definitionGone(o)) : undefined;
+                if (note && fromHome && handedOutcome) {
                     const key = handedKeyLive;
                     if (key && key.computer_id === note.computer_id && handedTo) {
                         const problem = rewriteHomeCredential(platform, fromHome, `${JSON.stringify(key, null, 2)}\n`, io.serviceIo);
@@ -777,17 +803,28 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                         else {
                             // On Windows the (administrators') service home keeps its copy: a later dedicated
                             // install finds that home and writes nothing into it, so it must still hold the key.
-                            if (platform !== 'win32')
-                                clearHandedHome(platform, handedTo.home, 'its key', io.serviceIo ?? {}, err);
+                            const cleared = platform === 'win32' || clearHandedHome(platform, handedTo.home, 'its key', io.serviceIo ?? {}, err);
+                            if (!cleared) {
+                                // Back here, and still there: the same key in two homes. Not done until that copy goes.
+                                ok = false;
+                                err(`  ✗ The key is back in ${fromHome} but also still in ${handedTo.home}: delete that copy before using either.`);
+                            }
                             out(`  The computer's key is back in ${fromHome}: prohost host install runs it there (prohost host unpair removes it).`);
                             if (platform === 'win32')
                                 out(`  To install it as a dedicated service again, first remove the folder ${handedTo.home}.`);
                         }
                     }
                     else {
-                        clearHandedHome(platform, fromHome, 'the note', io.serviceIo ?? {}, err);
+                        if (!clearHandedHome(platform, fromHome, 'the note', io.serviceIo ?? {}, err))
+                            ok = false;
                         out(`  ${fromHome} no longer points at ${note.handed_to.label}. Its key was not found: add the computer again with prohost host pair, or remove it on its page in ProhostAI.`);
                     }
+                    // Only now (the key is where it belongs): whether the service really stopped, bounded.
+                    if (handedSpec && !waitUntilGone(handedSpec, io.serviceIo ?? {})) {
+                        ok = false;
+                        err(`  ! ${note.handed_to.label} was still stopping after ${GIVE_BACK_WAIT_MS / 1000}s: wait until it has exited ` +
+                            `(${platform === 'darwin' ? `sudo launchctl print system/${note.handed_to.label}` : platform === 'win32' ? 'Task Manager' : `systemctl status ${systemdUnitOf(handedSpec)}`}) before running this computer from ${fromHome}.`);
+                    }
                 }
                 return ok ? 0 : 1;
             }
@@ -815,8 +852,17 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                 (env.SUDO_USER && !env.PROHOST_HOME ? homeOfUser(platform, env.SUDO_USER) : ownHome);
             // The key this install takes over, read before it runs: only a copy it really made is retired.
             const handedFrom = dedicated && path.resolve(adoptFrom) !== path.resolve(home) ? tryLoadComputer({ ...env, PROHOST_HOME: adoptFrom }) : null;
-            // Whether the service home already held a key before this install (then it copies none).
-            const serviceHadKey = handedFrom ? serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label) !== null : false;
+            // The key the service home already holds, read before this install (then it copies none in).
+            const serviceBefore = handedFrom ? serviceCredential(platform, home, serviceUser, io.serviceIo ?? {}, spec.label) : null;
+            // Another computer's: installing would restart that computer under this label and leave this
+            // one's key where it is, reported as a takeover. Refused before anything is installed.
+            if (handedFrom && serviceBefore && serviceBefore.computer_id !== handedFrom.computer_id) {
+                err(`✗ ${home} already holds the key of another computer ("${serviceBefore.name}", ${serviceBefore.computer_id}), not ` +
+                    `${adoptFrom}'s ("${handedFrom.name}"): nothing was installed. Remove that computer first ` +
+                    `(sudo prohost host unpair --label ${spec.label}), then install again.`);
+                return 1;
+            }
+            const serviceHadKey = serviceBefore !== null;
             const outcome = installService(spec, io.serviceIo, {
                 ...(tokenFile ? { claudeTokenFile: tokenFile } : {}),
                 ...(dedicated ? { adoptFrom } : {}),
@@ -828,6 +874,38 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                     ? `  ! ${home} has no computer yet (none in ${adoptFrom}): pair as yourself, then run this again — or pass --from-home <your PROHOST_HOME>.`
                     : `  This home (${home}) has no computer yet: run prohost host pair.`);
             }
+            // Undo this install (it copied a key in): the service uninstalled, every copy of the key it made
+            // removed, and the original home keeps its key. Returns the exit code.
+            const undoInstall = (options = { removeKeys: true }) => {
+                const undone = (() => {
+                    try {
+                        return uninstallService(spec, io.serviceIo);
+                    }
+                    catch (e) {
+                        return { ok: false, message: e instanceof Error ? e.message : String(e) };
+                    }
+                })();
+                // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
+                // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
+                // (Not `undone.ok`: on Windows uninstall reports a key copy it couldn't remove as not ok
+                // although the task is gone — that copy is named by removeCopiedKeys below.)
+                const serviceGone = undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
+                if (!options.removeKeys) {
+                    // Which file this install copied can't be told from one it didn't: no credential is deleted.
+                    err(serviceGone
+                        ? `  ✗ ${spec.label} is uninstalled. Check ${path.join(home, 'host', 'computer.json')} before installing again; ${adoptFrom} keeps its key.`
+                        : `  ✗ Could not uninstall ${spec.label}: remove it (sudo prohost host uninstall --label ${spec.label}), then check ${path.join(home, 'host', 'computer.json')}.`);
+                    return 1;
+                }
+                const leftover = serviceGone ? removeCopiedKeys(spec, io.serviceIo ?? {}) : [];
+                err(serviceGone && leftover.length === 0
+                    ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
+                        (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
+                    : serviceGone
+                        ? `  ✗ Partly undone: ${spec.label} is uninstalled, but its key is still in ${leftover.join(' and ')}: delete it yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`
+                        : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                return 1;
+            };
             if (outcome.ok && dedicated && handedFrom) {
                 // One key, one holder: the home it came from keeps a note of where the computer went, never
                 // the key — so an `unpair`, `pair` or personal `install` there can't revoke or run it twice.
@@ -868,27 +946,7 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                             return 1;
                         }
                         else if (!serviceHadKey) {
-                            const undone = (() => {
-                                try {
-                                    return uninstallService(spec, io.serviceIo);
-                                }
-                                catch (e) {
-                                    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-                                }
-                            })();
-                            // Removed and no longer loaded, not just "nothing failed": a Windows task that would not
-                            // stop removes nothing, and a launchd / systemd service whose stop failed may still run.
-                            // (Not `undone.ok`: on Windows uninstall reports a key copy it couldn't remove as not ok
-                            // although the task is gone — that copy is named by removeCopiedKeys below.)
-                            const serviceGone = undone.message.includes('✓ Removed') && !serviceStillLoaded(spec, io.serviceIo ?? {});
-                            const leftover = serviceGone ? removeCopiedKeys(spec, io.serviceIo ?? {}) : [];
-                            err(serviceGone && leftover.length === 0
-                                ? `  ✗ Undone: ${spec.label} is uninstalled and ${home} holds no key; ${adoptFrom} keeps its key. Fix the problem above, then ` +
-                                    (platform === 'win32' ? `remove the folder ${home} and install again.` : 'install again.')
-                                : serviceGone
-                                    ? `  ✗ Partly undone: ${spec.label} is uninstalled, but its key is still in ${leftover.join(' and ')}: delete it yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`
-                                    : `  ✗ Could not fully undo it: remove ${spec.label} (sudo prohost host uninstall --label ${spec.label}) and ${path.join(home, 'host', 'computer.json')} yourself — never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
-                            return 1;
+                            return undoInstall();
                         }
                         else {
                             err(`  ✗ ${home} already held this key before this install, so ${adoptFrom} still does too: never run \`prohost host unpair\` from that home. ` +
@@ -901,6 +959,20 @@ export async function runHost(subcommand, flags, printHelp, io = {}) {
                         out(`  The computer's key is the service's alone now: ${adoptFrom} keeps a note of where it went.`);
                     }
                 }
+                else if (!serviceHadKey) {
+                    // The copy this install made isn't there afterwards (or can't be read, or is another
+                    // computer's): no takeover happened, and the service must not run on whatever it holds.
+                    // Uninstalled; its files are left for a person to judge.
+                    err(`  ✗ ${spec.label} was installed, but ${home} does not hold ${adoptFrom}'s key afterwards ` +
+                        (serviceHas ? `(it holds ${serviceHas.computer_id}).` : "(it can't be read)."));
+                    return undoInstall({ removeKeys: false });
+                }
+                else {
+                    // It held this computer's key before the install and can't be read now: never reported done.
+                    err(`  ✗ ${home} held this computer's key before this install, but it can't be read now: check ` +
+                        `${path.join(home, 'host', 'computer.json')}, and never run \`prohost host unpair\` from ${adoptFrom} meanwhile.`);
+                    return 1;
+                }
             }
             if (outcome.ok && dedicated) {
                 out(`  Its status, for anyone on this computer: ${sharedDirFor(spec)}`);

package/dist/host/install.js

@@ -1048,9 +1048,17 @@ export function uninstallService(spec, io = {}) {
         const out = run('schtasks', ['/Delete', '/TN', task, '/F']);
         if (out.status === 0)
             removed.push(task);
-        for (const file of [serviceFilePath(spec), windowsWrapperPath(spec)]) {
-            if (exists(file))
-                remove(file);
+        // A delete that failed while the task is still there is a failure, never "nothing installed":
+        // the task can start again on its key. Its files stay, so a later uninstall still finds it.
+        const stillThere = out.status !== 0 && run('schtasks', ['/Query', '/TN', task]).status === 0;
+        if (stillThere) {
+            notes.push(`could not delete the task ${task} (${(out.stderr || out.stdout || `exit ${out.status}`).trim()}): it is still installed`);
+        }
+        else {
+            for (const file of [serviceFilePath(spec), windowsWrapperPath(spec)]) {
+                if (exists(file))
+                    remove(file);
+            }
         }
         // The administrators' copy of its key goes with the service: a reinstall never finds an old one.
         const copy = windowsServiceCredentialPath(spec);

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.16.7";
+export declare const CLI_VERSION = "0.16.8";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.16.7";
+export declare const USER_AGENT = "prohost-cli/0.16.8";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.16.7';
+export const CLI_VERSION = '0.16.8';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.16.7",
+  "version": "0.16.8",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",