centralu 0.1.0-beta.29 → 0.1.0-beta.30

package/bin/centralu.mjs

@@ -53,6 +53,7 @@ import {
   runDetachedChild,
   runServe,
   runStop,
+  runWindow,
   SERVE_HELP,
 } from './serve.mjs'
 import { swapInto } from './swap.mjs'
@@ -632,7 +633,7 @@ switch (cmd) {
        * off|status` and `--rotate-token` start no host and keep working, so the hub can still ask this
        * machine what Node it has.
        */
-      const startsHost = args.mode === 'serve' || args.mode === 'detach' || (args.mode === 'autostart' && args.autostart === 'on')
+      const startsHost = args.mode === 'serve' || args.mode === 'detach' || args.mode === 'window' || (args.mode === 'autostart' && args.autostart === 'on')
       if (startsHost && belowFloor(process.versions.node, NODE_FLOOR)) {
         const message = oldNodeSentence(process.versions.node, NODE_FLOOR)
         console.error(`centralu serve: ${message}`)
@@ -655,11 +656,12 @@ switch (cmd) {
       // realpath: npm's bin is a symlink to this file, and the launcher must not depend on the link
       const opts = { env: process.env, home: HOME, entry: requireHostEntry(), version: pkg.version, cliPath: realpathSync(process.argv[1]) }
       if (args.mode === 'connection') process.exitCode = await printConnection(opts)
-      else if (args.mode === 'detach') process.exitCode = await runDetach({ ...opts, port: args.port })
+      else if (args.mode === 'detach') process.exitCode = await runDetach({ ...opts, port: args.port, from: args.from })
       else if (args.mode === 'stop') process.exitCode = await runStop(opts)
+      else if (args.mode === 'window') process.exitCode = await runWindow(opts)
       else if (args.mode === 'autostart') process.exitCode = await runAutostart({ ...opts, action: args.autostart })
       else if (spec) process.exitCode = await runDetachedChild({ ...opts, spec, port: args.port })
-      else process.exitCode = await runServe({ ...opts, port: args.port })
+      else process.exitCode = await runServe({ ...opts, port: args.port, from: args.from })
     } catch (e) {
       // A state file that cannot be read or written: one sentence, not a stack, and nothing on stdout
       console.error(`centralu serve: ${e?.message ?? e}`)

package/bin/serve-args.mjs

@@ -7,13 +7,19 @@ export const SERVE_HELP = `centralu serve: run the Centralu host on this machine
   centralu serve --port <n>       ... on that port (kept for the next start; default ${DEFAULT_SERVE_PORT})
   centralu serve --detach         Start it in the background, outside this session; return once it answers
   centralu serve --stop           Ask the running host to stop, and wait until it has
+  centralu serve --window         What the Centralu window on Windows runs here: start the host if
+                                  none runs, print its port and token as a ready line, stay until
+                                  stdin ends, and leave the host running
   centralu serve --connection     Print how to reach it as one JSON line, then exit
   centralu serve --rotate-token   Replace the token (a running serve keeps the old one until restarted)
-  centralu serve --autostart on|off|status
+  centralu serve --from <hub>     With serve or --detach: the name of the computer whose link asks,
+                                  said by a second Centralu on this data folder when it is refused
+  centralu serve --autostart on|off|remove|status
                                   Start it when this machine starts (Linux: a systemd user unit;
-                                  Windows and WSL: a scheduled task at sign-in), stop doing that,
-                                  or say whether it does. Turning it on or off leaves a host that
-                                  runs now as it is
+                                  Windows and WSL: a scheduled task at sign-in), stop doing that
+                                  (Windows keeps the task, without its trigger, for --detach),
+                                  remove the entry altogether, or say whether it does. None of them
+                                  starts or stops a host that runs now
 
 The data folder is ~/.centralu (CC_DATA_DIR overrides it). The app on another computer reaches
 this host through an SSH local forward, and starts it with --detach when it is not running.
@@ -25,11 +31,11 @@ paths, for SSH sessions whose PATH has neither npm's global folder nor node. Not
 from an install the app made over SSH, which has a launcher of its own.`
 
 /** The flags that each make serve a different command */
-const MODE_FLAGS = { '--connection': 'connection', '--rotate-token': 'rotate', '--detach': 'detach', '--stop': 'stop' }
+const MODE_FLAGS = { '--connection': 'connection', '--rotate-token': 'rotate', '--detach': 'detach', '--stop': 'stop', '--window': 'window' }
 const FLAG_OF = { ...Object.fromEntries(Object.entries(MODE_FLAGS).map(([f, m]) => [m, f])), autostart: '--autostart' }
 
 /** What `--autostart` takes */
-export const AUTOSTART_ACTIONS = ['on', 'off', 'status']
+export const AUTOSTART_ACTIONS = ['on', 'off', 'remove', 'status']
 
 /**
  * The argument a detached launcher is started with: what it needs from the `--detach` that started
@@ -38,6 +44,12 @@ export const AUTOSTART_ACTIONS = ['on', 'off', 'status']
  */
 export const CHILD_FLAG = '--detached-child='
 
+/**
+ * What `--from` takes (#1223): a hub's name, short and of characters that cannot break the sentence a refused host says
+ * it in, nor a command line. The hub sends its own host name, cleaned the same way (`hubNameForRemote`, links/tunnel.ts)
+ */
+export const FROM_RE = /^[A-Za-z0-9._-]{1,64}$/
+
 /**
  * What the arguments after `serve` ask for: `{ mode, port }` (plus `child` for a detached launcher,
  * `autostart` for `--autostart`) or `{ error }`.
@@ -53,11 +65,12 @@ export function parseServeArgs(argv) {
   let help = false
   let child = null
   let autostart = null
+  let from = null
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]
     if (a === '--autostart' || a.startsWith('--autostart=')) {
       const raw = a === '--autostart' ? argv[++i] : a.slice('--autostart='.length)
-      if (!AUTOSTART_ACTIONS.includes(raw)) return { error: `--autostart needs on, off or status (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
+      if (!AUTOSTART_ACTIONS.includes(raw)) return { error: `--autostart needs on, off, remove or status (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
       if (mode !== 'serve' && mode !== 'autostart') return { error: `${FLAG_OF[mode]} and --autostart are separate commands; pass one` }
       mode = 'autostart'
       autostart = raw
@@ -72,22 +85,28 @@ export function parseServeArgs(argv) {
       const n = parsePort(raw)
       if (n === null) return { error: `--port needs a port number between 1 and 65535 (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
       port = n
+    } else if (a === '--from' || a.startsWith('--from=')) {
+      const raw = a === '--from' ? argv[++i] : a.slice('--from='.length)
+      if (typeof raw !== 'string' || !FROM_RE.test(raw)) return { error: `--from needs a computer's name: letters, digits, '.', '_' and '-' (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
+      from = raw
     } else return { error: `unknown option for serve: ${a}\n\n${SERVE_HELP}` }
   }
   if (help) return { mode: 'help', port }
+  if (from !== null && mode !== 'serve' && mode !== 'detach') return { error: `--from goes with \`centralu serve\` and --detach, which start a host; not with ${FLAG_OF[mode]}` }
   if (child !== null) {
     if (mode !== 'serve') return { error: `${CHILD_FLAG.slice(0, -1)} is how --detach starts serve, not an option of ${FLAG_OF[mode]}` }
-    return { mode, port, child }
+    return { mode, port, child, ...(from !== null ? { from } : {}) }
   }
   if ((mode === 'connection' || mode === 'rotate') && port !== null) {
     return { error: '--port goes with `centralu serve`; `--connection` reports the port serve listens on' }
   }
   if (mode === 'stop' && port !== null) return { error: '--stop stops the serve that is running, on the port it recorded; it takes no --port' }
+  if (mode === 'window' && port !== null) return { error: '--window uses the serve that runs, or starts one on the port it recorded; it takes no --port' }
   if (mode === 'autostart') {
     if (port !== null) return { error: '--autostart takes no --port: the entry it writes starts serve on the port serve recorded' }
     return { mode, port, autostart }
   }
-  return { mode, port }
+  return { mode, port, ...(from !== null ? { from } : {}) }
 }
 
 function parsePort(raw) {

package/bin/serve-autostart.mjs

@@ -69,12 +69,23 @@ export function pathKey(p, platform) {
  * this Node's `join`: the folder may be written with either separator (`CC_DATA_DIR=C:/x` on Windows),
  * and Windows paths do not differ by case, so `C:\Users\Me\.centralu` is the default folder too.
  */
-export function autostartName(how, { dataDir, home, env, platform = process.platform }) {
+export function autostartName(how, { dataDir, home, env, platform = process.platform, user = null }) {
   const key = pathKey(dataDir, platform)
   const own = key === pathKey(`${home}/.centralu`, platform) ? '' : createHash('sha256').update(key).digest('hex').slice(0, 8)
   if (how === 'systemd') return `centralu-serve${own ? `-${own}` : ''}.service`
   const distro = env.WSL_DISTRO_NAME && wslDistro(env.WSL_DISTRO_NAME)
-  return `Centralu host${distro ? ` (WSL ${distro})` : ''}${own ? ` ${own}` : ''}`
+  /*
+   * The user too (#1224 review): tasks in Task Scheduler's root folder are one list for every account, and an
+   * administrator's ssh logon sees the others'. Without it, a second account's `--detach` on a shared PC would find and
+   * start the first account's task. Characters a task name cannot hold become `-`
+   */
+  const who = user ? ` (${String(user).replace(/[\\/:*?"<>|]/g, '-')})` : ''
+  return `Centralu host${who}${distro ? ` (WSL ${distro})` : ''}${own ? ` ${own}` : ''}`
+}
+
+/** The task's name before the user was part of it: an earlier version's entry, removed when this user's (`taskScript`) */
+export function legacyTaskName({ dataDir, home, env, platform = process.platform }) {
+  return autostartName('task', { dataDir, home, env, platform })
 }
 
 /**
@@ -154,34 +165,104 @@ export function taskActionScript({ how, launcher, env, distro = null, user = nul
 const TASK_WORD = 'CENTRALU-AUTOSTART'
 
 /**
- * The PowerShell that registers, removes or reads the scheduled task, printing one `CENTRALU-AUTOSTART`
- * line. Registered for this user only, at this user's sign-in, run only while they are signed in
- * (`Interactive`): the kind of task a user may create without an administrator. On a laptop, it runs
- * on battery too, and with no time limit (the default ends a task after 72 hours).
+ * The PowerShell that registers, changes, removes or reads the scheduled task, printing one `CENTRALU-AUTOSTART` line.
+ * Registered for this user only, run only while they are signed in (`Interactive`, `Limited`): the kind of task a user
+ * may create without an administrator. On a laptop, it runs on battery too, and with no time limit (the default ends a
+ * task after 72 hours).
+ *
+ *   on      the task with an `AtLogOn` trigger: the host starts at sign-in
+ *   off     the same task without its trigger (#1224): kept for `serve --detach`, which starts the host in the
+ *           person's sign-in through it; a task without a trigger reads as autostart off (`status` says `notrigger`)
+ *   remove  the task gone (uninstall)
+ *   status  `state none`, `state notrigger` or the task's state
+ *   signin  `serve --detach`'s start (#1224): when this user has a desktop, the task is checked and started. It is
+ *           registered (without a trigger) when missing, and registered again when its action or its principal is not
+ *           what this serve would write (a launcher that moved, another install's data folder, a task some other
+ *           account wrote under this name): Start-ScheduledTask would otherwise run something else, or as someone else.
+ *           A trigger is kept only on a task that was this user's own
+ *
+ * A task whose principal is `Interactive` runs in that user's session with their sign-in's token, also when
+ * Start-ScheduledTask is called from an ssh session. Measured on a linked Windows 11 PC (2026-10-19): a task started
+ * that way from the hub's ssh logon ran in session 1 with an interactive logon at medium integrity and saw the user's
+ * Credential Manager entries, where the ssh logon's own processes saw none.
+ *
+ * `legacy` is the name before the user was part of it (`autostartName`): this user's task of that name is removed by
+ * `on`, `off`, `remove` and `signin`, and read by `status`, so an entry an earlier version wrote neither lingers nor
+ * starts twice.
  */
-export function taskScript(action, { name, run = '' }) {
+export function taskScript(action, { name, run = '', legacy = null }) {
   const head = ["$ErrorActionPreference = 'Stop'", PS_MODULE_PATH, '[Console]::OutputEncoding = [Text.Encoding]::UTF8', `$name = ${psText(name)}`]
   const fail = `} catch { "${TASK_WORD}-ERROR $($_.Exception.Message -replace '\\s+', ' ')" }`
   const find = "$t = Get-ScheduledTask -TaskName $name -TaskPath '\\' -ErrorAction SilentlyContinue"
-  if (action === 'status') return [...head, 'try {', `  ${find}`, `  if ($t) { "${TASK_WORD} state $($t.State)" } else { '${TASK_WORD} state none' }`, fail].join('\n')
+  // Whether a task's principal is this user's, as this serve registers it. Task Scheduler gives the id with or without the domain
+  const mine = [
+    '$me = if ($env:USERDOMAIN) { "$env:USERDOMAIN\\$env:USERNAME" } else { $env:USERNAME }',
+    "function Test-Mine($x) { $x -and $x.Principal -and ($x.Principal.UserId -eq $me -or $x.Principal.UserId -eq $env:USERNAME) -and \"$($x.Principal.LogonType)\" -eq 'Interactive' -and \"$($x.Principal.RunLevel)\" -eq 'Limited' }",
+  ]
+  const old = legacy
+    ? [`$legacy = ${psText(legacy)}`, "$old = Get-ScheduledTask -TaskName $legacy -TaskPath '\\' -ErrorAction SilentlyContinue"]
+    : ['$old = $null']
+  const dropOld = "if ($old -and (Test-Mine $old)) { Unregister-ScheduledTask -TaskName $legacy -TaskPath '\\' -Confirm:$false }"
+  if (action === 'status') {
+    return [
+      ...head,
+      'try {',
+      ...[...mine, ...old, find, 'if (-not $t -and (Test-Mine $old)) { $t = $old }'].map((l) => `  ${l}`),
+      `  if (-not $t) { '${TASK_WORD} state none' } elseif (@($t.Triggers | Where-Object { $_ }).Count -eq 0) { '${TASK_WORD} state notrigger' } else { "${TASK_WORD} state $($t.State)" }`,
+      fail,
+    ].join('\n')
+  }
+  if (action === 'remove') {
+    return [...head, 'try {', ...[...mine, ...old, find, "if ($t) { Unregister-ScheduledTask -TaskName $name -TaskPath '\\' -Confirm:$false }", dropOld].map((l) => `  ${l}`), `  '${TASK_WORD} off'`, fail].join('\n')
+  }
   if (action === 'off') {
-    return [...head, 'try {', `  ${find}`, "  if ($t) { Unregister-ScheduledTask -TaskName $name -TaskPath '\\' -Confirm:$false }", `  '${TASK_WORD} off'`, fail].join('\n')
+    // The task stays, with what it runs and as whom; only the trigger goes
+    const keep = "if ($t -and @($t.Triggers | Where-Object { $_ }).Count -gt 0) { Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $t.Actions -Principal $t.Principal -Settings $t.Settings -Description $t.Description -Force | Out-Null }"
+    return [...head, 'try {', ...[...mine, ...old, find, keep, dropOld].map((l) => `  ${l}`), `  '${TASK_WORD} off'`, fail].join('\n')
   }
   const encoded = encodedCommand(run)
-  return [
-    ...head,
-    'try {',
-    "  $exe = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'",
-    `  $arg = '-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encoded}'`,
-    '  $user = if ($env:USERDOMAIN) { "$env:USERDOMAIN\\$env:USERNAME" } else { $env:USERNAME }',
-    '  $a = New-ScheduledTaskAction -Execute $exe -Argument $arg',
-    '  $tr = New-ScheduledTaskTrigger -AtLogOn -User $user',
-    '  $p = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited',
-    '  $s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew',
-    `  Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $a -Trigger $tr -Principal $p -Settings $s -Description ${psText('Starts the Centralu host (centralu serve) when you sign in. Written by centralu serve --autostart on.')} -Force | Out-Null`,
-    `  '${TASK_WORD} on'`,
-    fail,
-  ].join('\n')
+  const want = [
+    "$exe = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'",
+    `$arg = '-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encoded}'`,
+    '$user = $me',
+  ]
+  const register = (trigger) => [
+    '$a = New-ScheduledTaskAction -Execute $exe -Argument $arg',
+    '$p = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited',
+    '$s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew',
+    `$d = ${psText(trigger === 'logon' ? 'Starts the Centralu host (centralu serve) when you sign in. Written by centralu serve --autostart on.' : 'Starts the Centralu host (centralu serve) in your sign-in when a linked computer asks for it. Written by centralu serve --detach; centralu serve --autostart remove removes it.')}`,
+    trigger === 'logon'
+      ? "Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $a -Trigger (New-ScheduledTaskTrigger -AtLogOn -User $user) -Principal $p -Settings $s -Description $d -Force | Out-Null"
+      : "if (@($keep).Count -gt 0) { Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $a -Trigger $keep -Principal $p -Settings $s -Description $d -Force | Out-Null } else { Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $a -Principal $p -Settings $s -Description $d -Force | Out-Null }",
+  ]
+  if (action === 'signin') {
+    /*
+     * Someone is signed in when this user owns an Explorer in a session of its own (not session 0, where an ssh
+     * logon's processes run). Asked of WMI for the owner, which needs no administrator for the user's own processes
+     * and reads the same in every language
+     */
+    return [
+      ...head,
+      'try {',
+      ...mine.map((l) => `  ${l}`),
+      "  $desk = @(Get-CimInstance Win32_Process -Filter \"Name='explorer.exe'\" | Where-Object { $_.SessionId -gt 0 } | Where-Object { $o = Invoke-CimMethod -InputObject $_ -MethodName GetOwner; $o.ReturnValue -eq 0 -and $o.User -eq $env:USERNAME -and (-not $env:USERDOMAIN -or $o.Domain -eq $env:USERDOMAIN) })",
+      `  if ($desk.Count -eq 0) { '${TASK_WORD} nosession' } else {`,
+      ...[...want, ...old, find, dropOld].map((l) => `    ${l}`),
+      '    $acts = @(if ($t) { $t.Actions })',
+      '    $same = (Test-Mine $t) -and $acts.Count -eq 1 -and $acts[0].Execute -eq $exe -and $acts[0].Arguments -eq $arg',
+      '    if (-not $same) {',
+      // A trigger is this user's own choice (autostart on): kept only when the task was theirs
+      '      $keep = @(if (Test-Mine $t) { $t.Triggers | Where-Object { $_ } })',
+      ...register('keep').map((l) => `      ${l}`),
+      `      '${TASK_WORD}-NOTE registered'`,
+      '    }',
+      "    Start-ScheduledTask -TaskName $name -TaskPath '\\'",
+      `    '${TASK_WORD} started'`,
+      '  }',
+      fail,
+    ].join('\n')
+  }
+  return [...head, 'try {', ...[...mine, ...want, ...old, ...register('logon'), dropOld].map((l) => `  ${l}`), `  '${TASK_WORD} on'`, fail].join('\n')
 }
 
 /** What a task script printed: `{ ok: true, word }` (`on`, `off`, or the state after `state`) or `{ ok: false, message }` */
@@ -256,7 +337,7 @@ async function systemdAutostart(action, { dataDir, env, home, name, run, user })
     else clearAutostartMark(dataDir)
     return { ...base, on, linger }
   }
-  if (action === 'off') {
+  if (action === 'off' || action === 'remove') {
     if (existsSync(file)) {
       await ctl('disable', name)
       rmSync(file, { force: true })
@@ -289,39 +370,69 @@ async function systemdAutostart(action, { dataDir, env, home, name, run, user })
   return { ...base, on: true, linger, ...(linger === true ? {} : { message: lingerMessage(user) }) }
 }
 
-async function taskAutostart(action, { dataDir, env, name, run, user, platform, interop }) {
+async function taskAutostart(action, { dataDir, env, home, name, run, user, platform, interop }) {
+  const legacy = legacyTaskName({ dataDir, home, env, platform })
   const detach = detachHow(platform, env, interop)
   const ps = windowsPowershell(detach, env)
   const base = { ok: true, how: 'task', linger: null }
   if (!ps) return { ...base, ok: false, on: false, message: 'Windows PowerShell is not reachable from this WSL distro' }
   const ask = (script) => askPowershell(ps, script, env, parseTaskAnswer, run)
   if (action === 'status') {
-    const a = await ask(taskScript('status', { name }))
+    const a = await ask(taskScript('status', { name, legacy }))
     if (!a.ok) return { ...base, ok: false, on: readAutostartMark(dataDir)?.how === 'task', message: `Task Scheduler did not answer: ${a.message}` }
-    const on = a.word !== 'none' && a.word !== 'Disabled'
+    // A task without its trigger is the one `--detach` starts in the sign-in (#1224): no start at sign-in
+    const on = a.word !== 'none' && a.word !== 'Disabled' && a.word !== 'notrigger'
     if (on) writeAutostartMark(dataDir, { how: 'task', name, linger: null })
     else clearAutostartMark(dataDir)
     return { ...base, on }
   }
-  if (action === 'off') {
-    const a = await ask(taskScript('off', { name }))
-    if (!a.ok) return { ...base, ok: false, on: true, message: `Task Scheduler did not remove the task "${name}": ${a.message}` }
+  if (action === 'off' || action === 'remove') {
+    // `off` keeps the task without its trigger, for `--detach`'s start in the sign-in; `remove` (uninstall) removes it
+    const a = await ask(taskScript(action, { name, legacy }))
+    if (!a.ok) return { ...base, ok: false, on: true, message: `Task Scheduler did not ${action === 'off' ? 'change' : 'remove'} the task "${name}": ${a.message}` }
     clearAutostartMark(dataDir)
     return { ...base, on: false }
   }
   const launcher = autostartLauncher(dataDir, platform)
   if (!launcher) return { ...base, ok: false, on: false, message: `there is no Centralu launcher in ${dataDir} to start at sign-in` }
   const runScript = taskActionScript({ how: detach, launcher, env, distro: env.WSL_DISTRO_NAME ?? null, user })
-  const a = await ask(taskScript('on', { name, run: runScript }))
+  const a = await ask(taskScript('on', { name, run: runScript, legacy }))
   if (!a.ok) return { ...base, ok: false, on: false, message: `Task Scheduler did not take the task: ${a.message}` }
   writeAutostartMark(dataDir, { how: 'task', name, linger: null })
   return { ...base, on: true }
 }
 
 /**
- * `centralu serve --autostart on|off|status` (docs/plans/remote-hub.md §10.4, owner decision 4: per
+ * Starts this data folder's host in the person's Windows sign-in, when someone is signed in (#1224): the task
+ * `--autostart` writes, registered without its trigger when it is not there, started with Start-ScheduledTask. Called
+ * by `serve --detach` before it falls back to WMI, whose process keeps the caller's logon: from an ssh session that is a
+ * network logon, which cannot open the user's Credential Manager vault, runs elevated for an administrator (#702) and
+ * opens what it shows in session 0, where nobody sees it.
+ *
+ * `{ started: true, name }`, or `{ started: false, reason, message? }`: `nosession` (nobody is signed in here),
+ * `off` (`CENTRALU_SIGNIN_TASK=off`, for a person who wants no task, and for tests on a machine with a desktop),
+ * `not_windows`, `no_launcher`, `error`. `run` is a parameter so tests never reach the real Task Scheduler.
+ */
+export async function startInSignIn({ dataDir, env, home, platform = process.platform, run = runCaptured, user = env.USERNAME || userInfo().username }) {
+  if (platform !== 'win32' || env.WSL_DISTRO_NAME) return { started: false, reason: 'not_windows' }
+  if (env.CENTRALU_SIGNIN_TASK === 'off') return { started: false, reason: 'off' }
+  const launcher = autostartLauncher(dataDir, platform)
+  if (!launcher) return { started: false, reason: 'no_launcher' }
+  const ps = windowsPowershell('wmi', env)
+  if (!ps) return { started: false, reason: 'error', message: 'Windows PowerShell is not reachable' }
+  const name = autostartName('task', { dataDir, home, env, platform, user })
+  const runScript = taskActionScript({ how: 'wmi', launcher, env })
+  const a = await askPowershell(ps, taskScript('signin', { name, run: runScript, legacy: legacyTaskName({ dataDir, home, env, platform }) }), env, parseTaskAnswer, run)
+  if (!a.ok) return { started: false, reason: 'error', message: a.message }
+  if (a.word === 'started') return { started: true, name }
+  if (a.word === 'nosession') return { started: false, reason: 'nosession' }
+  return { started: false, reason: 'error', message: `Task Scheduler answered ${a.word}` }
+}
+
+/**
+ * `centralu serve --autostart on|off|remove|status` (docs/plans/remote-hub.md §10.4, owner decision 4: per
  * machine, off by default). The hub runs it over ssh for the Settings → Machines toggle, and its
- * uninstall runs `off`. Turning it on or off never starts or stops a host: one runs already when the
+ * uninstall runs `remove` (`off` on a serve that predates it). Turning it on or off never starts or stops a host: one runs already when the
  * hub asks (the link started it), and the entry is for the next boot.
  *
  * stdout: one line, `{ v: 1, autostart: { ok, on, how, linger, message? } }`; `how` null where this
@@ -346,10 +457,10 @@ export async function runAutostart({
   const report = (a) => answerLine(write, 'autostart', a)
   if (how === null) {
     clearAutostartMark(dataDir)
-    return report({ ok: action !== 'on', on: false, how: null, linger: null, ...(action === 'off' ? {} : { message: autostartUnsupported(platform, env) }) })
+    return report({ ok: action !== 'on', on: false, how: null, linger: null, ...(action === 'off' || action === 'remove' ? {} : { message: autostartUnsupported(platform, env) }) })
   }
   try {
-    const name = autostartName(how, { dataDir, home, env, platform })
+    const name = autostartName(how, { dataDir, home, env, platform, user })
     const opts = { dataDir, env, home, name, run, user, platform, interop }
     return report(how === 'systemd' ? await systemdAutostart(action, opts) : await taskAutostart(action, opts))
   } catch (e) {

package/bin/serve-detach.mjs

@@ -6,12 +6,13 @@ import { spawn } from 'node:child_process'
 import { existsSync, openSync, renameSync, writeSync } from 'node:fs'
 import { userInfo } from 'node:os'
 import { join } from 'node:path'
-import { answerLine, isAlive, say, sayTo, runCaptured, tail, sleep, waitUntil } from './serve-util.mjs'
-import { SERVE_LOG_FILE, serveDataDir, readServeState, ensureServeState, heldHere, lockHolderPid, readServePid } from './serve-files.mjs'
+import { answerLine, isAlive, say, sayTo, runCaptured, tail, sleep } from './serve-util.mjs'
+import { SERVE_LOG_FILE, serveDataDir, ensureServeState } from './serve-files.mjs'
 import { askPowershell, detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell, windowsTool, wslDistro, wslUser } from './serve-windows.mjs'
-import { DEFAULT_SERVE_PORT } from './serve-port.mjs'
 import { CHILD_FLAG } from './serve-args.mjs'
-import { protocolVersionOf, connectionLine, hostProvesOf, probeHost, askHostToStop } from './serve-host.mjs'
+import { startInSignIn } from './serve-autostart.mjs'
+import { stopServedHost } from './serve-handover.mjs'
+import { connectionLine, serveFrom } from './serve-host.mjs'
 import { describe, runServe, serveFolder } from './serve-run.mjs'
 
 /**
@@ -19,7 +20,7 @@ import { describe, runServe, serveFolder } from './serve-run.mjs'
  * does not inherit this environment: it gets the account's default one. Everything else it needs
  * (the token, the port) is in the data folder. Never a secret.
  */
-export const CARRIED_ENV = ['CC_DATA_DIR', 'CENTRALU_HOST_ENTRY', 'CENTRALU_MANAGED']
+export const CARRIED_ENV = ['CC_DATA_DIR', 'CENTRALU_HOST_ENTRY', 'CENTRALU_MANAGED', 'CENTRALU_STARTED_FROM']
 
 export function encodeChildSpec({ env, log }) {
   const carried = {}
@@ -111,11 +112,14 @@ export async function runDetach({
   version,
   cliPath,
   port = null,
+  from = null,
   platform = process.platform,
   execPath = process.execPath,
   cwd = process.cwd(),
   start = startDetached,
   how = detachHow(platform, env),
+  signIn = startInSignIn,
+  signInMs = 20_000,
   timeoutMs = 30_000,
   noStartMs = 10_000,
   write = (line) => process.stdout.write(line),
@@ -123,14 +127,37 @@ export async function runDetach({
   // Created here, so the token exists before the launcher reads it and `answered` reads it again
   const { dataDir } = serveFolder({ env, home, cliPath, platform })
   const fail = (reason, message) => answerLine(write, 'detach', { ok: false, how, reason, message })
-  const answered = async (already) => {
+  const answered = async (already, as = how) => {
     const d = await describe({ env, dataDir, state: ensureServeState(dataDir, platform), entry, version })
     if (!d?.hostRunning) return false
-    write(`${connectionLine({ ...d, detach: { ok: true, how, already } })}\n`)
+    write(`${connectionLine({ ...d, detach: { ok: true, how: as, already } })}\n`)
     return true
   }
   if (await answered(true)) return 0
 
+  /*
+   * Windows: in the person's sign-in when someone is signed in (#1224), through the scheduled task, and through WMI only
+   * when nobody is. WMI's process keeps this ssh session's network logon, where Git cannot use the credentials saved in
+   * Windows. A task-started host that does not answer in time is left to the lock: the WMI start below then either
+   * holds the folder or is refused by it, never a second host on it.
+   */
+  if (how === 'wmi') {
+    const s = await signIn({ dataDir, env, home, platform })
+    if (s.started) {
+      say(`started centralu serve in the Windows sign-in (the scheduled task "${s.name}"); waiting for its host`)
+      const t0 = Date.now()
+      while (Date.now() - t0 < signInMs) {
+        if (await answered(false, 'task')) return 0
+        await sleep(250)
+      }
+      say(`the host the sign-in task started did not answer within ${Math.round(signInMs / 1000)} s; starting one through WMI instead`)
+    } else if (s.reason === 'nosession') {
+      say('nobody is signed in to Windows here: starting the host through WMI, outside any sign-in, where Git cannot use the credentials saved in Windows')
+    } else if (s.reason === 'error') {
+      say(`could not start the host in the Windows sign-in (${s.message}); starting it through WMI`)
+    }
+  }
+
   const log = join(dataDir, SERVE_LOG_FILE)
   // One start per log: the last one's is kept beside it, and its absence is how a start that never ran shows
   try {
@@ -138,7 +165,10 @@ export async function runDetach({
   } catch {
     // there was none
   }
-  const args = [cliPath, 'serve', ...(port !== null ? ['--port', String(port)] : []), `${CHILD_FLAG}${encodeChildSpec({ env, log })}`]
+  // Where this was asked for from (#1223): the launcher runs outside this ssh session, so it is told
+  const asked = serveFrom(env, from)
+  const childEnv = asked ? { ...env, CENTRALU_STARTED_FROM: JSON.stringify(asked) } : env
+  const args = [cliPath, 'serve', ...(port !== null ? ['--port', String(port)] : []), `${CHILD_FLAG}${encodeChildSpec({ env: childEnv, log })}`]
   let started
   try {
     started = await start({ how, execPath, args, env, cwd })
@@ -196,18 +226,8 @@ export async function runDetachedChild({ spec, ...opts }) {
 }
 
 /**
- * `centralu serve --stop` (docs/plans/remote-hub.md §10.4, S10): asks the running host to stop over
- * its own socket and waits until it has, so its shutdown runs (its agents, terminals and app
- * processes stopped in order, the store closed). Measured on Windows: killing the WMI-started
- * launcher ended the host 143 ms later with no "shutting down" line, because the host sits in
- * libuv's kill-on-close job object; so on Windows killing is the last resort, not the way.
- *
- * Then, only for a host that did not go: posix SIGTERM to the launcher (which passes it to the host,
- * the same clean stop), and on Windows ending the host. A host from before `host.stop` gets that
- * too. The launcher ends with its host; one still there afterwards is ended.
- *
- * Only the processes serve.pid and host.lock name, and only while they agree with each other and
- * the host answered with this folder's token: a stale pid is never signalled.
+ * `centralu serve --stop` (docs/plans/remote-hub.md §10.4, S10): the running host stopped in order, over its own
+ * socket, and waited for (`stopServedHost` in serve-handover.mjs, which the hand-over into the sign-in shares, #1224).
  *
  * stdout: one line, `{ v: 1, stop: { ok, wasRunning, how?, message? } }`.
  */
@@ -222,56 +242,5 @@ export async function runStop({
   write = (line) => process.stdout.write(line),
 }) {
   const dataDir = serveDataDir(env, home)
-  const report = (stop) => answerLine(write, 'stop', stop)
-  const state = readServeState(dataDir)
-  if (!state) return report({ ok: true, wasRunning: false, message: `no centralu serve has run for ${dataDir}` })
-  const port = state.port ?? DEFAULT_SERVE_PORT
-  const installed = protocolVersionOf(entry) ?? 0
-  const prove = hostProvesOf(entry)
-  const probe = () => probeHost({ port, token: state.token, protocolVersion: installed, prove })
-  const first = await probe()
-  if (!heldHere(first, dataDir)) return report({ ok: true, wasRunning: false, message: `centralu serve is not running for ${dataDir}` })
-
-  const hostPid = lockHolderPid(dataDir)
-  const launcher = readServePid(dataDir)
-  // serve.pid is only believed when it names the host that holds the folder now
-  const launcherPid = launcher && hostPid && launcher.hostPid === hostPid ? launcher.pid : null
-  const down = async () => !(await probe()).running && !(hostPid && isAlive(hostPid))
-
-  let asked = await askHostToStop({ port, token: state.token, protocolVersion: first.protocolVersion ?? installed, prove })
-  if (!asked.ok && asked.protocolVersion !== undefined) asked = await askHostToStop({ port, token: state.token, protocolVersion: asked.protocolVersion, prove })
-  let how = 'asked'
-  let stopped = asked.ok && (await waitUntil(down, timeoutMs))
-  let note = asked.ok ? null : `the host did not take the request to stop (${asked.message})`
-  if (!stopped) {
-    const target = platform !== 'win32' && launcherPid ? launcherPid : hostPid
-    if (target) {
-      how = platform === 'win32' ? 'ended' : 'signal'
-      try {
-        kill(target, 'SIGTERM')
-      } catch {
-        // gone in the meantime
-      }
-      stopped = await waitUntil(down, platform === 'win32' ? 5_000 : graceMs)
-      if (!stopped && hostPid && isAlive(hostPid)) {
-        how = 'ended'
-        try {
-          kill(hostPid, 'SIGKILL')
-        } catch {
-          // gone in the meantime
-        }
-        stopped = await waitUntil(down, 5_000)
-      }
-    }
-    if (how === 'ended') note = `${note ? `${note}; ` : ''}ended the host without its shutdown`
-  }
-  if (launcherPid && launcherPid !== process.pid && !(await waitUntil(() => !isAlive(launcherPid), 5_000))) {
-    try {
-      kill(launcherPid, 'SIGKILL')
-    } catch {
-      // gone in the meantime
-    }
-  }
-  if (!stopped) return report({ ok: false, wasRunning: true, how, message: `the host on 127.0.0.1:${port} is still running${note ? ` (${note})` : ''}` })
-  return report({ ok: true, wasRunning: true, how, ...(note ? { message: note } : {}) })
+  return answerLine(write, 'stop', await stopServedHost({ dataDir, entry, platform, timeoutMs, graceMs, kill }))
 }

package/bin/serve-files.mjs

@@ -183,13 +183,18 @@ export function lockHolderIsAlive(dataDir, startOf = processStartTime) {
   return startOf(holder.pid) === holder.started
 }
 
-/** host.lock's `{ pid, started }`; a bare pid (an older host) has no start time */
+/**
+ * host.lock's `{ pid, started, by? }`; a bare pid (an older host) has no start time. `by` (#1223, additive) is who
+ * started the host: `app`, `keeper` or `serve` (`instance-lock.ts`), absent when the host did not say
+ */
 function parseLockHolder(text) {
   const t = text.trim()
   if (/^\d+$/.test(t)) return Number(t) > 0 ? { pid: Number(t), started: null } : null
   try {
     const v = JSON.parse(t)
-    return Number.isInteger(v?.pid) && v.pid > 0 ? { pid: v.pid, started: typeof v.started === 'string' ? v.started : null } : null
+    if (!Number.isInteger(v?.pid) || v.pid <= 0) return null
+    const by = v.by === 'app' || v.by === 'keeper' || v.by === 'serve' ? v.by : null
+    return { pid: v.pid, started: typeof v.started === 'string' ? v.started : null, ...(by ? { by } : {}) }
   } catch {
     return null
   }
@@ -208,6 +213,15 @@ export function processStartTime(pid) {
   }
 }
 
+/** Who `host.lock` names as the data folder's owner, `{ pid, started, by? }`, or null */
+export function lockHolder(dataDir) {
+  try {
+    return parseLockHolder(readFileSync(join(dataDir, 'host.lock'), 'utf8'))
+  } catch {
+    return null
+  }
+}
+
 /** Who `host.lock` names as the data folder's owner, or null */
 export function lockHolderPid(dataDir) {
   try {

package/bin/serve-handover.mjs

@@ -0,0 +1,152 @@
+/**
+ * Stopping the host `serve` runs for a data folder, and moving one that runs in a network logon into the person's
+ * Windows sign-in (#1224). One module so the foreground `serve` (serve-run.mjs) and `--stop` (serve-detach.mjs) share
+ * the stop without importing each other.
+ */
+import { readServeState, heldHere, lockHolderPid, readServePid } from './serve-files.mjs'
+import { DEFAULT_SERVE_PORT } from './serve-port.mjs'
+import { protocolVersionOf, hostProvesOf, probeHost, askHostToStop, askHostRpc } from './serve-host.mjs'
+import { ownLogon } from './serve-windows.mjs'
+import { isAlive, say, sleep, waitUntil } from './serve-util.mjs'
+
+/**
+ * Asks the host serve runs for `dataDir` to stop over its own socket and waits until it has, so its shutdown runs (its
+ * agents, terminals and app processes stopped in order, the store closed). Measured on Windows: killing the
+ * WMI-started launcher ended the host 143 ms later with no "shutting down" line, because the host sits in libuv's
+ * kill-on-close job object; so on Windows killing is the last resort, not the way.
+ *
+ * Then, only for a host that did not go: posix SIGTERM to the launcher (which passes it to the host, the same clean
+ * stop), and on Windows ending the host. A host from before `host.stop` gets that too. The launcher ends with its host;
+ * one still there afterwards is ended.
+ *
+ * Only the processes serve.pid and host.lock name, and only while they agree with each other and the host answered
+ * with this folder's token: a stale pid is never signalled.
+ *
+ * `{ ok, wasRunning, how?, message? }`, the `--stop` line's `stop`. With `ifIdle` (#1224, the hand-over) the host stops only
+ * when nothing runs there, and `{ ok: false, busy: true }` says it did not.
+ */
+export async function stopServedHost({ dataDir, entry, platform = process.platform, ifIdle = false, timeoutMs = 30_000, graceMs = 15_000, kill = (pid, sig) => process.kill(pid, sig) }) {
+  const state = readServeState(dataDir)
+  if (!state) return { ok: true, wasRunning: false, message: `no centralu serve has run for ${dataDir}` }
+  const port = state.port ?? DEFAULT_SERVE_PORT
+  const installed = protocolVersionOf(entry) ?? 0
+  const prove = hostProvesOf(entry)
+  const probe = () => probeHost({ port, token: state.token, protocolVersion: installed, prove })
+  const first = await probe()
+  if (!heldHere(first, dataDir)) return { ok: true, wasRunning: false, message: `centralu serve is not running for ${dataDir}` }
+
+  const hostPid = lockHolderPid(dataDir)
+  const launcher = readServePid(dataDir)
+  // serve.pid is only believed when it names the host that holds the folder now
+  const launcherPid = launcher && hostPid && launcher.hostPid === hostPid ? launcher.pid : null
+  const down = async () => !(await probe()).running && !(hostPid && isAlive(hostPid))
+
+  let asked = await askHostToStop({ port, token: state.token, protocolVersion: first.protocolVersion ?? installed, prove, ifIdle })
+  if (!asked.ok && asked.protocolVersion !== undefined) asked = await askHostToStop({ port, token: state.token, protocolVersion: asked.protocolVersion, prove, ifIdle })
+  // `ifIdle` and it has work running (#1224): it was left as it is
+  if (asked.busy) return { ok: false, wasRunning: true, busy: true, message: asked.message }
+  let how = 'asked'
+  let stopped = asked.ok && (await waitUntil(down, timeoutMs))
+  let note = asked.ok ? null : `the host did not take the request to stop (${asked.message})`
+  if (!stopped) {
+    const target = platform !== 'win32' && launcherPid ? launcherPid : hostPid
+    if (target) {
+      how = platform === 'win32' ? 'ended' : 'signal'
+      try {
+        kill(target, 'SIGTERM')
+      } catch {
+        // gone in the meantime
+      }
+      stopped = await waitUntil(down, platform === 'win32' ? 5_000 : graceMs)
+      if (!stopped && hostPid && isAlive(hostPid)) {
+        how = 'ended'
+        try {
+          kill(hostPid, 'SIGKILL')
+        } catch {
+          // gone in the meantime
+        }
+        stopped = await waitUntil(down, 5_000)
+      }
+    }
+    if (how === 'ended') note = `${note ? `${note}; ` : ''}ended the host without its shutdown`
+  }
+  if (launcherPid && launcherPid !== process.pid && !(await waitUntil(() => !isAlive(launcherPid), 5_000))) {
+    try {
+      kill(launcherPid, 'SIGKILL')
+    } catch {
+      // gone in the meantime
+    }
+  }
+  if (!stopped) return { ok: false, wasRunning: true, how, message: `the host on 127.0.0.1:${port} is still running${note ? ` (${note})` : ''}` }
+  return { ok: true, wasRunning: true, how, ...(note ? { message: note } : {}) }
+}
+
+/** How long the hand-over waits for the host's work to end before it gives up and says so (#1224 review) */
+export const HANDOVER_WAIT_MS = 30 * 60_000
+
+/**
+ * The hand-over (#1224): a `serve` started in the person's Windows sign-in (the scheduled task, at sign-in or from
+ * `--detach`) found the folder held by a host that runs in a network logon, the one a hub's ssh started before anyone
+ * signed in. Git there cannot use the credentials saved in Windows, so the sign-in's host takes over, but only while that
+ * host has nothing running a person would lose. Windows has no keeper, so stopping a host ends what runs in it.
+ *
+ * The stop is `host.stop {ifIdle}`: the host itself checks and stops in one step, and from its yes on takes no new call,
+ * so a turn the hub starts cannot slip in between a check here and the stop (`lifecycle/stop-gate.ts` in agent-host).
+ * Until it says yes this asks again every `pollMs`, for `maxWaitMs` at most (30 minutes), and tells the host what it is
+ * doing (`host.handover`: `waiting`, then `gave_up`), which a hub linked to it shows on the machine's row. It ends early
+ * when that host goes by itself.
+ *
+ * Resolves true once the folder is free for this serve to start its host, false when there is nothing to move (not
+ * Windows, a host in any other logon or too old to say, this serve not in an interactive logon itself) or it gave up.
+ * The hub's link loses the machine between the stop and the new host's start, and reconnects by its usual backoff to the
+ * same port and token.
+ *
+ * `existing` is `probeHost`'s answer for the running host. `logonOf`, `stop`, `tell`, `pollMs`, `maxWaitMs` and `now` are
+ * parameters for tests.
+ */
+export async function moveIntoSignIn({
+  dataDir,
+  entry,
+  env,
+  existing,
+  platform = process.platform,
+  logonOf = () => ownLogon(env),
+  stop = () => stopServedHost({ dataDir, entry, platform, ifIdle: true }),
+  tell = null,
+  pollMs = 30_000,
+  maxWaitMs = HANDOVER_WAIT_MS,
+  now = Date.now,
+}) {
+  if (platform !== 'win32' || existing?.logon !== 'network') return false
+  if ((await logonOf()) !== 'interactive') return false
+  const state = readServeState(dataDir)
+  if (!state) return false
+  const port = state.port ?? DEFAULT_SERVE_PORT
+  const prove = hostProvesOf(entry)
+  const protocolVersion = existing.protocolVersion ?? protocolVersionOf(entry) ?? 0
+  const report = (handover) => (tell ?? ((h) => askHostRpc({ port, token: state.token, protocolVersion, prove, method: 'host.handover', params: { handover: h } })))(handover)
+  const pid = lockHolderPid(dataDir)
+  say(`the host running for ${dataDir}${pid ? ` (pid ${pid})` : ''} runs in a network logon (started over ssh), where Git cannot use the credentials saved in Windows; moving it into this Windows sign-in once nothing runs there`)
+  const t0 = now()
+  let waiting = false
+  for (;;) {
+    if (!(await probeHost({ port, token: state.token, protocolVersion, prove })).running) return true
+    const r = await stop()
+    if (r.ok) {
+      say(`stopped it${r.how && r.how !== 'asked' ? ` (${r.how})` : ''}; starting the host in this sign-in`)
+      return true
+    }
+    if (!r.busy) say(`could not stop it: ${r.message ?? 'no reason given'}; asking again later`)
+    if (!waiting) {
+      say('it has work running (a turn, an approval, a terminal or a command); waiting until it has none')
+      await report({ state: 'waiting', since: t0 })
+      waiting = true
+    }
+    if (now() - t0 >= maxWaitMs) {
+      await report({ state: 'gave_up', since: now() })
+      say(`gave up after ${Math.round(maxWaitMs / 60_000)} minutes: it still had work running. It moves into the sign-in at the next sign-in, or when a linked computer starts it again`)
+      return false
+    }
+    await sleep(pollMs)
+  }
+}

package/bin/serve-host.mjs

@@ -35,6 +35,12 @@ export function protocolVersionOf(entry) {
  * is added by `--detach` only.
  */
 export function connectionLine({ port, token, version, protocolVersion, dataDir, hostRunning, install, autostart, detach, proof }) {
+  /*
+   * The options this serve takes that an older one refuses (#1223): a hub adds `--from <its name>` to `--detach` only
+   * when the line says so, since an older serve answers an option it does not know with an error. `window`: the
+   * desktop window on Windows uses this serve's host through `--window` only when it is listed (#1223 review)
+   */
+  const takes = ['from', 'window']
   return JSON.stringify({
     v: 1,
     port,
@@ -48,9 +54,45 @@ export function connectionLine({ port, token, version, protocolVersion, dataDir,
     ...(detach ? { detach } : {}),
     // The running host proves it holds the token before the hub sends it (#838); absent: the hub sends hello as before
     ...(proof ? { proof: true } : {}),
+    takes,
   })
 }
 
+/**
+ * Where a `serve` was asked for from (#1223), for the host's `host.lock` (`CC_SERVE_FROM`): the hub's name `--from`
+ * gave, and the ssh client's address when this runs in an ssh session (OpenSSH's `SSH_CLIENT`, on Windows too). What a
+ * `--detach` found is carried to the launcher it starts (`CENTRALU_STARTED_FROM`), which runs outside the ssh session.
+ * Null when neither is known.
+ */
+export function serveFrom(env, hub = null) {
+  const carried = parseStartedFrom(env.CENTRALU_STARTED_FROM)
+  if (carried) return carried
+  const ssh = String(env.SSH_CLIENT ?? env.SSH_CONNECTION ?? '').trim().split(/\s+/)[0] ?? ''
+  const from = {
+    ...(typeof hub === 'string' && FROM_NAME_RE.test(hub) ? { hub } : {}),
+    ...(SSH_ADDRESS_RE.test(ssh) ? { ssh } : {}),
+  }
+  return from.hub || from.ssh ? from : null
+}
+
+const FROM_NAME_RE = /^[A-Za-z0-9._-]{1,64}$/
+/** An IPv4 or IPv6 address as OpenSSH writes it: digits, hex, dots and colons */
+const SSH_ADDRESS_RE = /^[0-9A-Fa-f.:]{2,64}$/
+
+function parseStartedFrom(raw) {
+  if (!raw) return null
+  try {
+    const v = JSON.parse(raw)
+    const from = {
+      ...(typeof v?.hub === 'string' && FROM_NAME_RE.test(v.hub) ? { hub: v.hub } : {}),
+      ...(typeof v?.ssh === 'string' && SSH_ADDRESS_RE.test(v.ssh) ? { ssh: v.ssh } : {}),
+    }
+    return from.hub || from.ssh ? from : null
+  } catch {
+    return null
+  }
+}
+
 /**
  * The host's environment.
  *
@@ -69,9 +111,11 @@ export function connectionLine({ port, token, version, protocolVersion, dataDir,
  *   `CENTRALU_MANAGED`, which is the launcher's business and would otherwise reach every agent.
  * - `CC_SERVE=1` lets the host take `host.stop` (`--stop`); a host the app runs refuses it.
  */
-export function hostEnv(env, { dataDir, version, hostDir, legacyToken }) {
+export function hostEnv(env, { dataDir, version, hostDir, legacyToken, from = null }) {
   const out = { ...env }
-  for (const k of ['DISPLAY', 'WAYLAND_DISPLAY', 'CC_KEEPER', 'CC_FRONT_DOOR', 'CC_DEV', 'CC_HOST_TOKEN', 'CC_HOST_TOKEN_ON_STDIN', 'CC_HOST_SOURCE', 'CENTRALU_MANAGED']) delete out[k]
+  for (const k of ['DISPLAY', 'WAYLAND_DISPLAY', 'CC_KEEPER', 'CC_FRONT_DOOR', 'CC_DEV', 'CC_HOST_TOKEN', 'CC_HOST_TOKEN_ON_STDIN', 'CC_HOST_SOURCE', 'CENTRALU_MANAGED', 'CENTRALU_STARTED_FROM', 'CC_SERVE_FROM', 'CC_STARTED_BY']) delete out[k]
+  // Who asked for this host, for its host.lock (#1223): a second host on the folder names it when refused
+  if (from) out.CC_SERVE_FROM = JSON.stringify(from)
   out.CC_DATA_DIR = dataDir
   // The host `host.stop` may end (`centralu serve --stop`): nothing else stops it in order on Windows
   out.CC_SERVE = '1'
@@ -238,6 +282,8 @@ export function probeHost({ port, token, protocolVersion, prove = false, timeout
             running: true,
             protocolVersion: Number.isInteger(m.protocolVersion) ? m.protocolVersion : undefined,
             version: typeof m.build?.version === 'string' ? m.build.version : undefined,
+            // Which Windows logon it runs in (#1224): a `network` one is moved into the sign-in (serve-handover.mjs)
+            ...(HOST_LOGONS.includes(m.logon) ? { logon: m.logon } : {}),
           })
         } else if (m.kind === 'res' && m.ok === false && m.error?.code === 'version_mismatch') {
           // The token was right (it is checked first), so this is our host, on another protocol
@@ -289,12 +335,39 @@ function tcpProbe(port, timeoutMs) {
   })
 }
 
+/** The logons a host's `hello_ok.logon` may name (#1224) */
+const HOST_LOGONS = ['interactive', 'network', 'batch', 'service']
+
+/**
+ * One call to a running host (`method` with `params`), as `askHostToStop` makes it: a hello with the token, then the
+ * call. Its result, or null when it did not answer or refused. For `host.handover` (#1224)
+ */
+export function askHostRpc({ port, token, protocolVersion, prove = false, method, params = {}, timeoutMs = 5000, WebSocketImpl = globalThis.WebSocket }) {
+  if (typeof WebSocketImpl !== 'function') return Promise.resolve(null)
+  return helloExchange({
+    port, token, protocolVersion, prove, WebSocketImpl, timeoutMs,
+    timedOut: null,
+    failed: () => null,
+    on: (done) => ({
+      unproven: () => done(null),
+      gone: () => done(null),
+      message: (m, ws) => {
+        if (m.kind === 'hello_ok') ws.send(JSON.stringify({ kind: 'rpc', id: 'call', method, params }))
+        else if (m.kind === 'res' && m.id === 'call') done(m.ok && m.result && typeof m.result === 'object' ? m.result : null)
+        else if (m.kind === 'res' && m.ok === false) done(null)
+      },
+    }),
+  })
+}
+
 /**
  * Asks a running host to stop (`host.stop`, an additive RPC): a hello with the token, then the call.
  * `{ ok: true }` once the host took it, `{ ok: false, message, protocolVersion? }` otherwise; the
  * last names the host's protocol when the hello was refused for it, so the caller can ask again.
+ * `ifIdle` (#1224): only if nothing runs there, checked and acted on by the host in one step; `{ ok: false, busy: true }`
+ * when something does.
  */
-export function askHostToStop({ port, token, protocolVersion, prove = false, timeoutMs = 5000, WebSocketImpl = globalThis.WebSocket }) {
+export function askHostToStop({ port, token, protocolVersion, prove = false, ifIdle = false, timeoutMs = 5000, WebSocketImpl = globalThis.WebSocket }) {
   if (typeof WebSocketImpl !== 'function') return Promise.resolve({ ok: false, message: `Node ${process.version} has no WebSocket to ask with` })
   // With `prove`, the token goes out only to a host that proved it holds it (#838)
   return helloExchange({
@@ -305,8 +378,11 @@ export function askHostToStop({ port, token, protocolVersion, prove = false, tim
       unproven: () => done({ ok: false, message: 'what answers on the port did not prove it holds the token' }),
       gone: () => done({ ok: false, message: 'the connection closed' }),
       message: (m, ws) => {
-        if (m.kind === 'hello_ok') ws.send(JSON.stringify({ kind: 'rpc', id: 'stop', method: 'host.stop', params: {} }))
-        else if (m.kind === 'res' && m.id === 'stop') done(m.ok ? { ok: true } : { ok: false, message: m.error?.message ?? 'refused' })
+        if (m.kind === 'hello_ok') ws.send(JSON.stringify({ kind: 'rpc', id: 'stop', method: 'host.stop', params: ifIdle ? { ifIdle: true } : {} }))
+        else if (m.kind === 'res' && m.id === 'stop' && m.ok && m.result?.ok === false) {
+          // `ifIdle` and something runs there (#1224): nothing was changed
+          done({ ok: false, busy: true, message: 'it has work running', activity: m.result.busy ?? null, calls: m.result.calls ?? 0 })
+        } else if (m.kind === 'res' && m.id === 'stop') done(m.ok ? { ok: true } : { ok: false, message: m.error?.message ?? 'refused' })
         else if (m.kind === 'res' && m.ok === false) {
           const pv = m.error?.code === 'version_mismatch' ? mismatchProtocolOf(m.error) : null
           done({ ok: false, message: m.error?.message ?? 'refused', ...(pv !== null ? { protocolVersion: pv } : {}) })

package/bin/serve-run.mjs

@@ -4,11 +4,12 @@ import { writeFileSync, writeSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { createInterface } from 'node:readline'
 import { isAlive, say } from './serve-util.mjs'
-import { SERVE_STATE_FILE, SERVE_PID_FILE, serveDataDir, ensureServeState, recordServePort, rotateServeToken, heldHere, lockHolderPid, removeServePid } from './serve-files.mjs'
+import { SERVE_STATE_FILE, SERVE_PID_FILE, serveDataDir, ensureServeState, recordServePort, rotateServeToken, heldHere, lockHolder, lockHolderPid, removeServePid } from './serve-files.mjs'
 import { DEFAULT_SERVE_PORT, SERVE_PORT_TRIES, chooseServePort, listensHere, windowsListening } from './serve-port.mjs'
 import { keepLauncher, installInfo } from './serve-install.mjs'
-import { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, hostProvesOf, probeHost, takesTokenOnStdin, tokenLine } from './serve-host.mjs'
+import { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, hostProvesOf, probeHost, serveFrom, takesTokenOnStdin, tokenLine } from './serve-host.mjs'
 import { autostartInfo } from './serve-autostart.mjs'
+import { moveIntoSignIn } from './serve-handover.mjs'
 
 /**
  * The data folder a command that may start or describe a host works in: its state, created on first use, and the
@@ -70,7 +71,7 @@ export async function printConnection({ env, home, entry, version, cliPath }) {
  * from a newer build) says why in a file `--detach` can quote. From then on host.log has every line,
  * and serve.log stops growing.
  */
-export async function runServe({ env, home, entry, version, cliPath, port: askedPort, platform = process.platform, execPath = process.execPath, logFd = null }) {
+export async function runServe({ env, home, entry, version, cliPath, port: askedPort, from = null, platform = process.platform, execPath = process.execPath, logFd = null, handOver = moveIntoSignIn }) {
   const { dataDir, state } = serveFolder({ env, home, cliPath, platform })
   const protocolVersion = protocolVersionOf(entry)
 
@@ -78,7 +79,8 @@ export async function runServe({ env, home, entry, version, cliPath, port: asked
   // would only fail on the data folder's lock with a less specific message.
   const recorded = state.port ?? DEFAULT_SERVE_PORT
   const existing = await probeHost({ port: recorded, token: state.token, protocolVersion, prove: hostProvesOf(entry) })
-  if (heldHere(existing, dataDir)) {
+  // A host the hub's ssh started before anyone signed in moves into this sign-in, once idle (#1224, serve-handover.mjs)
+  if (heldHere(existing, dataDir) && !(await handOver({ dataDir, entry, env, existing, platform }))) {
     const pid = lockHolderPid(dataDir)
     say(`centralu serve is already running for ${dataDir} on 127.0.0.1:${recorded}${pid ? ` (pid ${pid})` : ''}. Not starting a second one.`)
     return 1
@@ -100,7 +102,7 @@ export async function runServe({ env, home, entry, version, cliPath, port: asked
   const onStdin = takesTokenOnStdin(entry)
   const child = spawn(plan.command, plan.args, {
     stdio: ['pipe', 'pipe', logFd === null ? 'inherit' : 'pipe'],
-    env: hostEnv(env, { dataDir, version, hostDir: dirname(entry), ...(onStdin ? {} : { legacyToken: state.token }) }),
+    env: hostEnv(env, { dataDir, version, hostDir: dirname(entry), from: serveFrom(env, from), ...(onStdin ? {} : { legacyToken: state.token }) }),
     detached: plan.detached,
     windowsHide: true,
   })
@@ -168,12 +170,11 @@ export async function runServe({ env, home, entry, version, cliPath, port: asked
       for (const s of signals) process.off(s, forward)
       removeServePid(dataDir, process.pid)
       if (!ready && code !== 0) {
-        const pid = lockHolderPid(dataDir)
-        if (pid && pid !== child.pid && isAlive(pid)) {
-          say(
-            `the host did not start. ${dataDir} belongs to another Centralu host (pid ${pid}), ` +
-              'probably the Centralu app on this machine. Quit it, or point CC_DATA_DIR at another folder.',
-          )
+        const holder = lockHolder(dataDir)
+        if (holder && holder.pid !== child.pid && isAlive(holder.pid)) {
+          // Who it is, when its host.lock says (#1223)
+          const who = { app: 'the Centralu window on this machine', keeper: "Centralu's keeper on this machine", serve: 'another centralu serve' }[holder.by] ?? 'probably the Centralu app on this machine'
+          say(`the host did not start. ${dataDir} belongs to another Centralu host (pid ${holder.pid}), ${who}. Quit it, or point CC_DATA_DIR at another folder.`)
         }
       }
       if (logFd !== null) say(`the host exited (${signal ?? code})`)

package/bin/serve-window.mjs

@@ -0,0 +1,112 @@
+/**
+ * `centralu serve --window` (#1223): what the desktop window on Windows runs in place of a host of its own when
+ * `centralu serve` is installed in its data folder (`start_plan`'s `Host::Serve` in the window). One host per data
+ * folder: a linked hub's serve holds this one, or will, so the window uses that host rather than start one the folder's
+ * lock refuses.
+ */
+import { join } from 'node:path'
+import { readServeState } from './serve-files.mjs'
+import { DEFAULT_SERVE_PORT } from './serve-port.mjs'
+import { hostProvesOf, probeHost, protocolVersionOf } from './serve-host.mjs'
+import { serveFolder } from './serve-run.mjs'
+import { runDetach } from './serve-detach.mjs'
+import { startInSignIn } from './serve-autostart.mjs'
+import { say, sleep } from './serve-util.mjs'
+
+/**
+ * Makes sure the folder's serve host runs, then prints the window's ready line, `{"ready":true,"port","token","db"}`
+ * (the line a host the window starts prints), and stays until the window goes.
+ *
+ * - No host answers: one is started the way `--detach` starts it, in this Windows sign-in through the scheduled task,
+ *   so it outlives the window and the hub's link finds it (`serve --connection`).
+ * - A host in a network logon answers (the one the hub's ssh started before anyone signed in): the window uses it now,
+ *   and the sign-in task is started, whose serve moves it into this sign-in once nothing runs there
+ *   (`moveIntoSignIn`, serve-handover.mjs).
+ * - stdin is the window (it runs this with stdin a pipe): when it ends, this exits 0 and leaves the host running,
+ *   since it serves the hub's link too.
+ * - The host stops answering for `misses` polls in a row (the hand-over's gap, or it ended): this exits 1, and the
+ *   window's supervisor starts this again, which finds the new host or starts one.
+ *
+ * Resolves with the exit code. `detach`, `signIn`, `pollMs`, `misses` and `stdin` are parameters for tests.
+ */
+export async function runWindow({
+  env,
+  home,
+  entry,
+  version,
+  cliPath,
+  platform = process.platform,
+  write = (line) => process.stdout.write(line),
+  stdin = process.stdin,
+  detach = runDetach,
+  signIn = startInSignIn,
+  pollMs = 5_000,
+  misses = 3,
+}) {
+  const { dataDir } = serveFolder({ env, home, cliPath, platform })
+  const prove = hostProvesOf(entry)
+  const protocolVersion = protocolVersionOf(entry) ?? 0
+  const probe = () => {
+    const state = readServeState(dataDir)
+    return state ? probeHost({ port: state.port ?? DEFAULT_SERVE_PORT, token: state.token, protocolVersion, prove }) : Promise.resolve({ running: false })
+  }
+
+  let host = await probe()
+  if (!host.running) {
+    say(`no Centralu host runs for ${dataDir}: starting one in this Windows sign-in, which keeps running for a linked hub when the window closes`)
+    let answer = null
+    await detach({ env, home, entry, version, cliPath, platform, write: (line) => (answer = line) })
+    const d = parseLine(answer)
+    if (!d?.hostRunning) {
+      say(`could not start the host: ${d?.detach?.message ?? 'centralu serve --detach did not answer'}`)
+      return 1
+    }
+    host = await probe()
+    if (!host.running) {
+      say('the host started, then did not answer')
+      return 1
+    }
+  } else if (host.logon === 'network') {
+    const s = await signIn({ dataDir, env, home, platform }).catch((e) => ({ started: false, reason: 'error', message: e.message }))
+    say(
+      s.started
+        ? 'the host runs in a network logon (started over ssh): this window uses it, and it moves into this sign-in once nothing runs there'
+        : `the host runs in a network logon (started over ssh), and could not be moved into this sign-in (${s.message ?? s.reason})`,
+    )
+  }
+
+  const state = readServeState(dataDir)
+  write(`${JSON.stringify({ ready: true, port: state.port ?? DEFAULT_SERVE_PORT, token: state.token, db: join(dataDir, 'store.db') })}\n`)
+
+  return await new Promise((resolve) => {
+    let done = false
+    const finish = (code) => {
+      if (done) return
+      done = true
+      resolve(code)
+    }
+    stdin.once('end', () => finish(0))
+    stdin.once('close', () => finish(0))
+    stdin.resume()
+    void (async () => {
+      let missed = 0
+      while (!done) {
+        await sleep(pollMs)
+        if (done) return
+        missed = (await probe()).running ? 0 : missed + 1
+        if (missed >= misses) {
+          say(`the host for ${dataDir} stopped answering; the window starts this again`)
+          finish(1)
+        }
+      }
+    })()
+  })
+}
+
+function parseLine(text) {
+  try {
+    return JSON.parse(String(text ?? '').trim().split('\n').at(-1))
+  } catch {
+    return null
+  }
+}

package/bin/serve-windows.mjs

@@ -31,6 +31,21 @@ export function wslInterop() {
   return existsSync('/proc/sys/fs/binfmt_misc/WSLInterop') || existsSync('/proc/sys/fs/binfmt_misc/WSLInterop-late')
 }
 
+/**
+ * Which Windows logon this process runs in (#1224), from `whoami /groups` as the host reads its own (`logonFromGroups`
+ * in agent-host's os.ts): `interactive` (S-1-5-4), `network` (S-1-5-2), `batch`, `service`, or null when it cannot
+ * tell. By the SIDs, which read the same in every language
+ */
+export async function ownLogon(env, run = runCaptured) {
+  const r = await run(windowsTool('wmi', env, ['System32', 'whoami.exe']), ['/groups', '/fo', 'csv', '/nh'], env).catch(() => null)
+  const out = String(r?.stdout ?? '')
+  if (/"S-1-5-4"/.test(out)) return 'interactive'
+  if (/"S-1-5-2"/.test(out)) return 'network'
+  if (/"S-1-5-3"/.test(out)) return 'batch'
+  if (/"S-1-5-6"/.test(out)) return 'service'
+  return null
+}
+
 /** A WSL distro's name for `wsl.exe -d`, refused when it could be read as anything else */
 export function wslDistro(distro) {
   if (!/^[A-Za-z0-9._-]{1,64}$/.test(distro ?? '')) throw new Error(`not a WSL distro name: ${distro}`)

package/bin/serve.mjs

@@ -24,12 +24,14 @@
  * (`serve-autostart.mjs`), Windows, WSL and PowerShell (`serve-windows.mjs`), and small helpers
  * (`serve-util.mjs`).
  */
-export { SERVE_STATE_FILE, SERVE_LOG_FILE, SERVE_PID_FILE, serveDataDir, readServeState, ensureServeState, recordServePort, rotateServeToken, heldHere, lockHolderIsAlive, processStartTime, lockHolderPid, readServePid } from './serve-files.mjs'
-export { detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell } from './serve-windows.mjs'
+export { SERVE_STATE_FILE, SERVE_LOG_FILE, SERVE_PID_FILE, serveDataDir, readServeState, ensureServeState, recordServePort, rotateServeToken, heldHere, lockHolderIsAlive, processStartTime, lockHolder, lockHolderPid, readServePid } from './serve-files.mjs'
+export { detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell, ownLogon } from './serve-windows.mjs'
 export { DEFAULT_SERVE_PORT, SERVE_PORT_TRIES, chooseServePort, listensHere, parseNetstatListening } from './serve-port.mjs'
 export { SERVE_HELP, AUTOSTART_ACTIONS, parseServeArgs } from './serve-args.mjs'
 export { launcherScript, ensureLauncher, remoteLayout, parsePointer, installInfo, managedLauncherScript } from './serve-install.mjs'
-export { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, mismatchServerVersion, hostProvesOf, probeHost, askHostToStop, takesTokenOnStdin, tokenLine } from './serve-host.mjs'
-export { AUTOSTART_FILE, AUTOSTART_ENV, autostartHow, autostartUnsupported, pathKey, autostartName, autostartLauncher, systemdUnit, taskActionScript, taskScript, parseTaskAnswer, readAutostartMark, autostartInfo, lingerMessage, runAutostart } from './serve-autostart.mjs'
+export { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, mismatchServerVersion, hostProvesOf, probeHost, askHostToStop, askHostRpc, serveFrom, takesTokenOnStdin, tokenLine } from './serve-host.mjs'
+export { stopServedHost, moveIntoSignIn, HANDOVER_WAIT_MS } from './serve-handover.mjs'
+export { runWindow } from './serve-window.mjs'
+export { AUTOSTART_FILE, AUTOSTART_ENV, autostartHow, autostartUnsupported, pathKey, autostartName, autostartLauncher, systemdUnit, taskActionScript, taskScript, parseTaskAnswer, readAutostartMark, autostartInfo, lingerMessage, runAutostart, startInSignIn } from './serve-autostart.mjs'
 export { printConnection, runServe, rotateToken } from './serve-run.mjs'
 export { CARRIED_ENV, encodeChildSpec, decodeChildSpec, startDetached, runDetach, runDetachedChild, runStop } from './serve-detach.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "centralu",
-  "version": "0.1.0-beta.29",
+  "version": "0.1.0-beta.30",
   "description": "Run, watch and steer several Claude Code and Codex CLI sessions from one window",
   "license": "MIT",
   "author": "ijun17",
@@ -38,9 +38,9 @@
     "win32"
   ],
   "optionalDependencies": {
-    "@centralu/darwin-arm64": "0.1.0-beta.29",
-    "@centralu/linux-arm64": "0.1.0-beta.29",
-    "@centralu/linux-x64": "0.1.0-beta.29",
-    "@centralu/win32-x64": "0.1.0-beta.29"
+    "@centralu/darwin-arm64": "0.1.0-beta.30",
+    "@centralu/linux-arm64": "0.1.0-beta.30",
+    "@centralu/linux-x64": "0.1.0-beta.30",
+    "@centralu/win32-x64": "0.1.0-beta.30"
   }
 }