centralu 0.1.0-beta.45 → 0.1.0-beta.46

package/bin/centralu.mjs

@@ -661,7 +661,7 @@ switch (cmd) {
       if (spec) Object.assign(process.env, spec.env)
       // realpath: npm's bin is a symlink to this file, and the launcher must not depend on the link
       const opts = { env: process.env, home: HOME, entry: requireHostEntry(), version: pkg.version, cliPath: realpathSync(process.argv[1]) }
-      if (args.mode === 'connection') process.exitCode = await printConnection({ ...opts, pair: args.pair ?? null })
+      if (args.mode === 'connection') process.exitCode = await printConnection({ ...opts, pair: args.pair ?? null, pairKey: args.pairKey ?? null, keyPaired: args.keyPaired === true })
       else if (args.mode === 'detach') process.exitCode = await runDetach({ ...opts, port: args.port, from: args.from })
       else if (args.mode === 'stop') process.exitCode = await runStop(opts)
       else if (args.mode === 'window') process.exitCode = await runWindow(opts)

package/bin/serve-args.mjs

@@ -1,5 +1,6 @@
 /** The arguments after `centralu serve`, and its help */
 import { DEFAULT_SERVE_PORT } from './serve-port.mjs'
+import { parseLinkPublicKey } from './serve-keys.mjs'
 
 export const SERVE_HELP = `centralu serve: run the Centralu host on this machine, without a window
 
@@ -83,6 +84,8 @@ export function parseServeArgs(argv) {
   let autostart = null
   let from = null
   let pair = null
+  let pairKey = null
+  let keyPaired = false
   let revoke = null
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]
@@ -90,6 +93,19 @@ export function parseServeArgs(argv) {
       const raw = a === '--pair' ? argv[++i] : a.slice('--pair='.length)
       if (typeof raw !== 'string' || !PAIR_LABEL_RE.test(raw)) return { error: `--pair needs a label: letters, digits, ':', '.', '_' and '-' (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
       pair = raw
+    } else if (a === '--pair-key') {
+      /*
+       * `--pair-key <label> <public key>` (#1711, docs/plans/key-pairing.md §4.2): a hub's key pairing, at each link in
+       * place of `--pair`. The key is checked as the host checks it (§4.1): a refused one writes nothing
+       */
+      const label = argv[++i]
+      const publicKey = argv[++i]
+      if (typeof label !== 'string' || !PAIR_LABEL_RE.test(label)) return { error: `--pair-key needs a label: letters, digits, ':', '.', '_' and '-' (got ${label === undefined ? 'nothing' : JSON.stringify(label)})` }
+      if (!parseLinkPublicKey(publicKey)) return { error: `--pair-key needs an Ed25519 public key after the label, as 43 characters of base64url (got ${publicKey === undefined ? 'nothing' : JSON.stringify(String(publicKey).slice(0, 64))})` }
+      pairKey = { label, publicKey }
+    } else if (a === '--key-paired') {
+      // The hub has paired by key with this machine before (#1711, §4.2): a key line removes the label's verifier entry
+      keyPaired = true
     } else if (a === '--revoke' || a.startsWith('--revoke=')) {
       const raw = a === '--revoke' ? argv[++i] : a.slice('--revoke='.length)
       if (typeof raw !== 'string' || !CREDENTIAL_ID_RE.test(raw)) return { error: `--revoke needs a credential's id, as --connection lists it (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
@@ -121,6 +137,9 @@ export function parseServeArgs(argv) {
   }
   if (help) return { mode: 'help', port }
   if (pair !== null && mode !== 'connection') return { error: '--pair goes with --connection' }
+  if (pairKey !== null && mode !== 'connection') return { error: '--pair-key goes with --connection' }
+  if (pair !== null && pairKey !== null) return { error: '--pair and --pair-key are two ways of pairing; pass one' }
+  if (keyPaired && pairKey === null) return { error: '--key-paired goes with --pair-key' }
   if (mode === 'revoke') return port !== null ? { error: '--revoke takes no --port' } : { mode, port, revoke }
   if (from !== null && mode !== 'serve' && mode !== 'detach') return { error: `--from goes with \`centralu serve\` and --detach, which start a host; not with ${FLAG_OF[mode]}` }
   if (child !== null) {
@@ -136,7 +155,7 @@ export function parseServeArgs(argv) {
     if (port !== null) return { error: '--autostart takes no --port: the entry it writes starts serve on the port serve recorded' }
     return { mode, port, autostart }
   }
-  return { mode, port, ...(from !== null ? { from } : {}), ...(pair !== null ? { pair } : {}) }
+  return { mode, port, ...(from !== null ? { from } : {}), ...(pair !== null ? { pair } : {}), ...(pairKey !== null ? { pairKey, keyPaired } : {}) }
 }
 
 function parsePort(raw) {

package/bin/serve-autostart.mjs

@@ -384,10 +384,10 @@ async function systemdAutostart(action, { dataDir, env, home, name, run, user })
   return { ...base, on: true, linger, ...(linger === true ? {} : { message: lingerMessage(user) }) }
 }
 
-async function taskAutostart(action, { dataDir, env, home, name, run, user, platform, interop }) {
+async function taskAutostart(action, { dataDir, env, home, name, run, user, platform, interop, mounts }) {
   const legacy = legacyTaskName({ dataDir, home, env, platform })
   const detach = detachHow(platform, env, interop)
-  const ps = windowsPowershell(detach, env)
+  const ps = windowsPowershell(detach, env, mounts)
   const base = { ok: true, how: 'task', linger: null }
   if (!ps) return { ...base, ok: false, on: false, message: 'Windows PowerShell is not reachable from this WSL distro' }
   const ask = (script) => askPowershell(ps, script, env, parseTaskAnswer, run)
@@ -456,8 +456,8 @@ export async function startInSignIn({ dataDir, env, home, platform = process.pla
  * hub asks (the link started it), and the entry is for the next boot.
  *
  * stdout: one line, `{ v: 1, autostart: { ok, on, how, linger, message? } }`; `how` null where this
- * machine offers nothing (`autostartHow`). `run` (a command runner) and `how` are parameters so
- * tests never reach the real systemd or Task Scheduler.
+ * machine offers nothing (`autostartHow`). `run` (a command runner), `how` and `mounts` (what /proc/mounts says, where WSL finds
+ * the Windows drive) are parameters so tests never reach the real systemd or Task Scheduler, nor depend on the drives of the machine.
  */
 export async function runAutostart({
   env,
@@ -467,6 +467,7 @@ export async function runAutostart({
   platform = process.platform,
   interop = wslInterop,
   how = autostartHow(platform, env, { interop }),
+  mounts = undefined,
   run = runCaptured,
   user = userInfo().username,
   write = (line) => process.stdout.write(line),
@@ -481,7 +482,7 @@ export async function runAutostart({
   }
   try {
     const name = autostartName(how, { dataDir, home, env, platform, user })
-    const opts = { dataDir, env, home, name, run, user, platform, interop }
+    const opts = { dataDir, env, home, name, run, user, platform, interop, mounts }
     return report(how === 'systemd' ? await systemdAutostart(action, opts) : await taskAutostart(action, opts))
   } catch (e) {
     return report({ ok: false, on: readAutostartMark(dataDir)?.how === how, how, linger: null, message: e?.message ?? String(e) })

package/bin/serve-detach.mjs

@@ -8,7 +8,7 @@ import { userInfo } from 'node:os'
 import { join } from 'node:path'
 import { answerLine, isAlive, say, sayTo, runCaptured, tail, sleep } from './serve-util.mjs'
 import { SERVE_LOG_FILE, serveDataDir, ensureServeState, markStopped, rotateServeLog } from './serve-files.mjs'
-import { askPowershell, detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell, windowsTool, wslDistro, wslUser } from './serve-windows.mjs'
+import { askPowershell, detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell, windowsTool, wslCommandLine } from './serve-windows.mjs'
 import { CHILD_FLAG } from './serve-args.mjs'
 import { startInSignIn } from './serve-autostart.mjs'
 import { stopServedHost } from './serve-handover.mjs'
@@ -72,11 +72,7 @@ export async function startDetached({ how, execPath, args, env, cwd }) {
   let commandLine
   try {
     if (how === 'wmi') commandLine = [execPath, ...args].map(windowsArg).join(' ')
-    else {
-      const distro = wslDistro(env.WSL_DISTRO_NAME ?? '')
-      const user = wslUser(userInfo().username)
-      commandLine = ['wsl.exe', '-d', distro, '-u', user, '--cd', cwd, '--exec', execPath, ...args].map(windowsArg).join(' ')
-    }
+    else commandLine = wslCommandLine({ distro: env.WSL_DISTRO_NAME ?? '', user: userInfo().username, cwd, execPath, args })
   } catch (e) {
     return { ok: false, blocked: false, message: e.message }
   }

package/bin/serve-files.mjs

@@ -9,6 +9,8 @@ import { chmodSync, existsSync, linkSync, mkdirSync, openSync, readFileSync, ren
 import { join } from 'node:path'
 import { isAlive, renameRetrying, replaceFile, sleepSync } from './serve-util.mjs'
 import { CREDENTIAL_ID_RE, PAIR_LABEL_RE } from './serve-args.mjs'
+import { parseLinkPublicKey } from './serve-keys.mjs'
+import { windowsPowershell } from './serve-windows.mjs'
 
 /**
  * The file in the data folder that holds the host's key, the full credentials' verifiers and the port, mode 0600.
@@ -22,13 +24,15 @@ import { CREDENTIAL_ID_RE, PAIR_LABEL_RE } from './serve-args.mjs'
  *   credential. The credential itself is printed once, to whoever asked for it (`--pair`: a hub at each link,
  *   `--window` for the person's own window, which the desktop app runs on Windows and which runs on every OS), and written nowhere. The host checks a hello against these,
  *   read again at each hello, so a pairing or a revocation applies at once.
- * - `legacyHostToken`: only while the installed host is from before verifiers (a rollback): the one token such a
- *   host knows, given to it and to the hub that pairs, as before #1405.
+ * - `keys` (#1711, docs/plans/key-pairing.md §4.2, additive: still version 2): one entry per hub that paired by key,
+ *   `{ id, label, publicKey, created, via: 'pair-key' }`, the hub's Ed25519 public key. Public: nothing in it opens the
+ *   host. A host from before key pairing ignores it, and a launcher from before drops it at its next write.
  *
  * The port is the one the last `serve` actually listened on, which is how `--connection`, a separate process, learns a
  * `--port` given to `serve` in a systemd unit. A version 1 file (`{ token, port }`) is moved to version 2 on first
  * use: its token becomes a full credential labelled `legacy` (a hub or window still holding it keeps working), which the
- * next pairing removes.
+ * next pairing removes. This is the update path for a machine below `MIN_SUPPORTED_VERSION` (#1143): version 2 first
+ * shipped in 0.1.0-beta.45, so the hub's update of an older machine (`serve --detach`) and `npm i -g` run on a version 1 file.
  */
 export const SERVE_STATE_FILE = 'serve.json'
 
@@ -154,16 +158,18 @@ function parseServeState(raw) {
   try {
     const v = JSON.parse(raw)
     const port = Number.isInteger(v?.port) && v.port >= 1 && v.port <= 65535 ? v.port : null
-    if (v?.v === 2) {
-      if (typeof v.key !== 'string' || v.key.length < 32) return null
-      // Exactly what the host takes (serve-credentials.ts `isListedEntry`): an entry of another shape is dropped here, so
-      // the next write leaves it out too, and the host refuses it meanwhile
-      const full = (Array.isArray(v.full) ? v.full : []).filter((e) => isListedEntry(e)).map((e) => ({ id: e.id, label: e.label, verifier: e.verifier, created: Number.isFinite(e.created) ? e.created : 0, ...(PAIRED_VIA.includes(e.via) ? { via: e.via } : {}), ...(e.replaced === true ? { replaced: true } : {}) }))
-      const legacyHostToken = typeof v.legacyHostToken === 'string' && v.legacyHostToken.length >= 32 ? v.legacyHostToken : null
-      return { v: 2, key: v.key, port, full, legacyHostToken, token: limitedOf(v.key), proofKey: v.key }
+    if (v?.v !== 2) {
+      // A version 1 file, moved by `ensureServeState`: the update path from below the minimum (#1143)
+      if (typeof v?.token !== 'string' || v.token.length < 32) return null
+      return { v: 1, token: v.token, proofKey: v.token, port, key: null, full: [], keys: [] }
     }
-    if (typeof v?.token !== 'string' || v.token.length < 32) return null
-    return { v: 1, token: v.token, proofKey: v.token, port, key: null, full: [], legacyHostToken: null }
+    if (typeof v.key !== 'string' || v.key.length < 32) return null
+    // Exactly what the host takes (serve-credentials.ts `isListedEntry`): an entry of another shape is dropped here, so
+    // the next write leaves it out too, and the host refuses it meanwhile
+    const full = (Array.isArray(v.full) ? v.full : []).filter((e) => isListedEntry(e)).map((e) => ({ id: e.id, label: e.label, verifier: e.verifier, created: Number.isFinite(e.created) ? e.created : 0, ...(PAIRED_VIA.includes(e.via) ? { via: e.via } : {}), ...(e.replaced === true ? { replaced: true } : {}) }))
+    // The same for the hubs' key entries (#1711): one with a key the host refuses (§4.1) is dropped at the next write
+    const keys = (Array.isArray(v.keys) ? v.keys : []).filter((e) => isKeyEntry(e)).map((e) => ({ id: e.id, label: e.label, publicKey: e.publicKey, created: Number.isFinite(e.created) ? e.created : 0, via: 'pair-key', ...(e.replaced === true ? { replaced: true } : {}) }))
+    return { v: 2, key: v.key, port, full, keys, token: limitedOf(v.key), proofKey: v.key }
   } catch {
     return null
   }
@@ -174,9 +180,14 @@ export function isListedEntry(e) {
   return typeof e?.id === 'string' && CREDENTIAL_ID_RE.test(e.id) && typeof e.label === 'string' && PAIR_LABEL_RE.test(e.label) && typeof e.verifier === 'string' && /^[0-9a-f]{64}$/.test(e.verifier)
 }
 
-/** What version 2 writes for a state */
+/** A hub's key entry the launcher lists, `--revoke` takes and the host accepts (#1711): an 8-hex id, a label `--pair` takes, a public key the host takes (§4.1) */
+export function isKeyEntry(e) {
+  return typeof e?.id === 'string' && CREDENTIAL_ID_RE.test(e.id) && typeof e.label === 'string' && PAIR_LABEL_RE.test(e.label) && parseLinkPublicKey(e.publicKey) !== null
+}
+
+/** What version 2 writes for a state; `keys` only when there are any, so a folder no hub paired by key keeps today's file */
 function stateFile(state) {
-  return { v: 2, key: state.key, port: state.port, full: state.full, ...(state.legacyHostToken ? { legacyHostToken: state.legacyHostToken } : {}) }
+  return { v: 2, key: state.key, port: state.port, full: state.full, ...(state.keys?.length ? { keys: state.keys } : {}) }
 }
 
 /** A new full credential and its id */
@@ -204,11 +215,12 @@ export function ensureServeState(dataDir, platform = process.platform, now = Dat
   }
   let state = readServeState(dataDir)
   if (!state) throw noState(file)
-  // A version 1 file (#1405): its token becomes a full credential no longer written down, and a new key is drawn
+  // A version 1 file (#1405): its token becomes a full credential no longer written down, and a new key is drawn. Kept as
+  // the update path for a machine below `MIN_SUPPORTED_VERSION` (#1143), whose launcher wrote version 1
   if (state.v === 1) {
     state = changeServeState(dataDir, (s) =>
       s.v === 1
-        ? { v: 2, key: randomBytes(32).toString('base64url'), port: s.port, full: [{ id: randomBytes(4).toString('hex'), label: LEGACY_LABEL, verifier: verifierOf(s.token), created: now }], legacyHostToken: null }
+        ? { v: 2, key: randomBytes(32).toString('base64url'), port: s.port, full: [{ id: randomBytes(4).toString('hex'), label: LEGACY_LABEL, verifier: verifierOf(s.token), created: now }], keys: [] }
         : s,
       platform,
     )
@@ -421,30 +433,58 @@ function takesLegacyPlace(label) {
   return label === 'window' || label.startsWith('hub:')
 }
 
-/** Removes the full credential `id`; true when there was one. A hello with it is refused from then on */
-export function revokeServe(dataDir, id, platform = process.platform) {
-  let found = false
-  changeServeState(dataDir, (s) => {
-    found = s.full.some((e) => e.id === id)
-    return found ? { ...s, full: s.full.filter((e) => e.id !== id) } : s
+/**
+ * The key entry for `label` with `publicKey` (#1711, docs/plans/key-pairing.md §4.2): `--pair-key`'s write. At most one
+ * key entry per label. The same key under the same label keeps its entry and id; another key under it is a new entry
+ * with a new id, marked `replaced`, and the old key entry goes, so a socket in under the old key is closed by the sweep
+ * (which compares id and key). The label's verifier entry is never touched here. Returns `{ entry, state }`.
+ */
+export function pairKeyServe(dataDir, label, publicKey, platform = process.platform, now = Date.now()) {
+  if (!parseLinkPublicKey(publicKey)) throw new Error('A refused public key is never written')
+  ensureServeState(dataDir, platform)
+  let entry = null
+  const state = changeServeState(dataDir, (s) => {
+    const before = s.keys.find((k) => k.label === label)
+    /*
+     * The host takes the first key entry of an id (#1717 review, L2), so one written by hand ahead of the hub's, with its id
+     * and another key, keeps the hub from linking. Such an id is not kept: the entry gets a fresh one, which the line reports.
+     * The same for an id a verifier entry has (#1717 recheck, F1): the host takes no key entry of such an id
+     */
+    const shared = before !== undefined && (s.keys.some((k) => k !== before && k.id === before.id) || s.full.some((e) => e.id === before.id))
+    if (before && before.publicKey === publicKey && !shared) {
+      entry = before
+      return s
+    }
+    entry = { id: freshId(s), label, publicKey, created: now, via: 'pair-key', ...(before ? { replaced: true } : {}) }
+    return { ...s, keys: [...s.keys.filter((k) => k.label !== label), entry] }
   }, platform)
-  return found
+  return { entry, state }
+}
+
+/** An entry id no full credential and no key entry of `state` has: a `--revoke <id>` names one entry */
+function freshId(state) {
+  for (;;) {
+    const id = randomBytes(4).toString('hex')
+    if (!state.full.some((e) => e.id === id) && !state.keys.some((k) => k.id === id)) return id
+  }
 }
 
 /**
- * The one token an installed host from before verifiers knows (a rollback): kept in the state while such a host is
- * installed, given to it and to a hub that pairs. Created once; returns it.
+ * Removes the verifier entry under `label` (#1711, `--key-paired`): the hub paired by key with this machine before and
+ * now has a key line, so the verifier entry it made under its label is no longer its own. Returns the state written.
  */
-export function legacyHostTokenOf(dataDir, platform = process.platform) {
-  const state = ensureServeState(dataDir, platform)
-  if (state.legacyHostToken) return state.legacyHostToken
-  const token = randomBytes(32).toString('base64url')
-  return changeServeState(dataDir, (s) => (s.legacyHostToken ? s : { ...s, legacyHostToken: token }), platform).legacyHostToken
+export function dropVerifierUnder(dataDir, label, platform = process.platform) {
+  return changeServeState(dataDir, (s) => (s.full.some((e) => e.label === label) ? { ...s, full: s.full.filter((e) => e.label !== label) } : s), platform)
 }
 
-/** A host of today runs: the token kept for an older one is not kept any longer */
-export function dropLegacyHostToken(dataDir, platform = process.platform) {
-  changeServeState(dataDir, (s) => (s.legacyHostToken ? { ...s, legacyHostToken: null } : s), platform)
+/** Removes the full credential or the key entry `id`; true when there was one. A hello with it is refused from then on */
+export function revokeServe(dataDir, id, platform = process.platform) {
+  let found = false
+  changeServeState(dataDir, (s) => {
+    found = s.full.some((e) => e.id === id) || s.keys.some((k) => k.id === id)
+    return found ? { ...s, full: s.full.filter((e) => e.id !== id), keys: s.keys.filter((k) => k.id !== id) } : s
+  }, platform)
+  return found
 }
 
 /** Writes the port `serve` listened on, keeping the rest. Atomic: a temp file renamed over it */
@@ -453,13 +493,13 @@ export function recordServePort(dataDir, port, platform = process.platform) {
 }
 
 /**
- * A new key, and no full credential, keeping the port. Only when the person asks (`--rotate-token`): every hub pairs
- * again at its next link, the window at its next start, and a serve already running keeps its old key (what it hands
- * out) until it restarts, while the full credentials end at once.
+ * A new key, and no full credential and no key entry, keeping the port. Only when the person asks (`--rotate-token`):
+ * every hub pairs again at its next link, the window at its next start, and a serve already running keeps its old key
+ * (what it hands out, and what it signs with, #1711 §7) until it restarts, while the full credentials end at once.
  */
 export function rotateServeToken(dataDir, platform = process.platform) {
   ensureServeState(dataDir, platform)
-  return changeServeState(dataDir, (s) => ({ ...s, key: randomBytes(32).toString('base64url'), full: [], legacyHostToken: null }), platform)
+  return changeServeState(dataDir, (s) => ({ ...s, key: randomBytes(32).toString('base64url'), full: [], keys: [] }), platform)
 }
 
 /**
@@ -511,45 +551,78 @@ export function removeServePid(dataDir, pid) {
 }
 
 /**
- * A probe that did not prove the token, while this data folder's host is alive (`host.lock`): a host from before #838
- * still running after an update. It is running, and is not sent the token; a hub asking it for a proof is refused
- * until it restarts. Without a live lock holder, what answered is not ours.
+ * A probe that did not prove the token, while this data folder's `serve` is alive (`host.lock`): a host still on its old
+ * key after `--rotate-token`. It is running, and is not sent the token; a hub asking it for a proof is refused until it
+ * restarts. Without a live lock holder that `serve` started (`startedByServe`), what answered is not ours: a live holder
+ * the app or the keeper started owns the folder, and whatever sits on the recorded port (a hub's ssh forward, #1722) is
+ * not that holder.
+ *
+ * `portRecorded`: serve.json names the port the probe went to (`state.port != null`). A folder that has none was probed
+ * on the default port, where whatever listens is as likely another host's (a hub's ssh forward to a linked machine's serve
+ * lands there): an unproven answer from it says nothing about this folder, whoever holds the lock.
  */
-export function heldHere(probe, dataDir, startOf = processStartTime) {
+export function heldHere(probe, dataDir, startOf = processStartTime, portRecorded = true) {
   if (probe.running) return true
-  if (!probe.unproven) return false
-  return lockHolderIsAlive(dataDir, startOf)
+  if (!probe.unproven || !portRecorded) return false
+  return lockHolderIsAlive(dataDir, startOf) && startedByServe(dataDir)
+}
+
+/**
+ * Whether the process `host.lock` names is a host `centralu serve` started (#1722): what lets the launcher signal it.
+ * The lock says so itself (`by: 'serve'`, #1223); a lock that names another starter (`app`, `keeper`), or none (a host
+ * started by hand), is not serve's.
+ */
+export function startedByServe(dataDir) {
+  return lockHolder(dataDir)?.by === 'serve'
+}
+
+/** Who `by` in host.lock says started the host, as a phrase (#1223); an absent `by` is most likely the app */
+export function holderWho(by) {
+  return { app: 'the Centralu window on this machine', keeper: "Centralu's keeper on this machine", serve: 'another centralu serve' }[by] ?? 'probably the Centralu app on this machine'
+}
+
+/**
+ * The live process that holds this folder's lock and that `centralu serve` did not start, `{ pid, started, by? }`, or
+ * null (#1722): `--stop` names it rather than signal it. Only named, so a pid that is alive is enough (no start time:
+ * Windows has none), as for the message `serve` itself prints when the lock stops its host.
+ */
+export function foreignHolder(dataDir) {
+  const holder = lockHolder(dataDir)
+  return holder && isAlive(holder.pid) && !startedByServe(dataDir) ? holder : null
 }
 
 /**
  * Whether the process `host.lock` names is the one that wrote it (#838 review): alive, and started when the lock says
  * (`ps -o lstart`, as the host writes it, `instance-lock.ts`). A lock left by a host that died, whose pid another
  * process of the same user now has, names a stranger: counted as running, `--stop` would signal it. A lock without a
- * start time (a host from before #184) or a system without `ps` (Windows) cannot be told apart, so it does not count.
+ * start time and no `at` (its host found no `ps`) cannot be told apart, so it does not count. Windows has no `ps` and its
+ * host records no start time (#1723), only `at`, when it took the folder: the process that wrote the lock was created by
+ * then, and one given its number afterwards was created later. Both times come from one clock and the host writes `at`
+ * 17 ms or more after its process was created, so the slack is one clock tick, for the two readings of it. An `at` in the
+ * future (a clock set back since) proves nothing.
  */
-export function lockHolderIsAlive(dataDir, startOf = processStartTime) {
-  let holder
-  try {
-    holder = parseLockHolder(readFileSync(join(dataDir, 'host.lock'), 'utf8'))
-  } catch {
-    return false
-  }
-  if (!holder || !holder.started || !isAlive(holder.pid)) return false
-  return startOf(holder.pid) === holder.started
+export function lockHolderIsAlive(dataDir, startOf = processStartTime, createdAt = processCreatedAt) {
+  const holder = lockHolder(dataDir)
+  if (!holder || !isAlive(holder.pid)) return false
+  if (holder.started) return startOf(holder.pid) === holder.started
+  if (holder.at === undefined || holder.at > Date.now()) return false
+  const created = createdAt(holder.pid)
+  return created !== null && created <= holder.at + CLOCK_TICK_MS
 }
 
+/** One tick of the Windows clock */
+const CLOCK_TICK_MS = 16
+
 /**
- * host.lock's `{ pid, started, by? }`; a bare pid (an older host) has no start time. `by` (#1223, additive) is who
- * started the host: `app`, `keeper` or `serve` (`instance-lock.ts`), absent when the host did not say
+ * host.lock's `{ pid, started, by? }`. `by` (#1223, additive) is who started the host: `app`, `keeper` or `serve`
+ * (`instance-lock.ts`), absent when the host did not say
  */
 function parseLockHolder(text) {
-  const t = text.trim()
-  if (/^\d+$/.test(t)) return Number(t) > 0 ? { pid: Number(t), started: null } : null
   try {
-    const v = JSON.parse(t)
+    const v = JSON.parse(text)
     if (!Number.isInteger(v?.pid) || v.pid <= 0) return null
     const by = v.by === 'app' || v.by === 'keeper' || v.by === 'serve' ? v.by : null
-    return { pid: v.pid, started: typeof v.started === 'string' ? v.started : null, ...(by ? { by } : {}) }
+    return { pid: v.pid, started: typeof v.started === 'string' ? v.started : null, ...(Number.isFinite(v.at) ? { at: v.at } : {}), ...(by ? { by } : {}) }
   } catch {
     return null
   }
@@ -568,7 +641,24 @@ export function processStartTime(pid) {
   }
 }
 
-/** Who `host.lock` names as the data folder's owner, `{ pid, started, by? }`, or null */
+/**
+ * When a pid's process was created, as milliseconds since the epoch, on Windows (PowerShell); null elsewhere, or when
+ * it cannot be told (a process of another account). Asked of .NET, not `Get-Process`: that one loads a module, which
+ * under PowerShell 7's module path (a CI runner's, a pwsh terminal's) fails, and every lock held on Windows read as a
+ * dead one's (#1906)
+ */
+export function processCreatedAt(pid) {
+  if (process.platform !== 'win32') return null
+  try {
+    const out = execFileSync(windowsPowershell('wmi', process.env), ['-NoProfile', '-NonInteractive', '-Command', `([DateTimeOffset][Diagnostics.Process]::GetProcessById(${pid}).StartTime).ToUnixTimeMilliseconds()`], { encoding: 'utf8', timeout: 10_000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] })
+    const ms = Number(out.trim())
+    return Number.isFinite(ms) && ms > 0 ? ms : null
+  } catch {
+    return null
+  }
+}
+
+/** Who `host.lock` names as the data folder's owner, `{ pid, started, by?, at? }`, or null */
 export function lockHolder(dataDir) {
   try {
     return parseLockHolder(readFileSync(join(dataDir, 'host.lock'), 'utf8'))

package/bin/serve-handover.mjs

@@ -3,9 +3,9 @@
  * Windows sign-in (#1224). One module so the foreground `serve` (serve-run.mjs) and `--stop` (serve-detach.mjs) share
  * the stop without importing each other.
  */
-import { readServeState, heldHere, lockHolderPid, readServePid, pairServe, revokeServe } from './serve-files.mjs'
-import { DEFAULT_SERVE_PORT } from './serve-port.mjs'
-import { protocolVersionOf, hostProvesOf, probeHost, askHostToStop, askHostRpc, ownCredentials, takesVerifiers } from './serve-host.mjs'
+import { readServeState, heldHere, startedByServe, foreignHolder, holderWho, lockHolderIsAlive, lockHolderPid, readServePid } from './serve-files.mjs'
+import { DEFAULT_SERVE_PORT, listensHere } from './serve-port.mjs'
+import { protocolVersionOf, probeHost, askHostToStop, askHostRpc } from './serve-host.mjs'
 import { ownLogon } from './serve-windows.mjs'
 import { isAlive, say, sleep, waitUntil } from './serve-util.mjs'
 
@@ -20,7 +20,11 @@ import { isAlive, say, sleep, waitUntil } from './serve-util.mjs'
  * one still there afterwards is ended.
  *
  * Only the processes serve.pid and host.lock name, and only while they agree with each other and the host answered
- * with this folder's token: a stale pid is never signalled.
+ * with this folder's token, or nothing listens on the port while the process host.lock names is the one that wrote it
+ * (`heldSilently`, #1903: a host that took the lock and hung before it listened; never under `ifIdle`): a stale pid is
+ * never signalled.
+ * And only a host `serve` started (`startedByServe`, #1722): a lock held by the app's or the keeper's host is theirs,
+ * whatever answers on the port, so `--stop` says whose it is and leaves it.
  *
  * `{ ok, wasRunning, how?, message? }`, the `--stop` line's `stop`. With `ifIdle` (#1224, the hand-over) the host stops only
  * when nothing runs there, and `{ ok: false, busy: true }` says it did not. `forUpdate` (#1618): a hub's update stops it, and
@@ -32,28 +36,42 @@ export async function stopServedHost({ dataDir, entry, platform = process.platfo
   if (!state) return { ok: true, wasRunning: false, message: `no centralu serve has run for ${dataDir}` }
   const port = state.port ?? DEFAULT_SERVE_PORT
   const installed = protocolVersionOf(entry) ?? 0
-  const prove = hostProvesOf(entry)
   // The limited credential is enough to probe and to stop it (#1405, `host.stop` is everyday)
-  const own = ownCredentials(state, entry)
-  const probe = () => probeHost({ port, ...own, protocolVersion: installed, prove })
+  const own = { token: state.token, proofKey: state.proofKey }
+  const probe = () => probeHost({ port, ...own, protocolVersion: installed })
   const first = await probe()
-  if (!heldHere(first, dataDir)) return { ok: true, wasRunning: false, message: `centralu serve is not running for ${dataDir}` }
+  const silent = !first.running && !first.unproven && (await heldSilently(dataDir, port))
+  if (!silent && !heldHere(first, dataDir, undefined, state.port != null)) {
+    // The folder is held, but not by a serve (#1722): the app's or the keeper's host, whatever answered on the port
+    const other = foreignHolder(dataDir)
+    const whose = other ? `. It belongs to another Centralu host (pid ${other.pid}), ${holderWho(other.by)}; not stopping it` : ''
+    return { ok: true, wasRunning: false, message: `centralu serve is not running for ${dataDir}${whose}` }
+  }
 
   const hostPid = lockHolderPid(dataDir)
+  // Only a host `serve` started is ever signalled, whoever answered with this folder's token
+  const mayKill = startedByServe(dataDir)
   const launcher = readServePid(dataDir)
   // serve.pid is only believed when it names the host that holds the folder now
-  const launcherPid = launcher && hostPid && launcher.hostPid === hostPid ? launcher.pid : null
+  const launcherPid = mayKill && launcher && hostPid && launcher.hostPid === hostPid ? launcher.pid : null
   const down = async () => !(await probe()).running && !(hostPid && isAlive(hostPid))
 
-  let asked = await askHostToStop({ port, ...own, protocolVersion: first.protocolVersion ?? installed, prove, ifIdle, forUpdate })
-  if (!asked.ok && asked.protocolVersion !== undefined) asked = await askHostToStop({ port, ...own, protocolVersion: asked.protocolVersion, prove, ifIdle, forUpdate })
-  // `ifIdle` and it has work running (#1224): it was left as it is
-  if (asked.busy) return { ok: false, wasRunning: true, busy: true, message: asked.message }
   let how = 'asked'
-  let stopped = asked.ok && (await waitUntil(down, timeoutMs))
-  let note = asked.ok ? null : `the host did not take the request to stop (${asked.message})`
+  let stopped = false
+  let note = silent ? 'nothing listens on its port' : null
+  // The hand-over stops only a host that said it is idle: one that cannot say so is left
+  if (silent && ifIdle) return { ok: false, wasRunning: true, message: `the host holds the folder but ${note}` }
+  if (!silent) {
+    let asked = await askHostToStop({ port, ...own, protocolVersion: first.protocolVersion ?? installed, ifIdle, forUpdate })
+    if (!asked.ok && asked.protocolVersion !== undefined) asked = await askHostToStop({ port, ...own, protocolVersion: asked.protocolVersion, ifIdle, forUpdate })
+    // `ifIdle` and it has work running (#1224): it was left as it is
+    if (asked.busy) return { ok: false, wasRunning: true, busy: true, message: asked.message }
+    stopped = asked.ok && (await waitUntil(down, timeoutMs))
+    if (!asked.ok) note = `the host did not take the request to stop (${asked.message})`
+  }
   if (!stopped) {
-    const target = platform !== 'win32' && launcherPid ? launcherPid : hostPid
+    const target = platform !== 'win32' && launcherPid ? launcherPid : mayKill ? hostPid : null
+    if (hostPid && !mayKill) note = `${note ? `${note}; ` : ''}the lock names pid ${hostPid}, which centralu serve did not start, so it was not signalled`
     if (target) {
       how = platform === 'win32' ? 'ended' : 'signal'
       try {
@@ -85,6 +103,16 @@ export async function stopServedHost({ dataDir, entry, platform = process.platfo
   return { ok: true, wasRunning: true, how, ...(note ? { message: note } : {}) }
 }
 
+/**
+ * A host `serve` started that holds the folder's lock while nothing listens on its port (#1903): it took the lock and hung
+ * before it listened, or is still starting. Told by a listen on the port, not by the probe: a host that listens but whose
+ * event loop is stalled answers no probe in time either, and is running (#1906 review). Not part of `heldHere`, which
+ * `--connection` and `--detach`'s wait read: there a host still starting must not count as one that answers
+ */
+async function heldSilently(dataDir, port) {
+  return startedByServe(dataDir) && lockHolderIsAlive(dataDir) && !(await listensHere(port))
+}
+
 /** How long the hand-over waits for the host's work to end before it gives up and says so (#1224 review) */
 export const HANDOVER_WAIT_MS = 30 * 60_000
 
@@ -126,28 +154,22 @@ export async function moveIntoSignIn({
   const state = readServeState(dataDir)
   if (!state) return false
   const port = state.port ?? DEFAULT_SERVE_PORT
-  const prove = hostProvesOf(entry)
   const protocolVersion = existing.protocolVersion ?? protocolVersionOf(entry) ?? 0
-  const own = ownCredentials(state, entry)
+  const own = { token: state.token, proofKey: state.proofKey }
   /*
-   * `host.handover` is a hub's call (#1405, `link`): said with a full credential made for this one call and withdrawn
-   * right after, never kept. An older installed host knows only the token kept for it
+   * `host.handover` takes everyday rights (#1711, docs/plans/key-pairing.md §4.4): said with the credentials this
+   * launcher holds for its own host (the limited credential, after a proof under the key), and no credential is made for
+   * it. Before, a full one made for this call went to whatever answered that proof, which a reader of serve.json can. A
+   * host from #1405 to key pairing refuses it (`link`): no note on the row while this waits, and the move goes on
    */
-  const sayHandover = async (h) => {
-    const made = takesVerifiers(entry) ? pairServe(dataDir, 'handover', platform, Date.now(), 'handover') : null
-    try {
-      return await askHostRpc({ port, token: made?.token ?? own.token, proofKey: own.proofKey, protocolVersion, prove, method: 'host.handover', params: { handover: h } })
-    } finally {
-      if (made) revokeServe(dataDir, made.id, platform)
-    }
-  }
+  const sayHandover = (h) => askHostRpc({ port, ...own, protocolVersion, method: 'host.handover', params: { handover: h } })
   const report = (handover) => (tell ?? sayHandover)(handover)
   const pid = lockHolderPid(dataDir)
   say(`the host running for ${dataDir}${pid ? ` (pid ${pid})` : ''} runs in a network logon (started over ssh), where Git cannot use the credentials saved in Windows; moving it into this Windows sign-in once nothing runs there`)
   const t0 = now()
   let waiting = false
   for (;;) {
-    if (!(await probeHost({ port, ...own, protocolVersion, prove })).running) return true
+    if (!(await probeHost({ port, ...own, protocolVersion })).running) return true
     const r = await stop()
     if (r.ok) {
       say(`stopped it${r.how && r.how !== 'asked' ? ` (${r.how})` : ''}; starting the host in this sign-in`)