centralu 0.1.0-beta.45 → 0.1.0-beta.47

package/bin/centralu.mjs

@@ -45,6 +45,7 @@ import {
 } from './platform.mjs'
 import {
   decodeChildSpec,
+  gateHostStart,
   parseServeArgs,
   printConnection,
   rotateToken,
@@ -54,6 +55,9 @@ import {
   runDetachedChild,
   runServe,
   runStop,
+  runSwitch,
+  runSwitchRun,
+  runSwitchStatus,
   runWindow,
   SERVE_HELP,
 } from './serve.mjs'
@@ -631,6 +635,19 @@ switch (cmd) {
         process.exitCode = rotateToken({ env: process.env, home: HOME })
         break
       }
+      // The hub's switch of the install it manages (serve-switch.mjs): it starts and checks hosts only through serve's CLI
+      if (args.mode === 'switch') {
+        process.exitCode = await runSwitch({ env: process.env, home: HOME, raw: args.switchArg, cliPath: realpathSync(process.argv[1]) })
+        break
+      }
+      if (args.mode === 'switch-run') {
+        process.exitCode = await runSwitchRun({ env: process.env, home: HOME, raw: args.switchArg, dataDir: args.dataDir })
+        break
+      }
+      if (args.mode === 'switch-status') {
+        process.exitCode = await runSwitchStatus({ env: process.env, home: HOME, seen: args.seen })
+        break
+      }
       /*
        * Before anything spawns a host: under a Node below the floor the host crashes on its first
        * database call, with nothing in its log (issue #699). `--detach` also answers in the line the
@@ -640,6 +657,19 @@ switch (cmd) {
        * machine what Node it has.
        */
       const startsHost = args.mode === 'serve' || args.mode === 'detach' || args.mode === 'window' || (args.mode === 'autostart' && args.autostart === 'on')
+      /*
+       * A switch of the managed install under way there (§10.5a): no host starts between its stop and its start, and one
+       * whose switcher died is finished first, before this version refuses for a reason of its own (a host already
+       * answering, a missing host entry, a Node below the floor), so a reboot or a sign-in finishes it with no hub (#1907).
+       * Not for the launcher `--detach` started: that one asked already
+       */
+      if ((args.mode === 'serve' || args.mode === 'detach' || args.mode === 'window') && args.child === undefined) {
+        const refused = await gateHostStart({ env: process.env, home: HOME, version: pkg.version, detach: args.mode === 'detach' })
+        if (refused !== null) {
+          process.exitCode = refused
+          break
+        }
+      }
       if (startsHost && belowFloor(process.versions.node, NODE_FLOOR)) {
         const message = oldNodeSentence(process.versions.node, NODE_FLOOR)
         console.error(`centralu serve: ${message}`)
@@ -661,7 +691,7 @@ switch (cmd) {
       if (spec) Object.assign(process.env, spec.env)
       // realpath: npm's bin is a symlink to this file, and the launcher must not depend on the link
       const opts = { env: process.env, home: HOME, entry: requireHostEntry(), version: pkg.version, cliPath: realpathSync(process.argv[1]) }
-      if (args.mode === 'connection') process.exitCode = await printConnection({ ...opts, pair: args.pair ?? null })
+      if (args.mode === 'connection') process.exitCode = await printConnection({ ...opts, pair: args.pair ?? null, pairKey: args.pairKey ?? null, keyPaired: args.keyPaired === true })
       else if (args.mode === 'detach') process.exitCode = await runDetach({ ...opts, port: args.port, from: args.from })
       else if (args.mode === 'stop') process.exitCode = await runStop(opts)
       else if (args.mode === 'window') process.exitCode = await runWindow(opts)

package/bin/serve-args.mjs

@@ -1,5 +1,6 @@
 /** The arguments after `centralu serve`, and its help */
 import { DEFAULT_SERVE_PORT } from './serve-port.mjs'
+import { parseLinkPublicKey } from './serve-keys.mjs'
 
 export const SERVE_HELP = `centralu serve: run the Centralu host on this machine, without a window
 
@@ -76,6 +77,22 @@ export const FROM_RE = /^[A-Za-z0-9._-]{1,64}$/
  * `--autostart` writes starts serve on the port it recorded.
  */
 export function parseServeArgs(argv) {
+  // The hub's switch of the install it manages (docs/plans/remote-hub.md §10.5a): whole commands of their own, not in the help
+  const b64 = (a) => typeof a === 'string' && /^[A-Za-z0-9_-]{1,4096}$/.test(a)
+  if (argv[0] === '--switch') {
+    if (argv.length !== 2 || !b64(argv[1])) return { error: '--switch takes one argument, the switch the hub wrote' }
+    return { mode: 'switch', port: null, switchArg: argv[1] }
+  }
+  // What `--switch` starts: the hub's argument as it came, and the data folder (base64url) when it is not the default
+  if (argv[0] === '--switch-run') {
+    if (argv.length < 2 || argv.length > 3 || !argv.slice(1).every(b64)) return { error: '--switch-run takes the switch the hub wrote, and the data folder' }
+    return { mode: 'switch-run', port: null, switchArg: argv[1], dataDir: argv[2] ?? null }
+  }
+  if (argv[0] === '--switch-status') {
+    if (argv.length === 1) return { mode: 'switch-status', port: null, seen: null }
+    if (argv.length === 3 && argv[1] === '--seen' && /^[0-9A-Za-z-]{8,64}$/.test(argv[2])) return { mode: 'switch-status', port: null, seen: argv[2] }
+    return { error: '--switch-status takes only --seen <id>' }
+  }
   let mode = 'serve'
   let port = null
   let help = false
@@ -83,6 +100,8 @@ export function parseServeArgs(argv) {
   let autostart = null
   let from = null
   let pair = null
+  let pairKey = null
+  let keyPaired = false
   let revoke = null
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]
@@ -90,6 +109,19 @@ export function parseServeArgs(argv) {
       const raw = a === '--pair' ? argv[++i] : a.slice('--pair='.length)
       if (typeof raw !== 'string' || !PAIR_LABEL_RE.test(raw)) return { error: `--pair needs a label: letters, digits, ':', '.', '_' and '-' (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
       pair = raw
+    } else if (a === '--pair-key') {
+      /*
+       * `--pair-key <label> <public key>` (#1711, docs/plans/key-pairing.md §4.2): a hub's key pairing, at each link in
+       * place of `--pair`. The key is checked as the host checks it (§4.1): a refused one writes nothing
+       */
+      const label = argv[++i]
+      const publicKey = argv[++i]
+      if (typeof label !== 'string' || !PAIR_LABEL_RE.test(label)) return { error: `--pair-key needs a label: letters, digits, ':', '.', '_' and '-' (got ${label === undefined ? 'nothing' : JSON.stringify(label)})` }
+      if (!parseLinkPublicKey(publicKey)) return { error: `--pair-key needs an Ed25519 public key after the label, as 43 characters of base64url (got ${publicKey === undefined ? 'nothing' : JSON.stringify(String(publicKey).slice(0, 64))})` }
+      pairKey = { label, publicKey }
+    } else if (a === '--key-paired') {
+      // The hub has paired by key with this machine before (#1711, §4.2): a key line removes the label's verifier entry
+      keyPaired = true
     } else if (a === '--revoke' || a.startsWith('--revoke=')) {
       const raw = a === '--revoke' ? argv[++i] : a.slice('--revoke='.length)
       if (typeof raw !== 'string' || !CREDENTIAL_ID_RE.test(raw)) return { error: `--revoke needs a credential's id, as --connection lists it (got ${raw === undefined ? 'nothing' : JSON.stringify(raw)})` }
@@ -121,6 +153,9 @@ export function parseServeArgs(argv) {
   }
   if (help) return { mode: 'help', port }
   if (pair !== null && mode !== 'connection') return { error: '--pair goes with --connection' }
+  if (pairKey !== null && mode !== 'connection') return { error: '--pair-key goes with --connection' }
+  if (pair !== null && pairKey !== null) return { error: '--pair and --pair-key are two ways of pairing; pass one' }
+  if (keyPaired && pairKey === null) return { error: '--key-paired goes with --pair-key' }
   if (mode === 'revoke') return port !== null ? { error: '--revoke takes no --port' } : { mode, port, revoke }
   if (from !== null && mode !== 'serve' && mode !== 'detach') return { error: `--from goes with \`centralu serve\` and --detach, which start a host; not with ${FLAG_OF[mode]}` }
   if (child !== null) {
@@ -136,7 +171,7 @@ export function parseServeArgs(argv) {
     if (port !== null) return { error: '--autostart takes no --port: the entry it writes starts serve on the port serve recorded' }
     return { mode, port, autostart }
   }
-  return { mode, port, ...(from !== null ? { from } : {}), ...(pair !== null ? { pair } : {}) }
+  return { mode, port, ...(from !== null ? { from } : {}), ...(pair !== null ? { pair } : {}), ...(pairKey !== null ? { pairKey, keyPaired } : {}) }
 }
 
 function parsePort(raw) {

package/bin/serve-autostart.mjs

@@ -384,10 +384,10 @@ async function systemdAutostart(action, { dataDir, env, home, name, run, user })
   return { ...base, on: true, linger, ...(linger === true ? {} : { message: lingerMessage(user) }) }
 }
 
-async function taskAutostart(action, { dataDir, env, home, name, run, user, platform, interop }) {
+async function taskAutostart(action, { dataDir, env, home, name, run, user, platform, interop, mounts }) {
   const legacy = legacyTaskName({ dataDir, home, env, platform })
   const detach = detachHow(platform, env, interop)
-  const ps = windowsPowershell(detach, env)
+  const ps = windowsPowershell(detach, env, mounts)
   const base = { ok: true, how: 'task', linger: null }
   if (!ps) return { ...base, ok: false, on: false, message: 'Windows PowerShell is not reachable from this WSL distro' }
   const ask = (script) => askPowershell(ps, script, env, parseTaskAnswer, run)
@@ -456,8 +456,8 @@ export async function startInSignIn({ dataDir, env, home, platform = process.pla
  * hub asks (the link started it), and the entry is for the next boot.
  *
  * stdout: one line, `{ v: 1, autostart: { ok, on, how, linger, message? } }`; `how` null where this
- * machine offers nothing (`autostartHow`). `run` (a command runner) and `how` are parameters so
- * tests never reach the real systemd or Task Scheduler.
+ * machine offers nothing (`autostartHow`). `run` (a command runner), `how` and `mounts` (what /proc/mounts says, where WSL finds
+ * the Windows drive) are parameters so tests never reach the real systemd or Task Scheduler, nor depend on the drives of the machine.
  */
 export async function runAutostart({
   env,
@@ -467,6 +467,7 @@ export async function runAutostart({
   platform = process.platform,
   interop = wslInterop,
   how = autostartHow(platform, env, { interop }),
+  mounts = undefined,
   run = runCaptured,
   user = userInfo().username,
   write = (line) => process.stdout.write(line),
@@ -481,7 +482,7 @@ export async function runAutostart({
   }
   try {
     const name = autostartName(how, { dataDir, home, env, platform, user })
-    const opts = { dataDir, env, home, name, run, user, platform, interop }
+    const opts = { dataDir, env, home, name, run, user, platform, interop, mounts }
     return report(how === 'systemd' ? await systemdAutostart(action, opts) : await taskAutostart(action, opts))
   } catch (e) {
     return report({ ok: false, on: readAutostartMark(dataDir)?.how === how, how, linger: null, message: e?.message ?? String(e) })

package/bin/serve-detach.mjs

@@ -8,7 +8,7 @@ import { userInfo } from 'node:os'
 import { join } from 'node:path'
 import { answerLine, isAlive, say, sayTo, runCaptured, tail, sleep } from './serve-util.mjs'
 import { SERVE_LOG_FILE, serveDataDir, ensureServeState, markStopped, rotateServeLog } from './serve-files.mjs'
-import { askPowershell, detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell, windowsTool, wslDistro, wslUser } from './serve-windows.mjs'
+import { askPowershell, detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, windowsPowershell, windowsTool, wslCommandLine } from './serve-windows.mjs'
 import { CHILD_FLAG } from './serve-args.mjs'
 import { startInSignIn } from './serve-autostart.mjs'
 import { stopServedHost } from './serve-handover.mjs'
@@ -72,11 +72,7 @@ export async function startDetached({ how, execPath, args, env, cwd }) {
   let commandLine
   try {
     if (how === 'wmi') commandLine = [execPath, ...args].map(windowsArg).join(' ')
-    else {
-      const distro = wslDistro(env.WSL_DISTRO_NAME ?? '')
-      const user = wslUser(userInfo().username)
-      commandLine = ['wsl.exe', '-d', distro, '-u', user, '--cd', cwd, '--exec', execPath, ...args].map(windowsArg).join(' ')
-    }
+    else commandLine = wslCommandLine({ distro: env.WSL_DISTRO_NAME ?? '', user: userInfo().username, cwd, execPath, args })
   } catch (e) {
     return { ok: false, blocked: false, message: e.message }
   }

package/bin/serve-files.mjs

@@ -9,6 +9,8 @@ import { chmodSync, existsSync, linkSync, mkdirSync, openSync, readFileSync, ren
 import { join } from 'node:path'
 import { isAlive, renameRetrying, replaceFile, sleepSync } from './serve-util.mjs'
 import { CREDENTIAL_ID_RE, PAIR_LABEL_RE } from './serve-args.mjs'
+import { parseLinkPublicKey } from './serve-keys.mjs'
+import { windowsPowershell } from './serve-windows.mjs'
 
 /**
  * The file in the data folder that holds the host's key, the full credentials' verifiers and the port, mode 0600.
@@ -22,13 +24,15 @@ import { CREDENTIAL_ID_RE, PAIR_LABEL_RE } from './serve-args.mjs'
  *   credential. The credential itself is printed once, to whoever asked for it (`--pair`: a hub at each link,
  *   `--window` for the person's own window, which the desktop app runs on Windows and which runs on every OS), and written nowhere. The host checks a hello against these,
  *   read again at each hello, so a pairing or a revocation applies at once.
- * - `legacyHostToken`: only while the installed host is from before verifiers (a rollback): the one token such a
- *   host knows, given to it and to the hub that pairs, as before #1405.
+ * - `keys` (#1711, docs/plans/key-pairing.md §4.2, additive: still version 2): one entry per hub that paired by key,
+ *   `{ id, label, publicKey, created, via: 'pair-key' }`, the hub's Ed25519 public key. Public: nothing in it opens the
+ *   host. A host from before key pairing ignores it, and a launcher from before drops it at its next write.
  *
  * The port is the one the last `serve` actually listened on, which is how `--connection`, a separate process, learns a
  * `--port` given to `serve` in a systemd unit. A version 1 file (`{ token, port }`) is moved to version 2 on first
  * use: its token becomes a full credential labelled `legacy` (a hub or window still holding it keeps working), which the
- * next pairing removes.
+ * next pairing removes. This is the update path for a machine below `MIN_SUPPORTED_VERSION` (#1143): version 2 first
+ * shipped in 0.1.0-beta.45, so the hub's update of an older machine (`serve --detach`) and `npm i -g` run on a version 1 file.
  */
 export const SERVE_STATE_FILE = 'serve.json'
 
@@ -154,16 +158,18 @@ function parseServeState(raw) {
   try {
     const v = JSON.parse(raw)
     const port = Number.isInteger(v?.port) && v.port >= 1 && v.port <= 65535 ? v.port : null
-    if (v?.v === 2) {
-      if (typeof v.key !== 'string' || v.key.length < 32) return null
-      // Exactly what the host takes (serve-credentials.ts `isListedEntry`): an entry of another shape is dropped here, so
-      // the next write leaves it out too, and the host refuses it meanwhile
-      const full = (Array.isArray(v.full) ? v.full : []).filter((e) => isListedEntry(e)).map((e) => ({ id: e.id, label: e.label, verifier: e.verifier, created: Number.isFinite(e.created) ? e.created : 0, ...(PAIRED_VIA.includes(e.via) ? { via: e.via } : {}), ...(e.replaced === true ? { replaced: true } : {}) }))
-      const legacyHostToken = typeof v.legacyHostToken === 'string' && v.legacyHostToken.length >= 32 ? v.legacyHostToken : null
-      return { v: 2, key: v.key, port, full, legacyHostToken, token: limitedOf(v.key), proofKey: v.key }
+    if (v?.v !== 2) {
+      // A version 1 file, moved by `ensureServeState`: the update path from below the minimum (#1143)
+      if (typeof v?.token !== 'string' || v.token.length < 32) return null
+      return { v: 1, token: v.token, proofKey: v.token, port, key: null, full: [], keys: [] }
     }
-    if (typeof v?.token !== 'string' || v.token.length < 32) return null
-    return { v: 1, token: v.token, proofKey: v.token, port, key: null, full: [], legacyHostToken: null }
+    if (typeof v.key !== 'string' || v.key.length < 32) return null
+    // Exactly what the host takes (serve-credentials.ts `isListedEntry`): an entry of another shape is dropped here, so
+    // the next write leaves it out too, and the host refuses it meanwhile
+    const full = (Array.isArray(v.full) ? v.full : []).filter((e) => isListedEntry(e)).map((e) => ({ id: e.id, label: e.label, verifier: e.verifier, created: Number.isFinite(e.created) ? e.created : 0, ...(PAIRED_VIA.includes(e.via) ? { via: e.via } : {}), ...(e.replaced === true ? { replaced: true } : {}) }))
+    // The same for the hubs' key entries (#1711): one with a key the host refuses (§4.1) is dropped at the next write
+    const keys = (Array.isArray(v.keys) ? v.keys : []).filter((e) => isKeyEntry(e)).map((e) => ({ id: e.id, label: e.label, publicKey: e.publicKey, created: Number.isFinite(e.created) ? e.created : 0, via: 'pair-key', ...(e.replaced === true ? { replaced: true } : {}) }))
+    return { v: 2, key: v.key, port, full, keys, token: limitedOf(v.key), proofKey: v.key }
   } catch {
     return null
   }
@@ -174,9 +180,14 @@ export function isListedEntry(e) {
   return typeof e?.id === 'string' && CREDENTIAL_ID_RE.test(e.id) && typeof e.label === 'string' && PAIR_LABEL_RE.test(e.label) && typeof e.verifier === 'string' && /^[0-9a-f]{64}$/.test(e.verifier)
 }
 
-/** What version 2 writes for a state */
+/** A hub's key entry the launcher lists, `--revoke` takes and the host accepts (#1711): an 8-hex id, a label `--pair` takes, a public key the host takes (§4.1) */
+export function isKeyEntry(e) {
+  return typeof e?.id === 'string' && CREDENTIAL_ID_RE.test(e.id) && typeof e.label === 'string' && PAIR_LABEL_RE.test(e.label) && parseLinkPublicKey(e.publicKey) !== null
+}
+
+/** What version 2 writes for a state; `keys` only when there are any, so a folder no hub paired by key keeps today's file */
 function stateFile(state) {
-  return { v: 2, key: state.key, port: state.port, full: state.full, ...(state.legacyHostToken ? { legacyHostToken: state.legacyHostToken } : {}) }
+  return { v: 2, key: state.key, port: state.port, full: state.full, ...(state.keys?.length ? { keys: state.keys } : {}) }
 }
 
 /** A new full credential and its id */
@@ -204,11 +215,12 @@ export function ensureServeState(dataDir, platform = process.platform, now = Dat
   }
   let state = readServeState(dataDir)
   if (!state) throw noState(file)
-  // A version 1 file (#1405): its token becomes a full credential no longer written down, and a new key is drawn
+  // A version 1 file (#1405): its token becomes a full credential no longer written down, and a new key is drawn. Kept as
+  // the update path for a machine below `MIN_SUPPORTED_VERSION` (#1143), whose launcher wrote version 1
   if (state.v === 1) {
     state = changeServeState(dataDir, (s) =>
       s.v === 1
-        ? { v: 2, key: randomBytes(32).toString('base64url'), port: s.port, full: [{ id: randomBytes(4).toString('hex'), label: LEGACY_LABEL, verifier: verifierOf(s.token), created: now }], legacyHostToken: null }
+        ? { v: 2, key: randomBytes(32).toString('base64url'), port: s.port, full: [{ id: randomBytes(4).toString('hex'), label: LEGACY_LABEL, verifier: verifierOf(s.token), created: now }], keys: [] }
         : s,
       platform,
     )
@@ -421,30 +433,58 @@ function takesLegacyPlace(label) {
   return label === 'window' || label.startsWith('hub:')
 }
 
-/** Removes the full credential `id`; true when there was one. A hello with it is refused from then on */
-export function revokeServe(dataDir, id, platform = process.platform) {
-  let found = false
-  changeServeState(dataDir, (s) => {
-    found = s.full.some((e) => e.id === id)
-    return found ? { ...s, full: s.full.filter((e) => e.id !== id) } : s
+/**
+ * The key entry for `label` with `publicKey` (#1711, docs/plans/key-pairing.md §4.2): `--pair-key`'s write. At most one
+ * key entry per label. The same key under the same label keeps its entry and id; another key under it is a new entry
+ * with a new id, marked `replaced`, and the old key entry goes, so a socket in under the old key is closed by the sweep
+ * (which compares id and key). The label's verifier entry is never touched here. Returns `{ entry, state }`.
+ */
+export function pairKeyServe(dataDir, label, publicKey, platform = process.platform, now = Date.now()) {
+  if (!parseLinkPublicKey(publicKey)) throw new Error('A refused public key is never written')
+  ensureServeState(dataDir, platform)
+  let entry = null
+  const state = changeServeState(dataDir, (s) => {
+    const before = s.keys.find((k) => k.label === label)
+    /*
+     * The host takes the first key entry of an id (#1717 review, L2), so one written by hand ahead of the hub's, with its id
+     * and another key, keeps the hub from linking. Such an id is not kept: the entry gets a fresh one, which the line reports.
+     * The same for an id a verifier entry has (#1717 recheck, F1): the host takes no key entry of such an id
+     */
+    const shared = before !== undefined && (s.keys.some((k) => k !== before && k.id === before.id) || s.full.some((e) => e.id === before.id))
+    if (before && before.publicKey === publicKey && !shared) {
+      entry = before
+      return s
+    }
+    entry = { id: freshId(s), label, publicKey, created: now, via: 'pair-key', ...(before ? { replaced: true } : {}) }
+    return { ...s, keys: [...s.keys.filter((k) => k.label !== label), entry] }
   }, platform)
-  return found
+  return { entry, state }
+}
+
+/** An entry id no full credential and no key entry of `state` has: a `--revoke <id>` names one entry */
+function freshId(state) {
+  for (;;) {
+    const id = randomBytes(4).toString('hex')
+    if (!state.full.some((e) => e.id === id) && !state.keys.some((k) => k.id === id)) return id
+  }
 }
 
 /**
- * The one token an installed host from before verifiers knows (a rollback): kept in the state while such a host is
- * installed, given to it and to a hub that pairs. Created once; returns it.
+ * Removes the verifier entry under `label` (#1711, `--key-paired`): the hub paired by key with this machine before and
+ * now has a key line, so the verifier entry it made under its label is no longer its own. Returns the state written.
  */
-export function legacyHostTokenOf(dataDir, platform = process.platform) {
-  const state = ensureServeState(dataDir, platform)
-  if (state.legacyHostToken) return state.legacyHostToken
-  const token = randomBytes(32).toString('base64url')
-  return changeServeState(dataDir, (s) => (s.legacyHostToken ? s : { ...s, legacyHostToken: token }), platform).legacyHostToken
+export function dropVerifierUnder(dataDir, label, platform = process.platform) {
+  return changeServeState(dataDir, (s) => (s.full.some((e) => e.label === label) ? { ...s, full: s.full.filter((e) => e.label !== label) } : s), platform)
 }
 
-/** A host of today runs: the token kept for an older one is not kept any longer */
-export function dropLegacyHostToken(dataDir, platform = process.platform) {
-  changeServeState(dataDir, (s) => (s.legacyHostToken ? { ...s, legacyHostToken: null } : s), platform)
+/** Removes the full credential or the key entry `id`; true when there was one. A hello with it is refused from then on */
+export function revokeServe(dataDir, id, platform = process.platform) {
+  let found = false
+  changeServeState(dataDir, (s) => {
+    found = s.full.some((e) => e.id === id) || s.keys.some((k) => k.id === id)
+    return found ? { ...s, full: s.full.filter((e) => e.id !== id), keys: s.keys.filter((k) => k.id !== id) } : s
+  }, platform)
+  return found
 }
 
 /** Writes the port `serve` listened on, keeping the rest. Atomic: a temp file renamed over it */
@@ -453,13 +493,13 @@ export function recordServePort(dataDir, port, platform = process.platform) {
 }
 
 /**
- * A new key, and no full credential, keeping the port. Only when the person asks (`--rotate-token`): every hub pairs
- * again at its next link, the window at its next start, and a serve already running keeps its old key (what it hands
- * out) until it restarts, while the full credentials end at once.
+ * A new key, and no full credential and no key entry, keeping the port. Only when the person asks (`--rotate-token`):
+ * every hub pairs again at its next link, the window at its next start, and a serve already running keeps its old key
+ * (what it hands out, and what it signs with, #1711 §7) until it restarts, while the full credentials end at once.
  */
 export function rotateServeToken(dataDir, platform = process.platform) {
   ensureServeState(dataDir, platform)
-  return changeServeState(dataDir, (s) => ({ ...s, key: randomBytes(32).toString('base64url'), full: [], legacyHostToken: null }), platform)
+  return changeServeState(dataDir, (s) => ({ ...s, key: randomBytes(32).toString('base64url'), full: [], keys: [] }), platform)
 }
 
 /**
@@ -511,45 +551,86 @@ export function removeServePid(dataDir, pid) {
 }
 
 /**
- * A probe that did not prove the token, while this data folder's host is alive (`host.lock`): a host from before #838
- * still running after an update. It is running, and is not sent the token; a hub asking it for a proof is refused
- * until it restarts. Without a live lock holder, what answered is not ours.
+ * A probe that did not prove the token, while this data folder's `serve` is alive (`host.lock`): a host still on its old
+ * key after `--rotate-token`. It is running, and is not sent the token; a hub asking it for a proof is refused until it
+ * restarts. Without a live lock holder that `serve` started (`startedByServe`), what answered is not ours: a live holder
+ * the app or the keeper started owns the folder, and whatever sits on the recorded port (a hub's ssh forward, #1722) is
+ * not that holder.
+ *
+ * `portRecorded`: serve.json names the port the probe went to (`state.port != null`). A folder that has none was probed
+ * on the default port, where whatever listens is as likely another host's (a hub's ssh forward to a linked machine's serve
+ * lands there): an unproven answer from it says nothing about this folder, whoever holds the lock.
  */
-export function heldHere(probe, dataDir, startOf = processStartTime) {
+export function heldHere(probe, dataDir, startOf = processStartTime, portRecorded = true) {
   if (probe.running) return true
-  if (!probe.unproven) return false
-  return lockHolderIsAlive(dataDir, startOf)
+  if (!probe.unproven || !portRecorded) return false
+  return lockHolderIsAlive(dataDir, startOf) && startedByServe(dataDir)
+}
+
+/**
+ * Whether the process `host.lock` names is a host `centralu serve` started (#1722): what lets the launcher signal it.
+ * The lock says so itself (`by: 'serve'`, #1223); a lock that names another starter (`app`, `keeper`), or none (a host
+ * started by hand), is not serve's.
+ */
+export function startedByServe(dataDir) {
+  return lockHolder(dataDir)?.by === 'serve'
+}
+
+/** Who `by` in host.lock says started the host, as a phrase (#1223); an absent `by` is most likely the app */
+export function holderWho(by) {
+  return { app: 'the Centralu window on this machine', keeper: "Centralu's keeper on this machine", serve: 'another centralu serve' }[by] ?? 'probably the Centralu app on this machine'
+}
+
+/**
+ * The live process that holds this folder's lock and that `centralu serve` did not start, `{ pid, started, by? }`, or
+ * null (#1722): `--stop` names it rather than signal it. Only named, so a pid that is alive is enough (no start time:
+ * Windows has none), as for the message `serve` itself prints when the lock stops its host.
+ */
+export function foreignHolder(dataDir) {
+  const holder = lockHolder(dataDir)
+  return holder && isAlive(holder.pid) && !startedByServe(dataDir) ? holder : null
 }
 
 /**
  * Whether the process `host.lock` names is the one that wrote it (#838 review): alive, and started when the lock says
  * (`ps -o lstart`, as the host writes it, `instance-lock.ts`). A lock left by a host that died, whose pid another
  * process of the same user now has, names a stranger: counted as running, `--stop` would signal it. A lock without a
- * start time (a host from before #184) or a system without `ps` (Windows) cannot be told apart, so it does not count.
+ * start time and no `at` (its host found no `ps`) cannot be told apart, so it does not count. Windows has no `ps` and its
+ * host records no start time (#1723), only `at`, when it took the folder: the process that wrote the lock was created by
+ * then, and one given its number afterwards was created later. Both times come from one clock and the host writes `at`
+ * 17 ms or more after its process was created, so the slack is one clock tick, for the two readings of it. An `at` in the
+ * future (a clock set back since) proves nothing.
  */
-export function lockHolderIsAlive(dataDir, startOf = processStartTime) {
-  let holder
-  try {
-    holder = parseLockHolder(readFileSync(join(dataDir, 'host.lock'), 'utf8'))
-  } catch {
-    return false
-  }
-  if (!holder || !holder.started || !isAlive(holder.pid)) return false
-  return startOf(holder.pid) === holder.started
+export function lockHolderIsAlive(dataDir, startOf = processStartTime, createdAt = processCreatedAt) {
+  return isWriter(lockHolder(dataDir), startOf, createdAt) === true
 }
 
 /**
- * host.lock's `{ pid, started, by? }`; a bare pid (an older host) has no start time. `by` (#1223, additive) is who
- * started the host: `app`, `keeper` or `serve` (`instance-lock.ts`), absent when the host did not say
+ * Whether `{ pid, started, at }` names the live process that wrote it, by `lockHolderIsAlive`'s rule: true, false, or
+ * null when it lives and Windows cannot say when it was created (another logon's process); each caller decides what
+ * that counts as
+ */
+export function isWriter(holder, startOf = processStartTime, createdAt = processCreatedAt) {
+  if (!holder || !isAlive(holder.pid)) return false
+  if (holder.started) return startOf(holder.pid) === holder.started
+  if (holder.at === undefined || holder.at > Date.now()) return false
+  const created = createdAt(holder.pid)
+  return created === null ? null : created <= holder.at + CLOCK_TICK_MS
+}
+
+/** One tick of the Windows clock */
+const CLOCK_TICK_MS = 16
+
+/**
+ * host.lock's `{ pid, started, by? }`. `by` (#1223, additive) is who started the host: `app`, `keeper` or `serve`
+ * (`instance-lock.ts`), absent when the host did not say
  */
 function parseLockHolder(text) {
-  const t = text.trim()
-  if (/^\d+$/.test(t)) return Number(t) > 0 ? { pid: Number(t), started: null } : null
   try {
-    const v = JSON.parse(t)
+    const v = JSON.parse(text)
     if (!Number.isInteger(v?.pid) || v.pid <= 0) return null
     const by = v.by === 'app' || v.by === 'keeper' || v.by === 'serve' ? v.by : null
-    return { pid: v.pid, started: typeof v.started === 'string' ? v.started : null, ...(by ? { by } : {}) }
+    return { pid: v.pid, started: typeof v.started === 'string' ? v.started : null, ...(Number.isFinite(v.at) ? { at: v.at } : {}), ...(by ? { by } : {}) }
   } catch {
     return null
   }
@@ -568,7 +649,24 @@ export function processStartTime(pid) {
   }
 }
 
-/** Who `host.lock` names as the data folder's owner, `{ pid, started, by? }`, or null */
+/**
+ * When a pid's process was created, as milliseconds since the epoch, on Windows (PowerShell); null elsewhere, or when
+ * it cannot be told (a process of another account). Asked of .NET, not `Get-Process`: that one loads a module, which
+ * under PowerShell 7's module path (a CI runner's, a pwsh terminal's) fails, and every lock held on Windows read as a
+ * dead one's (#1906)
+ */
+export function processCreatedAt(pid) {
+  if (process.platform !== 'win32') return null
+  try {
+    const out = execFileSync(windowsPowershell('wmi', process.env), ['-NoProfile', '-NonInteractive', '-Command', `([DateTimeOffset][Diagnostics.Process]::GetProcessById(${pid}).StartTime).ToUnixTimeMilliseconds()`], { encoding: 'utf8', timeout: 10_000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] })
+    const ms = Number(out.trim())
+    return Number.isFinite(ms) && ms > 0 ? ms : null
+  } catch {
+    return null
+  }
+}
+
+/** Who `host.lock` names as the data folder's owner, `{ pid, started, by?, at? }`, or null */
 export function lockHolder(dataDir) {
   try {
     return parseLockHolder(readFileSync(join(dataDir, 'host.lock'), 'utf8'))