@inoku/lepan 0.7.64 → 0.7.66

package/README.md

@@ -30,9 +30,11 @@ To upgrade an existing key-auth installation without changing its authorized dev
 npx --yes @inoku/lepan@latest --upgrade
 ```
 
-The installer reuses a running Leither node and finds its directory automatically. If none is running, Linux/macOS fresh setup first looks for Leither in the selected directory, the current directory, or on `PATH`; otherwise it uses `~/.local/share/lifedrive/leither`. Windows uses `%ProgramData%\LifeDrive\Leither` unless `--leither-root` selects another directory. It downloads the matching binary from the [official Leither distribution](http://vzhan.cn/#start.html), verifies its SHA-256 checksum, initializes local configuration and keys, installs boot startup, and waits for the managed process and local version endpoint before continuing. Existing executables, configuration, and keys are never replaced.
+The installer reuses a running Leither node and finds its directory automatically. If none is running, Linux/macOS fresh setup first looks for Leither in the selected directory, the current directory, or on `PATH`; otherwise it uses `~/.local/share/leither`. Windows uses `%ProgramData%\LifeDrive\Leither` unless `--leither-root` selects another directory. It downloads the matching binary from the [official Leither distribution](http://vzhan.cn/#start.html), verifies its SHA-256 checksum, initializes local configuration and keys, installs boot startup, and waits for the managed process and local version endpoint before continuing. Existing executables, configuration, and keys are never replaced.
 
-When the installer creates a new node, it shows the free space on the selected drive and asks how many whole decimal gigabytes Leither may use. The default is **100 GB**. This is a node-wide maximum covering LePan and every other application stored by that Leither node; it does not reserve or preallocate the space. The installer refuses a value larger than the space currently available and saves the choice before Leither first starts. For unattended setup, pass `--storage-max-gb GB` or set `LIFEDRIVE_STORAGE_MAX_GB`. Existing nodes and upgrades keep their current limit; change those from LePan Settings.
+Fresh Linux/macOS installations keep LePan application files in `<Leither root>/lepan` (by default `~/.local/share/leither/lepan`). This also applies to the macOS setup package. The folder contains `lifeDrive/` and `lifedrive-identity/`; compatibility links in the node root preserve the published app identity and service paths. Private node and household state stays in the node root. Existing installations retain their directories during upgrades.
+
+When the installer creates a new node, it shows the free space on the selected drive and asks how many whole decimal gigabytes Leither may use. The default is **100 GB**. This is a node-wide maximum covering LePan and every other application stored by that Leither node; it does not reserve or preallocate the space. The installer refuses a value larger than the space currently available and retains the choice before Leither first starts. On Linux/macOS, the first start creates the node key and datastore configuration; setup then applies the limit and restarts only that newly created, managed node before continuing. If setup is interrupted, rerunning fresh setup finishes the pending storage configuration. For unattended setup, pass `--storage-max-gb GB` or set `LIFEDRIVE_STORAGE_MAX_GB`. Existing nodes and upgrades keep their current limit; change those from LePan Settings.
 
 Choose another empty directory for a fresh node, select a stopped node, or select among multiple running instances:
 
@@ -84,7 +86,31 @@ The Linux/macOS legacy browser-owner setup uses the built-in AV1 registration en
 
 LifeDrive requires Leither V0.24.11 or newer. Linux/macOS browser-owner setup creates a separate Ed25519 `sodiumv2` identity for the primary browser. Windows prints a private ten-minute invitation for the first paired phone; later users and devices are managed from a paired device.
 
-After successful npm setup, the installer saves a private `lepan-pairing-<id>.png` and prints its full path. It also displays the QR code when the terminal is wide enough. In the iPhone or Android app, open **Settings → Set up users → Scan QR code** and scan the terminal or the saved image. The PNG is saved in the Leither root on Linux/macOS and its private `.lifedrive-household` directory on Windows. Household invitations expire ten minutes after creation; legacy identity codes contain a device private key, so keep them private and delete the image after pairing. Legacy `--add-device` and `--upgrade` also produce a code when an identity is available; household upgrades preserve existing pairings without issuing new invitations.
+After successful npm setup, the installer saves a private `lepan-pairing-<id>.png` and prints its full path. It also displays the QR code when it fits the terminal's width and height. In the iPhone or Android app, open **Settings → Set up users → Scan QR code** and scan the terminal or the saved image. A private `.json` invitation is saved alongside it for apps without a setup scanner: transfer that file to the phone and use **Choose identity file**. These files are saved in the Leither root on Linux/macOS and its private `.lifedrive-household` directory on Windows. Household invitations expire ten minutes after creation; legacy identity codes contain a device private key, so keep them private and delete the transfer copies after pairing. Legacy `--add-device` and `--upgrade` also produce a code when an identity is available; household upgrades preserve existing pairings without issuing new invitations.
+
+### Renew an expired first-phone invitation
+
+Run this again **on the computer running Leither**:
+
+```bash
+npx --yes @inoku/lepan@latest --household
+```
+
+If more than one node is running, also pass `--leither-root` with the same node
+directory used during installation. On Windows, use an administrator terminal.
+The macOS setup package also supports renewal when run again.
+
+Before the first owner has been created, setup replaces the previous invitation
+and produces a fresh QR image and import file with a new ten-minute expiry. It
+briefly stops only the managed account service while issuing the invitation,
+then starts it and verifies readiness before displaying the new code. If issuance
+fails, it attempts to restore the service. Leither keeps running; existing node
+keys and drive data are preserved.
+
+Setup never replaces an existing owner or an interrupted account claim. If users
+already exist, use **My devices** on a paired phone to invite another device. An
+interrupted first claim must be resumed on the original phone with its original
+invitation. Ordinary `--upgrade` does not renew invitations.
 
 An existing installation is backed up before replacement. The explicit `--upgrade` path requires the saved application and key-auth owner state before changing files, synchronizes the same published application MID, and does not rerun device or domain setup. This release intentionally does not migrate the earlier password-owner prototype. Application files are active only after Leither advances the application from `cur` to `last`; a publication timeout leaves the prior `last` version serving users.
 

package/USER_MANUAL.md

@@ -24,7 +24,7 @@ A LifeDrive node needs:
 | A startup manager | systemd on Linux, launchd on macOS, or Task Scheduler on Windows starts the node at boot and recovers it after crashes. |
 | The LifeDrive app on your phone | iPhone or Android. The first user is created from a phone. |
 
-LifeDrive never stops or restarts Leither. If more than one Leither node runs on
+Normal LifeDrive upgrades never stop or restart Leither. Linux/macOS fresh setup restarts only the node it just created to activate the selected storage limit. If more than one Leither node runs on
 the machine, the installer lists them and asks you to choose one with
 `--leither-root <directory>`.
 
@@ -53,7 +53,7 @@ The same command also remains available from an Administrator Windows Terminal f
 The installer finds an existing running Leither node. If none is running, it
 reuses Leither in the selected directory, current directory, or `PATH`, or
 downloads and verifies the official runtime for your machine. A new node is
-created in `~/.local/share/lifedrive/leither` on Linux/macOS or
+created in `~/.local/share/leither` on Linux/macOS or
 `%ProgramData%\LifeDrive\Leither` on Windows, initialized with its own private
 keys, and prepared for automatic boot startup. Before starting the service,
 setup shows the selected drive's available space and asks for the maximum space
@@ -64,6 +64,8 @@ service, waits for Leither's local version
 endpoint, verifies the LifeDrive archive, installs LifeDrive and runs terminal
 setup. Follow its prompts.
 
+Fresh Linux/macOS installations keep LePan application files in `<Leither root>/lepan` (by default `~/.local/share/leither/lepan`). This also applies to the macOS setup package. The folder contains `lifeDrive/` and `lifedrive-identity/`; compatibility links in the node root preserve the published app identity and service paths. Private node and household state stays in the node root. Existing installations retain their directories during upgrades.
+
 To choose another empty directory or start a stopped existing node:
 
 ```bash

package/bin/lifedrive.js

@@ -22,24 +22,59 @@ async function showPairingCode(resultPath) {
   }
   const directory = fs.readFileSync(`${resultPath}.directory`, "utf8");
   if (!path.isAbsolute(directory)) throw new Error("Invalid pairing image directory");
-  const QRCode = require("qrcode");
   const payload = JSON.stringify(pairing);
+  // Only encode fields consumed by the existing Android and iOS setup parsers.
+  // The node enforces expiry and returns account details after a successful claim.
+  // Keep the full invitation in the import file, and leave legacy identities intact.
+  // iOS still requires certificate_sha256 even when Leither transport uses a key.
+  const qrPayload = pairing.type === "lifedrive-node-setup"
+    ? JSON.stringify(Object.fromEntries([
+      "type", "version", "app_id", "node_id", "endpoint", "transport",
+      "transport_key", "certificate_sha256", "request_id", "secret",
+    ].filter(key => Object.hasOwn(pairing, key)).map(key => [key, pairing[key]])))
+    : payload;
+  const basename = path.join(directory, `lepan-pairing-${randomUUID()}`);
+  const imagePath = `${basename}.png`;
+  const identityPath = `${basename}.json`;
+  // Older mobile releases support importing this file but have no setup scanner.
+  // Keep a private copy even when QR generation succeeds.
+  fs.writeFileSync(identityPath, payload, { flag: "wx", mode: 0o600 });
   const options = { errorCorrectionLevel: "M", margin: 4, scale: 8 };
-  const png = await QRCode.toBuffer(payload, options);
-  // Unique names and exclusive creation avoid overwriting another device's
-  // code or following a pre-existing symlink. Keep this outside the app bundle.
-  const imagePath = path.join(directory, `lepan-pairing-${randomUUID()}.png`);
-  fs.writeFileSync(imagePath, png, { flag: "wx", mode: 0o600 });
-  process.stdout.write(`\nPair your phone: open LePan → Settings → Set up users → Scan QR code.\n`);
-  process.stdout.write(`Pairing image saved: ${imagePath}\n`);
-  process.stdout.write(pairing.type === "lifedrive-node-setup"
-    ? "Keep this code private. The invitation expires ten minutes after creation.\n"
-    : "This code contains your device private key. Keep it private and delete the image after pairing.\n");
+  const privacyNote = pairing.type === "lifedrive-node-setup"
+    ? "Keep it private. This invitation expires ten minutes after creation."
+    : "This contains your device private key. Keep it private and delete it after pairing.";
+  const renewalHint = pairing.type === "lifedrive-node-setup"
+    ? "\nInvitation expired? Run this again on the node:\n  npx --yes @inoku/lepan@latest --household\n"
+    : "";
+  let modules;
+  try {
+    const QRCode = require("qrcode");
+    const png = await QRCode.toBuffer(qrPayload, options);
+    modules = QRCode.create(qrPayload, options).modules;
+    // Unique names and exclusive creation avoid overwriting another device's
+    // code or following a pre-existing symlink. Keep this outside the app bundle.
+    fs.writeFileSync(imagePath, png, { flag: "wx", mode: 0o600 });
+  } catch {
+    // The child no longer prints secrets. Preserve an importable fallback
+    // before runInstaller removes the temporary handoff directory.
+    process.stderr.write("\nNext: pair your phone\n\nThe QR code could not be created. Use the saved pairing file instead.\n");
+    process.stderr.write(`  ${identityPath}\n\n`);
+    process.stderr.write("Transfer this file to your phone, then select it in LePan > Settings > Set up users > Choose identity file.\n");
+    process.stderr.write(`${privacyNote}\n`);
+    process.stderr.write(renewalHint);
+    return;
+  }
+  process.stdout.write("\nNext: pair your phone\n\n");
+  process.stdout.write("  1. Open LePan on your iPhone or Android phone.\n");
+  process.stdout.write("  2. Go to Settings > Set up users > Scan QR code.\n");
   // Small terminal codes use half-height blocks. If the terminal would wrap,
-  // direct the user to the full-resolution PNG instead of a broken code.
-  const modules = QRCode.create(payload, options).modules;
+  // or scroll the instructions out of view, use the full-resolution PNG.
   const width = modules.size + options.margin * 2;
-  if (process.stdout.isTTY && (!process.stdout.columns || process.stdout.columns > width)) {
+  const height = Math.ceil(width / 2);
+  const fitsTerminal = process.stdout.isTTY && process.stdout.columns > width &&
+    process.stdout.rows >= height + 26;
+  if (fitsTerminal) {
+    process.stdout.write("  3. Scan the code below.\n\n");
     // Explicit colors and a four-module quiet zone work on light/dark themes.
     const dark = (x, y) => x >= 0 && y >= 0 && x < modules.size && y < modules.size && modules.get(y, x);
     let terminal = "";
@@ -52,8 +87,15 @@ async function showPairingCode(resultPath) {
     }
     process.stdout.write(terminal);
   } else {
-    process.stdout.write("Open the saved PNG on this computer to scan it.\n");
+    process.stdout.write("  3. Open the saved QR image on this computer and scan it.\n");
   }
+  process.stdout.write(`\nQR image:\n  ${imagePath}\n\n${privacyNote}\n`);
+  process.stdout.write("\nNo Scan QR code button? Transfer this pairing file to your phone:\n");
+  process.stdout.write(`  ${identityPath}\n`);
+  process.stdout.write("Then open Settings > Set up users > Choose identity file.\n");
+  process.stdout.write("Keep the pairing file private; delete the transfer copy after import.\n");
+  process.stdout.write("Keep this computer on and connected while using LePan.\n");
+  process.stdout.write(renewalHint);
 }
 
 async function runInstaller(command, args) {
@@ -73,7 +115,7 @@ async function runInstaller(command, args) {
       try { await showPairingCode(resultPath); }
       catch {
         // Parser errors may contain identity text; never print them.
-        process.stderr.write("LePan is installed, but its pairing QR code could not be created. Use the identity file or invitation shown above.\n");
+        process.stderr.write("\nPhone pairing could not be prepared. Use your existing identity file, or create a new setup invitation from the node.\n");
       }
     }
   } finally {

package/dist/lifedrive-bundle.tar.gz

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/lifedrive-bundle.tar.gz
-size: 44090184 bytes
-sha256: d86c1bc223d01cb0ba01afcdc5a992ac11e5c5f33fb9196c8f8d0faa345638d1
+size: 44139710 bytes
+sha256: 134de0bb85330eb3192e837e5054074969a80cbb4eaa1ee0b7870e55b9a3b310

package/dist/lifedrive-bundle.tar.gz.sha256

@@ -1 +1 @@
-d86c1bc223d01cb0ba01afcdc5a992ac11e5c5f33fb9196c8f8d0faa345638d1  lifedrive-bundle.tar.gz
+134de0bb85330eb3192e837e5054074969a80cbb4eaa1ee0b7870e55b9a3b310  lifedrive-bundle.tar.gz

package/dist/lifedrive-install.ps1

@@ -27,7 +27,7 @@ Windows options:
   --no-install-leither      Require an already running Leither node.
   --leither-service         Configure Leither startup only.
   --upgrade                 Upgrade an existing Windows LePan installation.
-  --household               Accepted for parity; Windows uses household mode by default.
+  --household               Set up household users or renew an unclaimed setup invitation.
 
 Run Windows Terminal or PowerShell as Administrator. Windows setup supports
 native x64 Windows 10/11 and Windows Server; WSL and Git Bash are not required.
@@ -382,8 +382,8 @@ if ($Upgrade) {
     if (Test-Path -LiteralPath (Join-Path $root "lifeDrive.owner") -PathType Leaf) {
         throw "This node uses the legacy browser-owner setup, which Windows does not migrate automatically. Its files were left unchanged."
     }
-    if (Test-Path -LiteralPath $routes -PathType Leaf) {
-        throw "An initialized LePan household already exists. Rerun with --upgrade."
+    if ((Test-Path -LiteralPath $routes -PathType Leaf) -and -not $Household) {
+        throw "A LePan household already exists. Use --household for phone setup, or --upgrade for application updates."
     }
 }
 

package/dist/lifedrive-install.sh

@@ -28,7 +28,7 @@ Installer options:
   --storage-max-gb GB       Maximum disk space for a newly installed Leither node (default: 100 GB).
   --release-base URL        Alternate GitHub Release asset base URL.
   --upgrade                 Upgrade an existing LePan without changing device authorization.
-  --household              Prepare mobile household setup using the existing node address.
+  --household              Set up household users or renew an unclaimed setup invitation.
   --household-config FILE   Install mobile-led household setup using a private service configuration.
 
 Setup options are forwarded to lifeDrive-setup.sh. Common examples:
@@ -164,22 +164,22 @@ available_storage_gb() {
   LC_ALL=C df -Pk "$LEITHER_WORKDIR" 2>/dev/null | awk 'NR == 2 && $4 ~ /^[0-9]+$/ { print int(($4 * 1024) / 1000000000) }'
 }
 
-configure_new_node_storage() {
-  local available_gb selected_gb default_gb=100 config
-  config="$LEITHER_WORKDIR/ds/config"
-  [[ -f "$config" && ! -L "$config" ]] || {
-    echo "Leither initialization did not create a regular datastore configuration at $config." >&2
-    return 1
-  }
+choose_new_node_storage() {
+  local available_gb selected_gb default_gb=100
+  local pending="$LEITHER_WORKDIR/.lifedrive-storage-pending"
+  if [[ -z "$STORAGE_MAX_GB" && -s "$pending" ]]; then
+    STORAGE_MAX_GB=$(cat "$pending")
+    valid_storage_gb "$STORAGE_MAX_GB" || { echo "Invalid saved Leither storage choice." >&2; return 1; }
+  fi
   available_gb=$(available_storage_gb)
-  echo
-  echo "Choose the maximum hard-drive space Leither may use for LePan and any other data on this node."
+  printf '\nStorage\n'
+  echo "Set the disk space limit for this node (LePan and other Leither data)."
   if [[ "$available_gb" =~ ^[0-9]+$ ]]; then
-    echo "Available now on the selected drive: ${available_gb} GB."
+    echo "  Available: ${available_gb} GB"
   fi
   if [[ -n "$STORAGE_MAX_GB" ]]; then
     selected_gb="$STORAGE_MAX_GB"
-    echo "Leither storage limit: ${selected_gb} GB."
+    echo "  Selected limit: ${selected_gb} GB"
   elif [[ -t 0 ]]; then
     while true; do
       read -r -p "Maximum Leither storage in GB [$default_gb]: " selected_gb
@@ -203,7 +203,18 @@ configure_new_node_storage() {
     echo "Free space or rerun setup with --storage-max-gb set to a smaller value." >&2
     return 1
   fi
-  node - "$config" "${selected_gb}GB" <<'NODE'
+  STORAGE_MAX_GB="$selected_gb"
+  # Retain the choice if service startup fails or the installer is interrupted.
+  (umask 077; printf '%s\n' "$selected_gb" > "$pending")
+}
+
+configure_new_node_storage() {
+  local config="$LEITHER_WORKDIR/ds/config"
+  [[ -f "$config" && ! -L "$config" ]] || {
+    echo "Leither startup did not create a regular datastore configuration at $config." >&2
+    return 1
+  }
+  node - "$config" "${STORAGE_MAX_GB}GB" <<'NODE' || return 1
 const fs = require("node:fs"), path = require("node:path");
 const file = process.argv[2], desired = process.argv[3];
 const info = fs.lstatSync(file);
@@ -241,7 +252,6 @@ try {
   throw error;
 }
 NODE
-  echo "Leither storage limit saved as ${selected_gb} GB."
 }
 
 install_leither_binary() (
@@ -464,7 +474,8 @@ configure_macos_leither_firewall() {
     return 1
   }
 
-  echo "Allowing Leither through the macOS Application Firewall..."
+  printf '\nNetwork access\n'
+  echo "Allowing connections through the macOS firewall..."
   firewall_apps=$("$firewall" --listapps) || {
     echo "LePan setup could not read the macOS Application Firewall rules." >&2
     return 1
@@ -490,7 +501,7 @@ configure_macos_leither_firewall() {
     echo "The macOS Application Firewall still reports Leither as blocked." >&2
     return 1
   }
-  echo "macOS Application Firewall allows incoming connections to Leither."
+  echo "  Firewall access ready."
 
   block_all_state=$("$firewall" --getblockall 2>/dev/null || true)
   if [[ "$block_all_state" == *"enabled"* ]]; then
@@ -499,6 +510,77 @@ configure_macos_leither_firewall() {
   fi
 }
 
+wait_for_leither() {
+  local version="$1" port="$2" previous_pid="${3:-}" attempt response current_pid
+  for attempt in {1..30}; do
+    current_pid=$(leither_service_pid || true)
+    response=$(curl --noproxy '*' -fsS --max-time 2 "http://127.0.0.1:$port/getvar?name=ver" 2>/dev/null || true)
+    if [[ -z "$previous_pid" || "$current_pid" != "$previous_pid" ]] &&
+       leither_service_owns_process &&
+       node -e 'try { process.exit(JSON.parse(process.argv[1]).replace(/^V/, "") === process.argv[2] ? 0 : 1); } catch { process.exit(1); }' "$response" "$version"; then
+      return 0
+    fi
+    sleep 1
+  done
+  echo "Leither did not become ready. Its files and service were retained." >&2
+  echo "Linux: journalctl -u lifedrive-leither.service. macOS: $LEITHER_WORKDIR/leither-service.log." >&2
+  return 1
+}
+
+verify_new_node_storage() {
+  local report
+  report=$(cd "$LEITHER_WORKDIR" && ./Leither repo stat --json 2>/dev/null) || return 1
+  # Some Leither versions still return a text table with --json. Read only the
+  # numeric active limit; never print the complete node response.
+  printf '%s' "$report" | node -e '
+const fs = require("node:fs");
+try {
+  const source = fs.readFileSync(0, "utf8");
+  let value;
+  try {
+    const reply = JSON.parse(source), data = reply.data ?? reply;
+    value = data.StorageMax ?? data.storageMax;
+  } catch {
+    value = source.match(/^StorageMax:[ \t]*(\d+)[ \t]*$/m)?.[1];
+  }
+  if (value === undefined || BigInt(value) !== BigInt(process.argv[1]) * 1000000000n) process.exit(1);
+} catch { process.exit(1); }
+' "$STORAGE_MAX_GB"
+}
+
+finish_new_node_storage() {
+  local pending="$LEITHER_WORKDIR/.lifedrive-storage-pending" previous_pid version port
+  [[ -f "$pending" && ! -L "$pending" ]] || return 1
+  # A restart is permitted only for the new node this installer is still
+  # provisioning, never a normal upgrade or another manager's process.
+  (( ! UPGRADE_ONLY && ! MANAGEMENT_ONLY && INSTALL_LEITHER )) || {
+    echo "Finish the pending fresh installation before upgrading or managing devices." >&2; return 1;
+  }
+  [[ ! -s "$LEITHER_WORKDIR/lifeDrive.owner" && ! -s "$LEITHER_WORKDIR/lifeDrive.households.json" ]] || {
+    echo "Storage setup marker conflicts with an initialized LePan installation." >&2; return 1;
+  }
+  leither_service_owns_process || { echo "Pending storage setup belongs to a node outside the managed service." >&2; return 1; }
+  [[ -s "$LEITHER_WORKDIR/hostkey.cfg" ]] || { echo "Leither startup did not create its node key." >&2; return 1; }
+  choose_new_node_storage || return 1
+  configure_new_node_storage || return 1
+  version=$(leither_version "$LEITHER_WORKDIR") || return 1
+  port=$(node -e 'const fs=require("node:fs"),p=require("node:path"),r=process.argv[1];const f=["SystemVars.json","systemvars.json"].map(n=>p.join(r,n)).find(f=>fs.existsSync(f));const v=JSON.parse(fs.readFileSync(f)).ServicePort??4800;if(!Number.isInteger(v)||v<1||v>65535)process.exit(1);process.stdout.write(String(v));' "$LEITHER_WORKDIR") || return 1
+  previous_pid=$(leither_service_pid) || return 1
+  echo "Applying the storage limit (restarting the newly created node)..."
+  case "$(uname -s)" in
+    Linux) sudo systemctl restart lifedrive-leither.service || return 1 ;;
+    Darwin) sudo launchctl kickstart -k system/uk.inoku.leither || return 1 ;;
+    *) return 1 ;;
+  esac
+  wait_for_leither "$version" "$port" "$previous_pid" || return 1
+  verify_new_node_storage || {
+    echo "The new Leither process has not confirmed the selected storage limit. Rerun fresh setup to finish." >&2
+    return 1
+  }
+  rm -f -- "$pending" || return 1
+  echo "  Storage ready: ${STORAGE_MAX_GB} GB limit."
+}
+
 bootstrap_leither() {
   if (( ! INSTALL_LEITHER || UPGRADE_ONLY || MANAGEMENT_ONLY )); then
     echo "LePan setup requires a running Leither node for this operation." >&2
@@ -513,7 +595,7 @@ bootstrap_leither() {
       LEITHER_WORKDIR=$(node -e 'const fs=require("node:fs"), path=require("node:path"); process.stdout.write(path.dirname(fs.realpathSync(process.argv[1])));' "$(command -v Leither)")
     else
       [[ "${HOME:-}" == /* ]] || { echo "Set --leither-root to an absolute installation directory." >&2; exit 1; }
-      LEITHER_WORKDIR="$HOME/.local/share/lifedrive/leither"
+      LEITHER_WORKDIR="$HOME/.local/share/leither"
     fi
   fi
   local new_node=0 node_version node_port storage_pending
@@ -533,7 +615,11 @@ bootstrap_leither() {
   # A failed quota choice or configuration write must be safely retryable. The
   # marker identifies only nodes this installer itself began creating; an
   # arbitrary stopped existing node is never treated as fresh.
-  if [[ -f "$storage_pending" && ! -L "$storage_pending" ]]; then new_node=1; fi
+  if [[ -L "$storage_pending" || ( -e "$storage_pending" && ! -f "$storage_pending" ) ]]; then
+    echo "Invalid Leither storage setup marker at $storage_pending." >&2
+    exit 1
+  fi
+  if [[ -f "$storage_pending" ]]; then new_node=1; fi
   # Validate the selected node's port and check availability before starting it.
   # The process and HTTP version are checked again after startup.
   node_port=$(node -e '
@@ -556,15 +642,17 @@ try {
       echo "Initializing the new private Leither node at $LEITHER_WORKDIR..."
       (umask 077; cd "$LEITHER_WORKDIR" && ./Leither init) || { echo "Leither initialization failed; its files were retained at $LEITHER_WORKDIR." >&2; exit 1; }
     fi
-    if [[ ! -s "$LEITHER_WORKDIR/SystemVars.json" || ! -s "$LEITHER_WORKDIR/hostkey.cfg" ]]; then
-      echo "Leither initialization did not create its configuration and node key. Inspect $LEITHER_WORKDIR before retrying." >&2
+    if [[ ! -s "$LEITHER_WORKDIR/SystemVars.json" && ! -s "$LEITHER_WORKDIR/systemvars.json" ]]; then
+      echo "Leither initialization did not create its settings. Inspect $LEITHER_WORKDIR before retrying." >&2
       exit 1
     fi
-    configure_new_node_storage || {
-      echo "Leither storage setup failed; the initialized node was retained but not started." >&2
-      exit 1
-    }
-    rm -f -- "$storage_pending" || { echo "Could not finish the new-node storage configuration." >&2; exit 1; }
+    choose_new_node_storage || exit 1
+    # init creates only SystemVars. The first run creates the node key and
+    # datastore; a stopped retry may already have that datastore available.
+    if [[ -e "$LEITHER_WORKDIR/ds/config" ]]; then
+      configure_new_node_storage || exit 1
+      rm -f -- "$storage_pending"
+    fi
   elif [[ -n "$STORAGE_MAX_GB" ]]; then
     echo "--storage-max-gb is only valid when this installer creates a new Leither node." >&2
     echo "Change an existing node's limit from LePan Settings instead." >&2
@@ -574,20 +662,7 @@ try {
   echo "Installing the Leither system service at $LEITHER_WORKDIR..."
   configure_leither_service stopped
   LEITHER_SERVICE_BOOTSTRAPPED=1
-  local ready=0 attempt response
-  for attempt in {1..30}; do
-    response=$(curl --noproxy '*' -fsS --max-time 2 "http://127.0.0.1:$node_port/getvar?name=ver" 2>/dev/null || true)
-    if leither_service_owns_process && node -e 'try { process.exit(JSON.parse(process.argv[1]).replace(/^V/, "") === process.argv[2] ? 0 : 1); } catch { process.exit(1); }' "$response" "$node_version"; then
-      ready=1
-      break
-    fi
-    sleep 1
-  done
-  if (( ! ready )); then
-    echo "Leither did not become ready. Its files and service were retained." >&2
-    echo "Linux: journalctl -u lifedrive-leither.service. macOS: $LEITHER_WORKDIR/leither-service.log." >&2
-    exit 1
-  fi
+  wait_for_leither "$node_version" "$node_port" || exit 1
   echo "Leither V$node_version is ready on port $node_port. Continuing LePan installation."
 }
 
@@ -596,12 +671,6 @@ if [[ -z "$running_pids" ]]; then
   bootstrap_leither
   running_pids=$(find_leither_pids)
 fi
-if [[ -n "$STORAGE_MAX_GB" ]] && (( ! LEITHER_SERVICE_BOOTSTRAPPED )); then
-  echo "--storage-max-gb is only valid when this installer creates a new Leither node." >&2
-  echo "Change an existing node's limit from LePan Settings instead." >&2
-  exit 2
-fi
-
 running_roots=()
 while IFS= read -r leither_pid; do
   [[ "$leither_pid" =~ ^[0-9]+$ ]] || continue
@@ -684,6 +753,19 @@ fi
 echo "Found running Leither service at $LEITHER_WORKDIR"
 leither_version "$LEITHER_WORKDIR" >/dev/null || exit 1
 
+storage_pending="$LEITHER_WORKDIR/.lifedrive-storage-pending"
+if [[ -L "$storage_pending" ]]; then
+  echo "LePan installation stopped: the storage setup marker must not be a symbolic link." >&2
+  exit 1
+fi
+if [[ -f "$storage_pending" ]]; then
+  finish_new_node_storage || exit 1
+elif [[ -n "$STORAGE_MAX_GB" ]] && (( ! LEITHER_SERVICE_BOOTSTRAPPED )); then
+  echo "--storage-max-gb is only valid when this installer creates a new Leither node." >&2
+  echo "Change an existing node's limit from LePan Settings instead." >&2
+  exit 2
+fi
+
 if (( LEITHER_SERVICE_ONLY )); then
   if (( ! LEITHER_SERVICE_BOOTSTRAPPED )); then configure_leither_service running; fi
   configure_macos_leither_firewall
@@ -719,6 +801,7 @@ cleanup() {
 }
 trap cleanup EXIT HUP INT TERM
 
+printf '\nInstall LePan\n'
 if [[ "$RELEASE_BASE" == file://* ]]; then
   echo "Loading the LePan release included with the npm package..."
 else
@@ -759,14 +842,60 @@ if (( MANAGEMENT_ONLY )); then
   exit 0
 fi
 
+# Existing installations keep their paths (including publisher and service
+# configuration). Fresh installs group application payloads under lepan while
+# retaining the application name used to derive its published identity.
+lepan_dir="$LEITHER_WORKDIR/lepan"
+if [[ ! -d "$LEITHER_WORKDIR/lifeDrive" || -L "$LEITHER_WORKDIR/lifeDrive" ]]; then
+  if [[ -L "$lepan_dir" || ( -e "$lepan_dir" && ! -d "$lepan_dir" ) ]]; then
+    echo "LePan installation stopped: $lepan_dir must be a regular directory." >&2
+    exit 1
+  fi
+  if [[ -L "$lepan_dir/.installer-layout-v1" || ( -e "$lepan_dir/.installer-layout-v1" && ! -f "$lepan_dir/.installer-layout-v1" ) ]]; then
+    echo "LePan installation stopped: invalid layout marker in $lepan_dir." >&2
+    exit 1
+  fi
+  if [[ -d "$lepan_dir" && ! -f "$lepan_dir/.installer-layout-v1" && -n "$(ls -A "$lepan_dir")" ]]; then
+    echo "LePan installation stopped: $lepan_dir contains files from an unknown installation." >&2
+    exit 1
+  fi
+  # Stable links keep existing version readers and identity-service paths valid.
+  # Refuse conflicting files or links before changing either payload.
+  for payload_name in lifeDrive lifedrive-identity; do
+    legacy_path="$LEITHER_WORKDIR/$payload_name"
+    payload_path="$lepan_dir/$payload_name"
+    if [[ -L "$payload_path" || ( -e "$payload_path" && ! -d "$payload_path" ) ]]; then
+      echo "LePan installation stopped: unexpected payload at $payload_path." >&2
+      exit 1
+    fi
+    if [[ -L "$legacy_path" ]]; then
+      if [[ "$(readlink "$legacy_path")" != "lepan/$payload_name" ]]; then
+        echo "LePan installation stopped: $legacy_path points outside the managed LePan layout." >&2
+        exit 1
+      fi
+    elif [[ -e "$legacy_path" ]]; then
+      echo "LePan installation stopped: conflicting installation at $legacy_path." >&2
+      exit 1
+    fi
+  done
+  (umask 077; mkdir -p "$lepan_dir"; : > "$lepan_dir/.installer-layout-v1")
+  for payload_name in lifeDrive lifedrive-identity; do
+    (umask 077; mkdir -p "$lepan_dir/$payload_name")
+    if [[ ! -L "$LEITHER_WORKDIR/$payload_name" ]]; then
+      ln -s "lepan/$payload_name" "$LEITHER_WORKDIR/$payload_name"
+    fi
+  done
+  echo "LePan application files: $lepan_dir"
+fi
+
 backup_dir="$LEITHER_WORKDIR/deploy-backups/lifedrive-$(date -u +%Y%m%dT%H%M%SZ)"
-if [[ -d "$LEITHER_WORKDIR/lifeDrive" ]]; then
-  mkdir -p "$backup_dir"
-  if [[ -d "$LEITHER_WORKDIR/lifeDrive" ]]; then cp -R "$LEITHER_WORKDIR/lifeDrive" "$backup_dir/"; fi
+if [[ -d "$LEITHER_WORKDIR/lifeDrive" && -n "$(ls -A "$LEITHER_WORKDIR/lifeDrive/")" ]]; then
+  mkdir -p "$backup_dir/lifeDrive"
+  # Copy the contents rather than backing up only the compatibility link.
+  cp -R "$LEITHER_WORKDIR/lifeDrive/." "$backup_dir/lifeDrive/"
   echo "Previous LePan files backed up to $backup_dir"
 fi
 
-mkdir -p "$LEITHER_WORKDIR/lifeDrive"
 # Remove the previous top-level JavaScript MApp entries before installing the
 # Go dispatcher. Web assets below their hashed asset directory are retained.
 old_entry_files=(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inoku/lepan",
-  "version": "0.7.64",
+  "version": "0.7.66",
   "description": "Install LePan and its Leither runtime on Linux, macOS, or Windows",
   "os": [
     "linux",