@kvbox/server 0.5.8 → 0.5.10

package/dist/kvbox-server.js

@@ -292,6 +292,8 @@ var ConfigSchema = z2.object({
   /** Who boxes made over the local socket belong to: the Unix user running the server unless set here. No `@`, no `/`. */
   owner: z2.string().regex(LOCAL_OWNER_RE, "owner: letters, digits, '.', '_', '-'; no '@' or '/'").default(localOwner),
   pricing: PricingSchema.optional(),
+  /** What a new box gets when `new` does not say (#47): seconds without network traffic before it is hibernated; 0: never. */
+  autoHibernateSec: z2.number().int().min(0).default(0),
   /** Absent until the host joins a control plane; then the server also listens on HTTPS. */
   controlPlane: ControlPlaneSchema.optional(),
   /** Absent unless the host sits behind a relay. */
@@ -370,7 +372,9 @@ var MachineSchema = z3.object({
    */
   ssh: z3.object({ host: z3.string(), port: z3.number().int(), user: z3.string() }).optional(),
   /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /machines`. */
-  ownerKind: z3.enum(["user", "org"]).optional()
+  ownerKind: z3.enum(["user", "org"]).optional(),
+  /** Seconds without network traffic before the host hibernates the box (#47). Absent: never. */
+  autoHibernateSec: z3.number().int().positive().optional()
 });
 var CreateMachineRequest = z3.object({
   name: z3.string().optional(),
@@ -384,7 +388,9 @@ var CreateMachineRequest = z3.object({
    * its SSH CA as one `cert-authority …` line (#51). Written into the box's authorized_keys at every
    * boot (#49); a host older than that ignores them.
    */
-  sshKeys: z3.array(z3.string()).optional()
+  sshKeys: z3.array(z3.string()).optional(),
+  /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */
+  autoHibernateSec: z3.number().int().min(0).optional()
 });
 var SetSshKeysRequest = z3.object({
   sshKeys: z3.array(z3.string())
@@ -395,6 +401,10 @@ var RescaleMachineRequest = z3.object({
   memMib: z3.number().int().min(256).optional(),
   diskGib: z3.number().int().min(1).optional()
 });
+var SetMachineRequest = z3.object({
+  /** Seconds without network traffic before the box is hibernated (#47); 0: never. */
+  autoHibernateSec: z3.number().int().min(0).optional()
+});
 var SnapshotSchema = z3.object({
   name: z3.string(),
   owner: z3.string(),
@@ -419,6 +429,12 @@ var CapacitySchema = z3.object({
   reservedVcpu: z3.number().int(),
   running: z3.number().int()
 });
+var RecoveryReportSchema = z3.object({
+  at: z3.string(),
+  booted: z3.array(z3.string()),
+  leftStopped: z3.array(z3.string()),
+  failed: z3.array(z3.object({ box: z3.string(), error: z3.string() }))
+});
 var HealthSchema = z3.object({
   ok: z3.literal(true),
   version: z3.string(),
@@ -441,8 +457,13 @@ var HealthSchema = z3.object({
     /** The public IP the relay owns for this host. */
     publicIp: z3.string(),
     /** The relay's WireGuard endpoint the tunnel dials. */
-    endpoint: z3.string()
-  }).nullable().optional()
+    endpoint: z3.string(),
+    /** Times the server redialed the tunnel since it started, because the relay stopped answering. Older servers omit them. */
+    restarts: z3.number().int().optional(),
+    lastRestartAt: z3.string().nullable().optional()
+  }).nullable().optional(),
+  /** Boxes brought back at the server's last start; null when there were none or it is still at it. Older servers omit it. */
+  recovery: RecoveryReportSchema.nullable().optional()
 });
 var MachineUsageSchema = z3.object({
   name: z3.string(),
@@ -863,250 +884,124 @@ async function requireKvm(device = KVM_DEVICE, groupFile = "/etc/group") {
   );
 }
 
-// src/core/network.ts
-import { randomInt } from "node:crypto";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-var TAP_PREFIX = "kv-";
-var PRIVILEGED_SCRIPT = "/usr/local/lib/kvbox/net-setup.sh";
-function tapName(box) {
-  return `${TAP_PREFIX}${box}`.slice(0, 15);
-}
-function netSetupScript() {
-  const override = process.env["KVBOX_NET_SETUP"];
-  if (override) return override;
-  if (existsSync(PRIVILEGED_SCRIPT)) return PRIVILEGED_SCRIPT;
-  for (const rel of ["../scripts/net-setup.sh", "../../scripts/net-setup.sh"]) {
-    const candidate = fileURLToPath(new URL(rel, import.meta.url));
-    if (existsSync(candidate)) return candidate;
-  }
-  throw new KvboxError("net-setup.sh not found next to kvbox-server");
-}
-function bridgeExists(bridge) {
-  return existsSync(`/sys/class/net/${bridge}`);
-}
-function netRun(cfg, args) {
-  return run([netSetupScript(), ...args], {
-    env: { ...process.env, KVBOX_BRIDGE: cfg.bridge, KVBOX_SUBNET: cfg.subnet, KVBOX_GATEWAY: cfg.gateway }
-  }).catch((err) => {
-    throw new KvboxError(
-      `${err.message}
-  (root is needed for host networking; install-server.sh sets up a sudoers rule for ${PRIVILEGED_SCRIPT})`
-    );
-  });
-}
-async function netSetup(cfg, args) {
-  await netRun(cfg, args);
-}
-async function ensureHostNetwork(cfg) {
-  if (bridgeExists(cfg.bridge)) return "present";
-  await netRun(cfg, ["up"]);
-  return "created";
-}
-async function createTap(box, cfg, opts = {}) {
-  const tap = tapName(box);
-  await netRun(cfg, ["tap", "add", tap, ...opts.detached ? ["detached"] : []]);
-  return tap;
-}
-async function attachTap(box, cfg) {
-  await netRun(cfg, ["tap", "attach", tapName(box)]);
-}
-async function deleteTap(box, cfg) {
-  await netRun(cfg, ["tap", "del", tapName(box)]);
-}
-var SSH_PORT_MIN = 2e4;
-var SSH_PORT_MAX = 6e4;
-function pickSshPort(taken) {
-  const span = SSH_PORT_MAX - SSH_PORT_MIN + 1;
-  for (let i = 0; i < 32; i++) {
-    const port = SSH_PORT_MIN + randomInt(span);
-    if (!taken.has(port)) return port;
-  }
-  const start = randomInt(span);
-  for (let i = 0; i < span; i++) {
-    const port = SSH_PORT_MIN + (start + i) % span;
-    if (!taken.has(port)) return port;
-  }
-  throw new KvboxError(`no free port left between ${SSH_PORT_MIN} and ${SSH_PORT_MAX} on this host`);
-}
-function parseListeningPorts(ssOutput) {
-  const ports = /* @__PURE__ */ new Set();
-  for (const line of ssOutput.split("\n")) {
-    const cols = line.trim().split(/\s+/);
-    const local = cols[3];
-    if (!local) continue;
-    const port = Number(local.slice(local.lastIndexOf(":") + 1));
-    if (Number.isInteger(port) && port > 0) ports.add(port);
-  }
-  return ports;
-}
-async function listeningPorts() {
-  try {
-    return parseListeningPorts((await run(["ss", "-ltnH"])).stdout);
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-}
-var proxyArgs = (p) => [p.box, p.boxIp, String(p.hostPort), String(p.guestPort), p.proto ?? "tcp"];
-async function openProxy(proxy, cfg) {
-  await netRun(cfg, ["proxy", "add", ...proxyArgs(proxy)]);
-}
-async function closeProxy(proxy, cfg) {
-  await netRun(cfg, ["proxy", "rm", ...proxyArgs(proxy)]);
-}
-var ipToInt = (ip) => ip.split(".").reduce((acc, o) => (acc << 8) + Number(o), 0) >>> 0;
-var intToIp = (n) => [24, 16, 8, 0].map((s) => n >>> s & 255).join(".");
-function nextFreeIp(subnet, inUse) {
-  const [base, lenStr] = subnet.split("/");
-  const len = Number(lenStr);
-  if (!base || !Number.isInteger(len) || len < 8 || len > 30) throw new KvboxError(`bad subnet: ${subnet}`);
-  const mask = len === 0 ? 0 : ~0 << 32 - len >>> 0;
-  const network = (ipToInt(base) & mask) >>> 0;
-  const broadcast = (network | ~mask >>> 0) >>> 0;
-  const used = new Set(inUse.map(ipToInt));
-  for (let n = network + 2; n < broadcast; n++) {
-    if (!used.has(n)) return intToIp(n);
-  }
-  throw new KvboxError(`no free IP left in ${subnet}`);
-}
-function macFor(ip) {
-  const hex = ip.split(".").map((o) => Number(o).toString(16).padStart(2, "0").toUpperCase());
-  return ["06", "00", ...hex].join(":");
-}
-
-// src/core/relay.ts
-import { chmod as chmod3, mkdir as mkdir2, rm, writeFile as writeFile2 } from "node:fs/promises";
+// src/core/machines.ts
+import { spawn } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync2, openSync as openSync2, statSync } from "node:fs";
+import { link, mkdir as mkdir3, readFile as readFile5, realpath, rm, truncate, writeFile as writeFile3 } from "node:fs/promises";
+import { basename } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
 
-// ../shared/src/relay.ts
-import { z as z4 } from "zod";
-var RELAY_TUNNEL_GATEWAY = "10.77.0.1";
-var IPV4_RE = /^(\d{1,3})(\.\d{1,3}){3}$/;
-var WG_KEY_RE = /^[A-Za-z0-9+/]{43}=$/;
-var RelayJoinSchema = z4.object({
-  v: z4.literal(1),
-  /** How the relay lists this host. */
-  name: z4.string().regex(/^[a-z0-9][a-z0-9-]{0,30}$/),
-  /** `<relay-primary-ip>:<port>`, the WireGuard endpoint the host dials. */
-  relay: z4.string().regex(/^(\d{1,3})(\.\d{1,3}){3}:\d{1,5}$/),
-  /** The relay's WireGuard public key. */
-  relayKey: z4.string().regex(WG_KEY_RE),
-  /** This host's address inside the tunnel. */
-  tunnelIp: z4.string().regex(IPV4_RE),
-  /** This host's WireGuard private key, generated on the relay, kept nowhere else. */
-  privateKey: z4.string().regex(WG_KEY_RE),
-  /** The extra public IPv4 the relay owns for this host; what the host advertises to the control plane. */
-  publicIp: z4.string().regex(IPV4_RE)
-});
-function decodeRelayJoin(text) {
+// src/core/agent.ts
+import { connect } from "node:net";
+var AGENT_PORT = 52;
+async function agentCall(udsPath, req, timeoutMs = 5e3) {
+  const reply = await new Promise((resolve, reject) => {
+    const sock = connect(udsPath);
+    let buf = "";
+    let handshaken = false;
+    const fail = (err) => {
+      sock.destroy();
+      reject(err);
+    };
+    sock.setTimeout(timeoutMs, () => fail(new KvboxError(`kvbox-agent did not answer within ${timeoutMs} ms`)));
+    sock.once("error", (err) => fail(new KvboxError(`kvbox-agent unreachable: ${err.message}`)));
+    sock.once("connect", () => sock.write(`CONNECT ${AGENT_PORT}
+`));
+    sock.on("data", (chunk) => {
+      buf += chunk.toString("utf8");
+      let nl;
+      while ((nl = buf.indexOf("\n")) !== -1) {
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 1);
+        if (!handshaken) {
+          if (!line.startsWith("OK ")) return fail(new KvboxError(`vsock connect refused: ${line}`));
+          handshaken = true;
+          sock.write(JSON.stringify(req) + "\n");
+        } else {
+          sock.end();
+          return resolve(line);
+        }
+      }
+    });
+    sock.once("close", () => {
+      if (!handshaken) fail(new KvboxError("vsock connection closed before the guest accepted"));
+      else fail(new KvboxError("kvbox-agent closed the connection without a reply"));
+    });
+  });
   let parsed;
   try {
-    parsed = JSON.parse(Buffer.from(text.trim(), "base64url").toString("utf8"));
+    parsed = JSON.parse(reply);
   } catch {
-    return null;
+    throw new KvboxError(`kvbox-agent sent something that is not JSON: ${reply}`);
   }
-  const res = RelayJoinSchema.safeParse(parsed);
-  return res.success ? res.data : null;
-}
-
-// src/core/relay.ts
-function relayConf(join2) {
-  return [
-    "# kvbox relay tunnel: made by `kvbox server relay`, installed by net-setup.sh. Do not edit.",
-    "[Interface]",
-    `PrivateKey = ${join2.privateKey}`,
-    `Address = ${join2.tunnelIp}/32`,
-    "",
-    "[Peer]",
-    `PublicKey = ${join2.relayKey}`,
-    `Endpoint = ${join2.relay}`,
-    // Only the relay's own tunnel address goes through the tunnel: the host keeps its normal internet
-    // route, and the relay SNATs forwarded connections so their replies come back this way.
-    `AllowedIPs = ${RELAY_TUNNEL_GATEWAY}/32`,
-    // The router forgets an idle outbound mapping; a packet every 25 s keeps the relay able to reach us.
-    "PersistentKeepalive = 25",
-    ""
-  ].join("\n");
+  if (!parsed.ok) throw new KvboxError(`kvbox-agent: ${parsed.error}`);
+  return parsed;
 }
-async function useRelay(joinString, p = paths()) {
-  const join2 = decodeRelayJoin(joinString);
-  if (!join2) throw new KvboxError("that is not a relay join string; copy the whole line `kvbox-relay add` printed on the relay");
-  const cfg = await loadConfig(p);
-  if (cfg.relay && cfg.relay.name !== join2.name) {
-    throw new KvboxError(`this host already goes through relay ${cfg.relay.name} (${cfg.relay.publicIp}); run kvbox server relay off first`);
-  }
-  if (cfg.relay && cfg.relay.publicIp !== join2.publicIp && cfg.controlPlane?.advertise === cfg.relay.publicIp) {
-    throw new KvboxError(
-      `${cfg.controlPlane.name} reaches this host at ${cfg.relay.publicIp}, not ${join2.publicIp}; run kvbox server leave first, then join again`
-    );
-  }
-  await mkdir2(p.relay, { recursive: true, mode: 448 });
-  await writeFile2(p.relayConf, relayConf(join2), { mode: 384 });
-  await chmod3(p.relayConf, 384);
-  await netSetup(cfg, ["relay", "up", p.relayConf, String(cfg.controlPlane?.port ?? DEFAULT_HTTPS_PORT)]);
-  const relay = { name: join2.name, publicIp: join2.publicIp, tunnelIp: join2.tunnelIp, endpoint: join2.relay };
-  await saveConfig({ ...cfg, relay }, p);
-  return relay;
+function setIdentity(udsPath, id, timeoutMs) {
+  return agentCall(udsPath, { op: "identity", ...id }, timeoutMs);
 }
-async function dropRelay(p = paths()) {
-  const cfg = await loadConfig(p);
-  const relay = cfg.relay;
-  if (!relay) throw new KvboxError("this host does not go through a relay");
-  if (cfg.controlPlane?.advertise === relay.publicIp) {
-    throw new KvboxError(`${cfg.controlPlane.name} reaches this host through the relay (${relay.publicIp}); run kvbox server leave first`);
-  }
-  await netSetup(cfg, ["relay", "down"]);
-  await rm(p.relayConf, { force: true });
-  const { relay: _gone, ...rest } = cfg;
-  await saveConfig(rest, p);
-  return relay;
+function setAuthorizedKeys(udsPath, lines, timeoutMs) {
+  return agentCall(udsPath, { op: "authorizedKeys", lines: [...lines] }, timeoutMs);
 }
+var isUnknownOp = (err) => /unknown op/.test(err.message ?? "");
 
-// src/listen.ts
-import { readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
-import { createServer as createHttpsServer } from "node:https";
-import { createAdaptorServer } from "@hono/node-server";
+// src/core/capacity.ts
+import { cpus, totalmem } from "node:os";
+
+// ../shared/src/capacity.ts
+var MEM_HEADROOM_MIB = 2048;
+var VCPU_OVERSUBSCRIPTION = 2;
 
 // src/core/state.ts
 import { randomBytes } from "node:crypto";
-import { mkdir as mkdir3, readFile as readFile4, readdir, writeFile as writeFile3 } from "node:fs/promises";
-import { z as z5 } from "zod";
-var MachineMetaSchema = z5.object({
+import { readFileSync } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile4, readdir, writeFile as writeFile2 } from "node:fs/promises";
+import { z as z4 } from "zod";
+var MachineMetaSchema = z4.object({
   /** Host-unique, minted at `kvbox new` (fresh or restored) and kept for the box's life; the tap is `kv-<id>`. */
-  id: z5.string(),
-  name: z5.string(),
+  id: z4.string(),
+  name: z4.string(),
   /** Part of the box's identity: machines/<owner>/<name>. See refs.ts. */
-  owner: z5.string(),
-  ip: z5.string(),
-  mac: z5.string(),
-  pid: z5.number().int().nullable(),
+  owner: z4.string(),
+  ip: z4.string(),
+  mac: z4.string(),
+  pid: z4.number().int().nullable(),
   // null: stopped on purpose, disk kept
-  vcpu: z5.number().int(),
-  memMib: z5.number().int(),
-  createdAt: z5.string(),
-  source: z5.string(),
+  /**
+   * The host boot `pid` belongs to (/proc/sys/kernel/random/boot_id at launch, #29). After a reboot
+   * the number can name some other process; a pid from another boot is dead whatever `kill -0` says.
+   * Absent (boxes launched before #29): the pid alone decides.
+   */
+  bootId: z4.string().optional(),
+  vcpu: z4.number().int(),
+  memMib: z4.number().int(),
+  createdAt: z4.string(),
+  source: z4.string(),
   /** Base image version (assets/rootfs-<version>.ext4) the box's overlay stacks on. */
-  base: z5.string(),
+  base: z4.string(),
   /**
    * Snapshots taken since this VM started (boot or restore). Firecracker resets its dirty-page bitmap at
    * each one, so when this is > 0 the next diff is only standalone merged onto `mem.base`; if that file
    * is missing the lineage is broken and the next snapshot has to be a full dump. Absent: 0.
    */
-  memSnapshots: z5.number().int().optional(),
+  memSnapshots: z4.number().int().optional(),
   /** `kvbox pause`: Firecracker is alive but the VM is frozen (standby). Absent: not paused. */
-  paused: z5.boolean().optional(),
+  paused: z4.boolean().optional(),
   /**
    * authorized_keys lines the box gets on top of the host's own key, as the control plane sent them
    * at `new` (#49). kvbox-init rewrites authorized_keys from the kernel cmdline at every boot, so
    * `start` has to send the same lines again. Absent: host key only.
    */
-  sshKeys: z5.array(z5.string()).optional(),
+  sshKeys: z4.array(z4.string()).optional(),
   /**
    * The guest's authorized_keys may not match `sshKeys`: they changed while the box was not running,
    * or its agent could not take them (#55, #63). Cleared by a push through kvbox-agent or a boot.
    */
-  sshKeysStale: z5.boolean().optional(),
+  sshKeysStale: z4.boolean().optional(),
   /** Public port on the host DNATed to the box's SSH while it runs (#49); fixed for the box's life. Absent: none. */
-  sshPort: z5.number().int().optional()
+  sshPort: z4.number().int().optional(),
+  /** Seconds without traffic on the box's tap before the server hibernates it (#47, core/idle.ts). Absent: never. */
+  autoHibernateSec: z4.number().int().positive().optional()
 });
 function newBoxId(taken) {
   for (; ; ) {
@@ -1114,20 +1009,20 @@ function newBoxId(taken) {
     if (!taken.has(id)) return id;
   }
 }
-var SnapshotMetaSchema = z5.object({
-  name: z5.string(),
-  owner: z5.string(),
+var SnapshotMetaSchema = z4.object({
+  name: z4.string(),
+  owner: z4.string(),
   /** The box it was taken from, as owner/name. */
-  source: z5.string(),
-  base: z5.string(),
-  vcpu: z5.number().int(),
-  memMib: z5.number().int(),
-  sizeBytes: z5.number().int(),
-  createdAt: z5.string()
+  source: z4.string(),
+  base: z4.string(),
+  vcpu: z4.number().int(),
+  memMib: z4.number().int(),
+  sizeBytes: z4.number().int(),
+  createdAt: z4.string()
 });
 async function ensureLayout(p = paths()) {
   for (const dir of [p.home, p.ssh, p.bin, p.assets, p.machines, p.snapshots]) {
-    await mkdir3(dir, { recursive: true, mode: 448 });
+    await mkdir2(dir, { recursive: true, mode: 448 });
   }
   return p;
 }
@@ -1148,8 +1043,8 @@ async function readMachineMeta(ref, p = paths()) {
 }
 async function writeMachineMeta(meta, p = paths()) {
   const m = p.machine(meta.owner, meta.name);
-  await mkdir3(m.dir, { recursive: true });
-  await writeFile3(m.meta, JSON.stringify(meta, null, 2) + "\n");
+  await mkdir2(m.dir, { recursive: true });
+  await writeFile2(m.meta, JSON.stringify(meta, null, 2) + "\n");
 }
 async function listMachineRefs(p = paths()) {
   return listRefs(p.machines);
@@ -1159,8 +1054,8 @@ async function readSnapshotMeta(ref, p = paths()) {
 }
 async function writeSnapshotMeta(meta, p = paths()) {
   const s = p.snapshot(meta.owner, meta.name);
-  await mkdir3(s.dir, { recursive: true });
-  await writeFile3(s.meta, JSON.stringify(meta, null, 2) + "\n");
+  await mkdir2(s.dir, { recursive: true });
+  await writeFile2(s.meta, JSON.stringify(meta, null, 2) + "\n");
 }
 async function listSnapshotRefs(p = paths()) {
   return listRefs(p.snapshots);
@@ -1183,131 +1078,29 @@ function pidAlive(pid) {
     return err.code === "EPERM";
   }
 }
-
-// src/app.ts
-import { Hono as Hono6 } from "hono";
-
-// ../shared/src/version.ts
-import { createRequire } from "node:module";
-function versionOf(srcFileUrl, injected) {
-  if (typeof injected === "string") return injected;
-  try {
-    const require2 = createRequire(srcFileUrl);
-    return require2("../package.json").version;
-  } catch {
-    return "0.0.0-dev";
-  }
-}
-
-// src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.8" : void 0);
-
-// src/caller.ts
-import { createHash as createHash2, timingSafeEqual } from "node:crypto";
-var OWNER_HEADER = "x-kvbox-owner";
-function resolveCaller(opts = {}) {
-  const cp = opts.controlPlane;
-  if (!cp) {
-    return async (c, next) => {
-      const cfg = await loadConfig();
-      c.set("owner", cfg.owner);
-      c.set("listScope", cfg.owner);
-      await next();
-    };
-  }
-  const expected = digest(cp.secret);
-  return async (c, next) => {
-    const m = /^Bearer\s+(\S+)$/i.exec(c.req.header("authorization") ?? "");
-    if (!m || !timingSafeEqual(digest(m[1]), expected)) return c.json({ error: "not authorized" }, 401);
-    const user = c.req.header(OWNER_HEADER);
-    if (user === void 0) {
-      const path = c.req.path.replace(/\/$/, "");
-      const realmListing = c.req.method === "GET" && (path === "/machines" || path === "/snapshots");
-      if (!realmListing && /^\/(machines|snapshots)(\/|$)/.test(c.req.path)) {
-        return c.json({ error: "X-Kvbox-Owner header required" }, 400);
-      }
-      c.set("owner", "");
-      c.set("listScope", { realm: cp.name });
-    } else {
-      if (!LOCAL_OWNER_RE.test(user)) return c.json({ error: "X-Kvbox-Owner: letters, digits, '.', '_', '-'" }, 400);
-      const owner = `${user}@${cp.name}`;
-      c.set("owner", owner);
-      c.set("listScope", owner);
+var bootId;
+function currentBootId() {
+  if (bootId === void 0) {
+    try {
+      bootId = { id: readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() };
+    } catch {
+      bootId = { id: void 0 };
     }
-    await next();
-  };
+  }
+  return bootId.id;
 }
-function digest(secret) {
-  return createHash2("sha256").update(secret).digest();
+function vmAlive(meta) {
+  if (meta.bootId !== void 0 && meta.bootId !== currentBootId()) return false;
+  return pidAlive(meta.pid);
 }
-
-// src/core/machines.ts
-import { spawn } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync2, openSync as openSync2, statSync } from "node:fs";
-import { link, mkdir as mkdir4, readFile as readFile5, realpath, rm as rm2, truncate, writeFile as writeFile4 } from "node:fs/promises";
-import { basename } from "node:path";
-import { setTimeout as sleep } from "node:timers/promises";
-
-// src/core/agent.ts
-import { connect } from "node:net";
-var AGENT_PORT = 52;
-async function agentCall(udsPath, req, timeoutMs = 5e3) {
-  const reply = await new Promise((resolve, reject) => {
-    const sock = connect(udsPath);
-    let buf = "";
-    let handshaken = false;
-    const fail = (err) => {
-      sock.destroy();
-      reject(err);
-    };
-    sock.setTimeout(timeoutMs, () => fail(new KvboxError(`kvbox-agent did not answer within ${timeoutMs} ms`)));
-    sock.once("error", (err) => fail(new KvboxError(`kvbox-agent unreachable: ${err.message}`)));
-    sock.once("connect", () => sock.write(`CONNECT ${AGENT_PORT}
-`));
-    sock.on("data", (chunk) => {
-      buf += chunk.toString("utf8");
-      let nl;
-      while ((nl = buf.indexOf("\n")) !== -1) {
-        const line = buf.slice(0, nl);
-        buf = buf.slice(nl + 1);
-        if (!handshaken) {
-          if (!line.startsWith("OK ")) return fail(new KvboxError(`vsock connect refused: ${line}`));
-          handshaken = true;
-          sock.write(JSON.stringify(req) + "\n");
-        } else {
-          sock.end();
-          return resolve(line);
-        }
-      }
-    });
-    sock.once("close", () => {
-      if (!handshaken) fail(new KvboxError("vsock connection closed before the guest accepted"));
-      else fail(new KvboxError("kvbox-agent closed the connection without a reply"));
-    });
-  });
-  let parsed;
+function hostBootTime() {
   try {
-    parsed = JSON.parse(reply);
+    const m = /^btime (\d+)$/m.exec(readFileSync("/proc/stat", "utf8"));
+    return m ? new Date(Number(m[1]) * 1e3) : null;
   } catch {
-    throw new KvboxError(`kvbox-agent sent something that is not JSON: ${reply}`);
+    return null;
   }
-  if (!parsed.ok) throw new KvboxError(`kvbox-agent: ${parsed.error}`);
-  return parsed;
-}
-function setIdentity(udsPath, id, timeoutMs) {
-  return agentCall(udsPath, { op: "identity", ...id }, timeoutMs);
-}
-function setAuthorizedKeys(udsPath, lines, timeoutMs) {
-  return agentCall(udsPath, { op: "authorizedKeys", lines: [...lines] }, timeoutMs);
 }
-var isUnknownOp = (err) => /unknown op/.test(err.message ?? "");
-
-// src/core/capacity.ts
-import { cpus, totalmem } from "node:os";
-
-// ../shared/src/capacity.ts
-var MEM_HEADROOM_MIB = 2048;
-var VCPU_OVERSUBSCRIPTION = 2;
 
 // src/core/capacity.ts
 function hostResources() {
@@ -1318,7 +1111,7 @@ async function runningReservations(p = paths()) {
   for (const ref of await listMachineRefs(p)) {
     try {
       const meta = await readMachineMeta(ref, p);
-      if (pidAlive(meta.pid)) out.push({ name: meta.name, vcpu: meta.vcpu, memMib: meta.memMib });
+      if (vmAlive(meta)) out.push({ name: meta.name, vcpu: meta.vcpu, memMib: meta.memMib });
     } catch {
     }
   }
@@ -1447,6 +1240,10 @@ function closeOpenRun(boxId, at, p = paths()) {
   insertRaw({ ...last, at, state: "stopped", by: "server" }, db);
   return true;
 }
+function closeRunCutByBoot(boxId, bootAt, now, p = paths()) {
+  const last = lastEvent(boxId, openDb(p));
+  return closeOpenRun(boxId, last !== void 0 && last.at < bootAt ? bootAt : now, p);
+}
 function usageEventsFor(boxId, since, p = paths()) {
   const rows = openDb(p).prepare("select * from usage_events where box_id = ? and at >= ? order by at, id").all(boxId, since);
   return rows.map(fromRaw);
@@ -1468,6 +1265,33 @@ function usageEventsInScope(scope, window, p = paths()) {
   return rows.filter((r) => inScope(r.owner, scope)).map(withId);
 }
 
+// src/core/locks.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var tails = /* @__PURE__ */ new Map();
+var held = new AsyncLocalStorage();
+async function withBoxLock(ref, fn) {
+  const key = refKey(ref);
+  const mine = held.getStore();
+  if (mine?.has(key)) return fn();
+  const previous = tails.get(key);
+  let release;
+  const tail = new Promise((resolve) => release = resolve);
+  tails.set(key, tail);
+  try {
+    await previous;
+    return await held.run(/* @__PURE__ */ new Set([...mine ?? [], key]), fn);
+  } finally {
+    release();
+    if (tails.get(key) === tail) tails.delete(key);
+  }
+}
+function boxBusy(ref) {
+  return tails.has(refKey(ref));
+}
+function locked(fn) {
+  return (...args) => withBoxLock(args[0], () => fn(...args));
+}
+
 // src/core/firecracker.ts
 import { Agent, request as request2 } from "undici";
 var FirecrackerClient = class {
@@ -1569,13 +1393,124 @@ var FirecrackerClient = class {
       resume_vm: opts.resume
     });
   }
-  info() {
-    return this.call("GET", "/");
+  info() {
+    return this.call("GET", "/");
+  }
+  async close() {
+    await this.agent.close();
+  }
+};
+
+// src/core/network.ts
+import { randomInt } from "node:crypto";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+var TAP_PREFIX = "kv-";
+var PRIVILEGED_SCRIPT = "/usr/local/lib/kvbox/net-setup.sh";
+function tapName(box) {
+  return `${TAP_PREFIX}${box}`.slice(0, 15);
+}
+function netSetupScript() {
+  const override = process.env["KVBOX_NET_SETUP"];
+  if (override) return override;
+  if (existsSync(PRIVILEGED_SCRIPT)) return PRIVILEGED_SCRIPT;
+  for (const rel of ["../scripts/net-setup.sh", "../../scripts/net-setup.sh"]) {
+    const candidate = fileURLToPath(new URL(rel, import.meta.url));
+    if (existsSync(candidate)) return candidate;
+  }
+  throw new KvboxError("net-setup.sh not found next to kvbox-server");
+}
+function bridgeExists(bridge) {
+  return existsSync(`/sys/class/net/${bridge}`);
+}
+function netRun(cfg, args) {
+  return run([netSetupScript(), ...args], {
+    env: { ...process.env, KVBOX_BRIDGE: cfg.bridge, KVBOX_SUBNET: cfg.subnet, KVBOX_GATEWAY: cfg.gateway }
+  }).catch((err) => {
+    throw new KvboxError(
+      `${err.message}
+  (root is needed for host networking; install-server.sh sets up a sudoers rule for ${PRIVILEGED_SCRIPT})`
+    );
+  });
+}
+async function netSetup(cfg, args) {
+  await netRun(cfg, args);
+}
+async function ensureHostNetwork(cfg) {
+  if (bridgeExists(cfg.bridge)) return "present";
+  await netRun(cfg, ["up"]);
+  return "created";
+}
+async function createTap(box, cfg, opts = {}) {
+  const tap = tapName(box);
+  await netRun(cfg, ["tap", "add", tap, ...opts.detached ? ["detached"] : []]);
+  return tap;
+}
+async function attachTap(box, cfg) {
+  await netRun(cfg, ["tap", "attach", tapName(box)]);
+}
+async function deleteTap(box, cfg) {
+  await netRun(cfg, ["tap", "del", tapName(box)]);
+}
+var SSH_PORT_MIN = 2e4;
+var SSH_PORT_MAX = 6e4;
+function pickSshPort(taken) {
+  const span = SSH_PORT_MAX - SSH_PORT_MIN + 1;
+  for (let i = 0; i < 32; i++) {
+    const port = SSH_PORT_MIN + randomInt(span);
+    if (!taken.has(port)) return port;
+  }
+  const start = randomInt(span);
+  for (let i = 0; i < span; i++) {
+    const port = SSH_PORT_MIN + (start + i) % span;
+    if (!taken.has(port)) return port;
+  }
+  throw new KvboxError(`no free port left between ${SSH_PORT_MIN} and ${SSH_PORT_MAX} on this host`);
+}
+function parseListeningPorts(ssOutput) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const line of ssOutput.split("\n")) {
+    const cols = line.trim().split(/\s+/);
+    const local = cols[3];
+    if (!local) continue;
+    const port = Number(local.slice(local.lastIndexOf(":") + 1));
+    if (Number.isInteger(port) && port > 0) ports.add(port);
+  }
+  return ports;
+}
+async function listeningPorts() {
+  try {
+    return parseListeningPorts((await run(["ss", "-ltnH"])).stdout);
+  } catch {
+    return /* @__PURE__ */ new Set();
   }
-  async close() {
-    await this.agent.close();
+}
+var proxyArgs = (p) => [p.box, p.boxIp, String(p.hostPort), String(p.guestPort), p.proto ?? "tcp"];
+async function openProxy(proxy, cfg) {
+  await netRun(cfg, ["proxy", "add", ...proxyArgs(proxy)]);
+}
+async function closeProxy(proxy, cfg) {
+  await netRun(cfg, ["proxy", "rm", ...proxyArgs(proxy)]);
+}
+var ipToInt = (ip) => ip.split(".").reduce((acc, o) => (acc << 8) + Number(o), 0) >>> 0;
+var intToIp = (n) => [24, 16, 8, 0].map((s) => n >>> s & 255).join(".");
+function nextFreeIp(subnet, inUse) {
+  const [base, lenStr] = subnet.split("/");
+  const len = Number(lenStr);
+  if (!base || !Number.isInteger(len) || len < 8 || len > 30) throw new KvboxError(`bad subnet: ${subnet}`);
+  const mask = len === 0 ? 0 : ~0 << 32 - len >>> 0;
+  const network = (ipToInt(base) & mask) >>> 0;
+  const broadcast = (network | ~mask >>> 0) >>> 0;
+  const used = new Set(inUse.map(ipToInt));
+  for (let n = network + 2; n < broadcast; n++) {
+    if (!used.has(n)) return intToIp(n);
   }
-};
+  throw new KvboxError(`no free IP left in ${subnet}`);
+}
+function macFor(ip) {
+  const hex = ip.split(".").map((o) => Number(o).toString(16).padStart(2, "0").toUpperCase());
+  return ["06", "00", ...hex].join(":");
+}
 
 // src/core/machines.ts
 var NAME_RE = /^[a-z0-9][a-z0-9-]{0,11}$/;
@@ -1624,17 +1559,17 @@ function recordState(meta, state, by, p, at = (/* @__PURE__ */ new Date()).toISO
   }
 }
 function isHibernated(meta, p) {
-  return !pidAlive(meta.pid) && existsSync2(p.machine(meta.owner, meta.name).hibernateVmstate);
+  return !vmAlive(meta) && existsSync2(p.machine(meta.owner, meta.name).hibernateVmstate);
 }
 function statusOf(meta, p = paths()) {
-  if (pidAlive(meta.pid)) return meta.paused ? "standby" : "running";
+  if (vmAlive(meta)) return meta.paused ? "standby" : "running";
   return isHibernated(meta, p) ? "hibernated" : "stopped";
 }
 function stateMessage(ref, status) {
   return `box ${shown(ref)} is ${status === "standby" ? "in standby" : status}`;
 }
 function toMachine(meta, p = paths()) {
-  const alive = pidAlive(meta.pid);
+  const alive = vmAlive(meta);
   if (!alive && meta.pid !== null) {
     try {
       closeOpenRun(meta.id, (/* @__PURE__ */ new Date()).toISOString(), p);
@@ -1656,9 +1591,13 @@ function toMachine(meta, p = paths()) {
     createdAt: meta.createdAt,
     source: meta.source,
     status: statusOf(meta, p),
-    ...meta.sshPort === void 0 ? {} : { sshPort: meta.sshPort }
+    ...meta.sshPort === void 0 ? {} : { sshPort: meta.sshPort },
+    ...meta.autoHibernateSec ? { autoHibernateSec: meta.autoHibernateSec } : {}
   };
 }
+function autoHibernateFor(req, cfg) {
+  return (req.autoHibernateSec ?? cfg.autoHibernateSec) || void 0;
+}
 async function readAllMeta(p) {
   const metas = [];
   for (const ref of await listMachineRefs(p)) {
@@ -1739,7 +1678,7 @@ async function assertOverlayCapable(baseFile, version) {
   if (!ok) throw new KvboxError(`base image ${version} is not a kvbox base image (no /sbin/overlay-init); rerun install-server.sh`);
 }
 async function createOverlay(file, gib) {
-  await writeFile4(file, "", { mode: 384 });
+  await writeFile3(file, "", { mode: 384 });
   await truncate(file, gib * 1024 ** 3);
   await run(["mkfs.ext4", "-q", "-F", "-m", "0", "-L", "kvbox-box", "-E", "lazy_itable_init=1,lazy_journal_init=1", file]);
 }
@@ -1760,8 +1699,8 @@ async function tailOf(file, lines = 5) {
 }
 async function spawnFirecracker(ref, cfg, p) {
   const m = p.machine(ref.owner, ref.name);
-  await rm2(m.sock, { force: true });
-  await rm2(m.vsock, { force: true });
+  await rm(m.sock, { force: true });
+  await rm(m.vsock, { force: true });
   const logFd = openSync2(m.log, "a");
   let child;
   try {
@@ -1871,7 +1810,7 @@ async function createMachine(req, owner, p = paths()) {
   const base = await currentBase(cfg, p);
   await assertOverlayCapable(base.file, base.version);
   await ensureHostNetwork(cfg);
-  await mkdir4(m.dir, { recursive: true, mode: 448 });
+  await mkdir3(m.dir, { recursive: true, mode: 448 });
   let tapCreated = false;
   let pid;
   try {
@@ -1881,7 +1820,7 @@ async function createMachine(req, owner, p = paths()) {
     const spec = { id, name, owner, ip, mac, vcpu: size.vcpu, memMib: size.memMib, base: base.version, sshKeys, sshPort };
     pid = await launch(spec, tap, cfg, keysB64, p);
     await openSshPort(spec, cfg);
-    const meta = { ...spec, pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: "base" };
+    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: "base", autoHibernateSec: autoHibernateFor(req, cfg) };
     await writeMachineMeta(meta, p);
     recordState(meta, "running", "new", p, meta.createdAt);
     return toMachine(meta, p);
@@ -1889,7 +1828,7 @@ async function createMachine(req, owner, p = paths()) {
     if (pid !== void 0) killQuietly(pid);
     await closeSshPort({ id, ip, sshPort }, cfg);
     if (tapCreated) await deleteTap(id, cfg).catch(() => void 0);
-    await rm2(m.dir, { recursive: true, force: true });
+    await rm(m.dir, { recursive: true, force: true });
     throw err;
   }
 }
@@ -1927,7 +1866,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
   const m = p.machine(owner, name);
   const s = p.snapshot(from.owner, from.name);
   await ensureHostNetwork(cfg);
-  await mkdir4(m.dir, { recursive: true, mode: 448 });
+  await mkdir3(m.dir, { recursive: true, mode: 448 });
   let tapCreated = false;
   let pid;
   try {
@@ -1945,7 +1884,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
     const stale = await pushAuthorizedKeys({ owner, name, sshKeys }, m.vsock, p);
     await attachTap(id, cfg);
     await openSshPort(spec, cfg);
-    const meta = { ...spec, pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: `snapshot:${refKey(from)}`, memSnapshots: 1, sshKeysStale: stale ? true : void 0 };
+    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: `snapshot:${refKey(from)}`, memSnapshots: 1, sshKeysStale: stale ? true : void 0, autoHibernateSec: autoHibernateFor(req, cfg) };
     await writeMachineMeta(meta, p);
     recordState(meta, "running", "new", p, meta.createdAt);
     return toMachine(meta, p);
@@ -1953,7 +1892,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
     if (pid !== void 0) killQuietly(pid);
     await closeSshPort({ id, ip, sshPort }, cfg);
     if (tapCreated) await deleteTap(id, cfg).catch(() => void 0);
-    await rm2(m.dir, { recursive: true, force: true });
+    await rm(m.dir, { recursive: true, force: true });
     throw err;
   }
 }
@@ -1999,7 +1938,7 @@ async function resumeVm(sock) {
 }
 async function shutdown(meta, cfg, p, graceMs) {
   const pid = meta.pid;
-  if (pidAlive(pid)) {
+  if (vmAlive(meta)) {
     const fc = new FirecrackerClient(p.machine(meta.owner, meta.name).sock);
     try {
       if (meta.paused) await fc.resume();
@@ -2023,26 +1962,26 @@ async function cleanupProcess(meta, cfg, p) {
   await closeSshPort(meta, cfg);
   await deleteTap(meta.id, cfg);
   const m = p.machine(meta.owner, meta.name);
-  await rm2(m.sock, { force: true });
-  await rm2(m.vsock, { force: true });
+  await rm(m.sock, { force: true });
+  await rm(m.vsock, { force: true });
 }
-async function stopMachine(ref, p = paths()) {
+var stopMachine = locked(async function stopMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const m = p.machine(ref.owner, ref.name);
-  if (!pidAlive(meta.pid) && !isHibernated(meta, p)) throw new KvboxError(`box ${shown(ref)} is already stopped`);
+  if (!vmAlive(meta) && !isHibernated(meta, p)) throw new KvboxError(`box ${shown(ref)} is already stopped`);
   await shutdown(meta, cfg, p, 1e4);
-  await rm2(m.hibernateDir, { recursive: true, force: true });
-  await rm2(m.memBase, { force: true });
+  await rm(m.hibernateDir, { recursive: true, force: true });
+  await rm(m.memBase, { force: true });
   const stopped = { ...meta, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(stopped, p);
   recordState(stopped, "stopped", "stop", p);
   return toMachine(stopped, p);
-}
-async function startMachine(ref, p = paths()) {
+});
+var startMachine = locked(async function startMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
-  if (pidAlive(meta.pid)) throw new KvboxError(`box ${shown(ref)} is already ${meta.paused ? "up, in standby (kvbox resume " + shown(ref) + ")" : "running"}`);
+  if (vmAlive(meta)) throw new KvboxError(`box ${shown(ref)} is already ${meta.paused ? "up, in standby (kvbox resume " + shown(ref) + ")" : "running"}`);
   if (isHibernated(meta, p)) {
     throw new KvboxError(`${stateMessage(ref, "hibernated")}: kvbox wake ${shown(ref)} continues where it left off; to boot fresh instead, kvbox stop ${shown(ref)} first (discards its memory)`);
   }
@@ -2054,7 +1993,7 @@ async function startMachine(ref, p = paths()) {
   try {
     pid = await launch(meta, tap, cfg, keysB64, p);
     await openSshPort(meta, cfg);
-    const started = { ...meta, pid, sshKeysStale: void 0 };
+    const started = { ...meta, pid, bootId: currentBootId(), sshKeysStale: void 0 };
     await writeMachineMeta(started, p);
     recordState(started, "running", "start", p);
     return toMachine(started, p);
@@ -2064,15 +2003,15 @@ async function startMachine(ref, p = paths()) {
     await deleteTap(meta.id, cfg).catch(() => void 0);
     throw err;
   }
-}
-async function setSshKeys(ref, sshKeys, p = paths()) {
+});
+var setSshKeys = locked(async function setSshKeys2(ref, sshKeys, p = paths()) {
   const meta = await readMeta(ref, p);
   if (!isCloudBox(meta.owner)) throw new KvboxError(`box ${shown(ref)} is local: it trusts this host's key, there are no authorized_keys lines to replace`);
   if (sshKeys.length === 0) throw new KvboxError("sshKeys: at least one authorized_keys line (the box would keep only the host's own key)");
   authorizedKeysB64(await readHostPubkey(p), sshKeys);
   const { meta: updated, applied } = await applySshKeys(meta, sshKeys, p);
   return { machine: toMachine(updated, p), applied };
-}
+});
 async function applySshKeys(meta, sshKeys, p) {
   const status = statusOf(meta, p);
   let updated = { ...meta, sshKeys: [...sshKeys], sshKeysStale: status === "stopped" ? void 0 : true };
@@ -2090,27 +2029,30 @@ async function applySshKeys(meta, sshKeys, p) {
 }
 async function trustCa(publicKeyText, p = paths()) {
   const publicKey = parseSshPublicKey(publicKeyText);
-  const report = { publicKey, fingerprint: sshKeyFingerprint(publicKey), updated: [], pending: [], failed: [], local: 0 };
+  const report2 = { publicKey, fingerprint: sshKeyFingerprint(publicKey), updated: [], pending: [], failed: [], local: 0 };
   const hostKey = await readHostPubkey(p);
-  for (const meta of await readAllMeta(p)) {
-    if (!isCloudBox(meta.owner)) {
-      report.local++;
+  for (const listed of await readAllMeta(p)) {
+    if (!isCloudBox(listed.owner)) {
+      report2.local++;
       continue;
     }
-    const box = refKey(meta);
+    const box = refKey(listed);
     try {
-      const sshKeys = [...(meta.sshKeys ?? []).filter((l) => !isCaLine(l)), caLineFor(meta.owner, publicKey)];
-      authorizedKeysLines(hostKey, sshKeys);
-      const { applied, why } = await applySshKeys(meta, sshKeys, p);
-      if (applied === "now") report.updated.push(box);
-      else report.pending.push(why === void 0 ? { box, when: applied } : { box, when: applied, why });
+      await withBoxLock(listed, async () => {
+        const meta = await readMeta(listed, p);
+        const sshKeys = [...(meta.sshKeys ?? []).filter((l) => !isCaLine(l)), caLineFor(meta.owner, publicKey)];
+        authorizedKeysLines(hostKey, sshKeys);
+        const { applied, why } = await applySshKeys(meta, sshKeys, p);
+        if (applied === "now") report2.updated.push(box);
+        else report2.pending.push(why === void 0 ? { box, when: applied } : { box, when: applied, why });
+      });
     } catch (err) {
-      report.failed.push({ box, error: err.message });
+      report2.failed.push({ box, error: err.message });
     }
   }
-  return report;
+  return report2;
 }
-async function pauseMachine(ref, p = paths()) {
+var pauseMachine = locked(async function pauseMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const status = statusOf(meta, p);
   if (status === "standby") throw new KvboxError(`${stateMessage(ref, status)} already`);
@@ -2126,8 +2068,8 @@ async function pauseMachine(ref, p = paths()) {
   await writeMachineMeta(paused, p);
   recordState(paused, "standby", "pause", p);
   return toMachine(paused, p);
-}
-async function resumeMachine(ref, p = paths()) {
+});
+var resumeMachine = locked(async function resumeMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const status = statusOf(meta, p);
   if (status === "running") throw new KvboxError(`${stateMessage(ref, status)} already`);
@@ -2140,23 +2082,23 @@ async function resumeMachine(ref, p = paths()) {
   await writeMachineMeta(running, p);
   recordState(running, "running", "resume", p);
   return toMachine(running, p);
-}
-async function hibernateMachine(ref, p = paths()) {
+});
+var hibernateMachine = locked(async function hibernateMachine2(ref, p = paths(), by = "hibernate") {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const status = statusOf(meta, p);
   if (status === "hibernated") throw new KvboxError(`${stateMessage(ref, status)} already`);
   if (status === "stopped") throw new KvboxError(`${stateMessage(ref, status)}; only a running box can be hibernated (there is no memory to keep)`);
   const m = p.machine(ref.owner, ref.name);
-  await rm2(m.hibernateDir, { recursive: true, force: true });
-  await mkdir4(m.hibernateDir, { recursive: true, mode: 448 });
+  await rm(m.hibernateDir, { recursive: true, force: true });
+  await mkdir3(m.hibernateDir, { recursive: true, mode: 448 });
   const fc = new FirecrackerClient(m.sock);
   try {
     try {
       await fc.pause();
       await fc.snapshotCreate(m.hibernateVmstate, m.hibernateMem, "Full");
     } catch (err) {
-      await rm2(m.hibernateDir, { recursive: true, force: true });
+      await rm(m.hibernateDir, { recursive: true, force: true });
       if (!meta.paused) await fc.resume().catch(() => void 0);
       throw err;
     }
@@ -2167,13 +2109,13 @@ async function hibernateMachine(ref, p = paths()) {
   await waitFor(() => !pidAlive(meta.pid), 5e3, 50);
   await cleanupProcess(meta, cfg, p);
   await run(["fallocate", "--dig-holes", m.hibernateMem]);
-  await rm2(m.memBase, { force: true });
+  await rm(m.memBase, { force: true });
   const hibernated = { ...meta, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(hibernated, p);
-  recordState(hibernated, "hibernated", "hibernate", p);
+  recordState(hibernated, "hibernated", by, p);
   return toMachine(hibernated, p);
-}
-async function wakeMachine(ref, p = paths()) {
+});
+var wakeMachine = locked(async function wakeMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const status = statusOf(meta, p);
@@ -2205,19 +2147,19 @@ async function wakeMachine(ref, p = paths()) {
     await deleteTap(meta.id, cfg).catch(() => void 0);
     throw err;
   }
-  await rm2(m.memBase, { force: true });
+  await rm(m.memBase, { force: true });
   await link(m.hibernateMem, m.memBase);
-  await rm2(m.hibernateDir, { recursive: true, force: true });
-  const running = { ...meta, pid, memSnapshots: 1, paused: void 0, sshKeysStale: stale ? true : void 0 };
+  await rm(m.hibernateDir, { recursive: true, force: true });
+  const running = { ...meta, pid, bootId: currentBootId(), memSnapshots: 1, paused: void 0, sshKeysStale: stale ? true : void 0 };
   await writeMachineMeta(running, p);
   recordState(running, "running", "wake", p);
   return toMachine(running, p);
-}
+});
 async function applyAtNextBoot(meta, changes, by, cfg, p, whileStopped) {
-  const wasRunning = pidAlive(meta.pid);
+  const wasRunning = vmAlive(meta);
   if (wasRunning) {
     await shutdown(meta, cfg, p, 1e4);
-    await rm2(p.machine(meta.owner, meta.name).memBase, { force: true });
+    await rm(p.machine(meta.owner, meta.name).memBase, { force: true });
   }
   const updated = { ...meta, ...changes, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(updated, p);
@@ -2230,7 +2172,7 @@ function assertNotHibernated(meta, p) {
     throw new KvboxError(`${stateMessage(meta, "hibernated")}; its memory image was made with its current shape and base: kvbox wake ${shown(meta)} first`);
   }
 }
-async function updateMachine(ref, p = paths()) {
+var updateMachine = locked(async function updateMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   assertNotHibernated(meta, p);
@@ -2239,8 +2181,8 @@ async function updateMachine(ref, p = paths()) {
   if (base.version === meta.base) return toMachine(meta, p);
   await assertOverlayCapable(base.file, base.version);
   return applyAtNextBoot(meta, { base: base.version }, "update", cfg, p);
-}
-async function rescaleMachine(ref, req, p = paths()) {
+});
+var rescaleMachine = locked(async function rescaleMachine2(ref, req, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   assertNotHibernated(meta, p);
@@ -2261,7 +2203,14 @@ async function rescaleMachine(ref, req, p = paths()) {
   const growTo = target.diskGib > currentDiskGib ? target.diskGib : void 0;
   if (Object.keys(changes).length === 0 && growTo === void 0) return toMachine(meta, p);
   return applyAtNextBoot(meta, changes, "rescale", cfg, p, growTo === void 0 ? void 0 : () => growDisk(disk, growTo));
-}
+});
+var setMachine = locked(async function setMachine2(ref, req, p = paths()) {
+  const meta = await readMeta(ref, p);
+  const next = { ...meta };
+  if (req.autoHibernateSec !== void 0) next.autoHibernateSec = req.autoHibernateSec || void 0;
+  await writeMachineMeta(next, p);
+  return toMachine(next, p);
+});
 async function growDisk(file, gib) {
   await truncate(file, gib * 1024 ** 3);
   await run(["e2fsck", "-f", "-p", file], { okExitCodes: [1] });
@@ -2275,12 +2224,369 @@ async function readMeta(ref, p) {
     throw err;
   }
 }
-async function destroyMachine(ref, p = paths()) {
+var destroyMachine = locked(async function destroyMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   await shutdown(meta, cfg, p, 2e3);
   recordState(meta, "stopped", "rm", p);
-  await rm2(p.machine(ref.owner, ref.name).dir, { recursive: true, force: true });
+  await rm(p.machine(ref.owner, ref.name).dir, { recursive: true, force: true });
+});
+var RECOVERY_CONCURRENCY = 2;
+async function settleDeadBoxes(p = paths()) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const bootAt = hostBootTime()?.toISOString() ?? now;
+  const boot = [];
+  const leftStopped = [];
+  for (const meta of await readAllMeta(p)) {
+    if (!cutByReboot(meta) || vmAlive(meta)) continue;
+    try {
+      closeRunCutByBoot(meta.id, bootAt, now, p);
+    } catch (err) {
+      console.error(`warning: usage ledger: ${err.message}`);
+    }
+    await rm(p.machine(meta.owner, meta.name).memBase, { force: true });
+    if (meta.paused) {
+      await writeMachineMeta({ ...meta, pid: null, bootId: void 0, memSnapshots: void 0, paused: void 0 }, p);
+      leftStopped.push(refKey(meta));
+    } else {
+      await writeMachineMeta({ ...meta, memSnapshots: void 0 }, p);
+      boot.push({ owner: meta.owner, name: meta.name });
+    }
+  }
+  return { boot, leftStopped };
+}
+function cutByReboot(meta) {
+  return meta.pid !== null && meta.bootId !== currentBootId();
+}
+var recovery = null;
+var recoveryStopping = false;
+var recoveryRun = Promise.resolve();
+function lastRecovery() {
+  return recovery;
+}
+async function stopRecovery() {
+  recoveryStopping = true;
+  await recoveryRun;
+}
+async function bootRecovered(settled, p = paths()) {
+  const refs = settled.boot;
+  if (refs.length === 0 && settled.leftStopped.length === 0) return null;
+  const booted = [];
+  const failed = [];
+  const queue = [...refs];
+  const worker = async () => {
+    for (let ref = queue.shift(); ref !== void 0 && !recoveryStopping; ref = queue.shift()) {
+      try {
+        if (!cutByReboot(await readMeta(ref, p))) continue;
+        await startMachine(ref, p);
+        booted.push(refKey(ref));
+      } catch (err) {
+        failed.push({ box: refKey(ref), error: err.message });
+      }
+    }
+  };
+  const run2 = Promise.all(Array.from({ length: Math.min(RECOVERY_CONCURRENCY, refs.length) }, worker));
+  recoveryRun = run2;
+  await run2;
+  recovery = { at: (/* @__PURE__ */ new Date()).toISOString(), booted, leftStopped: [...settled.leftStopped], failed };
+  return recovery;
+}
+
+// src/core/relay.ts
+import { chmod as chmod3, mkdir as mkdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
+
+// ../shared/src/relay.ts
+import { z as z5 } from "zod";
+var RELAY_TUNNEL_GATEWAY = "10.77.0.1";
+var IPV4_RE = /^(\d{1,3})(\.\d{1,3}){3}$/;
+var WG_KEY_RE = /^[A-Za-z0-9+/]{43}=$/;
+var RelayJoinSchema = z5.object({
+  v: z5.literal(1),
+  /** How the relay lists this host. */
+  name: z5.string().regex(/^[a-z0-9][a-z0-9-]{0,30}$/),
+  /** `<relay-primary-ip>:<port>`, the WireGuard endpoint the host dials. */
+  relay: z5.string().regex(/^(\d{1,3})(\.\d{1,3}){3}:\d{1,5}$/),
+  /** The relay's WireGuard public key. */
+  relayKey: z5.string().regex(WG_KEY_RE),
+  /** This host's address inside the tunnel. */
+  tunnelIp: z5.string().regex(IPV4_RE),
+  /** This host's WireGuard private key, generated on the relay, kept nowhere else. */
+  privateKey: z5.string().regex(WG_KEY_RE),
+  /** The extra public IPv4 the relay owns for this host; what the host advertises to the control plane. */
+  publicIp: z5.string().regex(IPV4_RE)
+});
+function decodeRelayJoin(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(text.trim(), "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  const res = RelayJoinSchema.safeParse(parsed);
+  return res.success ? res.data : null;
+}
+
+// src/core/relay.ts
+function relayConf(join2) {
+  return [
+    "# kvbox relay tunnel: made by `kvbox server relay`, installed by net-setup.sh. Do not edit.",
+    "[Interface]",
+    `PrivateKey = ${join2.privateKey}`,
+    `Address = ${join2.tunnelIp}/32`,
+    "",
+    "[Peer]",
+    `PublicKey = ${join2.relayKey}`,
+    `Endpoint = ${join2.relay}`,
+    // Only the relay's own tunnel address goes through the tunnel: the host keeps its normal internet
+    // route, and the relay SNATs forwarded connections so their replies come back this way.
+    `AllowedIPs = ${RELAY_TUNNEL_GATEWAY}/32`,
+    // The router forgets an idle outbound mapping; a packet every 25 s keeps the relay able to reach us.
+    "PersistentKeepalive = 25",
+    ""
+  ].join("\n");
+}
+async function useRelay(joinString, p = paths()) {
+  const join2 = decodeRelayJoin(joinString);
+  if (!join2) throw new KvboxError("that is not a relay join string; copy the whole line `kvbox-relay add` printed on the relay");
+  const cfg = await loadConfig(p);
+  if (cfg.relay && cfg.relay.name !== join2.name) {
+    throw new KvboxError(`this host already goes through relay ${cfg.relay.name} (${cfg.relay.publicIp}); run kvbox server relay off first`);
+  }
+  if (cfg.relay && cfg.relay.publicIp !== join2.publicIp && cfg.controlPlane?.advertise === cfg.relay.publicIp) {
+    throw new KvboxError(
+      `${cfg.controlPlane.name} reaches this host at ${cfg.relay.publicIp}, not ${join2.publicIp}; run kvbox server leave first, then join again`
+    );
+  }
+  await mkdir4(p.relay, { recursive: true, mode: 448 });
+  await writeFile4(p.relayConf, relayConf(join2), { mode: 384 });
+  await chmod3(p.relayConf, 384);
+  await netSetup(cfg, ["relay", "up", p.relayConf, String(cfg.controlPlane?.port ?? DEFAULT_HTTPS_PORT)]);
+  const relay = { name: join2.name, publicIp: join2.publicIp, tunnelIp: join2.tunnelIp, endpoint: join2.relay };
+  await saveConfig({ ...cfg, relay }, p);
+  return relay;
+}
+async function dropRelay(p = paths()) {
+  const cfg = await loadConfig(p);
+  const relay = cfg.relay;
+  if (!relay) throw new KvboxError("this host does not go through a relay");
+  if (cfg.controlPlane?.advertise === relay.publicIp) {
+    throw new KvboxError(`${cfg.controlPlane.name} reaches this host through the relay (${relay.publicIp}); run kvbox server leave first`);
+  }
+  await netSetup(cfg, ["relay", "down"]);
+  await rm2(p.relayConf, { force: true });
+  const { relay: _gone, ...rest } = cfg;
+  await saveConfig(rest, p);
+  return relay;
+}
+
+// src/core/idle.ts
+import { readFile as readFile6 } from "node:fs/promises";
+var HIBERNATE_CONCURRENCY = 2;
+async function tapTraffic(id) {
+  const dir = `/sys/class/net/${tapName(id)}/statistics`;
+  try {
+    const [rx, tx] = await Promise.all([readFile6(`${dir}/rx_bytes`, "utf8"), readFile6(`${dir}/tx_bytes`, "utf8")]);
+    return Number(rx) + Number(tx);
+  } catch {
+    return null;
+  }
+}
+async function hibernateIfRunning(box, p) {
+  const ref = { owner: box.owner, name: box.name };
+  return withBoxLock(ref, async () => {
+    if ((await getMachine(ref, p)).status !== "running") return false;
+    await hibernateMachine(ref, p, "auto-hibernate");
+    return true;
+  });
+}
+function startIdleWatch(opts = {}) {
+  const intervalMs = opts.intervalMs ?? 6e4;
+  const p = opts.p ?? paths();
+  const list = opts.list ?? (() => listMachines(null, p));
+  const traffic = opts.traffic ?? tapTraffic;
+  const hibernate = opts.hibernate ?? ((box) => hibernateIfRunning(box, p));
+  const busy = opts.busy ?? ((box) => boxBusy(box));
+  const now = opts.now ?? Date.now;
+  const log = opts.log ?? ((line) => console.log(line));
+  const seen = /* @__PURE__ */ new Map();
+  let timer;
+  let stopped = false;
+  const inflight = /* @__PURE__ */ new Set();
+  const hibernateOne = async (box, quiet, bytes, t) => {
+    inflight.add(box.id);
+    try {
+      if (await hibernate(box)) log(`box ${box.owner}/${box.name}: no network traffic for ${quiet} min; hibernated it (kvbox connect wakes it)`);
+      seen.delete(box.id);
+    } catch (err) {
+      log(`warning: box ${box.owner}/${box.name}: could not hibernate it after ${quiet} min without traffic: ${err.message}`);
+      seen.set(box.id, { bytes, since: t });
+    } finally {
+      inflight.delete(box.id);
+    }
+  };
+  const check = async () => {
+    const started = [];
+    const watched = /* @__PURE__ */ new Set();
+    for (const box of await list()) {
+      if (!box.autoHibernateSec || box.status !== "running") continue;
+      if (inflight.has(box.id)) {
+        watched.add(box.id);
+        continue;
+      }
+      const bytes = await traffic(box.id);
+      if (bytes === null) continue;
+      watched.add(box.id);
+      const t = now();
+      const last = seen.get(box.id);
+      if (!last || last.bytes !== bytes || busy(box)) {
+        seen.set(box.id, { bytes, since: t });
+        continue;
+      }
+      if (t - last.since < box.autoHibernateSec * 1e3) continue;
+      if (inflight.size >= HIBERNATE_CONCURRENCY) continue;
+      started.push(hibernateOne(box, Math.round((t - last.since) / 6e4), bytes, t));
+    }
+    for (const id of seen.keys()) if (!watched.has(id)) seen.delete(id);
+    return started;
+  };
+  const round2 = async () => {
+    await Promise.all(await check());
+  };
+  const schedule = () => {
+    if (stopped) return;
+    timer = setTimeout(() => void check().catch((err) => log(`warning: idle watch: ${err.message}`)).finally(schedule), intervalMs);
+    timer.unref();
+  };
+  schedule();
+  return {
+    stop: () => {
+      stopped = true;
+      clearTimeout(timer);
+    },
+    round: round2
+  };
+}
+
+// src/core/relayWatch.ts
+var report = { restarts: 0, lastRestartAt: null };
+function relayWatchReport() {
+  return report;
+}
+async function pingRelay() {
+  try {
+    await run(["ping", "-c", "1", "-W", "3", RELAY_TUNNEL_GATEWAY], { timeoutMs: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function startRelayWatch(opts = {}) {
+  const intervalMs = opts.intervalMs ?? 3e4;
+  const misses = opts.misses ?? 3;
+  const probe = opts.probe ?? pingRelay;
+  const p = opts.p ?? paths();
+  const log = opts.log ?? ((line) => console.log(line));
+  const restart = opts.restart ?? (async () => netSetup(await loadConfig(p), ["relay", "restart"]));
+  report = { restarts: 0, lastRestartAt: null };
+  let missed = 0;
+  let stuck = false;
+  let timer;
+  let stopped = false;
+  const round2 = async () => {
+    const cfg = await loadConfig(p).catch(() => null);
+    if (!cfg?.relay) {
+      missed = 0;
+      return;
+    }
+    if (await probe()) {
+      if (stuck) log(`relay ${cfg.relay.name}: the tunnel carries traffic again`);
+      missed = 0;
+      stuck = false;
+      return;
+    }
+    if (++missed < misses) return;
+    missed = 0;
+    if (!stuck) log(`relay ${cfg.relay.name}: no answer through the tunnel for ${misses * intervalMs / 1e3} s; restarting it`);
+    try {
+      await restart();
+      report = { restarts: report.restarts + 1, lastRestartAt: (/* @__PURE__ */ new Date()).toISOString() };
+    } catch (err) {
+      if (!stuck) console.error(`warning: relay ${cfg.relay.name}: could not restart the tunnel: ${err.message}`);
+    }
+    stuck = true;
+  };
+  const schedule = () => {
+    if (stopped) return;
+    timer = setTimeout(() => void round2().catch((err) => console.error(`warning: relay watch: ${err.message}`)).finally(schedule), intervalMs);
+    timer.unref();
+  };
+  schedule();
+  return () => {
+    stopped = true;
+    clearTimeout(timer);
+  };
+}
+
+// src/listen.ts
+import { readFile as readFile7, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
+import { createServer as createHttpsServer } from "node:https";
+import { createAdaptorServer } from "@hono/node-server";
+
+// src/app.ts
+import { Hono as Hono6 } from "hono";
+
+// ../shared/src/version.ts
+import { createRequire } from "node:module";
+function versionOf(srcFileUrl, injected) {
+  if (typeof injected === "string") return injected;
+  try {
+    const require2 = createRequire(srcFileUrl);
+    return require2("../package.json").version;
+  } catch {
+    return "0.0.0-dev";
+  }
+}
+
+// src/version.ts
+var VERSION = versionOf(import.meta.url, true ? "0.5.10" : void 0);
+
+// src/caller.ts
+import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+var OWNER_HEADER = "x-kvbox-owner";
+function resolveCaller(opts = {}) {
+  const cp = opts.controlPlane;
+  if (!cp) {
+    return async (c, next) => {
+      const cfg = await loadConfig();
+      c.set("owner", cfg.owner);
+      c.set("listScope", cfg.owner);
+      await next();
+    };
+  }
+  const expected = digest(cp.secret);
+  return async (c, next) => {
+    const m = /^Bearer\s+(\S+)$/i.exec(c.req.header("authorization") ?? "");
+    if (!m || !timingSafeEqual(digest(m[1]), expected)) return c.json({ error: "not authorized" }, 401);
+    const user = c.req.header(OWNER_HEADER);
+    if (user === void 0) {
+      const path = c.req.path.replace(/\/$/, "");
+      const realmListing = c.req.method === "GET" && (path === "/machines" || path === "/snapshots");
+      if (!realmListing && /^\/(machines|snapshots)(\/|$)/.test(c.req.path)) {
+        return c.json({ error: "X-Kvbox-Owner header required" }, 400);
+      }
+      c.set("owner", "");
+      c.set("listScope", { realm: cp.name });
+    } else {
+      if (!LOCAL_OWNER_RE.test(user)) return c.json({ error: "X-Kvbox-Owner: letters, digits, '.', '_', '-'" }, 400);
+      const owner = `${user}@${cp.name}`;
+      c.set("owner", owner);
+      c.set("listScope", owner);
+    }
+    await next();
+  };
+}
+function digest(secret) {
+  return createHash2("sha256").update(secret).digest();
 }
 
 // src/routes/capacity.ts
@@ -2329,6 +2635,10 @@ function machineRoutes() {
     const body = RescaleMachineRequest.parse(await c.req.json().catch(() => ({})));
     return c.json(await rescaleMachine(parseRef(c.req.param("name"), c.get("owner")), body));
   });
+  r.post("/:name/set", async (c) => {
+    const body = SetMachineRequest.parse(await c.req.json().catch(() => ({})));
+    return c.json(await setMachine(parseRef(c.req.param("name"), c.get("owner")), body));
+  });
   r.post("/:name/ssh-keys", async (c) => {
     const body = SetSshKeysRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!body.success) throw new KvboxError("sshKeys: expected a list of authorized_keys lines");
@@ -2402,8 +2712,12 @@ async function saveSnapshot(req, owner, p = paths()) {
   if (!NAME_RE2.test(req.name)) {
     throw new KvboxError(`invalid snapshot name "${req.name}": 1-64 chars, lowercase letters, digits, '.', '_' and '-', starting with a letter or digit`);
   }
-  const box = await readBox(parseRef(req.box, owner), p);
-  if (!pidAlive(box.pid)) {
+  const ref = parseRef(req.box, owner);
+  return withBoxLock(ref, () => snapshotBox(ref, req, owner, p));
+}
+async function snapshotBox(ref, req, owner, p) {
+  const box = await readBox(ref, p);
+  if (!vmAlive(box)) {
     if (existsSync3(p.machine(box.owner, box.name).hibernateVmstate)) {
       throw new KvboxError(`box ${req.box} is hibernated; a snapshot freezes a running box (kvbox wake ${req.box} first)`);
     }
@@ -2549,7 +2863,8 @@ function createApp(opts = {}) {
       base: await currentBaseVersion().catch(() => null),
       owner: cfg.owner,
       controlPlane: cp ? { name: cp.name, url: cp.url, hostUrl: `https://${cp.advertise}:${cp.port}` } : null,
-      relay: cfg.relay ? { name: cfg.relay.name, publicIp: cfg.relay.publicIp, endpoint: cfg.relay.endpoint } : null
+      relay: cfg.relay ? { name: cfg.relay.name, publicIp: cfg.relay.publicIp, endpoint: cfg.relay.endpoint, ...relayWatchReport() } : null,
+      recovery: lastRecovery()
     });
   });
   app.route("/machines", machineRoutes());
@@ -2589,7 +2904,7 @@ async function listen(opts = {}) {
   let httpsServer;
   const cp = cfg.controlPlane;
   if (cp) {
-    const [key, cert] = await Promise.all([readFile6(p.tlsKey), readFile6(p.tlsCert)]).catch((err) => {
+    const [key, cert] = await Promise.all([readFile7(p.tlsKey), readFile7(p.tlsCert)]).catch((err) => {
       throw new KvboxError(`joined ${cp.name} but the host's certificate is missing (${err.message}); run kvbox-server leave, then join again`);
     });
     httpsServer = createAdaptorServer({
@@ -2621,6 +2936,7 @@ async function listen(opts = {}) {
   const shutdown2 = async () => {
     server.close();
     httpsServer?.close();
+    await stopRecovery();
     await rm4(socketPath, { force: true });
     await rm4(p.serverPid, { force: true });
     process.exit(0);
@@ -2634,6 +2950,7 @@ async function listen(opts = {}) {
 var program = new Command("kvbox-server").description("kvbox host daemon: owns Firecracker and ~/.kvbox, serves the kvbox API").version(VERSION, "-v, --version").showHelpAfterError();
 program.command("start", { isDefault: true }).description("serve the API on the local Unix socket (foreground)").option("--socket <path>", "socket to listen on (default: $KVBOX_HOME/server.sock)").action(async (opts) => {
   await requireKvm();
+  const settled = await settleDeadBoxes(paths());
   const { socketPath, https } = await listen(opts.socket ? { socketPath: opts.socket } : {});
   console.log(`kvbox-server ${VERSION} listening on ${socketPath} (pid ${process.pid})`);
   if (https) {
@@ -2647,6 +2964,14 @@ program.command("start", { isDefault: true }).description("serve the API on the
   } catch (err) {
     console.error(`warning: host network not ready (${err.message}); run: kvbox-server net up`);
   }
+  startRelayWatch();
+  startIdleWatch();
+  const recovery2 = await bootRecovered(settled, paths());
+  if (recovery2) {
+    for (const box of recovery2.booted) console.log(`box ${box} was running when it went down; booted it again`);
+    for (const box of recovery2.leftStopped) console.log(`box ${box} was in standby when it went down; its memory is gone, left stopped`);
+    for (const f of recovery2.failed) console.error(`warning: box ${f.box} was running when it went down and did not come back: ${f.error}`);
+  }
 });
 program.command("join <control-plane-url>").description("register this host with a control plane (needs a one-time token minted there); it answers the control plane from its next start").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this host at (default: this host's default-route address)").option("--name <name>", "how the control plane lists this host (default: hostname)").action(async (url, opts) => {
   const joined = await joinControlPlane({ url, ...opts }, paths());