@omnitron-dev/omnitron 0.1.3 → 0.2.0

package/dist/daemon/pid-manager.d.ts

@@ -3,13 +3,32 @@
  *
  * Prevents duplicate daemons and enables daemon discovery.
  * Also handles stale PID/socket cleanup for robust restart.
+ *
+ * T#56 hardening — PID reuse detection
+ * ------------------------------------
+ * `process.kill(pid, 0)` only answers "is SOMETHING alive at this
+ * pid", not "is OUR daemon alive at this pid". After a daemon crash
+ * the kernel will eventually recycle the pid for an unrelated
+ * process (a Chrome tab, a Node REPL, whatever). The old pid file
+ * still pointed at it, so `omnitron daemon start` falsely reported
+ * "daemon already running" and refused to come up.
+ *
+ * Fix: write a signature alongside the pid (the daemon's argv[1] —
+ * the entry-point script path). On read, after pid-alive, verify
+ * the process at that pid actually has a matching argv. We read
+ * argv via `/proc/<pid>/cmdline` on Linux and `ps -p <pid> -o args=`
+ * on macOS / BSD; both are read-only and fast. If we can't tell
+ * either way (privilege issue, exotic platform), fall back to the
+ * pid-only check — strictly an improvement over the historical
+ * behaviour.
  */
 export declare class PidManager {
     private readonly pidFile;
     constructor(pidFile: string);
     /**
      * Check if another daemon is already running.
-     * Uses process.kill(pid, 0) to verify liveness.
+     * Uses process.kill(pid, 0) to verify liveness AND argv signature
+     * to verify the live process is actually the same daemon.
      */
     isRunning(): boolean;
     /**
@@ -22,7 +41,12 @@ export declare class PidManager {
      */
     readPid(): number | null;
     /**
-     * Write current process PID
+     * Read the signature line from the pidfile, if present.
+     * Returns null for legacy (pid-only) files.
+     */
+    private readSignature;
+    /**
+     * Write current process PID + signature.
      */
     write(): void;
     /**
@@ -31,13 +55,40 @@ export declare class PidManager {
     remove(): void;
     /**
      * Clean up stale PID file and optionally a socket file.
-     * Called when PID file exists but process is dead.
+     * Called when PID file exists but process is dead OR the live
+     * process is a pid-reused stranger.
      * Returns true if stale state was found and cleaned.
      */
     cleanupStale(socketPath?: string): boolean;
     /**
-     * Check if a process with given PID is alive.
+     * Check if a process with given PID is alive. Thin delegate to
+     * the shared helper in `@omnitron-dev/titan/utils` — kept on
+     * `PidManager` as a static so existing call sites continue to
+     * work, but the actual semantic (EPERM-as-alive,
+     * invalid-pid-as-dead) lives in one place. Pre-fix this
+     * version caught ALL errors as dead and so mis-classified
+     * processes owned by another uid (EPERM) as crashed —
+     * potentially triggering false-positive restarts in
+     * multi-tenant supervisors.
      */
     static isProcessAlive(pid: number): boolean;
+    /**
+     * The signature this daemon will record in its pidfile. Currently
+     * the absolute entry-point script path (argv[1]). Two daemon
+     * processes with the same script path are treated as the same
+     * service for pid-reuse purposes, which is the right granularity
+     * for omnitron.
+     */
+    static currentSignature(): string;
+    /**
+     * Best-effort argv check against the recorded signature.
+     *
+     * Returns true if we positively verified a match, false if we
+     * positively verified a mismatch (pid was reused), and — to err
+     * on the safe side — true if we couldn't read argv at all. The
+     * "unknown → assume same" fallback preserves the legacy behaviour
+     * for platforms where we can't introspect the live process.
+     */
+    static processArgvMatches(pid: number, expectedSignature: string): boolean;
 }
 //# sourceMappingURL=pid-manager.d.ts.map

package/dist/daemon/pid-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pid-manager.d.ts","sourceRoot":"","sources":["../../src/daemon/pid-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM;IAE5C;;;OAGG;IACH,SAAS,IAAI,OAAO;IAMpB;;OAEG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI;IAMvB;;;OAGG;IACH,OAAO,IAAI,MAAM,GAAG,IAAI;IAUxB;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,MAAM,IAAI,IAAI;IAQd;;;;OAIG;IACH,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO;IAqB1C;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAQ5C"}
+{"version":3,"file":"pid-manager.d.ts","sourceRoot":"","sources":["../../src/daemon/pid-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM;IAE5C;;;;OAIG;IACH,SAAS,IAAI,OAAO;IAapB;;OAEG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI;IAMvB;;;OAGG;IACH,OAAO,IAAI,MAAM,GAAG,IAAI;IAcxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAUrB;;OAEG;IACH,KAAK,IAAI,IAAI;IAOb;;OAEG;IACH,MAAM,IAAI,IAAI;IAQd;;;;;OAKG;IACH,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO;IAuB1C;;;;;;;;;;OAUG;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI3C;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,IAAI,MAAM;IAIjC;;;;;;;;OAQG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO;CAmC3E"}

package/dist/daemon/pid-manager.js

@@ -3,9 +3,29 @@
  *
  * Prevents duplicate daemons and enables daemon discovery.
  * Also handles stale PID/socket cleanup for robust restart.
+ *
+ * T#56 hardening — PID reuse detection
+ * ------------------------------------
+ * `process.kill(pid, 0)` only answers "is SOMETHING alive at this
+ * pid", not "is OUR daemon alive at this pid". After a daemon crash
+ * the kernel will eventually recycle the pid for an unrelated
+ * process (a Chrome tab, a Node REPL, whatever). The old pid file
+ * still pointed at it, so `omnitron daemon start` falsely reported
+ * "daemon already running" and refused to come up.
+ *
+ * Fix: write a signature alongside the pid (the daemon's argv[1] —
+ * the entry-point script path). On read, after pid-alive, verify
+ * the process at that pid actually has a matching argv. We read
+ * argv via `/proc/<pid>/cmdline` on Linux and `ps -p <pid> -o args=`
+ * on macOS / BSD; both are read-only and fast. If we can't tell
+ * either way (privilege issue, exotic platform), fall back to the
+ * pid-only check — strictly an improvement over the historical
+ * behaviour.
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { isProcessAlive } from '@omnitron-dev/titan/utils';
 export class PidManager {
     pidFile;
     constructor(pidFile) {
@@ -13,13 +33,22 @@ export class PidManager {
     }
     /**
      * Check if another daemon is already running.
-     * Uses process.kill(pid, 0) to verify liveness.
+     * Uses process.kill(pid, 0) to verify liveness AND argv signature
+     * to verify the live process is actually the same daemon.
      */
     isRunning() {
         const pid = this.readPid();
         if (pid === null)
             return false;
-        return PidManager.isProcessAlive(pid);
+        if (!PidManager.isProcessAlive(pid))
+            return false;
+        // T#56: pid is alive — but is it actually OUR daemon? If we
+        // recorded a signature and it doesn't match, treat as stale.
+        const recordedSignature = this.readSignature();
+        if (recordedSignature && !PidManager.processArgvMatches(pid, recordedSignature)) {
+            return false;
+        }
+        return true;
     }
     /**
      * Get the PID of the running daemon (only if alive).
@@ -28,7 +57,7 @@ export class PidManager {
         const pid = this.readPid();
         if (pid === null)
             return null;
-        return PidManager.isProcessAlive(pid) ? pid : null;
+        return this.isRunning() ? pid : null;
     }
     /**
      * Get the raw PID from file (even if process is dead).
@@ -36,8 +65,12 @@ export class PidManager {
      */
     readPid() {
         try {
-            const pidStr = fs.readFileSync(this.pidFile, 'utf-8').trim();
-            const pid = parseInt(pidStr, 10);
+            const raw = fs.readFileSync(this.pidFile, 'utf-8').trim();
+            // Backward-compat: legacy pidfiles contain only the pid; the
+            // T#56 format is `<pid>\n<signature>`. Either way `parseInt`
+            // on the first non-empty line returns the right thing.
+            const firstLine = raw.split('\n')[0]?.trim() ?? '';
+            const pid = parseInt(firstLine, 10);
             return isNaN(pid) ? null : pid;
         }
         catch {
@@ -45,12 +78,27 @@ export class PidManager {
         }
     }
     /**
-     * Write current process PID
+     * Read the signature line from the pidfile, if present.
+     * Returns null for legacy (pid-only) files.
+     */
+    readSignature() {
+        try {
+            const raw = fs.readFileSync(this.pidFile, 'utf-8');
+            const second = raw.split('\n')[1]?.trim();
+            return second && second.length > 0 ? second : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Write current process PID + signature.
      */
     write() {
         const dir = path.dirname(this.pidFile);
         fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(this.pidFile, String(process.pid), 'utf-8');
+        const signature = PidManager.currentSignature();
+        fs.writeFileSync(this.pidFile, `${process.pid}\n${signature}\n`, 'utf-8');
     }
     /**
      * Remove PID file
@@ -65,17 +113,20 @@ export class PidManager {
     }
     /**
      * Clean up stale PID file and optionally a socket file.
-     * Called when PID file exists but process is dead.
+     * Called when PID file exists but process is dead OR the live
+     * process is a pid-reused stranger.
      * Returns true if stale state was found and cleaned.
      */
     cleanupStale(socketPath) {
         const rawPid = this.readPid();
         if (rawPid === null)
             return false;
-        // If process is still alive, not stale
-        if (PidManager.isProcessAlive(rawPid))
+        // T#56: treat both "no process alive" and "different process is
+        // alive at this pid" as stale. The old logic only handled the
+        // dead-process case, so a recycled pid sat in the file forever.
+        if (this.isRunning())
             return false;
-        // Process is dead — clean up stale files
+        // Stale — clean up.
         this.remove();
         if (socketPath) {
             try {
@@ -88,16 +139,72 @@ export class PidManager {
         return true;
     }
     /**
-     * Check if a process with given PID is alive.
+     * Check if a process with given PID is alive. Thin delegate to
+     * the shared helper in `@omnitron-dev/titan/utils` — kept on
+     * `PidManager` as a static so existing call sites continue to
+     * work, but the actual semantic (EPERM-as-alive,
+     * invalid-pid-as-dead) lives in one place. Pre-fix this
+     * version caught ALL errors as dead and so mis-classified
+     * processes owned by another uid (EPERM) as crashed —
+     * potentially triggering false-positive restarts in
+     * multi-tenant supervisors.
      */
     static isProcessAlive(pid) {
-        try {
-            process.kill(pid, 0);
+        return isProcessAlive(pid);
+    }
+    /**
+     * The signature this daemon will record in its pidfile. Currently
+     * the absolute entry-point script path (argv[1]). Two daemon
+     * processes with the same script path are treated as the same
+     * service for pid-reuse purposes, which is the right granularity
+     * for omnitron.
+     */
+    static currentSignature() {
+        return process.argv[1] ?? '';
+    }
+    /**
+     * Best-effort argv check against the recorded signature.
+     *
+     * Returns true if we positively verified a match, false if we
+     * positively verified a mismatch (pid was reused), and — to err
+     * on the safe side — true if we couldn't read argv at all. The
+     * "unknown → assume same" fallback preserves the legacy behaviour
+     * for platforms where we can't introspect the live process.
+     */
+    static processArgvMatches(pid, expectedSignature) {
+        if (!expectedSignature)
             return true;
+        // Linux: /proc/<pid>/cmdline is null-separated argv.
+        if (process.platform === 'linux') {
+            try {
+                const buf = fs.readFileSync(`/proc/${pid}/cmdline`);
+                const argv = buf.toString('utf-8').split('\0').filter(Boolean);
+                return argv.includes(expectedSignature);
+            }
+            catch {
+                return true; // unknown — assume the same daemon
+            }
         }
-        catch {
-            return false;
+        // macOS / BSD: shell out to `ps`. -o args= prints the command
+        // line; bounded output, ms-scale, safe to call in this rare path.
+        if (process.platform === 'darwin' || process.platform.includes('bsd')) {
+            try {
+                const res = spawnSync('ps', ['-p', String(pid), '-o', 'args='], {
+                    encoding: 'utf-8',
+                    timeout: 2_000,
+                });
+                if (res.status === 0 && typeof res.stdout === 'string') {
+                    return res.stdout.includes(expectedSignature);
+                }
+            }
+            catch {
+                /* fall through */
+            }
+            return true;
         }
+        // Windows / other — no portable cheap check; preserve legacy
+        // pid-only semantics.
+        return true;
     }
 }
 //# sourceMappingURL=pid-manager.js.map

package/dist/daemon/pid-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"pid-manager.js","sourceRoot":"","sources":["../../src/daemon/pid-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD;;;OAGG;IACH,SAAS;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,UAAmB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAElC,uCAAuC;QACvC,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpD,yCAAyC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,GAAW;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"pid-manager.js","sourceRoot":"","sources":["../../src/daemon/pid-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD;;;;OAIG;IACH,SAAS;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,4DAA4D;QAC5D,6DAA6D;QAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/C,IAAI,iBAAiB,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,6DAA6D;YAC7D,6DAA6D;YAC7D,uDAAuD;YACvD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,aAAa;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC1C,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAmB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAElC,gEAAgE;QAChE,8DAA8D;QAC9D,gEAAgE;QAChE,IAAI,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,KAAK,CAAC;QAEnC,oBAAoB;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,cAAc,CAAC,GAAW;QAC/B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB;QACrB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAW,EAAE,iBAAyB;QAC9D,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAEpC,qDAAqD;QACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,mCAAmC;YAClD,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,kEAAkE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;oBAC9D,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACvD,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6DAA6D;QAC7D,sBAAsB;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/daemon/state-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../../src/daemon/state-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,iBAAiB,EAAE,CAAC;CAC3B;AAED,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAE9C,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAMjC,IAAI,IAAI,cAAc,GAAG,IAAI;IAS7B,KAAK,IAAI,IAAI;CAOd"}
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../../src/daemon/state-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,iBAAiB,EAAE,CAAC;CAC3B;AAED,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAE9C,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAwCjC,IAAI,IAAI,cAAc,GAAG,IAAI;IAS7B,KAAK,IAAI,IAAI;CAOd"}

package/dist/daemon/state-store.js

@@ -3,6 +3,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { randomBytes } from 'node:crypto';
 export class StateStore {
     stateFile;
     constructor(stateFile) {
@@ -11,7 +12,48 @@ export class StateStore {
     save(state) {
         const dir = path.dirname(this.stateFile);
         fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(this.stateFile, JSON.stringify(state, null, 2), 'utf-8');
+        // T#55: write atomically — `writeFileSync(stateFile, ...)` was a
+        // direct overwrite that left the file half-written if the
+        // daemon was SIGKILL'd mid-flush. The next boot's `load()` then
+        // saw truncated JSON, `JSON.parse` threw, and the daemon lost
+        // the entire process registry (returned `null` and started from
+        // scratch — every supervised app was treated as new).
+        //
+        // The standard POSIX recipe is:
+        //   1. write payload to a SIBLING temp file in the same dir;
+        //   2. fsync(tmp) so the bytes reach disk, not just page cache;
+        //   3. rename(tmp, stateFile) — POSIX-atomic on one filesystem.
+        //
+        // Pick a unique temp suffix per call so concurrent calls (and
+        // stale temp files from a crashed earlier write) don't collide.
+        const payload = JSON.stringify(state, null, 2);
+        const tmp = `${this.stateFile}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
+        let fd;
+        try {
+            fd = fs.openSync(tmp, 'w');
+            fs.writeFileSync(fd, payload, 'utf-8');
+            // Force the data + metadata to disk before the rename so the
+            // post-crash visible state is "either old contents or new
+            // contents", never "renamed link to half-written bytes".
+            fs.fsyncSync(fd);
+            fs.closeSync(fd);
+            fd = undefined;
+            fs.renameSync(tmp, this.stateFile);
+        }
+        catch (err) {
+            // Best-effort cleanup of the temp file if anything went wrong;
+            // we already failed the save, no point hiding the failure.
+            if (fd !== undefined)
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* */ }
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch { /* already gone */ }
+            throw err;
+        }
     }
     load() {
         try {

package/dist/daemon/state-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/daemon/state-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,IAAI,CAAC,KAAqB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/daemon/state-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmB1C,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,IAAI,CAAC,KAAqB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,8DAA8D;QAC9D,gEAAgE;QAChE,sDAAsD;QACtD,EAAE;QACF,gCAAgC;QAChC,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,EAAE;QACF,8DAA8D;QAC9D,gEAAgE;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,6DAA6D;YAC7D,0DAA0D;YAC1D,yDAAyD;YACzD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,GAAG,SAAS,CAAC;YACf,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACxD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/infrastructure/container-runtime.d.ts

@@ -48,6 +48,16 @@ export declare function execInContainer(nameOrId: string, command: string[]): Pr
  * Wait for container health check to pass.
  */
 export declare function waitForHealthy(name: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * Create a Docker bridge network if it doesn't exist.
+ *
+ * Idempotent — `docker network create` exits non-zero with a recognisable
+ * "already exists" message when the network is present; we swallow that
+ * specific case and propagate everything else. Done via execFile rather
+ * than the adapter because the adapter doesn't expose network APIs and
+ * the call is rare (once per daemon startup per network).
+ */
+export declare function ensureNetwork(name: string): Promise<void>;
 /**
  * Create a Docker volume if it doesn't exist.
  */

package/dist/infrastructure/container-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-runtime.d.ts","sourceRoot":"","sources":["../../src/infrastructure/container-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmBrF;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO1D;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CA6BvE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBpF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwFhF;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpF;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD"}
+{"version":3,"file":"container-runtime.d.ts","sourceRoot":"","sources":["../../src/infrastructure/container-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAoDrF;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAM1D;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CA6BvE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAkBpF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0GhF;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvF;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpF;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD"}

package/dist/infrastructure/container-runtime.js

@@ -8,7 +8,7 @@
  * All Omnitron-managed containers are labeled with `omnitron.managed=true`.
  */
 // =============================================================================
-// Singleton DockerAdapter (lazy-loaded)
+// Singleton DockerAdapter (lazy-loaded, self-healing)
 // =============================================================================
 let _adapter = null;
 async function getAdapter() {
@@ -18,6 +18,39 @@ async function getAdapter() {
     _adapter = new DockerAdapter();
     return _adapter;
 }
+/**
+ * Patterns that mean "the docker daemon connection is gone" rather than
+ * "this specific operation failed". When we see one, we invalidate the
+ * cached adapter so the next call gets a fresh instance — without this,
+ * a docker-daemon restart would leave us forever trying to talk to a
+ * dead socket.
+ */
+const ADAPTER_DEAD_PATTERNS = /(?:cannot connect to the docker daemon|docker daemon is not running|connect ENOENT|connect ECONNREFUSED.*docker|EOF$|connection reset)/i;
+function isAdapterDeadError(err) {
+    if (!err)
+        return false;
+    const msg = err instanceof Error ? err.message : String(err);
+    return ADAPTER_DEAD_PATTERNS.test(msg);
+}
+/**
+ * Run `op` against the docker adapter. If it fails with an error that
+ * indicates the daemon connection is dead, invalidate the cached adapter
+ * and retry exactly once with a fresh one — recovering automatically
+ * from docker daemon restarts.
+ */
+async function withAdapter(op) {
+    const adapter = await getAdapter();
+    try {
+        return await op(adapter);
+    }
+    catch (err) {
+        if (!isAdapterDeadError(err))
+            throw err;
+        _adapter = null;
+        const fresh = await getAdapter();
+        return await op(fresh);
+    }
+}
 // =============================================================================
 // Public API
 // =============================================================================
@@ -26,8 +59,7 @@ async function getAdapter() {
  */
 export async function isDockerAvailable() {
     try {
-        const adapter = await getAdapter();
-        return adapter.isAvailable();
+        return await withAdapter((adapter) => adapter.isAvailable());
     }
     catch {
         return false;
@@ -37,30 +69,30 @@ export async function isDockerAvailable() {
  * List all Omnitron-managed containers.
  */
 export async function listManagedContainers() {
-    const adapter = await getAdapter();
     try {
-        // listContainers returns names; filter by inspecting labels
-        const allNames = await adapter.listContainers(true);
-        const managed = [];
-        for (const name of allNames) {
-            try {
-                const info = await adapter.inspectContainer(name);
-                const labels = info?.Config?.Labels ?? {};
-                if (labels['omnitron.managed'] === 'true') {
-                    managed.push({
-                        name: (info.Name ?? name).replace(/^\//, ''),
-                        image: info.Config?.Image ?? '',
-                        status: mapInspectStatus(info.State?.Status),
-                        containerId: info.Id?.slice(0, 12),
-                        health: mapInspectHealth(info.State?.Health?.Status),
-                    });
+        return await withAdapter(async (adapter) => {
+            const allNames = await adapter.listContainers(true);
+            const managed = [];
+            for (const name of allNames) {
+                try {
+                    const info = await adapter.inspectContainer(name);
+                    const labels = info?.Config?.Labels ?? {};
+                    if (labels['omnitron.managed'] === 'true') {
+                        managed.push({
+                            name: (info.Name ?? name).replace(/^\//, ''),
+                            image: info.Config?.Image ?? '',
+                            status: mapInspectStatus(info.State?.Status),
+                            containerId: info.Id?.slice(0, 12),
+                            health: mapInspectHealth(info.State?.Health?.Status),
+                        });
+                    }
+                }
+                catch {
+                    // Container may have been removed between list and inspect
                 }
             }
-            catch {
-                // Container may have been removed between list and inspect
-            }
-        }
-        return managed;
+            return managed;
+        });
     }
     catch {
         return [];
@@ -70,19 +102,20 @@ export async function listManagedContainers() {
  * Get state of a specific container by name.
  */
 export async function getContainerState(name) {
-    const adapter = await getAdapter();
     try {
-        const exists = await adapter.containerExists(name);
-        if (!exists)
-            return null;
-        const info = await adapter.inspectContainer(name);
-        return {
-            name: (info.Name ?? name).replace(/^\//, ''),
-            image: info.Config?.Image ?? '',
-            status: mapInspectStatus(info.State?.Status),
-            containerId: info.Id?.slice(0, 12),
-            health: mapInspectHealth(info.State?.Health?.Status),
-        };
+        return await withAdapter(async (adapter) => {
+            const exists = await adapter.containerExists(name);
+            if (!exists)
+                return null;
+            const info = await adapter.inspectContainer(name);
+            return {
+                name: (info.Name ?? name).replace(/^\//, ''),
+                image: info.Config?.Image ?? '',
+                status: mapInspectStatus(info.State?.Status),
+                containerId: info.Id?.slice(0, 12),
+                health: mapInspectHealth(info.State?.Health?.Status),
+            };
+        });
     }
     catch {
         return null;
@@ -95,6 +128,14 @@ export async function createContainer(config) {
     const { execFile } = await import('node:child_process');
     const { promisify } = await import('node:util');
     const execFileAsync = promisify(execFile);
+    // Ensure the managed network exists before we try to attach to it.
+    // Idempotent — `docker network create` errors with "already exists"
+    // when present, which we treat as success. Doing this here (rather
+    // than at daemon start) keeps the provisioner self-sufficient and
+    // means single-container test setups work without a manual prep step.
+    if (config.network) {
+        await ensureNetwork(config.network);
+    }
     // Ensure volumes exist
     for (const vol of config.volumes) {
         if (!vol.source.startsWith('/') && !vol.source.startsWith('.')) {
@@ -105,6 +146,14 @@ export async function createContainer(config) {
     await ensureImage(config.image);
     // Build docker run command directly — xec adapter can hang
     const args = ['docker', 'run', '-d', '--name', config.name];
+    // Network — explicit network avoids the default bridge, which
+    // accumulates phantom endpoints after dockerd restarts on macOS and
+    // blocks container recreation with "endpoint with name X already
+    // exists in network bridge". Falls back to docker's default when
+    // unspecified so single-container / no-stack usage still works.
+    if (config.network) {
+        args.push('--network', config.network);
+    }
     // Port mappings
     for (const p of config.ports) {
         args.push('-p', `${p.host}:${p.container}`);
@@ -241,6 +290,32 @@ export async function waitForHealthy(name, timeoutMs = 60_000) {
         return false;
     }
 }
+/**
+ * Create a Docker bridge network if it doesn't exist.
+ *
+ * Idempotent — `docker network create` exits non-zero with a recognisable
+ * "already exists" message when the network is present; we swallow that
+ * specific case and propagate everything else. Done via execFile rather
+ * than the adapter because the adapter doesn't expose network APIs and
+ * the call is rare (once per daemon startup per network).
+ */
+export async function ensureNetwork(name) {
+    const { execFile } = await import('node:child_process');
+    const { promisify } = await import('node:util');
+    const execFileAsync = promisify(execFile);
+    try {
+        await execFileAsync('docker', ['network', 'create', name, '--driver', 'bridge'], {
+            encoding: 'utf-8',
+            timeout: 15_000,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/already exists/i.test(msg))
+            return; // idempotent
+        throw err;
+    }
+}
 /**
  * Create a Docker volume if it doesn't exist.
  */