@serfab/cadre-host 0.12.0 → 1.0.0

package/src/bin/host.ts

@@ -102,6 +102,7 @@ program
   .option('--own-cadre', 'Also run the host\'s own personal cadre here (founder persona; default: donor-only)')
   .option('--system', 'System-wide install (not yet supported in v1)')
   .option('--node-path <path>', 'Override the node binary embedded in the service unit')
+  .option('--no-service', 'Write the data dir only; register no OS service (run the host with `cadre-host start`)')
   .action(async (opts: {
     nonInteractive?: boolean;
     dataDir?: string;
@@ -113,6 +114,7 @@ program
     ownCadre?: boolean;
     system?: boolean;
     nodePath?: string;
+    service?: boolean;
   }) => {
     const installer = new Installer();
     try {
@@ -127,11 +129,17 @@ program
         ownCadre: opts.ownCadre === true,
         system: Boolean(opts.system),
         ...(opts.nodePath ? { nodePath: opts.nodePath } : {}),
+        noService: opts.service === false,
       });
       console.log(`cadre-host installed.`);
       console.log(`  Data dir:     ${result.dataDir}`);
       console.log(`  UI:           ${result.uiUrl}`);
-      console.log(`  Service:      ${result.serviceName}`);
+      if (result.serviceName) {
+        console.log(`  Service:      ${result.serviceName}`);
+      } else {
+        console.log('  Service:      not registered (--no-service)');
+        console.log(`  Run the host: cadre-host start --data-dir "${result.dataDir}"`);
+      }
       if (result.enrollmentInvite) {
         printEnrollmentInvite(result.enrollmentInvite);
       }

package/src/donation/__tests__/donation-service.test.ts

@@ -95,7 +95,7 @@ function makeGrants(opts?: { maxNodes?: number }): { grants: GrantService; token
 const baseRequest = (grantToken: string) => ({
   grantToken,
   partyId: 'party-P',
-  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
   ownerKeys: [OWNER_KEY],
 });
 
@@ -129,6 +129,21 @@ describe('DonationService.provision', () => {
     expect(store.liveNodeCount(token)).toBe(1);
   });
 
+  // A phone has no address to give: it sends no bootstrap nodes and dials the lent
+  // node itself. The empty list is a real spawn input, forwarded and persisted as given.
+  it('provisions with no bootstrap nodes, forwarding and persisting the empty list', async () => {
+    const orch = new FakeOrchestrator();
+    const store = new DonationStore(join(tmpRoot, 'donations'));
+    const { grants, token } = makeGrants();
+    const svc = new DonationService({ orchestrator: orch, grants, store });
+
+    const view = await svc.provision({ ...baseRequest(token), bootstrapNodes: [] });
+
+    expect(view.status).toBe('awaiting_seed');
+    expect(orch.createCalls[0].bootstrapNodes).toEqual([]);
+    expect(store.get(view.id)?.bootstrapNodes).toEqual([]);
+  });
+
   /**
    * The pins are checked before the grant is even validated, so a typo costs the
    * requester nothing: no orchestrator call, no record, and — the point — no quota
@@ -395,6 +410,31 @@ describe('DonationService.applySeed', () => {
     expect(store.get(provisioned.id)).toEqual(before);
   });
 
+  // A 401 is the node refusing the HOST's bearer — it never looked at the seed —
+  // so it must not read as the requester's seed being untrusted.
+  it('reports a node that refuses the host credential as a credential fault, not a seed rejection', async () => {
+    const orch = new FakeOrchestrator();
+    const store = new DonationStore(join(tmpRoot, 'donations'));
+    const { grants, token } = makeGrants();
+    const svc = new DonationService({ orchestrator: orch, grants, store });
+
+    const provisioned = await svc.provision(baseRequest(token));
+    const before = store.get(provisioned.id)!;
+    globalThis.fetch = (async () => new Response(
+      JSON.stringify({ success: false, error: 'unauthorized' }),
+      { status: 401, headers: { 'content-type': 'application/json' } },
+    )) as typeof globalThis.fetch;
+
+    const err = await svc.applySeed(provisioned.id, 'encoded-seed').catch((e: unknown) => e);
+
+    expect(err).toBeInstanceOf(DonationError);
+    expect(err).toMatchObject({
+      code: 'seed_failed',
+      message: 'Donated node rejected the host\'s seed credential (401)',
+    });
+    expect(store.get(provisioned.id)).toEqual(before);
+  });
+
   it('lets a borrower terminate that lands mid-seed win', async () => {
     const orch = new FakeOrchestrator();
     const store = new DonationStore(join(tmpRoot, 'donations'));
@@ -509,7 +549,7 @@ describe('DonationService.respawn', () => {
     expect(orch.createCalls[1]).toMatchObject({
       containerId: provisioned.id,
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       pinnedOwnerKeys: [OWNER_KEY],
       profile: 'storage',
     });
@@ -564,6 +604,49 @@ describe('DonationService.respawn', () => {
     expect(store.get('grn_legacy')?.dockerId).toBe('dock_old');
   });
 
+  // The empty list a phone requester provisions with is a persisted spawn input like
+  // any other, so that loan must come back too.
+  it('respawns a record provisioned with no bootstrap nodes, replaying the empty list', async () => {
+    const orch = new FakeOrchestrator();
+    const store = new DonationStore(join(tmpRoot, 'donations'));
+    const { grants, token } = makeGrants();
+    const svc = new DonationService({ orchestrator: orch, grants, store });
+
+    const provisioned = await svc.provision({ ...baseRequest(token), bootstrapNodes: [] });
+    store.put({ ...store.get(provisioned.id)!, status: 'seeded' });
+
+    const result = await svc.respawn(provisioned.id);
+
+    expect(result).toMatchObject({ outcome: 'respawned' });
+    expect(orch.createCalls).toHaveLength(2);
+    expect(orch.createCalls[1].bootstrapNodes).toEqual([]);
+    expect(store.get(provisioned.id)?.dockerId).toBe('dock_2');
+  });
+
+  // Only the field's ABSENCE marks a record from before spawn inputs were persisted,
+  // so owner keys alone do not make a record replayable.
+  it('skips a record that has owner keys but no bootstrapNodes field', async () => {
+    const orch = new FakeOrchestrator();
+    const store = new DonationStore(join(tmpRoot, 'donations'));
+    const { grants, token } = makeGrants();
+    const svc = new DonationService({ orchestrator: orch, grants, store });
+
+    store.put({
+      id: 'grn_partial',
+      grantToken: token,
+      partyId: 'party-P',
+      ownerKeys: [OWNER_KEY],
+      profile: 'storage',
+      status: 'seeded',
+      dockerId: 'dock_old',
+      createdAt: '2025-01-01T00:00:00.000Z',
+      updatedAt: '2025-01-01T00:00:00.000Z',
+    });
+
+    await expect(svc.respawn('grn_partial')).resolves.toEqual({ outcome: 'not_respawnable' });
+    expect(orch.createCalls).toHaveLength(0);
+  });
+
   it('refuses to resurrect a terminated loan', async () => {
     const orch = new FakeOrchestrator();
     const store = new DonationStore(join(tmpRoot, 'donations'));
@@ -606,8 +689,12 @@ describe('DonationService.respawn', () => {
 
     const stored = store.get(provisioned.id)!;
     expect(stored.respawn?.attempts).toBe(1);
-    // The old handles are untouched — the caller owns backoff, not cleanup.
+    // The old handles are untouched — the caller owns backoff, not cleanup. The
+    // seed token above all: the child still running was started with it, so a
+    // rotated token would make that child refuse every later seed.
     expect(stored.dockerId).toBe('dock_1');
+    expect(stored.seedEndpoint).toBe('http://127.0.0.1:9001/seed');
+    expect(stored.seedToken).toBe('seed-token-1');
     expect(stored.status).toBe('awaiting_seed');
   });
 
@@ -833,7 +920,7 @@ describe('DonationService.terminate', () => {
       id: 'grn_stuck',
       grantToken: token,
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       ownerKeys: [OWNER_KEY],
       profile: 'storage',
       status: 'provisioning',
@@ -952,7 +1039,7 @@ describe('DonationService.reapStaleProvisioning', () => {
     id: opts.id,
     grantToken: opts.token,
     partyId: 'party-P',
-    bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+    bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
     ownerKeys: [OWNER_KEY],
     profile: 'storage',
     status: 'provisioning',
@@ -998,7 +1085,7 @@ describe('DonationService.reapStaleProvisioning', () => {
     const spawn = await orch.createContainer({
       containerId: 'grn_stuck',
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       profile: 'storage',
       pinnedOwnerKeys: [OWNER_KEY],
     });
@@ -1041,7 +1128,7 @@ describe('DonationService.reapStaleProvisioning', () => {
     const firstSpawn = await orch.createContainer({
       containerId: 'grn_first',
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       profile: 'storage',
       pinnedOwnerKeys: [OWNER_KEY],
     });

package/src/donation/__tests__/donation-supervisor.test.ts

@@ -84,7 +84,7 @@ function makeHarness(): Harness {
     provision: () => service.provision({
       grantToken: token,
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       ownerKeys: [OWNER_KEY],
     }),
   };
@@ -229,6 +229,43 @@ describe('DonationSupervisor.reconcile', () => {
     expect(h.store.liveNodeCount(stored.grantToken)).toBe(0);
   });
 
+  // A spawn that succeeds and then dies at once (a crash on boot, a port clash)
+  // never throws out of `respawn`, so a give-up checked only on a throw would
+  // respawn such a node forever, rotating its seed token every time.
+  it('gives up on a node whose every respawn spawns but does not stay up', async () => {
+    const h = makeHarness();
+    const view = await h.provision();
+    setStatus(h.store, view.id, 'seeded');
+    h.orch.crash(dockerIdOf(view));
+    h.orch.onSpawned = (dockerId) => { h.orch.crash(dockerId); };
+
+    for (let i = 0; i < DONATION_RESPAWN_MAX_ATTEMPTS; i++) {
+      await expect(h.supervisor.reconcile()).resolves.toEqual([view.id]);
+      // Well past the longest backoff, so every pass gets to act.
+      h.advance(10 * 60_000);
+    }
+    expect(h.orch.createCalls).toHaveLength(1 + DONATION_RESPAWN_MAX_ATTEMPTS);
+    expect(requireDonation(h.store, view.id).status).toBe('seeded');
+
+    // The budget is spent and the last respawn died too: this pass gives up
+    // instead of spawning again.
+    await expect(h.supervisor.reconcile()).resolves.toEqual([]);
+    const stored = requireDonation(h.store, view.id);
+    expect(h.orch.createCalls).toHaveLength(1 + DONATION_RESPAWN_MAX_ATTEMPTS);
+    expect(stored.status).toBe('error');
+    expect(stored.respawn?.attempts).toBe(DONATION_RESPAWN_MAX_ATTEMPTS);
+    expect(stored.error).toContain(`${DONATION_RESPAWN_MAX_ATTEMPTS} attempts`);
+    expect(stored.error).toContain('did not stay running');
+    // The child the record names is stopped, never reclaimed.
+    expect(h.orch.stopped).toEqual([stored.dockerId]);
+    expect(h.orch.removed).toEqual([]);
+    expect(h.store.liveNodeCount(stored.grantToken)).toBe(0);
+
+    h.advance(10 * 60_000);
+    await expect(h.supervisor.reconcile()).resolves.toEqual([]);
+    expect(h.orch.createCalls).toHaveLength(1 + DONATION_RESPAWN_MAX_ATTEMPTS);
+  });
+
   it('refills the attempt budget once a respawned node has stayed up', async () => {
     const h = makeHarness();
     const view = await h.provision();
@@ -284,7 +321,7 @@ describe('DonationSupervisor.reconcile', () => {
       id: 'grn_inflight',
       grantToken: 'tok',
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       ownerKeys: [OWNER_KEY],
       profile: 'storage',
       status: 'provisioning',
@@ -304,7 +341,7 @@ describe('DonationSupervisor.reconcile', () => {
       id: 'grn_nohandle',
       grantToken: 'tok',
       partyId: 'party-P',
-      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
       ownerKeys: [OWNER_KEY],
       profile: 'storage',
       status: 'awaiting_seed',
@@ -349,10 +386,11 @@ describe('DonationSupervisor.reconcile', () => {
     h.store.put({
       ...requireDonation(h.store, view.id),
       status: 'seeded',
-      // Already at the cap, and long past the longest backoff — so the next
-      // failure lands straight in the give-up path.
+      // One attempt short of the cap (at the cap, the pass would give up before
+      // attempting), and long past the longest backoff — so the next failure
+      // lands straight in the give-up path.
       respawn: {
-        attempts: DONATION_RESPAWN_MAX_ATTEMPTS,
+        attempts: DONATION_RESPAWN_MAX_ATTEMPTS - 1,
         lastAttemptAt: new Date(h.nowMs() - 10 * 60_000).toISOString(),
       },
     });
@@ -370,7 +408,7 @@ describe('DonationSupervisor.reconcile', () => {
     expect(stored.status).toBe('terminated');
     expect(stored.error).toBeUndefined();
     // The attempt counter is the one thing the failed attempt may still record.
-    expect(stored.respawn?.attempts).toBe(DONATION_RESPAWN_MAX_ATTEMPTS + 1);
+    expect(stored.respawn?.attempts).toBe(DONATION_RESPAWN_MAX_ATTEMPTS);
     expect(h.orch.stopped).toEqual([]);
   });
 
@@ -380,10 +418,10 @@ describe('DonationSupervisor.reconcile', () => {
     h.store.put({
       ...requireDonation(h.store, view.id),
       status: 'seeded',
-      // Already at the cap and long past the longest backoff, so a *failed*
-      // attempt here would land straight in the give-up path.
+      // One attempt short of the cap and long past the longest backoff, so a
+      // *failed* attempt here would land straight in the give-up path.
       respawn: {
-        attempts: DONATION_RESPAWN_MAX_ATTEMPTS,
+        attempts: DONATION_RESPAWN_MAX_ATTEMPTS - 1,
         lastAttemptAt: new Date(h.nowMs() - 10 * 60_000).toISOString(),
       },
     });
@@ -400,7 +438,7 @@ describe('DonationSupervisor.reconcile', () => {
     // Nothing threw, so no attempt was persisted and give-up never ran.
     expect(stored.status).toBe('terminated');
     expect(stored.error).toBeUndefined();
-    expect(stored.respawn?.attempts).toBe(DONATION_RESPAWN_MAX_ATTEMPTS);
+    expect(stored.respawn?.attempts).toBe(DONATION_RESPAWN_MAX_ATTEMPTS - 1);
     expect(stored.dockerId).toBe(view.dockerId);
     // The abandoned child is stopped and reclaimed, not left holding ports.
     expect(h.orch.stopped).toContain('dock_2');
@@ -480,7 +518,7 @@ describe('DonationSupervisor start/stop', () => {
         status: 'stopped',
         spawnedAt: new Date(START_MS).toISOString(),
         workdir: '/fake/owner',
-        ports: { health: 0, metrics: 0, p2p: 0, admin: 0 },
+        ports: { health: 0, metrics: 0, p2p: 0, admin: 0, ws: 0 },
         owner: true,
       };
       h.orch.emit(ownerExit);