@serfab/cadre-host 0.13.0 → 1.1.0

package/src/donation/__tests__/fake-orchestrator.ts

@@ -220,6 +220,6 @@ function toNodeInfo(dockerId: string, child: FakeChild): ManagedNodeInfo {
     status: child.running ? 'running' : 'stopped',
     spawnedAt: new Date(0).toISOString(),
     workdir: `/fake/${child.containerId}`,
-    ports: { health: 0, metrics: 0, p2p: 0, admin: 0 },
+    ports: { health: 0, metrics: 0, p2p: 0, admin: 0, ws: 0 },
   };
 }

package/src/donation/donation-service.ts

@@ -78,7 +78,12 @@ export interface DonationProvisionRequest {
   grantToken: string;
   /** The REQUESTER's cadre — the party the donated node joins. */
   partyId: string;
-  /** Requester control-network bootstrap multiaddrs (dialable, with `/p2p/`). */
+  /**
+   * Requester control-network bootstrap multiaddrs (dialable, with `/p2p/`). Empty
+   * means the requester dials the node itself: a phone has no address to give, so it
+   * reaches the node at the WebSocket address {@link DonationService.getPeer} reports
+   * rather than being dialed by it.
+   */
   bootstrapNodes: string[];
   /**
    * The requester's owner public key(s), base64url. Pinned as cold-start
@@ -450,6 +455,18 @@ export class DonationService {
     } catch (err) {
       throw new DonationError('seed_failed', `Donated node unreachable: ${errorMessage(err)}`);
     }
+    if (res.status === 401) {
+      // The node refused the host's bearer, not the requester's seed — the node
+      // never looked at the seed. So the fault is the host's own token
+      // bookkeeping (the record names a token the running child was not started
+      // with), and the message must not read as a trust-policy rejection.
+      //
+      // Still `seed_failed`, deliberately: the phone retries that code, and a
+      // bookkeeping gap that is mid-repair (a respawn about to write its new
+      // token) can clear inside that retry window.
+      log('donated node for donation %s refused the host seed credential (401)', id);
+      throw new DonationError('seed_failed', 'Donated node rejected the host\'s seed credential (401)');
+    }
     if (!res.ok) {
       const body = await res.text();
       throw new DonationError('seed_failed', `Donated node /seed returned ${res.status}: ${body}`);
@@ -524,7 +541,9 @@ export class DonationService {
         `Donation ${id} cannot be respawned in status ${donation.status}`,
       );
     }
-    if (!donation.bootstrapNodes?.length || !donation.ownerKeys?.length) {
+    // An empty `bootstrapNodes` is a real spawn input (a requester that dials the node
+    // itself); only a missing field marks a record written before inputs were persisted.
+    if (donation.bootstrapNodes === undefined || !donation.ownerKeys?.length) {
       log('donation %s is not respawnable (record predates persisted spawn inputs)', id);
       return { outcome: 'not_respawnable' };
     }
@@ -613,7 +632,7 @@ export class DonationService {
    * (`<rootDir>/<containerId>`), reclaiming here would delete exactly what
    * `giveUp` meant to keep.
    *
-   * NOTE: that skipped reclaim leaks the new spawn's four ports — the record
+   * NOTE: that skipped reclaim leaks the new spawn's ports — the record
    * still names the *previous* `dockerId`, so a later `terminate` cleans up the
    * old handle, not this one. Unreachable today (`giveUp` is only called from
    * the supervisor's serialized pass, so it cannot overlap a respawn); if a

package/src/donation/donation-supervisor.ts

@@ -23,7 +23,8 @@ export const DONATION_RESPAWN_BACKOFF_BASE_MS = 5_000;
  *
  * NOTE: not reachable at the current {@link DONATION_RESPAWN_MAX_ATTEMPTS} of 5
  * — the longest wait actually served is the one before the 5th attempt,
- * `5s * 2^4` = 80s, and the 5th failure gives up. The cap only starts clamping
+ * `5s * 2^4` = 80s, and once that attempt fails or its node dies the supervisor
+ * gives up rather than waiting again. The cap only starts clamping
  * once a record can reach 6 recorded attempts (`5s * 2^6` = 320s), so raising
  * the attempt cap without revisiting this one changes nothing.
  */
@@ -33,6 +34,12 @@ export const DONATION_RESPAWN_BACKOFF_MAX_MS = 5 * 60_000;
  * Consecutive respawn attempts after which the host stops trying and marks the
  * donation `error` — a node that will not stay up is a host-side fault the
  * borrower cannot see, so surface it instead of spinning forever.
+ *
+ * Every attempt counts, whether its spawn failed or succeeded: a node that spawns
+ * and then dies before {@link DONATION_RESPAWN_HEALTHY_MS} refills the budget is
+ * as much a crash loop as one that never spawns. Give-up happens on whichever
+ * comes first — an attempt that throws with the cap reached, or a pass that finds
+ * the node down with the cap already reached.
  */
 export const DONATION_RESPAWN_MAX_ATTEMPTS = 5;
 
@@ -232,6 +239,19 @@ export class DonationSupervisor {
       this.refillBudgetIfHealthy(donation);
       return undefined;
     }
+    // The budget is spent, and the last attempt did not stay up long enough to
+    // refill it. Checked here and not only when `respawn` throws: a spawn that
+    // succeeds and then dies at once (a crash on boot, a port clash) never
+    // throws, so a catch-only check would respawn it forever.
+    // NOTE: a record at the cap whose last respawn was still up but not yet
+    // refilled when the host went down is given up on host restart rather than
+    // tried once more; if that is ever seen, skip this check when the host
+    // started after `respawn.lastAttemptAt`.
+    const attempts = donation.respawn?.attempts ?? 0;
+    if (attempts >= DONATION_RESPAWN_MAX_ATTEMPTS) {
+      await this.giveUp(donation.id, attempts, 'the node did not stay running after its last respawn');
+      return undefined;
+    }
     if (!this.backoffElapsed(donation)) {
       log('donation %s is down but still inside its respawn backoff', donation.id);
       return undefined;
@@ -294,7 +314,10 @@ export class DonationSupervisor {
     return this.now().getTime() - last > DONATION_RESPAWN_HEALTHY_MS;
   }
 
-  /** One respawn attempt, with the give-up check on failure. */
+  /**
+   * One respawn attempt, with the give-up check on failure. (The check for an
+   * attempt that spawned but then died lives in {@link reconcileOne}.)
+   */
   private async attemptRespawn(donation: Donation): Promise<string | undefined> {
     try {
       const result = await this.service.respawn(donation.id);

package/src/donation/types.ts

@@ -149,7 +149,8 @@ export interface Donation {
   /** The REQUESTER's cadre (a foreign party this host merely hosts a node for). */
   partyId: string;
   /**
-   * Requester control-network bootstrap multiaddrs — replayed on respawn.
+   * Requester control-network bootstrap multiaddrs — replayed on respawn. Empty when
+   * the requester dials the node itself (see `DonationProvisionRequest.bootstrapNodes`).
    * Absent on records written before respawn support; those are not respawnable.
    */
   bootstrapNodes?: string[];

package/src/installer/__tests__/installer.smoke.test.ts

@@ -1,218 +1,263 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { Installer } from '../index.js';
-import type { ServiceHost, ServiceHostContext, ServiceHostStatus } from '../service-host/types.js';
-
-class FakeServiceHost implements ServiceHost {
-  readonly name = 'cadre-host';
-  installCalls: ServiceHostContext[] = [];
-  uninstallCalls: ServiceHostContext[] = [];
-  installed = false;
-  running = false;
-
-  async install(ctx: ServiceHostContext): Promise<void> {
-    this.installCalls.push(ctx);
-    this.installed = true;
-    this.running = true;
-  }
-  async uninstall(ctx: ServiceHostContext): Promise<void> {
-    this.uninstallCalls.push(ctx);
-    this.installed = false;
-    this.running = false;
-  }
-  async restart(_ctx: ServiceHostContext): Promise<void> {
-    this.running = true;
-  }
-  async status(_ctx: ServiceHostContext): Promise<ServiceHostStatus> {
-    return { installed: this.installed, running: this.running };
-  }
-  renderUnit(_ctx: ServiceHostContext): string | null {
-    return 'rendered-unit';
-  }
-}
-
-describe('Installer smoke', () => {
-  let tmp: string;
-
-  beforeEach(() => {
-    tmp = mkdtempSync(join(tmpdir(), 'cadre-host-installer-smoke-'));
-  });
-
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('install creates config + identity + invokes service-host', async () => {
-    const fake = new FakeServiceHost();
-    const installer = new Installer({ platform: 'linux', installerVersion: 'test-1.0.0' });
-    const result = await installer.install({
-      nonInteractive: true,
-      dataDir: tmp,
-      uiPort: 19999,
-      libp2pPort: 14001,
-      openBrowser: false,
-      noInvite: true,
-      serviceHost: fake,
-    });
-
-    expect(result.dataDir).toBe(tmp);
-    expect(result.uiUrl).toBe('http://127.0.0.1:19999/');
-    expect(result.serviceName).toBe('cadre-host');
-    expect(result.configPath).toBe(join(tmp, 'host.config.json'));
-
-    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
-    expect(existsSync(join(tmp, 'identity.key'))).toBe(true);
-    expect(existsSync(join(tmp, 'nat.json'))).toBe(true);
-    expect(existsSync(join(tmp, 'logs'))).toBe(true);
-
-    expect(fake.installCalls).toHaveLength(1);
-    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
-  });
-
-  it('uninstall removes data only when --remove-data is set', async () => {
-    const fake = new FakeServiceHost();
-    const installer = new Installer({ platform: 'linux' });
-    await installer.install({
-      nonInteractive: true,
-      dataDir: tmp,
-      uiPort: 19998,
-      libp2pPort: 14002,
-      openBrowser: false,
-      noInvite: true,
-      serviceHost: fake,
-    });
-    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
-
-    await installer.uninstall({ yes: true, removeData: false, dataDir: tmp, serviceHost: fake });
-    expect(fake.uninstallCalls).toHaveLength(1);
-    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
-
-    await installer.uninstall({ yes: true, removeData: true, dataDir: tmp, serviceHost: fake });
-    expect(existsSync(tmp)).toBe(false);
-  });
-
-  it('rejects --system in v1', async () => {
-    const fake = new FakeServiceHost();
-    const installer = new Installer({ platform: 'linux' });
-    await expect(installer.install({
-      nonInteractive: true,
-      dataDir: tmp,
-      system: true,
-      serviceHost: fake,
-      openBrowser: false,
-      noInvite: true,
-    })).rejects.toThrow(/system.*not yet supported/);
-    expect(fake.installCalls).toHaveLength(0);
-  });
-
-  it('passes CLI overrides to the wizard as suggested defaults', async () => {
-    // Regression: the interactive wizard previously showed the platform
-    // default (`~/.local/share/cadre-host`) in the prompt even when the
-    // caller passed `--data-dir <path>`. Whatever the user typed was then
-    // silently discarded because the CLI flag won post-hoc. The fix: CLI
-    // overrides become the wizard's suggested defaults, and the wizard's
-    // returned answers stand on their own.
-    const fake = new FakeServiceHost();
-    const installer = new Installer({ platform: 'linux' });
-    let seenDefaults: { dataDir: string; uiPort: number; libp2pPort: number; upnpEnabled: boolean; ownCadre: boolean } | undefined;
-    await installer.install({
-      nonInteractive: false,
-      dataDir: tmp,
-      uiPort: 19997,
-      libp2pPort: 14003,
-      noUpnp: true,
-      openBrowser: false,
-      noInvite: true,
-      serviceHost: fake,
-      wizard: async (defaults) => {
-        seenDefaults = { ...defaults };
-        // Simulate the user pressing Enter at every prompt.
-        return {
-          dataDir: defaults.dataDir,
-          uiPort: defaults.uiPort,
-          libp2pPort: defaults.libp2pPort,
-          upnpEnabled: defaults.upnpEnabled,
-          configureDdns: false,
-          ownCadre: defaults.ownCadre,
-        };
-      },
-    });
-
-    expect(seenDefaults).toEqual({
-      dataDir: tmp,
-      uiPort: 19997,
-      libp2pPort: 14003,
-      upnpEnabled: false,
-      ownCadre: false,
-    });
-    expect(fake.installCalls).toHaveLength(1);
-    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
-  });
-
-  it('honors wizard-typed input when no CLI override is passed', async () => {
-    // Mirror of the previous test: with no `--data-dir`, the wizard's
-    // returned value is what the installer uses.
-    const fake = new FakeServiceHost();
-    const installer = new Installer({ platform: 'linux' });
-    await installer.install({
-      nonInteractive: false,
-      openBrowser: false,
-      noInvite: true,
-      serviceHost: fake,
-      wizard: async () => ({
-        dataDir: tmp,
-        uiPort: 19996,
-        libp2pPort: 14004,
-        upnpEnabled: true,
-        configureDdns: false,
-        ownCadre: false,
-      }),
-    });
-    expect(fake.installCalls).toHaveLength(1);
-    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
-  });
-
-  it('writes ownCadre.enabled=false by default and true when opted in', async () => {
-    const { readHostConfig } = await import('../config.js');
-
-    // Default (donor-only): --own-cadre absent → ownCadre.enabled false.
-    const fakeA = new FakeServiceHost();
-    const installerA = new Installer({ platform: 'linux' });
-    await installerA.install({
-      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fakeA,
-    });
-    const donorCfg = readHostConfig(join(tmp, 'host.config.json'));
-    expect(donorCfg.ownCadre).toEqual({ enabled: false });
-
-    // Opt-in: ownCadre:true (the --own-cadre flag) → ownCadre.enabled true.
-    const tmp2 = mkdtempSync(join(tmpdir(), 'cadre-host-installer-owncadre-'));
-    try {
-      const fakeB = new FakeServiceHost();
-      const installerB = new Installer({ platform: 'linux' });
-      await installerB.install({
-        nonInteractive: true, dataDir: tmp2, ownCadre: true, openBrowser: false, noInvite: true, serviceHost: fakeB,
-      });
-      const founderCfg = readHostConfig(join(tmp2, 'host.config.json'));
-      expect(founderCfg.ownCadre).toEqual({ enabled: true });
-    } finally {
-      rmSync(tmp2, { recursive: true, force: true });
-    }
-  });
-
-  it('re-running install preserves the existing identity', async () => {
-    const fake = new FakeServiceHost();
-    const installer = new Installer({ platform: 'linux' });
-    await installer.install({
-      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fake,
-    });
-    const idBefore = (await import('node:fs')).readFileSync(join(tmp, 'identity.key'));
-    await installer.install({
-      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fake,
-    });
-    const idAfter = (await import('node:fs')).readFileSync(join(tmp, 'identity.key'));
-    expect(Buffer.from(idBefore).equals(Buffer.from(idAfter))).toBe(true);
-  });
-});
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { Installer } from '../index.js';
+import type { ServiceHost, ServiceHostContext, ServiceHostStatus } from '../service-host/types.js';
+
+class FakeServiceHost implements ServiceHost {
+  readonly name = 'cadre-host';
+  installCalls: ServiceHostContext[] = [];
+  uninstallCalls: ServiceHostContext[] = [];
+  installed = false;
+  running = false;
+
+  async install(ctx: ServiceHostContext): Promise<void> {
+    this.installCalls.push(ctx);
+    this.installed = true;
+    this.running = true;
+  }
+  async uninstall(ctx: ServiceHostContext): Promise<void> {
+    this.uninstallCalls.push(ctx);
+    this.installed = false;
+    this.running = false;
+  }
+  async restart(_ctx: ServiceHostContext): Promise<void> {
+    this.running = true;
+  }
+  async status(_ctx: ServiceHostContext): Promise<ServiceHostStatus> {
+    return { installed: this.installed, running: this.running };
+  }
+  renderUnit(_ctx: ServiceHostContext): string | null {
+    return 'rendered-unit';
+  }
+}
+
+describe('Installer smoke', () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), 'cadre-host-installer-smoke-'));
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('install creates config + identity + invokes service-host', async () => {
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux', installerVersion: 'test-1.0.0' });
+    const result = await installer.install({
+      nonInteractive: true,
+      dataDir: tmp,
+      uiPort: 19999,
+      libp2pPort: 14001,
+      openBrowser: false,
+      noInvite: true,
+      serviceHost: fake,
+    });
+
+    expect(result.dataDir).toBe(tmp);
+    expect(result.uiUrl).toBe('http://127.0.0.1:19999/');
+    expect(result.serviceName).toBe('cadre-host');
+    expect(result.configPath).toBe(join(tmp, 'host.config.json'));
+
+    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
+    expect(existsSync(join(tmp, 'identity.key'))).toBe(true);
+    expect(existsSync(join(tmp, 'nat.json'))).toBe(true);
+    expect(existsSync(join(tmp, 'logs'))).toBe(true);
+
+    expect(fake.installCalls).toHaveLength(1);
+    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
+  });
+
+  it('noService writes the data dir without registering a service', async () => {
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux', installerVersion: 'test-1.0.0' });
+    const result = await installer.install({
+      nonInteractive: true,
+      dataDir: tmp,
+      uiPort: 19995,
+      libp2pPort: 14005,
+      noService: true,
+      serviceHost: fake,
+    });
+
+    expect(fake.installCalls).toHaveLength(0);
+    expect(result.serviceName).toBeUndefined();
+    expect(result.uiUrl).toBe('http://127.0.0.1:19995/');
+    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
+    expect(existsSync(join(tmp, 'identity.key'))).toBe(true);
+    expect(existsSync(join(tmp, 'nat.json'))).toBe(true);
+  });
+
+  it('noService on an interactive install skips the enrollment-invite fetch', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+    try {
+      const installer = new Installer({ platform: 'linux', installerVersion: 'test-1.0.0' });
+      const result = await installer.install({
+        nonInteractive: false,
+        noService: true,
+        wizard: async () => ({
+          dataDir: tmp,
+          uiPort: 19994,
+          libp2pPort: 14006,
+          upnpEnabled: false,
+          configureDdns: false,
+          ownCadre: false,
+        }),
+      });
+
+      expect(fetchSpy).not.toHaveBeenCalled();
+      expect(result.enrollmentInvite).toBeUndefined();
+      expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+
+  it('uninstall removes data only when --remove-data is set', async () => {
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    await installer.install({
+      nonInteractive: true,
+      dataDir: tmp,
+      uiPort: 19998,
+      libp2pPort: 14002,
+      openBrowser: false,
+      noInvite: true,
+      serviceHost: fake,
+    });
+    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
+
+    await installer.uninstall({ yes: true, removeData: false, dataDir: tmp, serviceHost: fake });
+    expect(fake.uninstallCalls).toHaveLength(1);
+    expect(existsSync(join(tmp, 'host.config.json'))).toBe(true);
+
+    await installer.uninstall({ yes: true, removeData: true, dataDir: tmp, serviceHost: fake });
+    expect(existsSync(tmp)).toBe(false);
+  });
+
+  it('rejects --system in v1', async () => {
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    await expect(installer.install({
+      nonInteractive: true,
+      dataDir: tmp,
+      system: true,
+      serviceHost: fake,
+      openBrowser: false,
+      noInvite: true,
+    })).rejects.toThrow(/system.*not yet supported/);
+    expect(fake.installCalls).toHaveLength(0);
+  });
+
+  it('passes CLI overrides to the wizard as suggested defaults', async () => {
+    // Regression: the interactive wizard previously showed the platform
+    // default (`~/.local/share/cadre-host`) in the prompt even when the
+    // caller passed `--data-dir <path>`. Whatever the user typed was then
+    // silently discarded because the CLI flag won post-hoc. The fix: CLI
+    // overrides become the wizard's suggested defaults, and the wizard's
+    // returned answers stand on their own.
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    let seenDefaults: { dataDir: string; uiPort: number; libp2pPort: number; upnpEnabled: boolean; ownCadre: boolean } | undefined;
+    await installer.install({
+      nonInteractive: false,
+      dataDir: tmp,
+      uiPort: 19997,
+      libp2pPort: 14003,
+      noUpnp: true,
+      openBrowser: false,
+      noInvite: true,
+      serviceHost: fake,
+      wizard: async (defaults) => {
+        seenDefaults = { ...defaults };
+        // Simulate the user pressing Enter at every prompt.
+        return {
+          dataDir: defaults.dataDir,
+          uiPort: defaults.uiPort,
+          libp2pPort: defaults.libp2pPort,
+          upnpEnabled: defaults.upnpEnabled,
+          configureDdns: false,
+          ownCadre: defaults.ownCadre,
+        };
+      },
+    });
+
+    expect(seenDefaults).toEqual({
+      dataDir: tmp,
+      uiPort: 19997,
+      libp2pPort: 14003,
+      upnpEnabled: false,
+      ownCadre: false,
+    });
+    expect(fake.installCalls).toHaveLength(1);
+    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
+  });
+
+  it('honors wizard-typed input when no CLI override is passed', async () => {
+    // Mirror of the previous test: with no `--data-dir`, the wizard's
+    // returned value is what the installer uses.
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    await installer.install({
+      nonInteractive: false,
+      openBrowser: false,
+      noInvite: true,
+      serviceHost: fake,
+      wizard: async () => ({
+        dataDir: tmp,
+        uiPort: 19996,
+        libp2pPort: 14004,
+        upnpEnabled: true,
+        configureDdns: false,
+        ownCadre: false,
+      }),
+    });
+    expect(fake.installCalls).toHaveLength(1);
+    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
+  });
+
+  it('writes ownCadre.enabled=false by default and true when opted in', async () => {
+    const { readHostConfig } = await import('../config.js');
+
+    // Default (donor-only): --own-cadre absent → ownCadre.enabled false.
+    const fakeA = new FakeServiceHost();
+    const installerA = new Installer({ platform: 'linux' });
+    await installerA.install({
+      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fakeA,
+    });
+    const donorCfg = readHostConfig(join(tmp, 'host.config.json'));
+    expect(donorCfg.ownCadre).toEqual({ enabled: false });
+
+    // Opt-in: ownCadre:true (the --own-cadre flag) → ownCadre.enabled true.
+    const tmp2 = mkdtempSync(join(tmpdir(), 'cadre-host-installer-owncadre-'));
+    try {
+      const fakeB = new FakeServiceHost();
+      const installerB = new Installer({ platform: 'linux' });
+      await installerB.install({
+        nonInteractive: true, dataDir: tmp2, ownCadre: true, openBrowser: false, noInvite: true, serviceHost: fakeB,
+      });
+      const founderCfg = readHostConfig(join(tmp2, 'host.config.json'));
+      expect(founderCfg.ownCadre).toEqual({ enabled: true });
+    } finally {
+      rmSync(tmp2, { recursive: true, force: true });
+    }
+  });
+
+  it('re-running install preserves the existing identity', async () => {
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    await installer.install({
+      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fake,
+    });
+    const idBefore = (await import('node:fs')).readFileSync(join(tmp, 'identity.key'));
+    await installer.install({
+      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fake,
+    });
+    const idAfter = (await import('node:fs')).readFileSync(join(tmp, 'identity.key'));
+    expect(Buffer.from(idBefore).equals(Buffer.from(idAfter))).toBe(true);
+  });
+});