@serfab/cadre-host 0.13.0 → 1.1.0

package/dist/installer/index.js

@@ -63,7 +63,12 @@ export class Installer {
         // 4. Seed nat.json with the chosen libp2p port + UPnP flag so the
         //    NatService picks them up on first start.
         seedNatSettings(answers.dataDir, answers.libp2pPort, answers.upnpEnabled);
+        const uiUrl = `http://127.0.0.1:${answers.uiPort}/`;
         // 5. Service-host registration.
+        if (opts.noService) {
+            log('--no-service: skipping service registration, browser open and enrollment invite');
+            return { dataDir: answers.dataDir, uiUrl, configPath: cfgPath };
+        }
         const serviceHost = opts.serviceHost ?? createServiceHost(this.platform);
         const ctx = {
             nodePath: opts.nodePath ?? process.execPath,
@@ -73,7 +78,6 @@ export class Installer {
         };
         await serviceHost.install(ctx);
         // 6. Browser open (best-effort).
-        const uiUrl = `http://127.0.0.1:${answers.uiPort}/`;
         const shouldOpenBrowser = opts.openBrowser !== false && !opts.nonInteractive && process.stdout.isTTY;
         if (shouldOpenBrowser) {
             openBrowser(uiUrl);

package/dist/installer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/installer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,GACR,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,GAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAA6C,MAAM,yBAAyB,CAAC;AACvG,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,aAAa,EACb,eAAe,EACf,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIhF,MAAM,GAAG,GAAG,KAAK,CAAC,sBAAsB,CAAC,CAAC;AA2D1C,MAAM,OAAO,SAAS;IAIpB,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAC;QAClD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhD,oCAAoC;QACpC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,GAAmB;YAC1B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,eAAe,EAAE;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,MAAM;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC7B,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;SACxC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE9B,kEAAkE;QAClE,8CAA8C;QAC9C,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAE1E,gCAAgC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAuB;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;YAC3C,MAAM,EAAE,aAAa,EAAE;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,iBAAiB,EAAE;SAChC,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,iCAAiC;QACjC,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC;QACpD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACrG,IAAI,iBAAiB,EAAE,CAAC;YACtB,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,uEAAuE;QACvE,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjE,GAAG,CAAC,oCAAoC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;gBAClE,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK;YACL,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAsB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAuB;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,aAAa,EAAE;YACvB,OAAO;YACP,UAAU,EAAE,iBAAiB,EAAE;SAChC,CAAC;QACF,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsC,EAAE;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAuB;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,aAAa,EAAE;YACvB,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO;YACnD,UAAU,EAAE,iBAAiB,EAAE;SAChC,CAAC;QACF,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,8FAA8F;IAC9F,yBAAyB,CAAC,IAAoB;QAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;YACtC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;YAClD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;YACvD,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;SAC7C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAoB;QAC/C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,OAAO;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gBAAgB,CAAC,MAAM;YAC9C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,UAAU;YAC1D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW;YAC/D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ;SACrD,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QACxC,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF;AAED,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;AAEpF,SAAS,eAAe,CAAC,OAAe,EAAE,UAAkB,EAAE,WAAoB;IAChF,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,gCAAgC;IAChC,KAAK,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,UAAU;QACxB,YAAY,EAAE,UAAU;QACxB,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB;IACzB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACjD,MAAM,GAAG,GAAG,oBAAoB,MAAM,eAAe,CAAC;IACtD,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAoD,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/installer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,GACR,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,GAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAA6C,MAAM,yBAAyB,CAAC;AACvG,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,aAAa,EACb,eAAe,EACf,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIhF,MAAM,GAAG,GAAG,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAmE1C,MAAM,OAAO,SAAS;IAIpB,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAC;QAClD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhD,oCAAoC;QACpC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,GAAmB;YAC1B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,eAAe,EAAE;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,MAAM;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC7B,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;SACxC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE9B,kEAAkE;QAClE,8CAA8C;QAC9C,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAE1E,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC;QAEpD,gCAAgC;QAChC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,GAAG,CAAC,iFAAiF,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAuB;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;YAC3C,MAAM,EAAE,aAAa,EAAE;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,iBAAiB,EAAE;SAChC,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACrG,IAAI,iBAAiB,EAAE,CAAC;YACtB,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,uEAAuE;QACvE,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjE,GAAG,CAAC,oCAAoC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;gBAClE,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK;YACL,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAsB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAuB;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,aAAa,EAAE;YACvB,OAAO;YACP,UAAU,EAAE,iBAAiB,EAAE;SAChC,CAAC;QACF,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsC,EAAE;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAuB;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,aAAa,EAAE;YACvB,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO;YACnD,UAAU,EAAE,iBAAiB,EAAE;SAChC,CAAC;QACF,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,8FAA8F;IAC9F,yBAAyB,CAAC,IAAoB;QAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;YACtC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;YAClD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;YACvD,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;SAC7C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAoB;QAC/C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,OAAO;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gBAAgB,CAAC,MAAM;YAC9C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,UAAU;YAC1D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW;YAC/D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ;SACrD,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QACxC,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF;AAED,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;AAEpF,SAAS,eAAe,CAAC,OAAe,EAAE,UAAkB,EAAE,WAAoB;IAChF,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,gCAAgC;IAChC,KAAK,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,UAAU;QACxB,YAAY,EAAE,UAAU;QACxB,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB;IACzB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACjD,MAAM,GAAG,GAAG,oBAAoB,MAAM,eAAe,CAAC;IACtD,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAoD,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/orchestrator/host-process-orchestrator.d.ts

@@ -1,5 +1,18 @@
 import type { Orchestrator, OrchestratorCreateRequest, OrchestratorCreateResult, OrchestratorStats } from '@serfab/cadre-provider';
-import { type OwnerSpawnConfig, type HostProcessConfig, type ManagedNodeInfo, type NodeStateListener } from './types.js';
+import { type OwnerSpawnConfig, type HostProcessConfig, type ManagedNodeInfo, type NodePorts, type NodeStateListener } from './types.js';
+/**
+ * The libp2p listen addresses a managed child binds — its `CADRE_LISTEN_ADDRS`, one
+ * entry per element: TCP on the `p2p` port and WebSocket on the `ws` port, both on
+ * every interface.
+ *
+ * The WebSocket entry is what lets a phone reach the child. A phone's node carries
+ * WebSocket, circuit-relay and WebRTC transports but no TCP
+ * (`reference-app-rn/src/phone-node-config.ts`), and it listens on nothing, so the
+ * phone has to be the one that dials. Naming a `/ws` address is all the child needs:
+ * cadre-core adds the WebSocket transport for any listen entry that names one
+ * (`resolveTransportOptions` in `cadre-core/src/relay-addrs.ts`).
+ */
+export declare function childListenAddrs(ports: Pick<NodePorts, 'p2p' | 'ws'>): string[];
 /** Fixed friendly id for the admin's owner node. */
 export declare const OWNER_CONTAINER_ID = "owner";
 /** Endpoint + bearer for the owner node's loopback admin channel (6.6). */
@@ -168,11 +181,51 @@ export declare class HostProcessOrchestrator implements Orchestrator {
      * `await` here.
      */
     private launchChild;
+    /**
+     * Refuse to re-spawn `containerId` while a previous child of it may still be
+     * running. Both spawn paths call this as their last `await` before the handle
+     * drop, so a refusal happens while nothing has been released, no token rotated
+     * and no child launched — the caller sees an ordinary failed spawn.
+     *
+     * Why it exists: the drop hands the old handle's ports back and the launch takes
+     * those same ports (`reusedNodePorts`), so a child started over a live one dies
+     * on a port clash — but only after `launchChild` has returned success with a
+     * fresh seed token. The caller then records a dead child, and the live one
+     * refuses the new token.
+     *
+     * - A handle this process spawned is checked exactly ({@link isHandleLive}); a
+     *   live one refuses outright.
+     * - A handle re-attached from `state.json` whose pid is alive but whose token
+     *   does not match is either our child still starting or an unrelated process
+     *   that inherited the pid. The ports decide: if any the re-spawn would take back
+     *   is already bound, refuse. The pid is never killed on that evidence — it may
+     *   not be ours.
+     *
+     * `overrides` are the ports the caller will override on top of the reused ones
+     * (the owner node's configured p2p port); `owner` adds the admin channel.
+     *
+     * NOTE: the probe cannot see a re-attached child still loading its modules —
+     * `cadre-cli start` writes its token and only then binds, so a child in that
+     * window shows neither, and a re-spawn launched then races it for the ports.
+     * Reachable only when the host restarts within a child's first seconds. If it
+     * is ever seen, treat a re-attached handle with a live pid as starting for a
+     * grace period after its `spawnedAt`.
+     *
+     * NOTE: the probe holds each port for an instant, so a child binding that port
+     * in the same instant fails. It would have had to write its token between the
+     * token check above and the probe, against the several awaited steps
+     * `cadre-cli start` takes between writing its token and binding; if a re-attached
+     * child is ever seen dying on its own port right after a host restart, probe by
+     * connecting instead of binding.
+     */
+    private refuseRespawnOverLiveChild;
+    /** Every handle for `containerId`, in map order — the order `dropStaleHandle` drops them in. */
+    private handlesFor;
     /**
      * Drop any handle left over from a previous spawn of the same `containerId`
      * and release its ports. Handles are keyed by the per-spawn `dockerId`, so
      * without this a re-spawn (donated-node respawn) would strand the prior
-     * handle in the map forever, leaking four ports from a bounded range each
+     * handle in the map forever, leaking its ports from a bounded range each
      * time. Mirrors the same cleanup in `ensureOwnerNode`.
      *
      * DO NOT delete the workdir: the identity key and node-local stores
@@ -180,11 +233,12 @@ export declare class HostProcessOrchestrator implements Orchestrator {
      * the whole reason a respawn comes back as the same node. `launchChild`
      * reuses the same workdir.
      *
-     * NOTE: releasing the ports hands them straight back to the allocator, so a
-     * re-spawn while the *previous* child is still listening can bind-clash. Every
-     * caller today re-spawns only a container it has established is not running
-     * (`DonationService.respawn`, `ensureOwnerNode`). If a caller ever needs to
-     * replace a live child, stop it first — or hold the ports until its exit.
+     * Releasing the ports hands them straight back to the allocator, and the
+     * re-spawn then takes those same ports as overrides (`reusedNodePorts`), so a
+     * re-spawn while the *previous* child is still listening would bind-clash.
+     * Callers must therefore never drop a live child, and both do so only after
+     * {@link refuseRespawnOverLiveChild} has passed. A caller that needs to replace
+     * a live child must stop it first.
      *
      * **The drop is reversible.** It happens before the launch can fail, so the
      * dropped handles are returned and every caller restores them via
@@ -197,7 +251,7 @@ export declare class HostProcessOrchestrator implements Orchestrator {
     private dropStaleHandle;
     /**
      * Inverse of {@link dropStaleHandle}, for a spawn that then failed: put each
-     * handle back in the map and re-reserve its four ports, leaving host state
+     * handle back in the map and re-reserve its ports, leaving host state
      * exactly as the failed attempt found it.
      *
      * **Precondition: the drop → launch window is synchronous.** Restoring is
@@ -215,9 +269,10 @@ export declare class HostProcessOrchestrator implements Orchestrator {
      *
      * NOTE: a restored handle keeps `alive: true` even if its child exited while
      * it was out of the map (`launchChild`'s exit listener looks the handle up by
-     * dockerId and finds nothing). Only reachable by re-spawning a container
-     * whose child is still live, which `dropStaleHandle`'s note above already
-     * forbids.
+     * dockerId and finds nothing). Only reachable by dropping a handle whose child
+     * is still live, which {@link refuseRespawnOverLiveChild} refuses before any
+     * drop. (Its start-up blind spot concerns re-attached handles only, and those
+     * have no exit listener to miss.)
      */
     private restoreDroppedHandles;
     /** A managed node's own directory under `rootDir` — config, log, storage, identity. */
@@ -233,6 +288,11 @@ export declare class HostProcessOrchestrator implements Orchestrator {
     private releasePorts;
     stopContainer(dockerId: string): Promise<void>;
     removeContainer(dockerId: string): Promise<void>;
+    /**
+     * Whether the child `dockerId` names is running — see {@link isHandleLive}. An
+     * id with no handle is not running: without the handle's workdir there is no
+     * token to verify a live pid against.
+     */
     isRunning(dockerId: string): Promise<boolean>;
     getStats(dockerId: string): Promise<OrchestratorStats>;
     getLogs(dockerId: string, tail?: number): Promise<string>;

package/dist/orchestrator/host-process-orchestrator.js

@@ -7,10 +7,11 @@ import debug from 'debug';
 import pidusage from 'pidusage';
 import { defaultLogPath, rotateOnDisk } from './log-rotator.js';
 import { ensureNodeIdentity } from './node-identity.js';
-import { allocateNodePorts, PortAllocator } from './port-allocator.js';
+import { allocateNodePorts, PortAllocator, releaseNodePorts, reserveNodePorts, reusedNodePorts, } from './port-allocator.js';
 import { StateStore } from './state-store.js';
 import { isPidAlive } from './pid-liveness.js';
-import { decodeDockerId, encodeDockerId, } from './types.js';
+import { assertPortFree } from './port-probe.js';
+import { encodeDockerId, } from './types.js';
 const log = debug('cadre:host:orchestrator');
 const DEFAULTS = {
     portRangeStart: 10000,
@@ -42,6 +43,38 @@ function scrubbedParentEnv() {
     }
     return env;
 }
+/**
+ * The libp2p listen addresses a managed child binds — its `CADRE_LISTEN_ADDRS`, one
+ * entry per element: TCP on the `p2p` port and WebSocket on the `ws` port, both on
+ * every interface.
+ *
+ * The WebSocket entry is what lets a phone reach the child. A phone's node carries
+ * WebSocket, circuit-relay and WebRTC transports but no TCP
+ * (`reference-app-rn/src/phone-node-config.ts`), and it listens on nothing, so the
+ * phone has to be the one that dials. Naming a `/ws` address is all the child needs:
+ * cadre-core adds the WebSocket transport for any listen entry that names one
+ * (`resolveTransportOptions` in `cadre-core/src/relay-addrs.ts`).
+ */
+export function childListenAddrs(ports) {
+    return [`/ip4/0.0.0.0/tcp/${ports.p2p}`, `/ip4/0.0.0.0/tcp/${ports.ws}/ws`];
+}
+/**
+ * Every TCP port a managed child binds, on the address it binds it to: health and
+ * metrics (`cadre-cli`'s `HealthServer`) and the libp2p TCP and WebSocket listeners
+ * ({@link childListenAddrs}) on every interface, plus the loopback admin channel —
+ * for the owner node only, the one child started with `--admin-port`. A key the
+ * set lacks (a handle persisted by an older build) is skipped.
+ */
+function childPortBindings(ports, owner) {
+    const bindings = [];
+    for (const port of [ports.health, ports.metrics, ports.p2p, ports.ws]) {
+        if (port !== undefined)
+            bindings.push({ port, host: '0.0.0.0' });
+    }
+    if (owner && ports.admin !== undefined)
+        bindings.push({ port: ports.admin, host: '127.0.0.1' });
+    return bindings;
+}
 /** Fixed friendly id for the admin's owner node. */
 export const OWNER_CONTAINER_ID = 'owner';
 /**
@@ -101,7 +134,6 @@ export class HostProcessOrchestrator {
         const state = this.stateStore.load();
         this.ownerConfig = state.ownerConfig;
         for (const persisted of state.handles) {
-            const alive = isPidAlive(persisted.pid) && tokenMatches(persisted.workdir, persisted.startupToken);
             const handle = {
                 containerId: persisted.containerId,
                 dockerId: persisted.dockerId,
@@ -113,8 +145,9 @@ export class HostProcessOrchestrator {
                 partyId: persisted.partyId,
                 profile: persisted.profile,
                 ...(persisted.owner ? { owner: true } : {}),
-                alive,
+                alive: false,
             };
+            handle.alive = isHandleLive(handle);
             this.handles.set(handle.dockerId, handle);
             // Always reserve ports — even for dead handles, until the caller cleans them up
             this.reservePorts(persisted.ports);
@@ -191,8 +224,8 @@ export class HostProcessOrchestrator {
             // Identity BEFORE any port is reserved: it is the one step here that can
             // fail on its own (an unreadable or undecodable identity.key throws rather
             // than silently re-keying), and everything past the allocation is either
-            // infallible or releases the ports itself. Allocating first would leak four
-            // ports from a bounded range on every failed provision attempt.
+            // infallible or releases the ports itself. Allocating first would leak a
+            // node's worth of ports from a bounded range on every failed provision attempt.
             const identity = await ensureNodeIdentity(workdir);
             log('container %s identity peerId=%s', request.containerId, identity.peerId);
             // A node started with pinned owner keys belongs to a FOREIGN cadre (the
@@ -203,8 +236,8 @@ export class HostProcessOrchestrator {
             const foreignParty = (request.pinnedOwnerKeys?.length ?? 0) > 0;
             // Only storage-profile nodes participate in strands and thus fan out push
             // wakes — a transaction-only node need not carry credentials. Resolved
-            // BEFORE the drop below: it is the last `await` on this path, which is what
-            // keeps the drop → launch window synchronous (see restoreDroppedHandles).
+            // BEFORE the drop below, which keeps the drop → launch window synchronous
+            // (see restoreDroppedHandles).
             const push = request.profile === 'storage' && !foreignParty ? await this.resolvePush() : undefined;
             // Pinned owner key(s) reach the child via CADRE_OWNER_KEYS (comma-separated);
             // `cadre-cli start` unions it into its cold-start pinnedKeyTrustPolicy so the
@@ -212,16 +245,17 @@ export class HostProcessOrchestrator {
             const extraEnv = request.pinnedOwnerKeys?.length
                 ? { CADRE_OWNER_KEYS: request.pinnedOwnerKeys.join(',') }
                 : undefined;
+            // The last `await` on this path: checked as close to the drop as it can be.
+            await this.refuseRespawnOverLiveChild(request.containerId, {}, false);
             // Nothing from here to the launch is `await`ed — which is what keeps
             // `restoreDroppedHandles`'s documented precondition true even though the
             // `try` now opens further up. Do not add an `await` past this line.
             dropped = this.dropStaleHandle(request.containerId);
-            // NOTE: the p2p port is re-allocated per spawn, so a re-spawned donated
-            // node keeps its peer id but may announce a different port. Recoverable —
-            // it dials out to its retained bootstrap peers and republishes its own
-            // CadrePeer row once connected. If that reconnect ever proves too slow,
-            // pin the p2p port per containerId (see donated-node-respawn-core).
-            ports = allocateNodePorts(this.portAllocator);
+            // A re-spawn comes back on the ports the dropped handle held, not merely the
+            // lowest free ones: a requester that dials the node itself (a phone) knows it
+            // only by the address it was given. The drop above just released them, and
+            // nothing can have taken them since — see reusedNodePorts.
+            ports = allocateNodePorts(this.portAllocator, reusedNodePorts(dropped));
             return this.launchChild({
                 containerId: request.containerId,
                 partyId: request.partyId,
@@ -355,7 +389,7 @@ export class HostProcessOrchestrator {
         }
         this.ownerConfig = config;
         const existing = this.findOwnerHandle();
-        if (existing && isPidAlive(existing.pid) && tokenMatches(existing.workdir, existing.startupToken)) {
+        if (existing && isHandleLive(existing)) {
             this.persist();
             return toNodeInfo(existing);
         }
@@ -365,6 +399,8 @@ export class HostProcessOrchestrator {
         // Resolved BEFORE the drop below so the drop → launch window stays
         // synchronous (see restoreDroppedHandles).
         const push = await this.resolvePush();
+        // The last `await` before the drop — same guard as in createContainer.
+        await this.refuseRespawnOverLiveChild(OWNER_CONTAINER_ID, { p2p: config.libp2pPort }, true);
         // NOTE: the short-circuit above matches via `findOwnerHandle` (owner flag OR
         // containerId), this drop only by containerId. Equivalent today — every
         // owner handle is launched with OWNER_CONTAINER_ID. If an owner spawn ever
@@ -374,8 +410,10 @@ export class HostProcessOrchestrator {
         let ports;
         try {
             // The owner node must listen on the configured libp2p port so the NAT
-            // mapping (external → internal) lands on it — hence the p2p override.
-            ports = allocateNodePorts(this.portAllocator, { p2p: config.libp2pPort });
+            // mapping (external → internal) lands on it — hence the p2p override, which
+            // wins over the dropped handle's. Every other port comes back as it was, for
+            // the same reason as in createContainer.
+            ports = allocateNodePorts(this.portAllocator, { ...reusedNodePorts(dropped), p2p: config.libp2pPort });
             const result = this.launchChild({
                 containerId: OWNER_CONTAINER_ID,
                 partyId: config.partyId,
@@ -493,17 +531,19 @@ export class HostProcessOrchestrator {
             CADRE_STARTUP_TOKEN: token,
             CADRE_HEALTH_PORT: String(ports.health),
             CADRE_METRICS_PORT: String(ports.metrics),
-            CADRE_LISTEN_ADDRS: `/ip4/0.0.0.0/tcp/${ports.p2p}`,
+            CADRE_LISTEN_ADDRS: childListenAddrs(ports).join(','),
             // NOTE: the scrub above drops every CADRE_* var and `extraEnv` is built only from
-            // pinnedOwnerKeys, so a managed child advertises only the port assigned to it here
+            // pinnedOwnerKeys, so a managed child advertises only the ports assigned to it here
             // — `CADRE_ANNOUNCE_ADDRS`/`CADRE_APPEND_ANNOUNCE_ADDRS` cannot reach it. Fine while
-            // children are reached at that port or through a relay; if a host is ever fronted by
-            // a proxy or DNS name, plumb an announce var through from host config. The port is
-            // the CHILD'S CONTROL NODE's alone: each strand node the child runs binds the same
-            // entry with an OS-assigned port instead, since one port cannot be held twice
-            // (`cadre-core/src/strand-network-config.ts`). A NAT forward of this port therefore
-            // reaches the control node only, and strand nodes are reached through observed
-            // addresses or a relay.
+            // children are reached at those ports or through a relay; if a host is ever fronted
+            // by a proxy or DNS name, plumb an announce var through from host config. The TCP
+            // and WebSocket ports are the CHILD'S CONTROL NODE's alone: each strand node the
+            // child runs binds the same two entries with OS-assigned ports instead, since one
+            // port cannot be held twice (`cadre-core/src/strand-network-config.ts`). A NAT
+            // forward (the owner node's, via `NatService`) covers the TCP port only, so it
+            // reaches the control node over TCP alone; a phone outside the LAN, which needs the
+            // WebSocket port, and every strand node are reached through observed addresses or
+            // a relay.
             CADRE_SEED_TOKEN: seedToken,
             // Pin each child's node-local state (trusted-owner anchor, retained
             // cold-start dial targets) to its OWN workdir. This is the same value the
@@ -604,11 +644,67 @@ export class HostProcessOrchestrator {
             p2pPort: ports.p2p,
         };
     }
+    /**
+     * Refuse to re-spawn `containerId` while a previous child of it may still be
+     * running. Both spawn paths call this as their last `await` before the handle
+     * drop, so a refusal happens while nothing has been released, no token rotated
+     * and no child launched — the caller sees an ordinary failed spawn.
+     *
+     * Why it exists: the drop hands the old handle's ports back and the launch takes
+     * those same ports (`reusedNodePorts`), so a child started over a live one dies
+     * on a port clash — but only after `launchChild` has returned success with a
+     * fresh seed token. The caller then records a dead child, and the live one
+     * refuses the new token.
+     *
+     * - A handle this process spawned is checked exactly ({@link isHandleLive}); a
+     *   live one refuses outright.
+     * - A handle re-attached from `state.json` whose pid is alive but whose token
+     *   does not match is either our child still starting or an unrelated process
+     *   that inherited the pid. The ports decide: if any the re-spawn would take back
+     *   is already bound, refuse. The pid is never killed on that evidence — it may
+     *   not be ours.
+     *
+     * `overrides` are the ports the caller will override on top of the reused ones
+     * (the owner node's configured p2p port); `owner` adds the admin channel.
+     *
+     * NOTE: the probe cannot see a re-attached child still loading its modules —
+     * `cadre-cli start` writes its token and only then binds, so a child in that
+     * window shows neither, and a re-spawn launched then races it for the ports.
+     * Reachable only when the host restarts within a child's first seconds. If it
+     * is ever seen, treat a re-attached handle with a live pid as starting for a
+     * grace period after its `spawnedAt`.
+     *
+     * NOTE: the probe holds each port for an instant, so a child binding that port
+     * in the same instant fails. It would have had to write its token between the
+     * token check above and the probe, against the several awaited steps
+     * `cadre-cli start` takes between writing its token and binding; if a re-attached
+     * child is ever seen dying on its own port right after a host restart, probe by
+     * connecting instead of binding.
+     */
+    async refuseRespawnOverLiveChild(containerId, overrides, owner) {
+        const previous = this.handlesFor(containerId);
+        if (previous.some(isHandleLive)) {
+            throw new Error(`container ${containerId} is still running`);
+        }
+        if (!previous.some((h) => isPidAlive(h.pid)))
+            return;
+        const bindings = childPortBindings({ ...reusedNodePorts(previous), ...overrides }, owner);
+        try {
+            await Promise.all(bindings.map(assertPortFree));
+        }
+        catch (err) {
+            throw new Error(`container ${containerId} may still be running: ${err.message}`, { cause: err });
+        }
+    }
+    /** Every handle for `containerId`, in map order — the order `dropStaleHandle` drops them in. */
+    handlesFor(containerId) {
+        return [...this.handles.values()].filter((h) => h.containerId === containerId);
+    }
     /**
      * Drop any handle left over from a previous spawn of the same `containerId`
      * and release its ports. Handles are keyed by the per-spawn `dockerId`, so
      * without this a re-spawn (donated-node respawn) would strand the prior
-     * handle in the map forever, leaking four ports from a bounded range each
+     * handle in the map forever, leaking its ports from a bounded range each
      * time. Mirrors the same cleanup in `ensureOwnerNode`.
      *
      * DO NOT delete the workdir: the identity key and node-local stores
@@ -616,11 +712,12 @@ export class HostProcessOrchestrator {
      * the whole reason a respawn comes back as the same node. `launchChild`
      * reuses the same workdir.
      *
-     * NOTE: releasing the ports hands them straight back to the allocator, so a
-     * re-spawn while the *previous* child is still listening can bind-clash. Every
-     * caller today re-spawns only a container it has established is not running
-     * (`DonationService.respawn`, `ensureOwnerNode`). If a caller ever needs to
-     * replace a live child, stop it first — or hold the ports until its exit.
+     * Releasing the ports hands them straight back to the allocator, and the
+     * re-spawn then takes those same ports as overrides (`reusedNodePorts`), so a
+     * re-spawn while the *previous* child is still listening would bind-clash.
+     * Callers must therefore never drop a live child, and both do so only after
+     * {@link refuseRespawnOverLiveChild} has passed. A caller that needs to replace
+     * a live child must stop it first.
      *
      * **The drop is reversible.** It happens before the launch can fail, so the
      * dropped handles are returned and every caller restores them via
@@ -631,20 +728,17 @@ export class HostProcessOrchestrator {
      * gone by then.
      */
     dropStaleHandle(containerId) {
-        const dropped = [];
-        for (const h of this.handles.values()) {
-            if (h.containerId !== containerId)
-                continue;
+        const dropped = this.handlesFor(containerId);
+        for (const h of dropped) {
             log('dropping stale handle %s for container %s', h.dockerId, containerId);
             this.releasePorts(h.ports);
             this.handles.delete(h.dockerId);
-            dropped.push(h);
         }
         return dropped;
     }
     /**
      * Inverse of {@link dropStaleHandle}, for a spawn that then failed: put each
-     * handle back in the map and re-reserve its four ports, leaving host state
+     * handle back in the map and re-reserve its ports, leaving host state
      * exactly as the failed attempt found it.
      *
      * **Precondition: the drop → launch window is synchronous.** Restoring is
@@ -662,9 +756,10 @@ export class HostProcessOrchestrator {
      *
      * NOTE: a restored handle keeps `alive: true` even if its child exited while
      * it was out of the map (`launchChild`'s exit listener looks the handle up by
-     * dockerId and finds nothing). Only reachable by re-spawning a container
-     * whose child is still live, which `dropStaleHandle`'s note above already
-     * forbids.
+     * dockerId and finds nothing). Only reachable by dropping a handle whose child
+     * is still live, which {@link refuseRespawnOverLiveChild} refuses before any
+     * drop. (Its start-up blind spot concerns re-attached handles only, and those
+     * have no exit listener to miss.)
      */
     restoreDroppedHandles(dropped) {
         for (const h of dropped) {
@@ -691,19 +786,10 @@ export class HostProcessOrchestrator {
      * launch then failed.
      */
     reservePorts(ports) {
-        this.portAllocator.markUsed(ports.health);
-        this.portAllocator.markUsed(ports.metrics);
-        this.portAllocator.markUsed(ports.p2p);
-        // `admin` is absent on handles persisted before this build; markUsed would
-        // otherwise put `undefined` in the used-set.
-        if (typeof ports.admin === 'number')
-            this.portAllocator.markUsed(ports.admin);
+        reserveNodePorts(this.portAllocator, ports);
     }
     releasePorts(ports) {
-        this.portAllocator.release(ports.health);
-        this.portAllocator.release(ports.metrics);
-        this.portAllocator.release(ports.p2p);
-        this.portAllocator.release(ports.admin);
+        releaseNodePorts(this.portAllocator, ports);
     }
     async stopContainer(dockerId) {
         const handle = this.requireHandle(dockerId);
@@ -770,37 +856,20 @@ export class HostProcessOrchestrator {
         this.handles.delete(dockerId);
         this.persist();
     }
+    /**
+     * Whether the child `dockerId` names is running — see {@link isHandleLive}. An
+     * id with no handle is not running: without the handle's workdir there is no
+     * token to verify a live pid against.
+     */
     async isRunning(dockerId) {
         const handle = this.handles.get(dockerId);
-        let pid;
-        let token;
-        let workdir;
-        if (handle) {
-            pid = handle.pid;
-            token = handle.startupToken;
-            workdir = handle.workdir;
-        }
-        else {
-            try {
-                const decoded = decodeDockerId(dockerId);
-                pid = decoded.pid;
-                token = decoded.token;
-            }
-            catch {
-                return false;
-            }
-        }
-        if (!isPidAlive(pid)) {
-            if (handle)
-                handle.alive = false;
-            return false;
-        }
-        if (workdir === undefined) {
-            // We have no record — without a workdir we can't verify the token,
-            // so we must treat this as unknown rather than running.
+        if (!handle)
             return false;
-        }
-        return tokenMatches(workdir, token);
+        if (isHandleLive(handle))
+            return true;
+        if (!isPidAlive(handle.pid))
+            handle.alive = false;
+        return false;
     }
     async getStats(dockerId) {
         const handle = this.requireHandle(dockerId);
@@ -958,6 +1027,30 @@ function resolveCadreCliBin() {
             `and listed as a dependency. Underlying error: ${err.message}`, { cause: err });
     }
 }
+/**
+ * Whether the process a handle names is still the child it was launched as — the
+ * one liveness rule behind `init`, `isRunning`, `ensureOwnerNode`'s short-circuit
+ * and the pre-spawn guard, so they cannot drift apart.
+ *
+ * A handle this process spawned carries its `ChildProcess`, and that answer is
+ * exact from the moment of spawn: no exit seen, and the pid still answering. (The
+ * pid check covers the moment between the OS ending the process and Node
+ * delivering its exit; the pid cannot have been reused in that moment, since the
+ * OS holds it until Node has reaped the child.) The startup-token file is no use
+ * here — a child writes it only once it is running its own code, so reading it
+ * would report every child dead for its first moments.
+ *
+ * A handle re-attached from `state.json` after a host restart has no
+ * `ChildProcess`, so it falls back to the pid plus that token file, which tells our
+ * child apart from an unrelated process that inherited its pid.
+ */
+function isHandleLive(handle) {
+    const { child } = handle;
+    if (child) {
+        return child.exitCode === null && child.signalCode === null && isPidAlive(handle.pid);
+    }
+    return isPidAlive(handle.pid) && tokenMatches(handle.workdir, handle.startupToken);
+}
 function tokenMatches(workdir, expected) {
     const tokenPath = join(workdir, STARTUP_TOKEN_FILE);
     try {