dominds 1.25.19 → 1.26.1

package/dist/server/certificates.js

@@ -0,0 +1,418 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SELF_SIGNED_CERT_DAYS = void 0;
+exports.getDefaultDomindsCertsDir = getDefaultDomindsCertsDir;
+exports.findAutoHttpsCertificateForHost = findAutoHttpsCertificateForHost;
+exports.createSelfSignedCertificate = createSelfSignedCertificate;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs/promises"));
+const net = __importStar(require("node:net"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const tls = __importStar(require("node:tls"));
+const node_util_1 = require("node:util");
+const network_hosts_1 = require("./network-hosts");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+const CERT_EXTENSIONS = ['.crt', '.cert', '.pem'];
+const KEY_SUFFIXES = ['.key.pem', '.key', '-key.pem'];
+exports.DEFAULT_SELF_SIGNED_CERT_DAYS = 3650;
+function getDefaultDomindsCertsDir() {
+    return path.join(os.homedir(), '.dominds', 'certs');
+}
+async function findAutoHttpsCertificateForHost(params) {
+    const host = (0, network_hosts_1.normalizeNetworkHost)(params.host);
+    const matchHosts = await (0, network_hosts_1.resolveLanHttpsHostsForBindHost)(host);
+    const endpoint = { bindHost: host, urlHost: matchHosts[0] ?? host };
+    const certsDirAbs = params.certsDirAbs ?? getDefaultDomindsCertsDir();
+    const now = params.now ?? new Date();
+    const diagnostics = [];
+    if (matchHosts.length === 0) {
+        return { kind: 'not_found', certsDirAbs, endpoint, diagnostics };
+    }
+    let entries;
+    try {
+        entries = await fs.readdir(certsDirAbs);
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, 'ENOENT')) {
+            return { kind: 'not_found', certsDirAbs, endpoint, diagnostics };
+        }
+        throw error;
+    }
+    const matches = [];
+    for (const entry of entries) {
+        if (!isCertificateFilename(entry))
+            continue;
+        const certPath = path.join(certsDirAbs, entry);
+        const keyPath = await findKeyPathForCert({ certsDirAbs, certEntry: entry });
+        if (keyPath === null) {
+            diagnostics.push({
+                level: 'warn',
+                code: 'missing_key_file',
+                message: `Certificate has no matching private key: ${certPath}`,
+                certPath,
+            });
+            continue;
+        }
+        const loaded = await loadAndValidateCandidate({
+            matchHosts,
+            now,
+            certPath,
+            keyPath,
+        });
+        if (loaded.kind === 'match') {
+            matches.push(loaded.certificate);
+            continue;
+        }
+        if (loaded.kind === 'diagnostic') {
+            diagnostics.push(loaded.diagnostic);
+        }
+    }
+    if (matches.length === 0) {
+        return { kind: 'not_found', certsDirAbs, endpoint, diagnostics };
+    }
+    matches.sort((a, b) => a.matchedHostPriority - b.matchedHostPriority || b.validTo.getTime() - a.validTo.getTime());
+    if (matches.length > 1) {
+        diagnostics.push({
+            level: 'warn',
+            code: 'multiple_matching_certs',
+            message: `Multiple valid certificates match host '${host}'; using the best-priority match with the latest expiry.`,
+            host,
+            certPaths: matches.map((m) => m.certPath),
+        });
+    }
+    return {
+        kind: 'found',
+        certsDirAbs,
+        endpoint: { bindHost: host, urlHost: matches[0].matchedHost },
+        certificate: matches[0],
+        diagnostics,
+    };
+}
+async function createSelfSignedCertificate(params) {
+    const hosts = normalizeCertificateHostsForCreate(params.host === undefined
+        ? await (0, network_hosts_1.resolveDefaultLanHttpsHosts)()
+        : [params.host, ...(params.altHosts ?? [])], { skipInvalidHosts: params.host === undefined });
+    const host = hosts[0];
+    const days = normalizeDays(params.days ?? exports.DEFAULT_SELF_SIGNED_CERT_DAYS);
+    const certsDirAbs = params.certsDirAbs ?? getDefaultDomindsCertsDir();
+    const basename = certificateBasenameForHosts(hosts);
+    const certPath = path.join(certsDirAbs, `${basename}.crt.pem`);
+    const keyPath = path.join(certsDirAbs, `${basename}.key.pem`);
+    const metadataPath = path.join(certsDirAbs, `${basename}.json`);
+    await fs.mkdir(certsDirAbs, { recursive: true, mode: 0o700 });
+    if (params.force !== true) {
+        await assertPathDoesNotExist(certPath);
+        await assertPathDoesNotExist(keyPath);
+        await assertPathDoesNotExist(metadataPath);
+    }
+    const san = buildSubjectAltName(hosts);
+    await execFileAsync('openssl', [
+        'req',
+        '-x509',
+        '-newkey',
+        'rsa:2048',
+        '-sha256',
+        '-nodes',
+        '-days',
+        String(days),
+        '-keyout',
+        keyPath,
+        '-out',
+        certPath,
+        '-subj',
+        `/CN=${escapeOpenSslSubjectValue(host)}`,
+        '-addext',
+        `subjectAltName=${san}`,
+    ], { maxBuffer: 1024 * 1024 });
+    await fs.chmod(keyPath, 0o600);
+    await fs.chmod(certPath, 0o644);
+    const metadata = {
+        kind: 'dominds_self_signed_cert',
+        host,
+        hosts,
+        days,
+        certPath,
+        keyPath,
+        createdAt: new Date().toISOString(),
+        subjectAltName: san,
+    };
+    await fs.writeFile(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`, 'utf8');
+    await fs.chmod(metadataPath, 0o644);
+    return { host, hosts, days, certsDirAbs, certPath, keyPath, metadataPath };
+}
+function normalizeCertificateHostsForCreate(rawHosts, options) {
+    const hosts = [];
+    const seen = new Set();
+    for (const rawHost of rawHosts) {
+        const hostCandidates = getCertificateMatchHostsForCreateHost(rawHost);
+        for (const host of hostCandidates) {
+            const validation = validateCertificateHost(host);
+            if (validation.kind === 'invalid') {
+                if (options.skipInvalidHosts)
+                    continue;
+                throw new Error(validation.message);
+            }
+            const key = host.toLowerCase();
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            hosts.push(host);
+        }
+    }
+    if (hosts.length === 0) {
+        throw new Error(options.skipInvalidHosts
+            ? 'No certificate-valid non-loopback LAN host was detected; provide --host explicitly'
+            : '--host must be provided at least once');
+    }
+    return hosts;
+}
+function getCertificateMatchHostsForCreateHost(rawHost) {
+    const host = (0, network_hosts_1.normalizeNetworkHost)(rawHost);
+    return [host];
+}
+function normalizeDays(days) {
+    if (!Number.isInteger(days) || days < 1 || days > 36500) {
+        throw new Error('--days must be an integer in [1, 36500]');
+    }
+    return days;
+}
+function validateCertificateHost(host) {
+    if (host === '') {
+        return { kind: 'invalid', message: '--host must not be empty' };
+    }
+    if (host.includes('/')) {
+        return {
+            kind: 'invalid',
+            message: '--host must be an exact DNS name or IP address; CIDR/IP ranges are not valid',
+        };
+    }
+    if (!(0, network_hosts_1.isLanHttpsHost)(host)) {
+        return {
+            kind: 'invalid',
+            message: '--host must not be localhost, loopback, 127.0.0.0/8, 169.254.0.0/16, ::1, fe80::/10, 0.0.0.0, or ::',
+        };
+    }
+    if (net.isIP(host) !== 0)
+        return { kind: 'valid' };
+    if (!isValidDnsHost(host)) {
+        return {
+            kind: 'invalid',
+            message: '--host must be a DNS name, an IPv4 address, or an IPv6 address',
+        };
+    }
+    return { kind: 'valid' };
+}
+function isValidDnsHost(host) {
+    if (host.length > 253)
+        return false;
+    const trimmed = host.endsWith('.') ? host.slice(0, -1) : host;
+    if (trimmed === '')
+        return false;
+    const labels = trimmed.split('.');
+    for (const label of labels) {
+        if (label.length < 1 || label.length > 63)
+            return false;
+        if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label))
+            return false;
+    }
+    return true;
+}
+async function assertPathDoesNotExist(filePathAbs) {
+    try {
+        await fs.access(filePathAbs);
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, 'ENOENT'))
+            return;
+        throw error;
+    }
+    throw new Error(`Refusing to overwrite existing certificate file: ${filePathAbs}`);
+}
+function certificateBasenameForHosts(hosts) {
+    const host = hosts[0];
+    const safeHost = host
+        .toLowerCase()
+        .replace(/[^a-z0-9.-]+/g, '_')
+        .replace(/^_+|_+$/g, '');
+    const digest = (0, node_crypto_1.createHash)('sha256').update(hosts.join('\0')).digest('hex').slice(0, 8);
+    return `dominds-${safeHost || 'host'}-${digest}`;
+}
+function buildSubjectAltName(hosts) {
+    return hosts
+        .map((host) => {
+        const ipVersion = net.isIP(host);
+        return ipVersion !== 0 ? `IP:${host}` : `DNS:${host}`;
+    })
+        .join(',');
+}
+function escapeOpenSslSubjectValue(value) {
+    return value.replace(/\\/g, '\\\\').replace(/\//g, '\\/');
+}
+function isCertificateFilename(filename) {
+    return CERT_EXTENSIONS.some((ext) => filename.endsWith(ext)) && !isKeyFilename(filename);
+}
+function isKeyFilename(filename) {
+    return KEY_SUFFIXES.some((suffix) => filename.endsWith(suffix));
+}
+async function findKeyPathForCert(params) {
+    const baseNames = certBaseNameVariants(params.certEntry);
+    for (const baseName of baseNames) {
+        for (const suffix of KEY_SUFFIXES) {
+            const keyPath = path.join(params.certsDirAbs, `${baseName}${suffix}`);
+            try {
+                await fs.access(keyPath);
+                return keyPath;
+            }
+            catch (error) {
+                if (isNodeErrorWithCode(error, 'ENOENT'))
+                    continue;
+                throw error;
+            }
+        }
+    }
+    return null;
+}
+function certBaseNameVariants(certEntry) {
+    const variants = [];
+    for (const ext of CERT_EXTENSIONS) {
+        if (certEntry.endsWith(ext)) {
+            variants.push(certEntry.slice(0, -ext.length));
+        }
+    }
+    if (certEntry.endsWith('.crt.pem')) {
+        variants.push(certEntry.slice(0, -'.crt.pem'.length));
+    }
+    return Array.from(new Set(variants));
+}
+async function loadAndValidateCandidate(params) {
+    let certPem;
+    let keyPem;
+    let cert;
+    try {
+        certPem = await fs.readFile(params.certPath, 'utf8');
+        keyPem = await fs.readFile(params.keyPath, 'utf8');
+        cert = new node_crypto_1.X509Certificate(certPem);
+    }
+    catch (error) {
+        return {
+            kind: 'diagnostic',
+            diagnostic: {
+                level: 'warn',
+                code: 'invalid_cert_file',
+                message: `Invalid certificate file '${params.certPath}': ${formatUnknownError(error)}`,
+                certPath: params.certPath,
+                keyPath: params.keyPath,
+            },
+        };
+    }
+    const matchedHost = findCertificateMatchedHost(cert, params.matchHosts);
+    if (matchedHost === null) {
+        return { kind: 'no_match' };
+    }
+    if (!certificateIsCurrentlyValid(cert, params.now)) {
+        return {
+            kind: 'diagnostic',
+            diagnostic: {
+                level: 'warn',
+                code: 'expired_or_not_yet_valid',
+                message: `Certificate is not currently valid: ${params.certPath}`,
+                certPath: params.certPath,
+                keyPath: params.keyPath,
+            },
+        };
+    }
+    try {
+        tls.createSecureContext({ cert: certPem, key: keyPem });
+    }
+    catch (error) {
+        return {
+            kind: 'diagnostic',
+            diagnostic: {
+                level: 'warn',
+                code: 'invalid_key_pair',
+                message: `Certificate and private key do not form a valid TLS pair: ${formatUnknownError(error)}`,
+                certPath: params.certPath,
+                keyPath: params.keyPath,
+            },
+        };
+    }
+    return {
+        kind: 'match',
+        certificate: {
+            cert: certPem,
+            key: keyPem,
+            certPath: params.certPath,
+            keyPath: params.keyPath,
+            matchedHost: matchedHost.host,
+            matchedHostPriority: matchedHost.priority,
+            validTo: new Date(Date.parse(cert.validTo)),
+        },
+    };
+}
+function certificateIsCurrentlyValid(cert, now) {
+    const validFromMs = Date.parse(cert.validFrom);
+    const validToMs = Date.parse(cert.validTo);
+    if (!Number.isFinite(validFromMs) || !Number.isFinite(validToMs)) {
+        return false;
+    }
+    const nowMs = now.getTime();
+    return validFromMs <= nowMs && nowMs <= validToMs;
+}
+function findCertificateMatchedHost(cert, matchHosts) {
+    for (let i = 0; i < matchHosts.length; i += 1) {
+        const host = matchHosts[i];
+        if (certificateMatchesHost(cert, host)) {
+            return { host, priority: i };
+        }
+    }
+    return null;
+}
+function certificateMatchesHost(cert, host) {
+    const normalizedHost = (0, network_hosts_1.normalizeNetworkHost)(host);
+    const ipVersion = net.isIP(normalizedHost);
+    if (ipVersion !== 0) {
+        return cert.checkIP(normalizedHost) !== undefined;
+    }
+    return cert.checkHost(normalizedHost) !== undefined;
+}
+function isNodeErrorWithCode(error, code) {
+    return error instanceof Error && error.code === code;
+}
+function formatUnknownError(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/server/dominds-self-update.js

@@ -15,14 +15,11 @@ const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
 const time_1 = require("@longrun-ai/kernel/utils/time");
 const log_1 = require("../log");
+const supervisor_protocol_1 = require("../supervisor-protocol");
 const dominds_running_version_1 = require("./dominds-running-version");
 const log = (0, log_1.createLogger)('dominds-self-update');
 const BACKGROUND_CHECK_INTERVAL_MS = 30 * 60 * 1000;
 const LATEST_VERSION_CHECK_TIMEOUT_MS = 60000;
-const RESTART_PORT_RELEASE_TIMEOUT_MS = 15000;
-const RESTART_PORT_PROBE_INTERVAL_MS = 150;
-const RESTART_EXIT_GRACE_MS = 1000;
-const RESTART_FORCE_KILL_AFTER_MS = 30000;
 const COMMAND_OUTPUT_LOG_LIMIT = 2000;
 const PROXY_URL_ENV_KEYS = new Set([
     'HTTP_PROXY',
@@ -34,7 +31,6 @@ const PROXY_URL_ENV_KEYS = new Set([
 ]);
 const IDLE_RESTART_STATE = { kind: 'idle' };
 const PROCESS_START_ARGV = [...process.argv];
-const PROCESS_START_EXEC_ARGV = [...process.execArgv];
 const PROCESS_START_CWD = process.cwd();
 let runtimeConfig = null;
 let latestObservation = { kind: 'unknown' };
@@ -86,19 +82,6 @@ function detectRunKind(mode) {
     }
     return 'global';
 }
-function hasInteractiveConsole() {
-    return Boolean(process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY);
-}
-function getRestartHelperStdio() {
-    return hasInteractiveConsole() ? 'inherit' : 'ignore';
-}
-function getRestartPortProbeHost(host) {
-    if (host === '0.0.0.0')
-        return '127.0.0.1';
-    if (host === '::')
-        return '::1';
-    return host;
-}
 function normalizeComparablePath(value) {
     const normalized = path_1.default.normalize(value);
     return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
@@ -118,9 +101,6 @@ function buildRestartTraceContext() {
     ].join('-'));
     return { debugDir, traceFile };
 }
-function getRestartHelperEntrypoint() {
-    return path_1.default.resolve(__dirname, 'dominds-self-update-restart-helper.js');
-}
 async function appendRestartTrace(trace, event, details = {}) {
     const payload = {
         ...details,
@@ -170,13 +150,6 @@ function getCurrentProcessEntrypoint() {
     }
     return entrypoint;
 }
-function buildCurrentProcessRestartArgs() {
-    getCurrentProcessEntrypoint();
-    return [...PROCESS_START_EXEC_ARGV, ...PROCESS_START_ARGV.slice(1)];
-}
-function buildCurrentDomindsCliArgs() {
-    return PROCESS_START_ARGV.slice(2);
-}
 function getNpxWorkspaceDirAbs() {
     const entrypoint = getCurrentProcessEntrypoint().replace(/\\/g, '/');
     const marker = '/node_modules/dominds/';
@@ -223,28 +196,12 @@ async function readNpxDomindsSpec() {
     }
     return null;
 }
-async function buildNpxLatestRestartLaunchSpec() {
-    const npm = await resolveNpmCommandSpec();
-    return {
-        command: npm.command,
-        args: [...npm.args, 'exec', '-y', '--', 'dominds@latest', ...buildCurrentDomindsCliArgs()],
-    };
-}
-function buildCurrentProcessRestartLaunchSpec() {
-    return {
-        command: process.execPath,
-        args: buildCurrentProcessRestartArgs(),
-    };
-}
 function truncateCommandOutput(value) {
     const raw = typeof value === 'string' ? value.trim() : '';
     if (raw.length <= COMMAND_OUTPUT_LOG_LIMIT)
         return raw;
     return `${raw.slice(0, COMMAND_OUTPUT_LOG_LIMIT)}...[truncated ${raw.length - COMMAND_OUTPUT_LOG_LIMIT} chars]`;
 }
-function delayMs(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 function formatPathEnvExcerpt(pathEnv) {
     if (pathEnv === null || pathEnv.trim() === '')
         return null;
@@ -1382,57 +1339,31 @@ async function installLatestDominds() {
     publishStatusUpdateSoon();
     return await getDomindsSelfUpdateStatus();
 }
-async function spawnDetachedRestartHelper(params) {
-    const stdioMode = getRestartHelperStdio();
-    const helperEntrypoint = getRestartHelperEntrypoint();
-    await promises_1.default.access(helperEntrypoint);
-    const helperPayload = {
-        command: params.command,
-        args: [...params.args],
-        cwd: params.cwd,
-        host: getRestartPortProbeHost(params.host),
-        port: params.port,
-        retiringPid: process.pid,
-        forceKillAfterMs: RESTART_FORCE_KILL_AFTER_MS,
-        probeIntervalMs: RESTART_PORT_PROBE_INTERVAL_MS,
-        portReleaseTimeoutMs: RESTART_PORT_RELEASE_TIMEOUT_MS,
-        stdioMode,
+async function requestSupervisorRestart(params) {
+    if (typeof process.send !== 'function') {
+        throw new Error('Dominds restart requires the dominds supervisor process; this runner has no supervisor IPC channel');
+    }
+    const cfg = assertRuntimeConfig();
+    const message = {
+        type: supervisor_protocol_1.DOMINDS_SUPERVISOR_RESTART_WEBUI,
+        cwd: process.cwd(),
+        host: cfg.host,
+        port: cfg.port,
         traceFile: params.trace.traceFile,
         debugDir: params.trace.debugDir,
+        currentVersion: params.currentVersion,
+        targetVersion: params.targetVersion,
+        runKind: params.runKind,
     };
-    const helper = (0, child_process_1.spawn)(process.execPath, [helperEntrypoint, JSON.stringify(helperPayload)], {
-        cwd: params.cwd,
-        env: process.env,
-        detached: stdioMode !== 'inherit',
-        stdio: stdioMode,
-        windowsHide: stdioMode !== 'inherit',
-    });
-    const helperPid = typeof helper.pid === 'number' ? helper.pid : null;
-    const helperSpawned = new Promise((resolve, reject) => {
-        helper.once('spawn', () => {
-            appendRestartTraceSoon(params.trace, 'parent.helper_spawn_event', {
-                helperPid,
-            });
-            resolve(helperPid);
-        });
-        helper.once('error', (error) => {
-            appendRestartTraceSoon(params.trace, 'parent.helper_error_event', {
-                message: error.message,
-                stack: error.stack ?? null,
-            });
-            reject(error);
-        });
-    });
-    helper.once('exit', (code, signal) => {
-        appendRestartTraceSoon(params.trace, 'parent.helper_exit_event', {
-            code,
-            signal,
+    await new Promise((resolve, reject) => {
+        process.send?.(message, (error) => {
+            if (error !== null) {
+                reject(error);
+                return;
+            }
+            resolve();
         });
     });
-    if (stdioMode !== 'inherit') {
-        helper.unref();
-    }
-    return await helperSpawned;
 }
 async function stopAndExitForRestart() {
     const cfg = assertRuntimeConfig();
@@ -1444,7 +1375,6 @@ async function stopAndExitForRestart() {
         await appendRestartTraceBestEffort(trace, 'parent.stop_and_exit.start', {
             host: cfg.host,
             port: cfg.port,
-            exitGraceMs: RESTART_EXIT_GRACE_MS,
         });
     }
     const stopPromise = cfg
@@ -1481,18 +1411,8 @@ async function stopAndExitForRestart() {
         return undefined;
     });
     cfg.closeWebSocketClients();
-    await delayMs(RESTART_EXIT_GRACE_MS);
-    if (!stopSettled) {
-        log.warn('Exiting Dominds process before graceful HTTP server stop completed during restart', undefined, {
-            host: cfg.host,
-            port: cfg.port,
-            graceMs: RESTART_EXIT_GRACE_MS,
-        });
-    }
+    await stopPromise;
     if (trace !== null) {
-        if (stopSettled) {
-            await stopPromise;
-        }
         await appendRestartTraceBestEffort(trace, 'parent.process_exit', {
             host: cfg.host,
             port: cfg.port,
@@ -1519,19 +1439,17 @@ async function restartDomindsIntoLatest() {
             throw new Error('No restartable Dominds update is currently available');
         }
         const runKind = detectRunKind(cfg.mode);
-        let launchSpec;
-        const previousRestartRequiredState = restartState.kind === 'restart_required' ? restartState : null;
-        if (previousRestartRequiredState !== null) {
-            launchSpec = buildCurrentProcessRestartLaunchSpec();
+        if (runKind === 'disabled') {
+            throw new Error('Dominds restart requires a production run kind');
         }
-        else if (runKind === 'npx') {
+        const previousRestartRequiredState = restartState.kind === 'restart_required' ? restartState : null;
+        if (previousRestartRequiredState === null && runKind === 'npx') {
             const npxSpec = await readNpxDomindsSpec();
             if (npxSpec?.kind !== 'latest') {
                 throw new Error('Dominds npx restart requires launching Dominds with dominds@latest');
             }
-            launchSpec = await buildNpxLatestRestartLaunchSpec();
         }
-        else {
+        else if (previousRestartRequiredState === null) {
             throw new Error('Dominds restart requires a completed install or a restartable session');
         }
         restartState = { kind: 'restarting', targetVersion: status.targetVersion };
@@ -1544,29 +1462,23 @@ async function restartDomindsIntoLatest() {
                 runKind,
                 currentVersion: status.currentVersion,
                 targetVersion: status.targetVersion,
-                launchCommand: launchSpec.command,
-                launchArgs: launchSpec.args,
                 restartCwd,
                 host: cfg.host,
                 port: cfg.port,
                 traceFile: trace.traceFile,
             });
-            const helperPid = await spawnDetachedRestartHelper({
-                command: launchSpec.command,
-                args: launchSpec.args,
-                cwd: restartCwd,
-                host: cfg.host,
-                port: cfg.port,
+            await requestSupervisorRestart({
                 trace,
+                runKind,
+                currentVersion: status.currentVersion,
+                targetVersion: status.targetVersion,
             });
-            await appendRestartTraceBestEffort(trace, 'parent.helper_spawned', {
-                helperPid,
+            await appendRestartTraceBestEffort(trace, 'parent.supervisor_restart_requested', {
                 retiringPid: process.pid,
                 host: cfg.host,
                 port: cfg.port,
             });
-            log.info('Dominds restart helper spawned', undefined, {
-                helperPid,
+            log.info('Dominds supervisor restart requested', undefined, {
                 traceFile: trace.traceFile,
             });
             setImmediate(() => {

package/dist/server/network-hosts.d.ts

@@ -0,0 +1,5 @@
+export declare function normalizeNetworkHost(host: string): string;
+export declare function isLanHttpsHost(host: string): boolean;
+export declare function resolveHttpUrlHostForBindHost(bindHost: string): string;
+export declare function resolveLanHttpsHostsForBindHost(bindHost: string): Promise<readonly string[]>;
+export declare function resolveDefaultLanHttpsHosts(): Promise<readonly string[]>;