home-hosted 0.7.0 → 0.7.1

package/AGENTS.md

@@ -21,7 +21,8 @@ seed entry, or a path that names one.
 ```sh
 pnpm run up|down|restart|status    # detached; `down` asks /_hh/shutdown, signals are the fallback
 pnpm run start                     # up --foreground (systemd, docker, a foreground shell)
-pnpm dev                           # tsx-watch panel :3999 + the stock UI's Vite :3998 (proxies /api)
+pnpm dev                           # tsx-watch panel :6000 + the stock UI's Vite :6001 (proxies /api), state in .dev-state/
+pnpm dev --ui noc-console          # the same, for another UI; --port/--ui-port override
 pnpm run build                     # dist/cli.js + the stock UI (uis/stock/dist)
 pnpm run build:uis                 # every UI under uis/, zipped into uis/dist/ (release assets)
 pnpm run quickcheck                # eslint + tsc + vue-tsc for every UI under uis/
@@ -36,6 +37,12 @@ pnpm run media                     # regenerate docs/media (mockups, both served
 
 The published bin is `home-hosted`, with an `hh` alias: both names run the same CLI.
 
+**Dev servers and test instances stay in the 6xxx range** — panel 6000, UI 6001, test-spawned panels
+6100+ (`pnpm dev` takes `--ui`/`--port`/`--ui-port`, or `HHOSTED_DEV_PANEL_PORT` /
+`HHOSTED_DEV_UI_PORT`). Never assume 3999 is free: an installed panel or another dev instance may hold
+it, and the CLI's port preflight runs *before* its config guard, so a busy default port turns config
+tests red for the wrong reason.
+
 Releases are dispatched from `.github/workflows/release.yml` with a version (and a `dry-run` switch
 that stops before pushing). It verifies the version, lints/types/tests, builds the CLI plus the stock
 UI and every UI zip, lets changelogen write the changelog, bump `package.json`, commit and tag

package/README.md

@@ -605,9 +605,10 @@ scripts/        builds, typechecks, media capture, release helpers
 test/           the vitest suite
 ```
 
-`pnpm dev` runs the panel with `tsx watch` plus the stock UI's dev server (state goes to
-`.dev-state/`); `pnpm build` produces `dist/` and `uis/stock/dist/`; `pnpm quickcheck` is lint plus
-types; `pnpm test` is vitest; `pnpm run media` regenerates the GIF above.
+`pnpm dev` runs the panel with `tsx watch` plus one UI's dev server on the 6xxx range — panel `6000`,
+UI `6001` (`pnpm dev --ui noc-console`), state in `.dev-state/` — so a dev instance never fights an
+installed panel's 3999. `pnpm build` produces `dist/` and `uis/stock/dist/`; `pnpm quickcheck` is lint
+plus types; `pnpm test` is vitest; `pnpm run media` regenerates the GIF above.
 
 <details>
 <summary><b>📚 Which doc do I need?</b></summary>

package/dist/cli.js

@@ -13029,22 +13029,6 @@ async function runControlPlane(options) {
 	const hub = new EventHub();
 	let app;
 	const token = newToken();
-	const controlServer = new ControlServer({
-		fetch: (request) => {
-			if (!app) throw new Error("the control app is not ready yet");
-			return app.fetch(request);
-		},
-		trustProxy: () => settings.control.auth.trustProxy,
-		tls: () => settings.control.tls.enabled ? tls.load() : null
-	}, {
-		host: settings.control.host,
-		port: settings.control.port,
-		tls: settings.control.tls.enabled
-	});
-	if (!auth.passwordSet) {
-		auth.ensureDefaultPassword("hh");
-		logger.warn(`no password was set — created the default "hh"; change it in Global Settings → Authentication`);
-	}
 	const configured = settings.control;
 	const intendedHost = options.host === void 0 ? configured.host : parseBind(options.host);
 	if (intendedHost === null) {
@@ -13059,6 +13043,22 @@ async function runControlPlane(options) {
 		logger.error(`invalid control port: ${String(options.port)}`);
 		process.exit(1);
 	}
+	const controlServer = new ControlServer({
+		fetch: (request) => {
+			if (!app) throw new Error("the control app is not ready yet");
+			return app.fetch(request);
+		},
+		trustProxy: () => settings.control.auth.trustProxy,
+		tls: () => settings.control.tls.enabled ? tls.load() : null
+	}, {
+		host: intended.host,
+		port: intended.port,
+		tls: settings.control.tls.enabled
+	});
+	if (!auth.passwordSet) {
+		auth.ensureDefaultPassword("hh");
+		logger.warn(`no password was set — created the default "hh"; change it in Global Settings → Authentication`);
+	}
 	const exposure = checkExposure({
 		...configured,
 		host: intended.host