home-hosted 0.7.21 → 0.8.0

package/dist/cli.js

@@ -49,6 +49,19 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/shared/error-message.ts
+/**
+* One rendering for a thrown value, so a caught error reads the same everywhere.
+*
+* `catch` binds `unknown`, and the same ternary was written out in ~60 places across the
+* panel and both UIs. Two idioms in one codebase is how they drift, and the UIs are
+* separate bundles: a fix applied to one copy silently misses the others.
+*/
+function errorMessage(caught) {
+	return caught instanceof Error ? caught.message : String(caught);
+}
+var init_error_message = __esmMin((() => {}));
+//#endregion
 //#region src/cli/nearest.ts
 /**
 * The nearest word to a typo, or null when nothing is close.
@@ -1895,7 +1908,11 @@ function isSealedDdns(value) {
 function isPlainDdns(value) {
 	return "plain" in value;
 }
-/** Every shape this file has held: sealed, `{ provider, values }`, or a bare field map. */
+/**
+* Sealed on disk, or `{ provider, values }` waiting for the sealing write. A bare
+* field map — written before the provider was recorded — no longer reads, because
+* there is nothing to say which provider those fields belong to.
+*/
 function readStoredDdns(value) {
 	if (!isRecord(value)) return {};
 	const out = {};
@@ -1904,12 +1921,12 @@ function readStoredDdns(value) {
 			out[accountId] = entry;
 			continue;
 		}
-		if (!isRecord(entry)) continue;
-		const values = readDdnsValues("values" in entry ? entry.values : entry);
+		if (!isRecord(entry) || typeof entry.provider !== "string" || entry.provider.length === 0) continue;
+		const values = readDdnsValues(entry.values);
 		if (Object.keys(values).length === 0) continue;
 		out[accountId] = {
 			plain: true,
-			provider: typeof entry.provider === "string" ? entry.provider : "",
+			provider: entry.provider,
 			values
 		};
 	}
@@ -1977,6 +1994,7 @@ var COST, KEYLEN, SALT_BYTES, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_
 var init_secrets = __esmMin((() => {
 	init_atomic();
 	init_logger();
+	init_error_message();
 	init_shape();
 	COST = {
 		N: 16384,
@@ -1996,6 +2014,7 @@ var init_secrets = __esmMin((() => {
 		scope;
 		cache = null;
 		cacheKey = "";
+		error = null;
 		ddnsKeyCache = null;
 		warnedAccounts = /* @__PURE__ */ new Set();
 		warnedDefaultSecret = false;
@@ -2120,7 +2139,7 @@ var init_secrets = __esmMin((() => {
 			if (stored === void 0) return null;
 			const record = this.openStored(accountId, stored);
 			if (record === null) return null;
-			return record.provider.length > 0 && record.provider !== provider ? null : record;
+			return record.provider === provider ? record : null;
 		}
 		/** An empty field is dropped, so clearing every field forgets the account. */
 		setDdnsCredentials(accountId, provider, credentials) {
@@ -2191,9 +2210,22 @@ var init_secrets = __esmMin((() => {
 			this.warnedAccounts.add(accountId);
 			logger.warn(`ddns: cannot read the credentials for "${accountId}" — ${reason}`);
 		}
+		/**
+		* A secrets file that exists but cannot be parsed, or null when it is fine (or absent).
+		*
+		* `read()` still returns the empty shape — a corrupt file must not authenticate anyone — but
+		* "unreadable" and "absent" have to stay distinguishable: treated as absent, a truncated
+		* `.control-secrets.json` reads as a fresh install, and `runControlPlane` then writes a
+		* **default-password** file over it, destroying the password hash, the API token and every
+		* Telegram and DDNS credential. Only the caller can refuse the boot, so this is its surface.
+		*/
+		get configError() {
+			this.load();
+			return this.error;
+		}
 		read() {
+			this.error = null;
 			const empty = {
-				version: 3,
 				password: null,
 				apiToken: null,
 				telegram: null,
@@ -2201,17 +2233,24 @@ var init_secrets = __esmMin((() => {
 				ddnsKdf: null
 			};
 			if (!fs.existsSync(this.file)) return this.inScope(empty);
+			let text;
 			try {
-				const parsed = JSON.parse(fs.readFileSync(this.file, "utf8"));
+				text = fs.readFileSync(this.file, "utf8");
+			} catch (error) {
+				this.error = `cannot read ${this.file}: ${errorMessage(error)}`;
+				return this.inScope(empty);
+			}
+			try {
+				const parsed = JSON.parse(text);
 				return this.inScope({
-					version: 3,
 					password: parsed?.password ?? null,
 					apiToken: parsed?.apiToken?.hash ? parsed.apiToken : null,
 					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null,
 					ddns: readStoredDdns(parsed?.ddns),
 					ddnsKdf: readDdnsKdf(parsed?.ddnsKdf)
 				});
-			} catch {
+			} catch (error) {
+				this.error = `${this.file} is not readable JSON (${errorMessage(error)}) — it was left untouched`;
 				return this.inScope(empty);
 			}
 		}
@@ -2231,6 +2270,7 @@ var init_secrets = __esmMin((() => {
 			return contents;
 		}
 		save(contents) {
+			if (this.configError !== null) throw new Error(`refusing to write ${this.file}: ${this.error}`);
 			const sealed = this.sealStored(this.inScope(contents));
 			writeFileAtomic(this.file, `${JSON.stringify(sealed, null, 2)}\n`, { mode: 384 });
 			this.cache = sealed;
@@ -2919,7 +2959,11 @@ function workspaceIdsOnDisk() {
 		return [];
 	}
 }
-/** True when a pre-workspace instance left state at the old paths. */
+/**
+* True when a pre-workspace instance left state at the old paths **and** never
+* crossed into `.hh`: `workspaces.json` means the layout is current, so a stray
+* root-level copy beside it is not an old instance.
+*/
 function hasLegacyLayout() {
 	if (fs.existsSync(workspacesPath)) return false;
 	return fs.existsSync(legacy.configPath) || fs.existsSync(legacy.secretsPath);
@@ -2955,15 +2999,7 @@ var init_paths = __esmMin((() => {
 	proxyChallengeAuthPath = path.join(proxyStateDir, "challenge.json");
 	legacy = {
 		configPath: path.join(dataRoot, "servers.config.json"),
-		configSchemaPath: path.join(dataRoot, "servers.config.schema.json"),
-		secretsPath: path.join(dataRoot, ".control-secrets.json"),
-		tlsDir: path.join(dataRoot, ".tls"),
-		logsDir: path.join(dataRoot, ".logs"),
-		historyPath: path.join(dataRoot, ".logs", "history.json"),
-		stateDir: path.join(dataRoot, ".state"),
-		backupsDir: path.join(dataRoot, ".backups"),
-		uiDir: path.join(dataRoot, ".ui"),
-		runtimePath: path.join(dataRoot, "run.json")
+		secretsPath: path.join(dataRoot, ".control-secrets.json")
 	};
 }));
 //#endregion
@@ -3624,7 +3660,7 @@ function planConfigMigrations(from, options = {}) {
 		to,
 		steps,
 		tooNew: from > to,
-		reached: steps.reduce((at, step) => step.to, from)
+		reached: steps.at(-1)?.to ?? from
 	};
 }
 /** Applies the plan in order; the caller owns writing the result. */
@@ -3692,6 +3728,35 @@ function parseTolerant(value, schema, prefix, unknownKeys) {
 	};
 }
 /**
+* Reads `meta`, then refuses a file this release cannot use.
+*
+* Both readers need this and the two messages have to stay in step: a file written by a
+* newer release, and one whose migration has not been applied, are different problems with
+* different fixes (`install that release` vs. `run migrate`). Written once here, so a change
+* to either wording cannot land on one path only.
+*/
+function readStamp(raw, options) {
+	const meta = isRecord(raw.meta) ? raw.meta : null;
+	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
+	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
+	if (schemaVersion > 1) return {
+		schemaVersion,
+		writtenBy,
+		error: `written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`
+	};
+	const { steps } = planConfigMigrations(schemaVersion, options);
+	if (steps.length > 0) return {
+		schemaVersion,
+		writtenBy,
+		error: `config schema ${schemaVersion} needs ${steps.length} migration${steps.length === 1 ? "" : "s"} before this release can use it`
+	};
+	return {
+		schemaVersion,
+		writtenBy,
+		error: null
+	};
+}
+/**
 * Reads one settings file from any release: schema guard, unrecognized keys
 * reported and left on disk, blocking problems returned for the caller to refuse on.
 */
@@ -3710,18 +3775,11 @@ function parseGrouped(raw, label, definition, options) {
 		errors.push(`the ${label} must contain a JSON object`);
 		return result;
 	}
-	const meta = isRecord(raw.meta) ? raw.meta : null;
-	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
-	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
-	result.schemaVersion = schemaVersion;
-	result.writtenBy = writtenBy;
-	if (schemaVersion > 1) {
-		errors.push(`written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`);
-		return result;
-	}
-	const { steps } = planConfigMigrations(schemaVersion, options);
-	if (steps.length > 0) {
-		errors.push(`config schema ${schemaVersion} needs ${steps.length} migration${steps.length === 1 ? "" : "s"} before this release can use it`);
+	const stamp = readStamp(raw, options);
+	result.schemaVersion = stamp.schemaVersion;
+	result.writtenBy = stamp.writtenBy;
+	if (stamp.error !== null) {
+		errors.push(stamp.error);
 		return result;
 	}
 	for (const key of Object.keys(raw)) if (!definition.keys.includes(key)) unknownKeys.push(key);
@@ -3733,8 +3791,8 @@ function parseGrouped(raw, label, definition, options) {
 	}
 	if (errors.length > 0) return result;
 	result.config = definition.build({
-		writtenBy: writtenBy ?? "",
-		schema: schemaVersion
+		writtenBy: stamp.writtenBy ?? "",
+		schema: stamp.schemaVersion
 	}, groups);
 	return result;
 }
@@ -3796,18 +3854,11 @@ function parseServersFile(raw, defaults, options = {}) {
 		errors.push("the servers config must contain a JSON object");
 		return result;
 	}
-	const meta = isRecord(raw.meta) ? raw.meta : null;
-	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
-	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
-	result.schemaVersion = schemaVersion;
-	result.writtenBy = writtenBy;
-	if (schemaVersion > 1) {
-		errors.push(`written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`);
-		return result;
-	}
-	const { steps } = planConfigMigrations(schemaVersion, options);
-	if (steps.length > 0) {
-		errors.push(`config schema ${schemaVersion} needs ${steps.length} migration${steps.length === 1 ? "" : "s"} before this release can use it`);
+	const stamp = readStamp(raw, options);
+	result.schemaVersion = stamp.schemaVersion;
+	result.writtenBy = stamp.writtenBy;
+	if (stamp.error !== null) {
+		errors.push(stamp.error);
 		return result;
 	}
 	for (const key of Object.keys(raw)) if (!SERVERS_FILE_KEYS.includes(key)) unknownKeys.push(key);
@@ -4202,6 +4253,18 @@ function failed(error) {
 		error
 	};
 }
+/**
+* The result of the write six providers end their `update()` with.
+*
+* They repeated the same two lines after their own write call, and they have to agree: a
+* non-ok response is a provider error with its body attached, and an ok one is a change.
+* The message names the record, because a settings page shows it as the account's last
+* result and "ok" would not say what actually moved.
+*/
+async function wrote(response, record) {
+	if (!response.ok) return failed(await errorText(response));
+	return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+}
 /** Missing required credential keys, as a sentence for the settings page. */
 function missingFields(credentials, keys) {
 	const missing = keys.filter((key) => (credentials?.[key] ?? "").trim().length === 0);
@@ -4279,7 +4342,7 @@ async function call$1(path, headers, context, init = {}) {
 		return {
 			data: null,
 			status: 0,
-			error: error instanceof Error ? error.message : String(error)
+			error: errorMessage(error)
 		};
 	}
 }
@@ -4338,6 +4401,7 @@ async function findRecord(zoneId, record, headers, context, cached) {
 var API$5, cloudflareProvider;
 var init_cloudflare = __esmMin((() => {
 	init_types();
+	init_error_message();
 	API$5 = "https://api.cloudflare.com/client/v4";
 	cloudflareProvider = {
 		id: "cloudflare",
@@ -4414,7 +4478,7 @@ var init_cloudflare = __esmMin((() => {
 					}
 				};
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		},
 		/**
@@ -4481,7 +4545,7 @@ var init_cloudflare = __esmMin((() => {
 			} catch (error) {
 				return {
 					ok: false,
-					message: error instanceof Error ? error.message : String(error)
+					message: errorMessage(error)
 				};
 			}
 		}
@@ -4612,6 +4676,7 @@ var ENDPOINT$7, desecProvider;
 var init_desec = __esmMin((() => {
 	init_dyndns2();
 	init_types();
+	init_error_message();
 	ENDPOINT$7 = "https://update.dedyn.io/";
 	desecProvider = {
 		id: "desec",
@@ -4641,7 +4706,7 @@ var init_desec = __esmMin((() => {
 				});
 				return describeDyndnsResponse(response, await response.text(), "desec");
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -4709,6 +4774,7 @@ var API$4, digitaloceanProvider;
 var init_digitalocean = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	API$4 = "https://api.digitalocean.com/v2/domains";
 	digitaloceanProvider = {
 		id: "digitalocean",
@@ -4742,7 +4808,7 @@ var init_digitalocean = __esmMin((() => {
 				if (!listed.ok) return failed(await errorText(listed));
 				const existing = ((await listed.json()).domain_records ?? []).find((entry) => entry.name === name && entry.type === record.type);
 				if (existing !== void 0 && existing.data === record.ip) return succeeded(`already ${record.ip}`, false);
-				const written = existing === void 0 ? await context.fetch(collection, {
+				return await wrote(existing === void 0 ? await context.fetch(collection, {
 					method: "POST",
 					headers,
 					body: JSON.stringify({
@@ -4762,11 +4828,9 @@ var init_digitalocean = __esmMin((() => {
 						ttl
 					}),
 					signal: context.signal
-				});
-				if (!written.ok) return failed(await errorText(written));
-				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+				}), record);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -4781,6 +4845,7 @@ function subdomain(host) {
 var ENDPOINT$6, duckdnsProvider;
 var init_duckdns = __esmMin((() => {
 	init_types();
+	init_error_message();
 	ENDPOINT$6 = "https://www.duckdns.org/update";
 	duckdnsProvider = {
 		id: "duckdns",
@@ -4809,7 +4874,7 @@ var init_duckdns = __esmMin((() => {
 				if (body.toUpperCase() === "OK") return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
 				return failed(`duckdns answered "${body.slice(0, 120) || `HTTP ${response.status}`}"`);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -4820,6 +4885,7 @@ var ENDPOINT$5, dynuProvider;
 var init_dynu = __esmMin((() => {
 	init_dyndns2();
 	init_types();
+	init_error_message();
 	ENDPOINT$5 = "https://api.dynu.com/nic/update";
 	dynuProvider = {
 		id: "dynu",
@@ -4855,7 +4921,7 @@ var init_dynu = __esmMin((() => {
 				});
 				return describeDyndnsResponse(response, await response.text(), "dynu");
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -4874,6 +4940,7 @@ function updateToken(credentials) {
 var ENDPOINT$4, freednsProvider;
 var init_freedns = __esmMin((() => {
 	init_types();
+	init_error_message();
 	ENDPOINT$4 = "https://freedns.afraid.org/dynamic/update.php";
 	freednsProvider = {
 		id: "freedns",
@@ -4900,7 +4967,7 @@ var init_freedns = __esmMin((() => {
 				if (!response.ok || /^ERROR/i.test(body)) return failed(`freedns answered "${body.slice(0, 160) || `HTTP ${response.status}`}"`);
 				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -4919,6 +4986,7 @@ var API$3, gandiProvider;
 var init_gandi = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	API$3 = "https://api.gandi.net/v5/livedns/domains";
 	gandiProvider = {
 		id: "gandi",
@@ -4955,7 +5023,7 @@ var init_gandi = __esmMin((() => {
 					const body = await current.json();
 					if (body.rrset_values?.length === 1 && body.rrset_values[0] === record.ip) return succeeded(`already ${record.ip}`, false);
 				}
-				const written = await context.fetch(url, {
+				return await wrote(await context.fetch(url, {
 					method: "PUT",
 					headers,
 					body: JSON.stringify({
@@ -4963,11 +5031,9 @@ var init_gandi = __esmMin((() => {
 						rrset_ttl: ttl
 					}),
 					signal: context.signal
-				});
-				if (!written.ok) return failed(await errorText(written));
-				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+				}), record);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -4982,6 +5048,7 @@ var API$2, godaddyProvider;
 var init_godaddy = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	API$2 = "https://api.godaddy.com/v1/domains";
 	godaddyProvider = {
 		id: "godaddy",
@@ -5030,7 +5097,7 @@ var init_godaddy = __esmMin((() => {
 					const body = await current.json();
 					if (body.length === 1 && body[0]?.data === record.ip) return succeeded(`already ${record.ip}`, false);
 				}
-				const written = await context.fetch(url, {
+				return await wrote(await context.fetch(url, {
 					method: "PUT",
 					headers,
 					body: JSON.stringify([{
@@ -5038,11 +5105,9 @@ var init_godaddy = __esmMin((() => {
 						ttl
 					}]),
 					signal: context.signal
-				});
-				if (!written.ok) return failed(await errorText(written));
-				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+				}), record);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -5053,6 +5118,7 @@ var ENDPOINT$3, henetProvider;
 var init_henet = __esmMin((() => {
 	init_dyndns2();
 	init_types();
+	init_error_message();
 	ENDPOINT$3 = "https://dyn.dns.he.net/nic/update";
 	henetProvider = {
 		id: "henet",
@@ -5078,7 +5144,7 @@ var init_henet = __esmMin((() => {
 				const response = await context.fetch(url, { signal: context.signal });
 				return describeDyndnsResponse(response, await response.text(), "hurricane electric");
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -5092,6 +5158,7 @@ var ENDPOINT$2, namecheapProvider;
 var init_namecheap = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	ENDPOINT$2 = "https://dynamicdns.park-your-domain.com/update";
 	namecheapProvider = {
 		id: "namecheap",
@@ -5126,7 +5193,7 @@ var init_namecheap = __esmMin((() => {
 				if (ip === null) return failed(`namecheap answered without an IP: ${body.replace(/\s+/g, " ").slice(0, 160)}`);
 				return succeeded(`${host === "@" ? zone : `${host}.${zone}`} now ${ip}`, ip !== record.ip);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -5218,7 +5285,7 @@ async function call(command, params, context) {
 			body
 		};
 	} catch (error) {
-		return error instanceof Error ? error.message : String(error);
+		return errorMessage(error);
 	}
 }
 /** The registered domain split into the `SLD`/`TLD` pair the API asks for. */
@@ -5265,6 +5332,7 @@ var ENDPOINT$1, RECORD_LIMIT, CHALLENGE_TTL, XML_ENTITIES, namecheapApiProvider;
 var init_namecheap_api = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	ENDPOINT$1 = "https://api.namecheap.com/xml.response";
 	RECORD_LIMIT = 150;
 	CHALLENGE_TTL = 60;
@@ -5379,6 +5447,7 @@ var ENDPOINT, DEFAULT_AGENT, noipProvider;
 var init_noip = __esmMin((() => {
 	init_dyndns2();
 	init_types();
+	init_error_message();
 	ENDPOINT = "https://dynupdate.no-ip.com/nic/update";
 	DEFAULT_AGENT = "home-hosted/1.0 (+https://github.com/NamesMT/home-hosted)";
 	noipProvider = {
@@ -5427,7 +5496,7 @@ var init_noip = __esmMin((() => {
 				});
 				return describeDyndnsResponse(response, await response.text(), "no-ip");
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -5462,7 +5531,7 @@ async function post(path, context, body) {
 	} catch (error) {
 		return {
 			data: null,
-			error: error instanceof Error ? error.message : String(error)
+			error: errorMessage(error)
 		};
 	}
 }
@@ -5470,6 +5539,7 @@ var API$1, porkbunProvider;
 var init_porkbun = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	API$1 = "https://api.porkbun.com/api/json/v3";
 	porkbunProvider = {
 		id: "porkbun",
@@ -5518,6 +5588,7 @@ var API, PAGE_SIZE, spaceshipProvider;
 var init_spaceship = __esmMin((() => {
 	init_types();
 	init_zone();
+	init_error_message();
 	API = "https://spaceship.dev/api/v1/dns/records";
 	PAGE_SIZE = 500;
 	spaceshipProvider = {
@@ -5562,7 +5633,7 @@ var init_spaceship = __esmMin((() => {
 					if (found !== void 0 || items.length < PAGE_SIZE) break;
 				}
 				if (found?.address === record.ip) return succeeded(`already ${record.ip}`, false);
-				const written = await context.fetch(`${API}/${encodeURIComponent(zone)}`, {
+				return await wrote(await context.fetch(`${API}/${encodeURIComponent(zone)}`, {
 					method: "PUT",
 					headers,
 					body: JSON.stringify({
@@ -5575,11 +5646,9 @@ var init_spaceship = __esmMin((() => {
 						}]
 					}),
 					signal: context.signal
-				});
-				if (!written.ok) return failed(await errorText(written));
-				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+				}), record);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(errorMessage(error));
 			}
 		}
 	};
@@ -6560,7 +6629,7 @@ function describeTelegramError(error) {
 		const description = candidate.description ?? candidate.message;
 		if (description) return `${description}${candidate.error_code === void 0 ? "" : ` (${candidate.error_code})`}${candidate.parameters?.retry_after === void 0 ? "" : `, retry in ${candidate.parameters.retry_after}s`}`;
 	}
-	return error instanceof Error ? error.message : String(error);
+	return errorMessage(error);
 }
 async function sendTelegramMessage(token, chatId, html) {
 	try {
@@ -6628,6 +6697,7 @@ async function listTelegramChats(token) {
 }
 var bots;
 var init_telegram = __esmMin((() => {
+	init_error_message();
 	bots = /* @__PURE__ */ new Map();
 }));
 //#endregion
@@ -7786,15 +7856,15 @@ function acmeIssuers(acme, challenge = {}) {
 	}, { module: "internal" }];
 }
 /**
-* The page a visitor gets when the hostname they reached is not routed at all. It is
-* the answer on both ports, so a request never lands on a redirect into a handshake
-* that cannot finish.
+* The one page shell both visitor-facing pages use. They are the same document with
+* different words, and the stylesheet has to stay identical — a page the engine serves
+* on a port a person reaches by hand is a page that has to look like this panel.
 */
-function notConfiguredPage() {
+function htmlPage(title, heading, body) {
 	return `<!doctype html>
 <html lang="en">
 <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>No route for this hostname</title>
+<title>${title}</title>
 <style>
   :root { color-scheme: light dark }
   body { margin: 0; min-height: 100dvh; display: grid; place-items: center; font: 15px/1.6 system-ui, sans-serif }
@@ -7805,13 +7875,21 @@ function notConfiguredPage() {
   footer { color: #888; font-size: .85em }
 </style></head>
 <body><main>
-  <h1>This route is not configured for any target yet</h1>
-  <p>No route in <strong>home-hosted</strong>'s reverse proxy claims the hostname
+  <h1>${heading}</h1>
+${body}
+</main></body></html>`;
+}
+/**
+* The page a visitor gets when the hostname they reached is not routed at all. It is
+* the answer on both ports, so a request never lands on a redirect into a handshake
+* that cannot finish.
+*/
+function notConfiguredPage() {
+	return htmlPage("No route for this hostname", "This route is not configured for any target yet", `  <p>No route in <strong>home-hosted</strong>'s reverse proxy claims the hostname
   <code>{http.request.host}</code>, so there is nothing here to serve.</p>
   <p>Add a route for it under <strong>Others → Reverse Proxy</strong>, or check that you
   reached the hostname you meant to.</p>
-  <footer>home-hosted reverse proxy</footer>
-</main></body></html>`;
+  <footer>home-hosted reverse proxy</footer>`);
 }
 /** The catch-all: it answers last, so every configured route wins over it. */
 function notConfiguredRoute() {
@@ -7824,30 +7902,14 @@ function notConfiguredRoute() {
 }
 /** The page a visitor gets when a name has no certificate yet and HTTPS cannot work. */
 function noticePage(host, httpPort, httpsPort) {
-	return `<!doctype html>
-<html lang="en">
-<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Certificate not ready — ${host}</title>
-<style>
-  :root { color-scheme: light dark }
-  body { margin: 0; min-height: 100dvh; display: grid; place-items: center; font: 15px/1.6 system-ui, sans-serif }
-  main { max-width: 34rem; padding: 2rem }
-  h1 { font-size: 1.15rem; margin: 0 0 .75rem }
-  p { margin: 0 0 .75rem }
-  code { font-family: ui-monospace, monospace; font-size: .9em }
-  footer { color: #888; font-size: .85em }
-</style></head>
-<body><main>
-  <h1>No certificate yet for ${host}</h1>
-  <p>This hostname is routed, but the certificate authority has not issued a certificate
+	return htmlPage(`Certificate not ready — ${host}`, `No certificate yet for ${host}`, `  <p>This hostname is routed, but the certificate authority has not issued a certificate
   for it yet, so HTTPS cannot complete a handshake. The engine keeps trying in the
   background and will serve the name as soon as it succeeds.</p>
   <p>The usual cause is that the CA cannot reach this machine: with the proxy on
   <code>${httpPort}</code>/<code>${httpsPort}</code>, forward <code>80 → ${httpPort}</code>
   and <code>443 → ${httpsPort}</code> on your router. Otherwise <code>http://${host}</code>
   will keep landing here.</p>
-  <footer>Details, and the engine's own reason, are in the panel: Others → Reverse Proxy.</footer>
-</main></body></html>`;
+  <footer>Details, and the engine's own reason, are in the panel: Others → Reverse Proxy.</footer>`);
 }
 /**
 * The same match, minus the ACME challenge path: the CA has to be able to read it on
@@ -8033,7 +8095,7 @@ function validatePair(certificate, privateKey) {
 	} catch (error) {
 		return {
 			ok: false,
-			error: `certificate is not a valid PEM: ${error instanceof Error ? error.message : String(error)}`
+			error: `certificate is not a valid PEM: ${errorMessage(error)}`
 		};
 	}
 	try {
@@ -8044,7 +8106,7 @@ function validatePair(certificate, privateKey) {
 	} catch (error) {
 		return {
 			ok: false,
-			error: `private key is not a valid PEM: ${error instanceof Error ? error.message : String(error)}`
+			error: `private key is not a valid PEM: ${errorMessage(error)}`
 		};
 	}
 	const invalid = validityError(x509);
@@ -8058,6 +8120,7 @@ var TlsStore;
 var init_tls$1 = __esmMin((() => {
 	init_atomic();
 	init_logger();
+	init_error_message();
 	TlsStore = class {
 		dir;
 		name;
@@ -8184,7 +8247,7 @@ var init_tls$1 = __esmMin((() => {
 			} catch (error) {
 				return {
 					...base,
-					error: `invalid certificate: ${error instanceof Error ? error.message : String(error)}`
+					error: `invalid certificate: ${errorMessage(error)}`
 				};
 			}
 		}
@@ -8347,6 +8410,7 @@ var init_proxy$1 = __esmMin((() => {
 	init_proxy$2();
 	init_proxy_config();
 	init_tls$1();
+	init_error_message();
 	init_proxy_form();
 	PROXY_ID = "proxy";
 	ADMIN_TIMEOUT_MS = 5e3;
@@ -8388,8 +8452,6 @@ var init_proxy$1 = __esmMin((() => {
 		failureCache = null;
 		/** The installed binary's modules, read once per process; an install clears it. */
 		moduleCache = null;
-		/** A legacy `engine.json` is reported once, not on every state frame. */
-		legacyChecksumWarned = false;
 		/** Why the engine's nanny could not be spawned, cleared on the next start. */
 		nannyError = null;
 		certCache = null;
@@ -8678,7 +8740,7 @@ var init_proxy$1 = __esmMin((() => {
 				} catch (error) {
 					return {
 						...base,
-						error: `unreadable certificate: ${error instanceof Error ? error.message : String(error)}`
+						error: `unreadable certificate: ${errorMessage(error)}`
 					};
 				}
 			});
@@ -8890,14 +8952,14 @@ var init_proxy$1 = __esmMin((() => {
 			if (this.live()) {
 				logger.info(`proxy:    reattached to the running ${this.config.engine} engine`);
 				await this.apply().catch((error) => {
-					logger.warn(`proxy:    could not apply the current configuration to the reattached engine: ${error instanceof Error ? error.message : String(error)}`);
+					logger.warn(`proxy:    could not apply the current configuration to the reattached engine: ${errorMessage(error)}`);
 				});
 				return;
 			}
 			try {
 				await this.start();
 			} catch (error) {
-				this.lastError = error instanceof Error ? error.message : String(error);
+				this.lastError = errorMessage(error);
 				logger.error(`proxy:    could not start: ${this.lastError}`);
 			}
 		}
@@ -9125,7 +9187,7 @@ var init_proxy$1 = __esmMin((() => {
 		*/
 		async postConfiguration(rendered) {
 			const result = await this.request("POST", "/load", rendered).catch((error) => {
-				this.lastError = `the engine did not accept the configuration: ${error instanceof Error ? error.message : String(error)}`;
+				this.lastError = `the engine did not accept the configuration: ${errorMessage(error)}`;
 				throw new DetailedError(this.lastError, {
 					statusCode: 502,
 					code: "ENGINE_UNREACHABLE"
@@ -9193,7 +9255,7 @@ var init_proxy$1 = __esmMin((() => {
 			this.certificateSignature = signature;
 			if (first) return;
 			await this.apply().catch((error) => {
-				logger.warn(`proxy:    could not re-apply after a certificate change: ${error instanceof Error ? error.message : String(error)}`);
+				logger.warn(`proxy:    could not re-apply after a certificate change: ${errorMessage(error)}`);
 			});
 		}
 		/**
@@ -9400,15 +9462,7 @@ var init_proxy$1 = __esmMin((() => {
 			try {
 				const parsed = JSON.parse(fs.readFileSync(path.join(this.options.binDir, "engine.json"), "utf8"));
 				if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
-				const record = parsed;
-				if ("sha256" in record) {
-					delete record.sha256;
-					if (!this.legacyChecksumWarned) {
-						this.legacyChecksumWarned = true;
-						logger.warn("proxy:    dropped the recorded engine checksum; nothing verifies it");
-					}
-				}
-				const parsedRecord = engineRecordSchema(record);
+				const parsedRecord = engineRecordSchema(parsed);
 				return parsedRecord instanceof type.errors ? null : parsedRecord;
 			} catch {
 				return null;
@@ -9959,7 +10013,7 @@ function createProxyRoute(deps) {
 			if (proxy().status().state === "running") await proxy().apply();
 			else await proxy().start();
 		} catch (error) {
-			proxy().recordError(error instanceof Error ? error.message : String(error));
+			proxy().recordError(errorMessage(error));
 			throw error;
 		}
 	};
@@ -10118,6 +10172,7 @@ var init_proxy = __esmMin((() => {
 	init_exposure();
 	init_proxy$1();
 	init_contracts();
+	init_error_message();
 	certificateParam = type({ id: "/^[a-z0-9][a-z0-9_-]*$/" });
 }));
 //#endregion
@@ -11023,237 +11078,26 @@ var init_app = __esmMin((() => {
 }));
 //#endregion
 //#region src/config/layout.ts
-var layout_exports = /* @__PURE__ */ __exportAll({
-	ensureLayout: () => ensureLayout,
-	migrateLayout: () => migrateLayout
-});
-function readJson(file) {
-	try {
-		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-		return isRecord(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
+var layout_exports = /* @__PURE__ */ __exportAll({ ensureLayout: () => ensureLayout });
 /**
-* A legacy file, with "absent" told apart from "present but unreadable".
+* Refuses a state directory this release cannot use, before any command resolves a
+* path into it.
 *
-* `readJson` collapses both into `null`, and a split that is skipped reads exactly like
-* one with nothing to do — so a corrupt legacy config used to be abandoned silently
-* while `workspaces.json` was still created, after which `hasLegacyLayout()` is false
-* and no later run ever looks at that file again. The definitions would sit unread
-* beside a panel supervising nothing.
-*/
-function readLegacy(file) {
-	if (!fs.existsSync(file)) return {
-		parsed: null,
-		unreadable: false
-	};
-	const parsed = readJson(file);
-	return {
-		parsed,
-		unreadable: parsed === null
-	};
-}
-function writeJson(file, value, mode) {
-	fs.mkdirSync(path.dirname(file), { recursive: true });
-	fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, mode === void 0 ? {} : { mode });
-}
-/** `renameSync` across devices fails with EXDEV; fall back to a copy. */
-function move(source, destination, warnings) {
-	if (!fs.existsSync(source)) return false;
-	if (fs.existsSync(destination)) {
-		warnings.push(`${destination} already exists — left ${source} alone`);
-		return false;
-	}
-	fs.mkdirSync(path.dirname(destination), { recursive: true });
-	try {
-		fs.renameSync(source, destination);
-	} catch {
-		fs.cpSync(source, destination, {
-			recursive: true,
-			force: true
-		});
-		fs.rmSync(source, {
-			recursive: true,
-			force: true
-		});
-	}
-	return true;
-}
-function metaOf(raw) {
-	const meta = raw?.meta;
-	if (typeof meta !== "object" || meta === null) return void 0;
-	return meta;
-}
-/** The old config split three ways: global settings, workspace settings, servers. */
-function splitConfig(raw) {
-	const meta = metaOf(raw);
-	const unknown = {};
-	for (const [key, value] of Object.entries(raw)) if (!KNOWN_TOP_LEVEL.has(key)) unknown[key] = value;
-	return {
-		global: {
-			$schema: "./settings.schema.json",
-			...meta === void 0 ? {} : { meta },
-			control: raw.control ?? {},
-			host: raw.host ?? {},
-			backups: raw.backups ?? {},
-			...unknown
-		},
-		settings: {
-			$schema: "./settings.schema.json",
-			...meta === void 0 ? {} : { meta },
-			defaults: raw.defaults ?? {},
-			logs: raw.logs ?? {},
-			notifications: raw.notifications ?? {},
-			ddns: raw.ddns ?? {}
-		},
-		servers: {
-			$schema: "./servers.config.schema.json",
-			...meta === void 0 ? {} : { meta },
-			servers: Array.isArray(raw.servers) ? raw.servers : []
-		}
-	};
-}
-/** The old secrets file split global (password, token) vs. workspace (Telegram, DDNS). */
-function splitSecrets(raw) {
-	return {
-		global: {
-			version: 3,
-			password: raw?.password ?? null,
-			apiToken: raw?.apiToken ?? null
-		},
-		workspace: {
-			version: 3,
-			telegram: raw?.telegram ?? null,
-			ddns: raw?.ddns ?? {},
-			ddnsKdf: raw?.ddnsKdf ?? null
-		}
-	};
-}
-/**
-* Moves the panel's console log apart from the per-server logs: both used to
-* live in `<root>/.logs`, and only the console log is global now.
-*/
-function splitLogsDir(warnings) {
-	if (!fs.existsSync(legacy.logsDir)) return;
-	const workspaceLogs = path.join(hhDir, "default", ".logs");
-	for (const name of fs.readdirSync(legacy.logsDir)) {
-		const destination = name === "home-hosted.log" || name.startsWith("home-hosted.log.") ? path.join(hhDir, ".logs", name) : path.join(workspaceLogs, name);
-		move(path.join(legacy.logsDir, name), destination, warnings);
-	}
-	try {
-		if (fs.readdirSync(legacy.logsDir).length === 0) fs.rmdirSync(legacy.logsDir);
-		else warnings.push(`${legacy.logsDir} still holds files that could not be moved — left it in place`);
-	} catch {}
-}
-function migrateLayout() {
-	if (!hasLegacyLayout()) return EMPTY;
-	const moved = [];
-	const warnings = [];
-	fs.mkdirSync(hhDir, { recursive: true });
-	const legacyConfig = readLegacy(legacy.configPath);
-	let configSplit = false;
-	if (legacyConfig.unreadable) warnings.push(`${legacy.configPath} could not be read — it was NOT migrated and is still there; fix or remove it, then move the file in by hand`);
-	if (legacyConfig.parsed !== null) {
-		const split = splitConfig(legacyConfig.parsed);
-		const destinations = [
-			path.join(hhDir, "settings.json"),
-			path.join(hhDir, "default", "settings.json"),
-			path.join(hhDir, "default", "servers.config.json")
-		];
-		const taken = destinations.filter((file) => fs.existsSync(file));
-		if (taken.length > 0) warnings.push(`${legacy.configPath} could not be split — ${taken.map((file) => path.relative(hhDir, file)).join(", ")} already exist(s); left it in place`);
-		else {
-			writeJson(destinations[0], split.global);
-			fs.mkdirSync(path.join(hhDir, "default"), { recursive: true });
-			writeJson(destinations[1], split.settings);
-			writeJson(destinations[2], split.servers);
-			moved.push("servers.config.json → settings.json + default/settings.json + default/servers.config.json");
-			configSplit = true;
-		}
-	}
-	const legacySecrets = readLegacy(legacy.secretsPath);
-	let secretsSplit = false;
-	if (legacySecrets.unreadable) warnings.push(`${legacy.secretsPath} could not be read — it was NOT migrated and is still there; a panel without it starts on the default password`);
-	if (legacySecrets.parsed !== null) {
-		const split = splitSecrets(legacySecrets.parsed);
-		const destinations = [path.join(hhDir, ".control-secrets.json"), path.join(hhDir, "default", ".secrets.json")];
-		const taken = destinations.filter((file) => fs.existsSync(file));
-		if (taken.length > 0) warnings.push(`${legacy.secretsPath} could not be split — ${taken.map((file) => path.relative(hhDir, file)).join(", ")} already exist(s); left it in place`);
-		else {
-			writeJson(destinations[0], split.global, 384);
-			fs.mkdirSync(path.join(hhDir, "default"), { recursive: true });
-			writeJson(destinations[1], split.workspace, 384);
-			moved.push(".control-secrets.json → .hh/.control-secrets.json + .hh/default/.secrets.json");
-			secretsSplit = true;
-		}
-	}
-	if (move(legacy.tlsDir, path.join(hhDir, ".tls"), warnings)) moved.push(".tls/ → .hh/.tls/");
-	if (move(legacy.uiDir, path.join(hhDir, ".ui"), warnings)) moved.push(".ui/ → .hh/.ui/");
-	if (move(legacy.backupsDir, path.join(hhDir, ".backups"), warnings)) moved.push(".backups/ → .hh/.backups/");
-	if (move(legacy.runtimePath, path.join(hhDir, "run.json"), warnings)) moved.push("run.json → .hh/run.json");
-	if (move(legacy.stateDir, path.join(hhDir, "default", ".state"), warnings)) moved.push(".state/ → .hh/default/.state/");
-	splitLogsDir(warnings);
-	if (configSplit) fs.rmSync(legacy.configPath, { force: true });
-	if (secretsSplit) fs.rmSync(legacy.secretsPath, { force: true });
-	fs.rmSync(legacy.configSchemaPath, { force: true });
-	if (!fs.existsSync(workspacesPath)) {
-		writeJson(workspacesPath, {
-			$schema: "./workspaces.schema.json",
-			workspaces: [{
-				id: "default",
-				label: "Default"
-			}]
-		});
-		moved.push("workspaces.json created with the `default` workspace");
-	} else warnings.push(`${workspacesPath} already exists — left the workspace registry alone`);
-	writeJson(path.join(hhDir, ".layout-migration.json"), {
-		version: 1,
-		at: Date.now(),
-		moved
-	});
-	return {
-		migrated: true,
-		moved,
-		warnings
-	};
-}
-/**
-* Runs the relocation and reports it through the logger. Every CLI entry point
-* calls this before it resolves a state path, so an existing instance keeps
-* working after the upgrade without anyone having to run a command first.
+* Through 0.7.x this relocated a pre-workspace `$HHOSTED_HOME` automatically. 0.8.0
+* dropped the mover, so an instance that never crossed `.hh` is stopped instead of
+* being read as an empty one — its `servers.config.json` would otherwise sit unread
+* beside a panel supervising nothing, with no error anywhere. The migration itself is
+* unchanged and still shipped: the 0.7 line performs it on its first run.
 */
 function ensureLayout() {
-	const result = migrateLayout();
-	if (result.migrated) {
-		logger.info(`state layout migrated into ${hhDir} (${result.moved.length} step(s))`);
-		for (const warning of result.warnings) logger.warn(`layout migration: ${warning}`);
-	}
-	return result;
+	if (!hasLegacyLayout()) return;
+	const found = [legacy.configPath, legacy.secretsPath].filter((file) => fs.existsSync(file));
+	throw new Error(`${found.join(", ")} belongs to home-hosted 0.6.x, which ${appVersion()} no longer relocates.\n  Install the latest 0.7.x once — it moves that state into .hh/ on its first run — then start this release.
+  Nothing has been changed or deleted.`);
 }
-var EMPTY, KNOWN_TOP_LEVEL;
 var init_layout = __esmMin((() => {
-	init_logger();
 	init_paths();
-	init_shape();
-	EMPTY = {
-		migrated: false,
-		moved: [],
-		warnings: []
-	};
-	KNOWN_TOP_LEVEL = /* @__PURE__ */ new Set([
-		"$schema",
-		"meta",
-		"control",
-		"defaults",
-		"logs",
-		"notifications",
-		"host",
-		"backups",
-		"ddns",
-		"servers"
-	]);
+	init_version();
 }));
 //#endregion
 //#region src/helpers/daemon.ts
@@ -11585,7 +11429,7 @@ function loadEnvFile(file) {
 		return {
 			env: {},
 			path: file,
-			error: error instanceof Error ? error.message : String(error)
+			error: errorMessage(error)
 		};
 	}
 }
@@ -11605,6 +11449,7 @@ function resolveEnvFilePath(file, cwd) {
 }
 var VARIABLE;
 var init_env_file = __esmMin((() => {
+	init_error_message();
 	VARIABLE = /\$\{([A-Z_]\w*)\}/gi;
 }));
 //#endregion
@@ -11865,7 +11710,7 @@ async function probeHttp(host, port, options) {
 		return {
 			healthy: false,
 			ms: Date.now() - started,
-			detail: `request failed: ${error instanceof Error ? error.message : String(error)}`
+			detail: `request failed: ${errorMessage(error)}`
 		};
 	}
 }
@@ -11887,6 +11732,7 @@ async function probeHealth(options) {
 }
 var init_health_check = __esmMin((() => {
 	init_port();
+	init_error_message();
 }));
 //#endregion
 //#region src/providers/process.ts
@@ -12305,6 +12151,7 @@ var TAIL_INTERVAL_MS, LogRelay;
 var init_log_relay = __esmMin((() => {
 	init_logger();
 	init_log_tail();
+	init_error_message();
 	TAIL_INTERVAL_MS = 250;
 	LogRelay = class {
 		options;
@@ -12365,7 +12212,7 @@ var init_log_relay = __esmMin((() => {
 				try {
 					this.poll();
 				} catch (error) {
-					logger.warn(`tail failed: ${error instanceof Error ? error.message : String(error)}`);
+					logger.warn(`tail failed: ${errorMessage(error)}`);
 				}
 			}, this.options.intervalMs ?? TAIL_INTERVAL_MS);
 			this.timer.unref();
@@ -12949,21 +12796,7 @@ var init_supervisor = __esmMin((() => {
 					return { kind: "free" };
 				}
 				this.log(entry, "system", `port ${port} is held by pid ${foreign.join(", ")} — onPortConflict: kill, stopping the holder`);
-				const { forced } = await terminatePids(foreign, { graceMs: entry.config.stop.graceMs });
-				if (forced.length > 0) this.log(entry, "system", `pid ${forced.join(", ")} ignored SIGTERM and was killed`);
-				await delay(PORT_RELEASE_RECHECK_MS);
-				if (await freeOnAll()) {
-					entry.portState = "free";
-					return { kind: "free" };
-				}
-				entry.status = "conflict";
-				entry.lastError = `port ${port} is still in use after killing pid ${foreign.join(", ")}`;
-				this.log(entry, "system", entry.lastError);
-				this.publishServer(entry);
-				return {
-					kind: "blocked",
-					error: entry.lastError
-				};
+				return await this.stopPortHolders(entry, foreign, port, "killing", freeOnAll);
 			}
 			if (own !== null && entry.config.onPortConflict === "follow") return {
 				kind: "adopt",
@@ -12971,21 +12804,7 @@ var init_supervisor = __esmMin((() => {
 			};
 			if (own !== null && entry.config.onPortConflict === "reclaim") {
 				this.log(entry, "system", `port ${port} is held by pid ${own}, a detached restart of this entry — replacing it with a supervised process`);
-				const { forced } = await terminatePids([own], { graceMs: entry.config.stop.graceMs });
-				if (forced.length > 0) this.log(entry, "system", `pid ${forced.join(", ")} ignored SIGTERM and was killed`);
-				await delay(PORT_RELEASE_RECHECK_MS);
-				if (await freeOnAll()) {
-					entry.portState = "free";
-					return { kind: "free" };
-				}
-				entry.status = "conflict";
-				entry.lastError = `port ${port} is still in use after replacing pid ${own}`;
-				this.log(entry, "system", entry.lastError);
-				this.publishServer(entry);
-				return {
-					kind: "blocked",
-					error: entry.lastError
-				};
+				return await this.stopPortHolders(entry, [own], port, "replacing", freeOnAll);
 			}
 			const hint = own !== null ? ` — pid ${own} is a detached restart of this entry: set onPortConflict to "follow" to adopt it, "reclaim" to replace it with a supervised process, or "kill" to stop whatever holds the port` : "";
 			if (entry.config.onPortConflict !== "warn") {
@@ -13011,6 +12830,31 @@ var init_supervisor = __esmMin((() => {
 		* persistent entry whose state file was lost would show its history but never
 		* another live line.
 		*/
+		/**
+		* Stops the listed port holders and reports whether the port came free.
+		*
+		* `kill` and `reclaim` are the same sequence over a different pid list — the foreign
+		* holder versus this entry's own detached successor — and they have to stay the same:
+		* a stop that does not re-probe, or that reports the port free without waiting, spawns
+		* onto a listener that is still there.
+		*/
+		async stopPortHolders(entry, pids, port, word, freeOnAll) {
+			const { forced } = await terminatePids(pids, { graceMs: entry.config.stop.graceMs });
+			if (forced.length > 0) this.log(entry, "system", `pid ${forced.join(", ")} ignored SIGTERM and was killed`);
+			await delay(PORT_RELEASE_RECHECK_MS);
+			if (await freeOnAll()) {
+				entry.portState = "free";
+				return { kind: "free" };
+			}
+			entry.status = "conflict";
+			entry.lastError = `port ${port} is still in use after ${word} pid ${pids.join(", ")}`;
+			this.log(entry, "system", entry.lastError);
+			this.publishServer(entry);
+			return {
+				kind: "blocked",
+				error: entry.lastError
+			};
+		}
 		adoptEntry(entry, pid) {
 			entry.adopted = true;
 			entry.pid = pid;
@@ -13903,6 +13747,7 @@ var init_backups = __esmMin((() => {
 	init_template();
 	init_archive();
 	init_supervisor();
+	init_error_message();
 	init_generated();
 	init_shape();
 	MANIFEST = "manifest.json";
@@ -14057,7 +13902,7 @@ var init_backups = __esmMin((() => {
 				fs.rmSync(destination, { force: true });
 				return {
 					ok: false,
-					error: error instanceof Error ? error.message : String(error)
+					error: errorMessage(error)
 				};
 			}
 		}
@@ -14098,7 +13943,7 @@ var init_backups = __esmMin((() => {
 				} catch (error) {
 					return {
 						...plan,
-						error: `the archive could not be read: ${error instanceof Error ? error.message : String(error)}`
+						error: `the archive could not be read: ${errorMessage(error)}`
 					};
 				}
 				plan.encrypted = entries.some((entry) => entry.encrypted);
@@ -14383,7 +14228,7 @@ var init_backups = __esmMin((() => {
 				const done = plan.applied.length > 0 ? ` — already applied: ${plan.applied.join(", ")}` : "";
 				return {
 					...plan,
-					error: `${error instanceof Error ? error.message : String(error)}${done}`
+					error: `${errorMessage(error)}${done}`
 				};
 			} finally {
 				fs.rmSync(staging, {
@@ -14648,6 +14493,7 @@ var ControlServer;
 var init_control_server = __esmMin((() => {
 	init_bind();
 	init_port();
+	init_error_message();
 	ControlServer = class {
 		options;
 		endpoint;
@@ -14681,7 +14527,7 @@ var init_control_server = __esmMin((() => {
 			} catch (error) {
 				return {
 					ok: false,
-					error: `restart failed: ${error instanceof Error ? error.message : String(error)}`
+					error: `restart failed: ${errorMessage(error)}`
 				};
 			}
 		}
@@ -14705,7 +14551,7 @@ var init_control_server = __esmMin((() => {
 				await this.listenWithRetry(next.host, next.port);
 				return { ok: true };
 			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
+				const message = errorMessage(error);
 				try {
 					await this.listenWithRetry(previous.host, previous.port);
 				} catch {}
@@ -15210,7 +15056,7 @@ async function detectPublicAddress(family, overrideUrl, fetchImpl, signal) {
 		};
 		lastError = `${endpoint} did not answer with a public ${family === "A" ? "IPv4" : "IPv6"} address`;
 	} catch (error) {
-		lastError = `${endpoint}: ${error instanceof Error ? error.message : String(error)}`;
+		lastError = `${endpoint}: ${errorMessage(error)}`;
 	}
 	return {
 		ip: null,
@@ -15219,6 +15065,7 @@ async function detectPublicAddress(family, overrideUrl, fetchImpl, signal) {
 }
 var DEFAULT_IPV4_ENDPOINTS, DEFAULT_IPV6_ENDPOINTS;
 var init_ip = __esmMin((() => {
+	init_error_message();
 	DEFAULT_IPV4_ENDPOINTS = [
 		"https://api4.ipify.org",
 		"https://ipv4.icanhazip.com",
@@ -15266,6 +15113,7 @@ var init_ddns = __esmMin((() => {
 	init_ddns$2();
 	init_ip();
 	init_types();
+	init_error_message();
 	RUN_TIMEOUT_MS = 6e4;
 	DdnsService = class {
 		deps;
@@ -15502,7 +15350,7 @@ var init_ddns = __esmMin((() => {
 			try {
 				writeFileAtomic(this.deps.statePath, `${JSON.stringify(this.persisted, null, 2)}\n`);
 			} catch (error) {
-				logger.warn(`ddns: could not save its state (${error instanceof Error ? error.message : String(error)})`);
+				logger.warn(`ddns: could not save its state (${errorMessage(error)})`);
 			}
 		}
 		dispose() {
@@ -15813,6 +15661,7 @@ var REASON_LABEL, TITLE, NotificationService;
 var init_notifications = __esmMin((() => {
 	init_logger();
 	init_telegram();
+	init_error_message();
 	REASON_LABEL = {
 		"crash": "gave up restarting",
 		"unhealthy": "health check failing",
@@ -15838,14 +15687,12 @@ var init_notifications = __esmMin((() => {
 	NotificationService = class {
 		secrets;
 		getConfig;
-		getLogsConfig;
 		cooldowns = /* @__PURE__ */ new Map();
 		lastResult = null;
 		lastResultAt = null;
-		constructor(secrets, getConfig, getLogsConfig) {
+		constructor(secrets, getConfig) {
 			this.secrets = secrets;
 			this.getConfig = getConfig;
-			this.getLogsConfig = getLogsConfig;
 		}
 		get telegramTokenSet() {
 			return this.secrets.telegramTokenSet;
@@ -15892,7 +15739,7 @@ var init_notifications = __esmMin((() => {
 		/** Fire-and-forget by design: supervision must never wait on a chat API. */
 		notify(event) {
 			this.dispatch(event).catch((error) => {
-				logger.warn(`notification failed: ${error instanceof Error ? error.message : String(error)}`);
+				logger.warn(`notification failed: ${errorMessage(error)}`);
 			});
 		}
 		async dispatch(event) {
@@ -16025,6 +15872,7 @@ var init_panel = __esmMin((() => {
 	init_notifications();
 	init_state$1();
 	init_supervisor();
+	init_error_message();
 	TICK_MS = 1e3;
 	PanelService = class {
 		options;
@@ -16234,7 +16082,7 @@ var init_panel = __esmMin((() => {
 			const secrets = new SecretsStore(workspaceSecretsPath(id), void 0, "workspace");
 			const logFiles = new LogFiles(workspaceLogsDir(id), () => store.logs);
 			const history = new HistoryStore(workspaceHistoryPath(id));
-			const notifications = new NotificationService(secrets, () => store.notifications, () => store.logs);
+			const notifications = new NotificationService(secrets, () => store.notifications);
 			const ddns = new DdnsService({
 				getConfig: () => store.ddns,
 				getCredentials: (accountId, provider) => secrets.getDdnsCredentials(accountId, provider)?.values ?? null,
@@ -16277,11 +16125,11 @@ var init_panel = __esmMin((() => {
 			runtime.watches = [new ConfigWatch({
 				file: store.path,
 				onChange: () => this.handleConfigChange(id),
-				onError: (error) => logger.warn(`cannot watch ${path.basename(store.path)}: ${error instanceof Error ? error.message : String(error)}`)
+				onError: (error) => logger.warn(`cannot watch ${path.basename(store.path)}: ${errorMessage(error)}`)
 			}), new ConfigWatch({
 				file: store.settingsPath,
 				onChange: () => this.handleConfigChange(id),
-				onError: (error) => logger.warn(`cannot watch ${path.basename(store.settingsPath)}: ${error instanceof Error ? error.message : String(error)}`)
+				onError: (error) => logger.warn(`cannot watch ${path.basename(store.settingsPath)}: ${errorMessage(error)}`)
 			})];
 			for (const watch of runtime.watches) watch.start();
 			return runtime;
@@ -16482,7 +16330,7 @@ function readDataRoot(dataRoot) {
 	}
 }
 function describeError$1(error) {
-	return error instanceof Error ? error.message : String(error);
+	return errorMessage(error);
 }
 /**
 * Where the site actually starts: the archive root, or a single wrapper directory
@@ -16516,6 +16364,7 @@ var init_ui = __esmMin((() => {
 	init_atomic();
 	init_archive();
 	init_contracts();
+	init_error_message();
 	META = "ui.json";
 	MAX_ENTRIES = 2e4;
 	MAX_BYTES = 536870912;
@@ -16577,7 +16426,7 @@ var init_ui = __esmMin((() => {
 			} catch (error) {
 				return {
 					ok: false,
-					error: error instanceof Error ? error.message : String(error)
+					error: errorMessage(error)
 				};
 			} finally {
 				fs.rmSync(staging, {
@@ -16602,7 +16451,7 @@ var init_ui = __esmMin((() => {
 			} catch (error) {
 				return {
 					ok: false,
-					error: `the archive could not be read: ${error instanceof Error ? error.message : String(error)}`
+					error: `the archive could not be read: ${errorMessage(error)}`
 				};
 			}
 			if (entries.length === 0) return {
@@ -16914,7 +16763,7 @@ function formatBytes(bytes) {
 	return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
 }
 function describeError(error) {
-	return error instanceof Error ? error.message : String(error);
+	return errorMessage(error);
 }
 /**
 * Tag ordering: `v1.2.3` beats `v1.2.2`, a prerelease loses to its release, and anything
@@ -16962,6 +16811,7 @@ function parseTag(tag) {
 }
 var DEFAULT_REPO, MAX_DOWNLOAD_BYTES, REQUEST_TIMEOUT_MS, DOWNLOAD_TIMEOUT_MS;
 var init_ui_release = __esmMin((() => {
+	init_error_message();
 	DEFAULT_REPO = "NamesMT/home-hosted";
 	MAX_DOWNLOAD_BYTES = 536870912;
 	REQUEST_TIMEOUT_MS = 3e4;
@@ -17039,7 +16889,7 @@ async function syncOfficialUi(ui, runningVersion = appVersion()) {
 	} catch (error) {
 		return {
 			kind: "failed",
-			error: error instanceof Error ? error.message : String(error)
+			error: errorMessage(error)
 		};
 	}
 }
@@ -17058,13 +16908,14 @@ function autoUpdateOfficialUi(ui, runningVersion = appVersion()) {
 		if (result.kind === "updated") logger.info(`ui:      updated to ${result.tag} — refresh the browser`);
 		else if (result.kind === "failed") logger.warn(`ui:      could not update to ${plan.tag}: ${result.error}`);
 	}).catch((error) => {
-		logger.warn(`ui:      could not update: ${error instanceof Error ? error.message : String(error)}`);
+		logger.warn(`ui:      could not update: ${errorMessage(error)}`);
 	});
 }
 var init_ui_update$1 = __esmMin((() => {
 	init_logger();
 	init_version();
 	init_ui_release();
+	init_error_message();
 }));
 //#endregion
 //#region src/index.ts
@@ -17090,7 +16941,12 @@ function probeHostFor(bindHost) {
 * directly.
 */
 async function runControlPlane(options) {
-	ensureLayout();
+	try {
+		ensureLayout();
+	} catch (error) {
+		logger.error(errorMessage(error));
+		process.exit(1);
+	}
 	const existing = readRuntime();
 	if (existing !== null && existing.pid !== process.pid && await runtimeIsAlive(existing)) {
 		logger.error(`already running (pid ${existing.pid}) at ${existing.url} — run \`home-hosted down\` first`);
@@ -17117,6 +16973,11 @@ async function runControlPlane(options) {
 		process.exit(1);
 	}
 	const secrets = new SecretsStore(globalSecretsPath, void 0, "global");
+	if (secrets.configError !== null) {
+		logger.error(`refusing to start: ${secrets.configError}`);
+		logger.info("fix or restore the file, or move it aside to start fresh — starting fresh discards it");
+		process.exit(1);
+	}
 	const auth = new AuthService(secrets, () => settings.control.auth);
 	const tls = new TlsStore(tlsDir);
 	const hub = new EventHub();
@@ -17263,6 +17124,11 @@ async function runControlPlane(options) {
 			logger.info(`fix ${store.path} and ${store.settingsPath}, or install the release that wrote them`);
 			process.exit(1);
 		}
+		if (workspace.secrets.configError !== null) {
+			logger.error(`refusing to start: workspace "${workspace.id}": ${workspace.secrets.configError}`);
+			logger.info("fix or restore the file, or move it aside to start fresh — starting fresh discards it");
+			process.exit(1);
+		}
 		if (store.pendingMigrations.length > 0) {
 			logger.error(`refusing to start: workspace "${workspace.id}" needs ${store.pendingMigrations.length} migration(s) before ${appVersion()} can use it`);
 			logger.info("run `home-hosted migrate` to see and apply them");
@@ -17410,6 +17276,7 @@ var init_src = __esmMin((() => {
 	init_ui();
 	init_ui_update$1();
 	init_contracts();
+	init_error_message();
 	packageRoot = path.resolve(fileURLToPath(new URL("..", import.meta.url)));
 }));
 //#endregion
@@ -17973,6 +17840,7 @@ async function runLogs(input) {
 var logsArgs, DEFAULT_LINES, logsCommand;
 var init_logs = __esmMin((() => {
 	init_io();
+	init_error_message();
 	logsArgs = {
 		lines: {
 			type: "string",
@@ -17999,7 +17867,7 @@ var init_logs = __esmMin((() => {
 					json: args.json
 				});
 			} catch (error) {
-				fail(error instanceof Error ? error.message : String(error));
+				fail(errorMessage(error));
 			}
 		}
 	});
@@ -18166,12 +18034,6 @@ function targets(configOverride) {
 	return list;
 }
 async function runMigrate(config, dryRun, yes) {
-	const relocated = migrateLayout();
-	if (relocated.migrated) {
-		process.stdout.write(`${green("state layout migrated")} into the current .hh layout\n`);
-		for (const step of relocated.moved) process.stdout.write(`  ${dim(step)}\n`);
-		for (const warning of relocated.warnings) process.stdout.write(`  ${dim(`warning: ${warning}`)}\n`);
-	}
 	const existing = targets(config).filter((target) => fs.existsSync(target.file));
 	if (existing.length === 0) fail(`no home-hosted state to migrate — nothing at ${globalSettingsPath} or any workspace`);
 	const consented = yes || (process.env.HHOSTED_MIGRATE ?? "").toLowerCase() === "allow";
@@ -18181,7 +18043,7 @@ async function runMigrate(config, dryRun, yes) {
 		try {
 			raw = JSON.parse(fs.readFileSync(target.file, "utf8"));
 		} catch (error) {
-			fail(`cannot read ${target.file}: ${error instanceof Error ? error.message : String(error)}`);
+			fail(`cannot read ${target.file}: ${errorMessage(error)}`);
 		}
 		const meta = typeof raw.meta === "object" && raw.meta !== null ? raw.meta : {};
 		const from = typeof meta.schema === "number" ? meta.schema : 1;
@@ -18226,13 +18088,13 @@ async function runMigrate(config, dryRun, yes) {
 var migrateArgs, migrateCommand;
 var init_migrate = __esmMin((() => {
 	init_io();
-	init_layout();
 	init_migrations();
 	init_parse();
 	init_workspaces();
 	init_atomic();
 	init_paths();
 	init_version();
+	init_error_message();
 	migrateArgs = {
 		config: {
 			type: "string",
@@ -18396,7 +18258,7 @@ async function runInit(options) {
 		process.stdout.write(`${green("project created")} in ${result.dir}\n`);
 		for (const file of result.files) process.stdout.write(`  ${dim(file)}\n`);
 	} catch (error) {
-		fail(error instanceof Error ? error.message : String(error));
+		fail(errorMessage(error));
 	}
 	const target = path.resolve(dir);
 	if (git) {
@@ -18427,6 +18289,7 @@ var initArgs, initCommand;
 var init_init = __esmMin((() => {
 	init_io();
 	init_init$1();
+	init_error_message();
 	initArgs = {
 		dir: {
 			type: "string",
@@ -19073,6 +18936,7 @@ var init_nanny = __esmMin((() => {
 }));
 //#endregion
 //#region src/cli.ts
+init_error_message();
 init_args();
 init_io();
 init_nearest();
@@ -19369,7 +19233,7 @@ async function main() {
 		try {
 			await runCommand(nannyCommand, { rawArgs: dirFlags.rest });
 		} catch (error) {
-			fail(error instanceof Error ? error.message : String(error));
+			fail(errorMessage(error));
 		}
 		return;
 	}
@@ -19398,11 +19262,11 @@ async function main() {
 	try {
 		await runCommand(rootCommand, { rawArgs: invocation.argv });
 	} catch (error) {
-		fail(error instanceof Error ? error.message : String(error));
+		fail(errorMessage(error));
 	}
 }
 main().catch((error) => {
-	fail(error instanceof Error ? error.message : String(error));
+	fail(errorMessage(error));
 });
 //#endregion
 export { commandHelp, suggestCommand };