home-hosted 0.8.2 → 0.8.3

package/dist/cli.js

@@ -709,7 +709,7 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restoreSkipSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
+var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, entryStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyActorSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restoreSkipSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	workspaceIdSchema = type("/^[a-z0-9][a-z0-9_-]*$/");
@@ -1154,6 +1154,19 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"heartbeatAt": "number",
 		"lastExit?": nannyExitSchema
 	}).onUndeclaredKey("reject");
+	entryStateSchema = type({
+		/** Attempts spent on the current crash sequence; reset once the process stays up. */
+		"restarts": "number.integer >= 0",
+		/** The `runOnce` bootstrap already ran for this entry. */
+		"bootstrapDone": "boolean",
+		/**
+		* The last child this panel spawned for a non-persistent entry. A detached child
+		* outlives the panel, so this is the only way a later boot recognizes its own
+		* survivor instead of spawning a second copy beside it.
+		*/
+		"lastPid?": "number | null",
+		"lastStartedAt?": "number | null"
+	});
 	settingsPatchSchema = type({
 		control: controlPatchSchema.optional(),
 		host: hostPatchSchema.optional(),
@@ -1419,13 +1432,16 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		stream: logStreamSchema,
 		text: "string"
 	});
+	historyActorSchema = type.enumerated("policy", "user", "agent", "boot");
 	historyEventSchema = type({
-		serverId: "string",
-		ts: "number",
-		type: "\"start\" | \"exit\" | \"crash\" | \"forced-restart\" | \"unhealthy\" | \"recovered\"",
-		detail: "string",
+		"serverId": "string",
+		"ts": "number",
+		"type": "\"start\" | \"exit\" | \"crash\" | \"forced-restart\" | \"unhealthy\" | \"recovered\"",
+		"detail": "string",
 		/** How long the process had been up, recorded on exit and crash. */
-		runtimeMs: "number?"
+		"runtimeMs": "number?",
+		/** Who caused it; absent on events from before this field existed. */
+		"actor?": historyActorSchema
 	});
 	serverHistorySchema = type({
 		windowMs: "number",
@@ -1497,6 +1513,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 			"labelParams?": "Record<string, string>",
 			/** `settings`/`servers`/`secrets` for a workspace, `data` for a declared path. */
 			"kind": "\"settings\" | \"servers\" | \"secrets\" | \"data\"",
+			/** Which secret a `secrets` leaf carries (`password`, `apiToken`, `telegram`, `ddns`, …). */
+			"secret?": "string",
 			"path?": "string",
 			/** Who declared a data path: `global`, `<serverId>:backupPaths` or `<serverId>:<ENV>`. */
 			"origin?": "string",
@@ -1546,6 +1564,14 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"encrypted": "boolean",
 		/** The archive needs a password (none or a wrong one was supplied). */
 		"needsPassword": "boolean",
+		/**
+		* Where the archive says it came from. Optional: an archive written before this
+		* stamp existed carries neither field, and an older panel never sends the row.
+		*/
+		"archive?": type({
+			"writtenBy?": "string",
+			"schema?": "number"
+		}),
 		"items": restoreItemSchema.array(),
 		"applied": type("string[]"),
 		/**
@@ -2635,6 +2661,14 @@ function createAuthGuard(deps) {
 		await next();
 	};
 }
+/**
+* Who is behind a request, as a history event names them: a cookie is a person at
+* the panel, a bearer token is a script or an agent. Anonymous callers can only be
+* loopback requests while auth is unarmed, which is the browser's own origin.
+*/
+function requestActor(c, auth) {
+	return requestIdentity(c, auth).method === "token" ? "agent" : "user";
+}
 var PUBLIC_PATHS, AUTH_REQUIRED_CODE;
 var init_auth = __esmMin((() => {
 	init_loopback();
@@ -3643,7 +3677,7 @@ function createControlRoute(deps) {
 		}
 	}), validate("query", workspaceQuerySchema), async (c) => {
 		assertLocalCall(c, "start or stop a server");
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.param("id"));
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.param("id"), { actor: "user" });
 		return c.json(result, statusForAction(result));
 	}).post("/servers/:id/stop", describeRoute({
 		tags: ["panel"],
@@ -3667,7 +3701,7 @@ function createControlRoute(deps) {
 		}
 	}), validate("query", workspaceQuerySchema), async (c) => {
 		assertLocalCall(c, "restart a server");
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.param("id"));
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.param("id"), { actor: "user" });
 		return c.json(result, statusForAction(result));
 	});
 }
@@ -6423,8 +6457,8 @@ var init_events = __esmMin((() => {
 /**
 * Liveness for external monitors. Mounted outside `/api`, so it answers without a
 * session: it reports whether the panel itself is serving, and 503 when an
-* autostart server has crashed. Server details are only included for an
-* authenticated caller.
+* autostart server has crashed, or a running one is failing its own health check.
+* Server details are only included for an authenticated caller.
 */
 function createHealthRoute(deps) {
 	return appFactory.createApp().get("/healthz", describeRoute({
@@ -6435,12 +6469,12 @@ function createHealthRoute(deps) {
 				description: "Serving",
 				content: jsonBody(healthResponseSchema)
 			},
-			503: { description: "An autostart server has crashed" }
+			503: { description: "An autostart server has crashed, or a running one is unhealthy" }
 		}
 	}), (c) => {
 		const state = deps.panel.getState();
 		const servers = state.workspaces.flatMap((workspace) => workspace.servers);
-		const broken = servers.filter((server) => server.config.autostart && server.status === "crashed");
+		const broken = servers.filter((server) => server.config.autostart && server.status === "crashed" || server.status === "running" && server.health === "unhealthy");
 		const authenticated = requestIdentity(c, deps.auth).authenticated;
 		return c.json({
 			status: broken.length > 0 ? "degraded" : "ok",
@@ -10361,7 +10395,7 @@ function createServersRoute(deps) {
 			404: ERROR_RESPONSES[404]
 		}
 	}), validate("query", workspaceQuerySchema), validate("param", idParam$1), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.valid("param").id);
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.valid("param").id, { actor: requestActor(c, deps.auth) });
 		return c.json(result, statusForAction(result));
 	}).post("/:id/stop", describeRoute({
 		tags: ["servers"],
@@ -10381,7 +10415,7 @@ function createServersRoute(deps) {
 			404: ERROR_RESPONSES[404]
 		}
 	}), validate("query", workspaceQuerySchema), validate("param", idParam$1), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.valid("param").id);
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.valid("param").id, { actor: requestActor(c, deps.auth) });
 		return c.json(result, statusForAction(result));
 	}).post("/:id/clear-logs", describeRoute({
 		tags: ["servers"],
@@ -10469,6 +10503,7 @@ var init_$_routes$1 = __esmMin((() => {
 	init_openapi$1();
 	init_validator();
 	init_workspace();
+	init_auth();
 	init_events$1();
 	init_contracts();
 	idParam$1 = type({ id: "string >= 1" });
@@ -11427,6 +11462,90 @@ var init_acme_challenge = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/config/secret-parts.ts
+/**
+* The parts of one scope, in a stable order: the known parts first in the fixed order
+* password, apiToken (global) / telegram, ddns (workspace) — then any other top-level
+* key present in `present`, sorted, as its own part with `fields: [key]`.
+*
+* An unknown key is taken as belonging to the scope being asked about, because the file
+* it was read from is the only evidence of where it lives: this release does not know the
+* key, so classifying it by name would drop a future *global* secret on the floor.
+*/
+function secretParts(scope, present) {
+	const keys = new Set(present);
+	const known = KNOWN[scope];
+	const parts = known.filter((key) => keys.has(key)).map((key) => ({
+		key,
+		fields: EXTRA_FIELDS[key] ?? [key],
+		scope
+	}));
+	const consumed = new Set(parts.flatMap((part) => part.fields));
+	const rest = [...keys].filter((key) => KNOWN_SCOPES[key] === void 0 && !known.includes(key) && !consumed.has(key)).sort();
+	return [...parts, ...rest.map((key) => ({
+		key,
+		fields: [key],
+		scope
+	}))];
+}
+/** The top-level keys of a raw secrets document that hold a non-null value. */
+function presentSecretKeys(source) {
+	return Object.entries(source).filter(([, value]) => value !== null && value !== void 0).map(([key]) => key);
+}
+/**
+* A JSON string carrying only `fields`, taken from `source`. Returns null when `source`
+* carries none of them. Always includes a field whose value is `null` ONLY if it is
+* present as a key and non-null; a null/absent field is omitted.
+*/
+function pickSecrets(source, fields) {
+	const picked = {};
+	for (const field of fields) {
+		const value = source[field];
+		if (value !== null && value !== void 0) picked[field] = value;
+	}
+	return Object.keys(picked).length === 0 ? null : JSON.stringify(picked);
+}
+/** Parses a secrets document, tolerating anything: not-an-object, or broken JSON returns {}. */
+function parseSecrets(text) {
+	try {
+		const parsed = JSON.parse(text);
+		return isRecord(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Merges `piece` into `current`, changing ONLY the fields in `fields` — every other key
+* of `current` is preserved (this is what stops restoring the Telegram token from wiping
+* the DDNS credentials). A field that is absent from `piece` is also DELETED from the
+* result, so restoring an older archive that predates a secret clears it rather than
+* leaving a stale value. Returns a new object; does not mutate its arguments.
+*/
+function mergeSecrets(current, piece, fields) {
+	const merged = { ...current };
+	for (const field of fields) {
+		const value = piece[field];
+		if (value === null || value === void 0) delete merged[field];
+		else merged[field] = value;
+	}
+	return merged;
+}
+var KNOWN, KNOWN_SCOPES, EXTRA_FIELDS;
+var init_secret_parts = __esmMin((() => {
+	init_shape();
+	KNOWN = {
+		global: ["password", "apiToken"],
+		workspace: ["telegram", "ddns"]
+	};
+	KNOWN_SCOPES = {
+		password: "global",
+		apiToken: "global",
+		telegram: "workspace",
+		ddns: "workspace"
+	};
+	EXTRA_FIELDS = { ddns: ["ddns", "ddnsKdf"] };
+}));
+//#endregion
 //#region src/helpers/env-file.ts
 /** `KEY=value` files, with optional `export `, `#` comments and quoted values. */
 function parseEnvFile(text) {
@@ -11684,6 +11803,41 @@ function computeBackoff(attempt, options) {
 }
 var init_backoff = __esmMin((() => {}));
 //#endregion
+//#region src/providers/entry-state.ts
+/**
+* The small slice of a server's runtime the panel has to remember across its own
+* restarts: how much of the retry budget is spent, and whether a `runOnce` bootstrap
+* already ran.
+*
+* Both lived only in memory, so a panel restart — a `restart`, a crash, a reboot —
+* handed a crash-looping server a fresh `maxRetries` and re-ran its bootstrap. The
+* retry counter has to outlive the process that increments it to bound anything.
+*/
+/** One JSON file per entry, beside the nanny's own state. */
+function entryStatePath(dir, id) {
+	return path.join(dir, `${id}.run.json`);
+}
+function readEntryState(file) {
+	try {
+		const parsed = entryStateSchema(JSON.parse(fs.readFileSync(file, "utf8")));
+		return parsed instanceof type.errors ? null : parsed;
+	} catch {
+		return null;
+	}
+}
+function writeEntryState(file, state) {
+	try {
+		writeFileAtomic(file, `${JSON.stringify(state)}\n`);
+	} catch {}
+}
+function clearEntryState(file) {
+	fs.rmSync(file, { force: true });
+}
+var init_entry_state = __esmMin((() => {
+	init_atomic();
+	init_contracts();
+}));
+//#endregion
 //#region src/providers/health-check.ts
 /** TCP connect timing, used for the default `port` mode and readiness. */
 async function probeTcp(host, port, timeoutMs) {
@@ -12304,6 +12458,7 @@ var init_supervisor = __esmMin((() => {
 	init_paths();
 	init_runtime();
 	init_template();
+	init_entry_state();
 	init_health_check();
 	init_identity();
 	init_nanny$2();
@@ -12371,7 +12526,7 @@ var init_supervisor = __esmMin((() => {
 				}
 			}
 			const targets = [...this.entries.values()].filter((entry) => !options.autostartOnly || entry.config.autostart).map((entry) => entry.config);
-			for (const config of orderByDependencies(targets)) await this.start(config.id);
+			for (const config of orderByDependencies(targets)) await this.start(config.id, { actor: "boot" });
 		}
 		/**
 		* Stops every entry this command owns. A persistent entry is deliberately not among
@@ -12402,11 +12557,13 @@ var init_supervisor = __esmMin((() => {
 				error: `server "${id}" is stopping`
 			};
 			entry.starting = true;
+			entry.actor = options.retry ? "policy" : options.actor ?? "policy";
 			this.clearRetry(entry);
 			if (!options.retry) {
 				entry.restarts = 0;
 				entry.healthFailures = 0;
 				entry.unhealthySince = null;
+				this.persistEntryState(entry);
 			}
 			try {
 				await this.startDependencies(entry);
@@ -12419,6 +12576,14 @@ var init_supervisor = __esmMin((() => {
 				entry.health = entry.config.health.enabled ? "unknown" : "disabled";
 				this.publishServer(entry);
 				if (entry.config.persistent && await this.resumePersistent(entry)) return { ok: true };
+				if (!entry.config.persistent) {
+					const recorded = await this.resolveRecordedChild(entry);
+					if (recorded.kind === "blocked") return {
+						ok: false,
+						error: recorded.error
+					};
+					if (recorded.kind === "adopt") return this.adoptEntry(entry, recorded.pid, "the child this panel started before it died is still running");
+				}
 				await this.runBootstrap(entry);
 				if (entry.stopping) return {
 					ok: false,
@@ -12433,7 +12598,7 @@ var init_supervisor = __esmMin((() => {
 					ok: false,
 					error: conflict.error
 				};
-				if (conflict.kind === "adopt") return this.adoptEntry(entry, conflict.pid);
+				if (conflict.kind === "adopt") return this.adoptEntry(entry, conflict.pid, `a detached restart of this entry is already serving port ${entry.config.port}`);
 				return this.spawnEntry(entry);
 			} finally {
 				entry.starting = false;
@@ -12444,9 +12609,9 @@ var init_supervisor = __esmMin((() => {
 			if (!entry) return missingServer(id);
 			return this.stopEntry(entry);
 		}
-		async restart(id) {
+		async restart(id, options = {}) {
 			await this.stop(id);
-			return this.start(id);
+			return this.start(id, options);
 		}
 		/**
 		* Frees the port this entry wants, by asking whatever listens on it to leave.
@@ -12678,6 +12843,10 @@ var init_supervisor = __esmMin((() => {
 			entry.pid = null;
 			entry.adopted = false;
 			entry.nannyExit = null;
+			if (entry.lastChild !== null && !isProcessAlive(entry.lastChild.pid)) {
+				entry.lastChild = null;
+				this.persistEntryState(entry);
+			}
 			entry.status = survivor === null ? "stopped" : "conflict";
 			if (survivor !== null) entry.lastError = `pid ${survivor} survived the stop`;
 			this.log(entry, "system", survivor === null ? "stopped" : entry.lastError);
@@ -12688,6 +12857,8 @@ var init_supervisor = __esmMin((() => {
 			};
 		}
 		createEntry(config) {
+			const persisted = readEntryState(entryStatePath(this.options.nannyDir, config.id));
+			const lastPid = persisted?.lastPid ?? null;
 			return {
 				config,
 				status: "stopped",
@@ -12696,9 +12867,13 @@ var init_supervisor = __esmMin((() => {
 				child: null,
 				pid: null,
 				startedAt: null,
+				lastChild: !config.persistent && lastPid !== null ? {
+					pid: lastPid,
+					startedAt: persisted?.lastStartedAt ?? 0
+				} : null,
 				exitCode: null,
 				exitSignal: null,
-				restarts: 0,
+				restarts: persisted?.restarts ?? 0,
 				lastError: null,
 				nextRetryAt: null,
 				retryTimer: null,
@@ -12711,8 +12886,9 @@ var init_supervisor = __esmMin((() => {
 				nannyExit: null,
 				starting: false,
 				stopping: false,
+				actor: "policy",
 				removed: false,
-				bootstrapDone: !config.bootstrap,
+				bootstrapDone: persisted?.bootstrapDone ?? !config.bootstrap,
 				logs: new LogBuffer(config.logBufferLines),
 				echoed: /* @__PURE__ */ new Set(),
 				responseMs: null,
@@ -12730,6 +12906,7 @@ var init_supervisor = __esmMin((() => {
 					this.relay.unfollow(id);
 					this.options.logFiles.clear(id);
 					this.options.history.forget(id);
+					clearEntryState(entryStatePath(this.options.nannyDir, id));
 					entry.removed = true;
 					this.stopEntry(entry).catch((error) => {
 						logger.error(`could not stop the removed server ${id}`, error);
@@ -12853,16 +13030,6 @@ var init_supervisor = __esmMin((() => {
 			return { kind: "free" };
 		}
 		/**
-		* Takes over a detached successor: no spawn, no duplicate. The pid is supervised
-		* from here on (liveness, health probe, resources, stop), while its output stays
-		* wherever it was redirected.
-		*
-		* For a persistent entry that output is not a mystery: its nanny is still writing
-		* the entry's log file, so the relay is started here too. Without this, adopting a
-		* persistent entry whose state file was lost would show its history but never
-		* another live line.
-		*/
-		/**
 		* Stops the listed port holders and reports whether the port came free.
 		*
 		* `kill` and `reclaim` are the same sequence over a different pid list — the foreign
@@ -12887,7 +13054,21 @@ var init_supervisor = __esmMin((() => {
 				error: entry.lastError
 			};
 		}
-		adoptEntry(entry, pid) {
+		/**
+		* Takes over a detached successor: no spawn, no duplicate. The pid is supervised
+		* from here on (liveness, health probe, resources, stop), while its output stays
+		* wherever it was redirected.
+		*
+		* For a persistent entry that output is not a mystery: its nanny is still writing
+		* the entry's log file, so the relay is started here too. Without this, adopting a
+		* persistent entry whose state file was lost would show its history but never
+		* another live line.
+		*
+		* `reason` is the caller's sentence for *why* this pid is ours: a port holder and a
+		* recorded child that survived a hard panel death are the same adoption, said
+		* differently, and the log line is the only place a person sees which happened.
+		*/
+		adoptEntry(entry, pid, reason) {
 			entry.adopted = true;
 			entry.pid = pid;
 			entry.child = null;
@@ -12896,12 +13077,60 @@ var init_supervisor = __esmMin((() => {
 			entry.startedAt = Date.now();
 			entry.lastError = null;
 			if (entry.config.persistent) this.followPersistent(entry, true);
-			this.log(entry, "system", `adopted pid ${pid}: a detached restart of this entry is already serving port ${entry.config.port}`);
+			this.log(entry, "system", `adopted pid ${pid}: ${reason}`);
 			this.publishServer(entry);
 			return { ok: true };
 		}
+		/**
+		* The child this entry's state file recorded, when it is still that same process.
+		*
+		* A non-persistent child is spawned detached, so it survives a panel killed hard while
+		* nothing else remembers it — `preflight` cannot help a portless entry, which is how a
+		* portless worker got a second copy beside the running one. A pid is recycled, so
+		* liveness alone proves nothing: the birth time and the marker decide, and a pid this
+		* platform cannot place is never adopted on a guess.
+		*
+		* The record is cleared only once its process is known to be gone or to be somebody
+		* else, so a stale pid is never chased and a live one is never forgotten into a twin.
+		*/
+		async resolveRecordedChild(entry) {
+			const recorded = entry.lastChild;
+			if (recorded === null) return { kind: "none" };
+			if (recorded.pid === process.pid) {
+				entry.lastChild = null;
+				this.persistEntryState(entry);
+				return { kind: "none" };
+			}
+			const liveness = recorded.startedAt > 0 ? await processLiveness(recorded.pid, recorded.startedAt) : isProcessAlive(recorded.pid) ? "unknown" : "gone";
+			if (liveness === "gone" || liveness === "recycled") {
+				entry.lastChild = null;
+				this.persistEntryState(entry);
+				return { kind: "none" };
+			}
+			if (await processCarriesServerId(recorded.pid, entry.config.id)) return {
+				kind: "adopt",
+				pid: recorded.pid
+			};
+			if (entry.config.port !== null) return { kind: "none" };
+			const error = `pid ${recorded.pid} may be a child this panel started for "${entry.config.id}" before it died, and this platform cannot confirm whose it is — not starting a second copy, stop pid ${recorded.pid} to clear it`;
+			entry.status = "conflict";
+			entry.lastError = error;
+			this.log(entry, "system", error);
+			this.publishServer(entry);
+			return {
+				kind: "blocked",
+				error
+			};
+		}
+		/** Clears the durable record of the last child, once that pid is known to be gone. */
+		forgetRecordedChild(entry, pid) {
+			if (pid === null || entry.lastChild === null || entry.lastChild.pid !== pid) return;
+			entry.lastChild = null;
+			this.persistEntryState(entry);
+		}
 		/** An adopted successor disappeared: fall back to the normal lifecycle. */
 		handleAdoptedExit(entry) {
+			const adoptedPid = entry.pid;
 			if (entry.pid !== null) this.sampler.forget(entry.pid);
 			if (entry.config.persistent) this.consumeNannyExit(entry);
 			const ranForMs = entry.nannyExit?.runtimeMs ?? (entry.startedAt === null ? 0 : Date.now() - entry.startedAt);
@@ -12909,6 +13138,7 @@ var init_supervisor = __esmMin((() => {
 			entry.nannyExit = null;
 			entry.adopted = false;
 			entry.pid = null;
+			this.forgetRecordedChild(entry, adoptedPid);
 			entry.resources = null;
 			entry.responseMs = null;
 			entry.exitCode = null;
@@ -12949,6 +13179,7 @@ var init_supervisor = __esmMin((() => {
 			} catch (error) {
 				this.log(entry, "system", `bootstrap could not start: ${error.message} — continuing anyway`);
 				entry.bootstrapDone = true;
+				this.persistEntryState(entry);
 				return;
 			}
 			child.stdout?.on("data", (chunk) => splitter.push("stdout", chunk));
@@ -12971,6 +13202,7 @@ var init_supervisor = __esmMin((() => {
 				});
 			});
 			entry.bootstrapDone = true;
+			this.persistEntryState(entry);
 			if (code === 0) this.log(entry, "system", "bootstrap finished");
 			else if (code !== null) this.log(entry, "system", `bootstrap exited with code ${code} — continuing anyway`);
 		}
@@ -13112,9 +13344,17 @@ var init_supervisor = __esmMin((() => {
 			entry.child = child;
 			entry.pid = child.pid ?? null;
 			entry.startedAt = Date.now();
+			if (!entry.config.persistent && child.pid !== void 0) {
+				entry.lastChild = {
+					pid: child.pid,
+					startedAt: entry.startedAt
+				};
+				this.persistEntryState(entry);
+			}
 			this.options.history.record(entry.config.id, {
 				type: "start",
-				detail
+				detail,
+				actor: entry.actor
 			});
 			entry.exitCode = null;
 			entry.exitSignal = null;
@@ -13304,6 +13544,7 @@ var init_supervisor = __esmMin((() => {
 			entry.responseMs = null;
 			entry.exitCode = code;
 			entry.exitSignal = signal;
+			this.forgetRecordedChild(entry, child.pid ?? null);
 			const neverStarted = nannyExit !== null ? nannyExit.code === null && nannyExit.signal === null : code === null && signal === null && entry.lastError !== null;
 			const detail = neverStarted ? entry.lastError ?? "the entry could not start" : nannyExit !== null ? describeNannyExit(nannyExit) : describeNannyExit({
 				code,
@@ -13332,10 +13573,12 @@ var init_supervisor = __esmMin((() => {
 			}
 			const restart = entry.config.restart;
 			if (ranForMs >= restart.resetAfterMs) entry.restarts = 0;
+			this.persistEntryState(entry);
 			this.log(entry, "system", neverStarted ? `did not start: ${detail}` : `exited with ${detail} after ${ranFor}`);
 			entry.lastError = neverStarted ? detail : `exited with ${detail}`;
 			if (restart.enabled && entry.restarts < restart.maxRetries) {
 				entry.restarts += 1;
+				this.persistEntryState(entry);
 				const backoffMs = computeBackoff(entry.restarts, restart);
 				entry.status = "backoff";
 				entry.nextRetryAt = Date.now() + backoffMs;
@@ -13471,6 +13714,15 @@ var init_supervisor = __esmMin((() => {
 				entry.retryTimer = null;
 			}
 		}
+		/** The decisions that have to survive this panel, and nothing else. */
+		persistEntryState(entry) {
+			writeEntryState(entryStatePath(this.options.nannyDir, entry.config.id), {
+				restarts: entry.restarts,
+				bootstrapDone: entry.bootstrapDone,
+				lastPid: entry.config.persistent ? null : entry.lastChild?.pid ?? null,
+				lastStartedAt: entry.config.persistent ? null : entry.lastChild?.startedAt ?? null
+			});
+		}
 		buildVars(entry) {
 			return serverTemplateVars(entry.config);
 		}
@@ -13754,6 +14006,28 @@ function labelOf(plan, id) {
 	return plan.items.find((item) => item.id === id)?.label ?? id;
 }
 /**
+* Restores only `fields` from an archived secrets document into a live one.
+*
+* The archive may predate a secret the live file holds, and the live file may hold one
+* the archive never carried: merging by field is what makes restoring the Telegram token
+* leave the DDNS credentials alone, and what clears a secret the archive does not carry
+* rather than leaving the newer value behind as if it had been restored.
+*/
+function mergeIntoFile(target, archived, fields) {
+	const merged = mergeSecrets(parseSecrets(readText(target) ?? ""), parseSecrets(archived), fields);
+	writeFileAtomic(target, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+}
+/**
+* What an archive says about where it came from. Both fields are absent on an archive
+* written before they existed, so a UI shows the row only when there is something to show.
+*/
+function manifestInfo(manifest) {
+	return {
+		...manifest.writtenBy === void 0 ? {} : { writtenBy: manifest.writtenBy },
+		...manifest.schema === void 0 ? {} : { schema: manifest.schema }
+	};
+}
+/**
 * `servers.config.json` is only a readability gate here: the store applies the
 * workspace's own defaults on the next load, and an archive from another machine
 * need not match this one's default shapes exactly.
@@ -13774,13 +14048,16 @@ function readableWorkspaceSettings(text) {
 		return false;
 	}
 }
-var MANIFEST, ALLOWED_ROOTS, SUFFIX, RELOADABLE, BackupService;
+var MANIFEST, ALLOWED_ROOTS, SUFFIX, RELOADABLE, SECRET_LABELS, BackupService;
 var init_backups = __esmMin((() => {
+	init_migrations();
 	init_parse();
+	init_secret_parts();
 	init_atomic();
 	init_env_file();
 	init_paths();
 	init_template();
+	init_version();
 	init_archive();
 	init_supervisor();
 	init_error_message();
@@ -13794,6 +14071,24 @@ var init_backups = __esmMin((() => {
 	]);
 	SUFFIX = ".zip";
 	RELOADABLE = /^global:settings$|^workspace:[^:]+:(?:settings|servers)$/;
+	SECRET_LABELS = {
+		password: {
+			en: "Password",
+			key: "settings.backup.secretPassword"
+		},
+		apiToken: {
+			en: "API token",
+			key: "settings.backup.secretApiToken"
+		},
+		telegram: {
+			en: "Telegram bot token",
+			key: "settings.backup.secretTelegram"
+		},
+		ddns: {
+			en: "DDNS credentials",
+			key: "settings.backup.secretDdns"
+		}
+	};
 	BackupService = class {
 		options;
 		/**
@@ -13856,6 +14151,16 @@ var init_backups = __esmMin((() => {
 			const wanted = options.include === void 0 ? null : new Set(options.include);
 			const capturesGlobal = (id) => wanted === null || wanted.has(id);
 			const capturesWorkspace = (id, suffix) => wanted === null || wanted.has(`workspace:${id}`) || wanted.has(`workspace:${id}:${suffix}`);
+			/**
+			* The secrets of one scope the request asked for; `null` means "every one of them".
+			* `workspaceId` is how a bare `workspace:<id>` selection covers all of its leaves.
+			*/
+			const selectedSecretFields = (entryId, path, scope, workspaceId) => {
+				const parts = secretParts(scope, presentSecretKeys(parseSecrets(readText(path) ?? "")));
+				const coversEntry = wanted === null || wanted.has(entryId) || workspaceId !== void 0 && wanted.has(`workspace:${workspaceId}`);
+				const picked = parts.filter((part) => coversEntry || wanted.has(`${entryId}:${part.key}`) || part.fields.some((field) => wanted.has(`${entryId}:${field}`)));
+				return picked.length === parts.length ? null : picked.flatMap((part) => part.fields);
+			};
 			const dir = this.resolveDir();
 			const sources = this.options.getSources();
 			const staging = path.join(dir, `.staging-${Date.now()}`);
@@ -13868,15 +14173,41 @@ var init_backups = __esmMin((() => {
 				const copy = (relative, source, ignoreGenerated = false) => {
 					if (this.copyInto(staging, relative, source, ignoreGenerated)) captured++;
 				};
+				/**
+				* Captures one secrets file, narrowed to the picked secrets. Copying the whole file
+				* would capture the ones that were *not* picked, so a per-secret selection writes a
+				* staged document holding only those — and the restore side merges by field, which
+				* is what keeps a restore from wiping a secret the archive never carried.
+				*/
+				const copySecrets = (relative, source, entryId, scope, workspaceId) => {
+					const text = readText(source);
+					if (text === null) return;
+					const fields = selectedSecretFields(entryId, source, scope, workspaceId);
+					if (fields === null) {
+						copy(relative, source);
+						return;
+					}
+					const chosen = pickSecrets(parseSecrets(text), fields);
+					if (chosen === null) return;
+					const target = path.join(staging, relative);
+					fs.mkdirSync(path.dirname(target), { recursive: true });
+					fs.writeFileSync(target, `${chosen}\n`);
+					captured++;
+				};
+				/**
+				* True when the request touches a secrets entry at all: the entry itself, one of its
+				* leaves, or — for a workspace — the workspace id, which names every leaf it has.
+				*/
+				const capturesSecrets = (entryId, workspaceId) => wanted === null || wanted.has(entryId) || workspaceId !== void 0 && wanted.has(`workspace:${workspaceId}`) || [...wanted].some((id) => id.startsWith(`${entryId}:`));
 				if (capturesGlobal("global:settings")) copy("global/settings.json", sources.globalSettingsPath);
-				if (capturesGlobal("global:secrets")) copy("global/secrets.json", sources.globalSecretsPath);
+				if (capturesSecrets("global:secrets")) copySecrets("global/secrets.json", sources.globalSecretsPath, "global:secrets", "global");
 				if (capturesGlobal("global:tls")) copy("global/tls", sources.tlsDir);
 				const data = [];
 				for (const workspace of sources.workspaces) {
 					const root = `workspaces/${workspace.id}`;
 					if (capturesWorkspace(workspace.id, "settings")) copy(`${root}/settings.json`, workspace.settingsPath);
 					if (capturesWorkspace(workspace.id, "servers")) copy(`${root}/servers.config.json`, workspace.serversPath);
-					if (capturesWorkspace(workspace.id, "secrets")) copy(`${root}/secrets.json`, workspace.secretsPath);
+					if (capturesSecrets(`workspace:${workspace.id}:secrets`, workspace.id)) copySecrets(`${root}/secrets.json`, workspace.secretsPath, `workspace:${workspace.id}:secrets`, "workspace", workspace.id);
 					for (const declared of this.declaredData(workspace.servers, sources.includePaths)) {
 						if (!declared.included) continue;
 						if (!capturesWorkspace(workspace.id, `data:${declared.path}`)) continue;
@@ -13907,6 +14238,8 @@ var init_backups = __esmMin((() => {
 					version: 1,
 					createdAt,
 					hostname: os.hostname(),
+					writtenBy: appVersion(),
+					schema: 1,
 					data
 				};
 				fs.writeFileSync(path.join(staging, MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`);
@@ -14021,6 +14354,11 @@ var init_backups = __esmMin((() => {
 					error: "the archive has no manifest"
 				};
 				const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+				plan.archive = manifestInfo(manifest);
+				if (manifest.schema !== void 0 && manifest.schema > 1) return {
+					...plan,
+					error: `written by home-hosted ${manifest.writtenBy ?? "a newer release"} (config schema ${manifest.schema}); this release understands schema 1`
+				};
 				const sources = this.options.getSources();
 				const selectedIds = options.include === void 0 ? null : new Set(options.include);
 				const actions = /* @__PURE__ */ new Map();
@@ -14077,16 +14415,32 @@ var init_backups = __esmMin((() => {
 					writeFileAtomic(sources.globalSettingsPath, settingsText);
 				}, ["config"]);
 				const globalSecrets = readText(path.join(staging, "global", "secrets.json"));
-				if (globalSecrets !== null) addItem({
-					id: "global:secrets",
-					label: "Global secrets (password, API token)",
-					labelKey: "settings.backup.entryGlobalSecrets",
-					kind: "secrets",
-					restorable: true,
-					note: null
-				}, () => {
-					writeFileAtomic(sources.globalSecretsPath, globalSecrets, { mode: 384 });
-				}, ["secrets"]);
+				if (globalSecrets !== null) {
+					addItem({
+						id: "global:secrets",
+						label: "Global secrets (password, API token)",
+						labelKey: "settings.backup.entryGlobalSecrets",
+						kind: "secrets",
+						restorable: true,
+						note: null
+					}, () => {
+						writeFileAtomic(sources.globalSecretsPath, globalSecrets, { mode: 384 });
+					}, ["secrets"]);
+					for (const part of secretParts("global", presentSecretKeys(parseSecrets(globalSecrets)))) addItem({
+						id: `global:secrets:${part.key}`,
+						label: `Global secrets: ${SECRET_LABELS[part.key]?.en ?? part.key}`,
+						labelKey: "settings.backup.restoreItemLabel",
+						labelParams: {
+							workspace: "global",
+							item: part.key
+						},
+						kind: "secrets",
+						restorable: true,
+						note: null
+					}, () => {
+						mergeIntoFile(sources.globalSecretsPath, globalSecrets, part.fields);
+					});
+				}
 				const tlsInArchive = path.join(staging, "global", "tls");
 				if (fs.existsSync(tlsInArchive)) {
 					const files = fs.readdirSync(tlsInArchive).filter((file) => fs.statSync(path.join(tlsInArchive, file)).isFile());
@@ -14214,21 +14568,38 @@ var init_backups = __esmMin((() => {
 							});
 						}
 					}
-					if (secrets !== null) addItem({
-						id: `workspace:${id}:secrets`,
-						label: `${workspace.label}: Secrets`,
-						labelKey: "settings.backup.restoreItemLabel",
-						labelParams: {
-							workspace: workspace.label,
-							item: "secrets"
-						},
-						kind: "secrets",
-						workspaceId: id,
-						restorable: true,
-						note: null
-					}, () => {
-						writeFileAtomic(workspace.secretsPath, secrets, { mode: 384 });
-					});
+					if (secrets !== null) {
+						addItem({
+							id: `workspace:${id}:secrets`,
+							label: `${workspace.label}: Secrets`,
+							labelKey: "settings.backup.restoreItemLabel",
+							labelParams: {
+								workspace: workspace.label,
+								item: "secrets"
+							},
+							kind: "secrets",
+							workspaceId: id,
+							restorable: true,
+							note: null
+						}, () => {
+							writeFileAtomic(workspace.secretsPath, secrets, { mode: 384 });
+						});
+						for (const part of secretParts("workspace", presentSecretKeys(parseSecrets(secrets)))) addItem({
+							id: `workspace:${id}:secrets:${part.key}`,
+							label: `${workspace.label}: ${SECRET_LABELS[part.key]?.en ?? part.key}`,
+							labelKey: "settings.backup.restoreItemLabel",
+							labelParams: {
+								workspace: workspace.label,
+								item: part.key
+							},
+							kind: "secrets",
+							workspaceId: id,
+							restorable: true,
+							note: null
+						}, () => {
+							mergeIntoFile(workspace.secretsPath, secrets, part.fields);
+						});
+					}
 				}
 				const instanceTargets = [];
 				for (const workspace of sources.workspaces) for (const declared of this.declaredData(workspace.servers, sources.includePaths)) {
@@ -14381,7 +14752,7 @@ var init_backups = __esmMin((() => {
 					labelKey: "settings.backup.entryGlobalSecrets",
 					kind: "secrets",
 					...missing(sources.globalSecretsPath, "settings.backup.noteMissing"),
-					items: []
+					items: this.secretItems("global", "global:secrets", sources.globalSecretsPath)
 				},
 				{
 					id: "global:tls",
@@ -14402,6 +14773,27 @@ var init_backups = __esmMin((() => {
 			});
 			return entries;
 		}
+		/**
+		* One leaf per secret the file actually holds, so a restore can bring back the
+		* password without the API token, or the Telegram token without the DDNS credentials.
+		*
+		* The set comes from the file's own top-level keys rather than a list here, so a
+		* secret added later appears on its own — the failure mode of a second list is a
+		* secret that can be captured but never restored individually.
+		*/
+		secretItems(scope, entryId, path) {
+			const present = presentSecretKeys(parseSecrets(readText(path) ?? ""));
+			if (present.length === 0) return [];
+			return secretParts(scope, present).map((part) => ({
+				id: `${entryId}:${part.key}`,
+				label: SECRET_LABELS[part.key]?.en ?? part.key,
+				...SECRET_LABELS[part.key] === void 0 ? {} : { labelKey: SECRET_LABELS[part.key].key },
+				kind: "secrets",
+				secret: part.key,
+				included: true,
+				note: null
+			}));
+		}
 		workspaceItems(workspace, includePaths) {
 			const id = workspace.id;
 			const note = (path) => {
@@ -14435,7 +14827,8 @@ var init_backups = __esmMin((() => {
 					kind: "secrets",
 					included: true,
 					...note(workspace.secretsPath)
-				}
+				},
+				...this.secretItems("workspace", `workspace:${id}:secrets`, workspace.secretsPath)
 			];
 			for (const declared of this.declaredData(workspace.servers, includePaths)) items.push({
 				id: `workspace:${id}:data:${declared.path}`,