fix(inference): recover interrupted managed vLLM install

src/lib/inference/vllm-serving-port.test.ts

@@ -20,6 +20,7 @@ const mocks = vi.hoisted(() => ({
   measureDirectorySizeBytes: vi.fn(),
   probeDockerStorage: vi.fn(),
   probeHostStorage: vi.fn(),
+  recoverHostLocalManagedVllmEndpoint: vi.fn(),
   runCapture: vi.fn(),
   tryInstallManagedClusterManagedVllm: vi.fn(async () => ({ kind: "not-selected" as const })),
 }));
@@ -59,6 +60,7 @@ vi.mock("./serving/vllm-managed-support", async (importOriginal) => {
   return {
     ...actual,
     ensureDualStationVllmApiKey: mocks.ensureDualStationVllmApiKey,
+    recoverHostLocalManagedVllmEndpoint: mocks.recoverHostLocalManagedVllmEndpoint,
     tryInstallManagedClusterManagedVllm: mocks.tryInstallManagedClusterManagedVllm,
   };
 });
@@ -67,9 +69,11 @@ import { detectVllmProfile, installVllm } from "./vllm";
 import {
   applyVllmInstallProbeDefaults,
   createVllmInstallSpies,
+  MANAGED_CONTAINER_ID,
   mockSuccessfulVllmInstall,
   resetVllmInstallEnv,
   type VllmInstallSpies,
+  vllmContainerRow,
 } from "./vllm-install.test-support";
 
 describe("managed vLLM serving-port guard (#8685)", () => {
@@ -81,6 +85,7 @@ describe("managed vLLM serving-port guard (#8685)", () => {
     vi.clearAllMocks();
     applyVllmInstallProbeDefaults(mocks);
     mocks.getGpuIndicesByName.mockReturnValue([0]);
+    mocks.recoverHostLocalManagedVllmEndpoint.mockReturnValue(null);
     mocks.tryInstallManagedClusterManagedVllm.mockResolvedValue({ kind: "not-selected" });
     ({ errSpy, restore: restoreSpies } = createVllmInstallSpies());
     resetVllmInstallEnv();
@@ -118,6 +123,57 @@ describe("managed vLLM serving-port guard (#8685)", () => {
     expect(reported).not.toContain("exit 125");
   });
 
+  it("replaces a validated interrupted managed container that holds the serving port", async () => {
+    const profile = detectVllmProfile({ platform: "spark", type: "nvidia" })!;
+    const managed = vllmContainerRow(profile.containerName);
+    mockSuccessfulVllmInstall(mocks, profile.containerName, [() => managed, () => managed]);
+    mocks.recoverHostLocalManagedVllmEndpoint.mockReturnValue({
+      baseUrl: "http://127.0.0.1:8000",
+      apiKey: "b".repeat(64),
+    });
+    const checkServingPort = vi.fn(async () => ({ ok: false, reason: "port 8000 is held" }));
+
+    const result = await installVllm(profile, {
+      hasImage: true,
+      nonInteractive: true,
+      promptFn: vi.fn<(q: string) => Promise<string>>(),
+      checkServingPort,
+    });
+
+    expect(result).toEqual({ ok: true });
+    expect(checkServingPort).toHaveBeenCalledWith(8000);
+    expect(mocks.recoverHostLocalManagedVllmEndpoint).toHaveBeenCalledOnce();
+    expect(mocks.dockerForceRm).toHaveBeenCalledWith(
+      MANAGED_CONTAINER_ID,
+      expect.objectContaining({ ignoreError: true, suppressOutput: true }),
+    );
+    expect(mocks.dockerRunDetached).toHaveBeenCalled();
+    expect(errSpy.mock.calls.flat().join("\n")).not.toContain("another process");
+  });
+
+  it("fails closed when a managed container holding the serving port cannot be recovered", async () => {
+    const profile = detectVllmProfile({ platform: "spark", type: "nvidia" })!;
+    mockSuccessfulVllmInstall(mocks, profile.containerName);
+    mocks.recoverHostLocalManagedVllmEndpoint.mockImplementation(() => {
+      throw new Error("Managed host-local vLLM runtime does not match its ownership receipt.");
+    });
+
+    const result = await installVllm(profile, {
+      hasImage: true,
+      nonInteractive: true,
+      promptFn: vi.fn<(q: string) => Promise<string>>(),
+      checkServingPort: async () => ({ ok: false, reason: "port 8000 is held" }),
+    });
+
+    expect(result).toEqual({ ok: false });
+    expect(mocks.dockerPullWithProgressWatchdog).not.toHaveBeenCalled();
+    expect(mocks.dockerForceRm).not.toHaveBeenCalled();
+    expect(mocks.dockerRunDetached).not.toHaveBeenCalled();
+    expect(errSpy.mock.calls.flat().join("\n")).toContain(
+      "managed host-local vLLM recovery could not verify the container",
+    );
+  });
+
   it("rejects the port before the storage decisions or the cache directory", async () => {
     const profile = detectVllmProfile({ platform: "spark", type: "nvidia" })!;
     mockSuccessfulVllmInstall(mocks, profile.containerName);

src/lib/inference/vllm.ts

@@ -1737,8 +1737,24 @@ async function runVllmInstall(
   // rendezvous contract and this single-node path never binds it.
   const servingPort = await opts.checkServingPort?.(VLLM_PORT);
   if (servingPort && !servingPort.ok) {
-    printServingPortConflict(servingPort);
-    return { ok: false };
+    // An interrupted host-local install can leave its authenticated managed
+    // container holding the fixed port. Admit that state only after the
+    // lifecycle recovery check validates the exact receipt, bindings, and
+    // credential fingerprint. The replacement guard below then removes the
+    // inspected container ID immediately before the new launch.
+    try {
+      if (recoverHostLocalManagedVllmEndpoint()) {
+        // Continue through the ordinary managed-container replacement path.
+      } else {
+        printServingPortConflict(servingPort);
+        return { ok: false };
+      }
+    } catch (error) {
+      console.error(
+        `  vLLM install failed: managed host-local vLLM recovery could not verify the container: ${(error as Error).message}`,
+      );
+      return { ok: false };
+    }
   }
 
   let hostLocalApiKey: string | null = null;