From e13831ca209133b03480fd7b08d9d7280b73ebb1 Mon Sep 17 00:00:00 2001
From: Admin <1+admin@noreply.git.dcntrlized.org>
Date: Sun, 16 Aug 2026 16:05:06 +0100
Subject: [PATCH] fix(infra): infraRunning must match the canonical container
 name

auth-debug carries the same org.dcntrlized.service=dcntrlized-auth role label,
so the shared-auth check considered it running and skipped starting the real
hub. Match the exact container name (dcntrlized-auth) on the running
candidate; dev lookalikes sharing the role label no longer satisfy the check.
---
 src/lib/containers/infra.go | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/lib/containers/infra.go b/src/lib/containers/infra.go
index 17cb9f8..efa0b51 100644
--- a/src/lib/containers/infra.go
+++ b/src/lib/containers/infra.go
@@ -18,6 +18,7 @@ package containers
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
@@ -117,8 +118,16 @@ func infraRunning(ctx context.Context, dc *docker.DockerClient, serviceName stri
 		return false
 	}
 	for _, c := range containers {
-		if c.State == "running" || c.State == "restarting" {
-			return true
+		if c.State != "running" && c.State != "restarting" {
+			continue
+		}
+		// Only the canonical container (e.g. "dcntrlized-auth") counts as the
+		// shared infrastructure being up. Dev lookalikes (auth-debug) share the
+		// role label but must never satisfy the check.
+		for _, n := range c.Names {
+			if strings.TrimPrefix(n, "/") == serviceName {
+				return true
+			}
 		}
 	}
 	return false