openship 0.2.1 → 0.2.2

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 
 // src/lib/output.ts
 import chalk from "chalk";
@@ -905,10 +905,17 @@ var PLANS = {
     description: "Get started for free",
     price: { monthly: 0, annual: 0 },
     stripePriceId: { monthly: null, annual: null },
-    // Paid tiers below are `null` (price + credits) until Openship Cloud pricing
-    // is finalized — the UI renders "coming soon". Self-hosted is free and never
-    // surfaces any of these numbers.
-    monthlyCredits: null,
+    // Public dollar `price` on the paid tiers is `null` — the UI renders
+    // "coming soon" and the Subscribe CTA stays disabled. Cloud pricing is
+    // intentionally NOT published yet. `monthlyCredits` (the CPU-time/credit
+    // quota pushed to Oblien) is real so tiers still enforce — it's an internal
+    // number, never shown as a price. NOTE (tune before launch): these credit
+    // numbers are placeholders sized to Oblien's 10,000,000-credit ceiling; the
+    // true credit-per-$/per-cpu-minute rate is Oblien-configured. 1 openship
+    // credit = 1 Oblien credit = 1000 milli (the wrapper divides by 1000 at the
+    // Oblien boundary). Self-hosted is free and surfaces none of these numbers.
+    monthlyCredits: 5e5,
+    // 500 credits — free-tier allowance
     oblienLimits: {
       max_workspaces: 1,
       max_vcpus: 2,
@@ -927,12 +934,13 @@ var PLANS = {
     name: "Pro",
     description: "For solo builders shipping production workloads",
     price: { monthly: null, annual: null },
-    // coming soon
+    // coming soon — pricing not published
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_PRO_MONTHLY ?? "price_pro_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_PRO_ANNUAL ?? "price_pro_annual_placeholder"
     },
-    monthlyCredits: null,
+    monthlyCredits: 1e7,
+    // 10,000 credits/mo (placeholder — tune before launch)
     oblienLimits: {
       max_workspaces: 10,
       max_vcpus: 16,
@@ -951,12 +959,13 @@ var PLANS = {
     name: "Team",
     description: "For teams collaborating on shared infra",
     price: { monthly: null, annual: null },
-    // coming soon
+    // coming soon — pricing not published
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_TEAM_MONTHLY ?? "price_team_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_TEAM_ANNUAL ?? "price_team_annual_placeholder"
     },
-    monthlyCredits: null,
+    monthlyCredits: 6e7,
+    // 60,000 credits/mo (placeholder — tune before launch)
     oblienLimits: {
       max_workspaces: 50,
       max_vcpus: 64,
@@ -2371,9 +2380,9 @@ import chalk5 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { createWriteStream as createWriteStream2, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname2, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/dashboard.ts
@@ -2480,16 +2489,29 @@ function assetName(tag) {
 async function ensureDashboard(opts = {}) {
   const override = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
   if (override) {
-    const cwd2 = join3(override, "apps", "dashboard");
-    const entry2 = join3(cwd2, "server.js");
-    if (!existsSync2(entry2)) {
+    const cwd = join3(override, "apps", "dashboard");
+    const entry = join3(cwd, "server.js");
+    if (!existsSync2(entry)) {
       throw new Error(
-        `OPENSHIP_DASHBOARD_DIR=${override} but ${entry2} is missing \u2014 build the dashboard standalone first (see docs).`
+        `OPENSHIP_DASHBOARD_DIR=${override} but ${entry} is missing \u2014 build the dashboard standalone first (see docs).`
       );
     }
-    return { tag: "local", entry: entry2, cwd: cwd2 };
+    return { tag: "local", entry, cwd };
+  }
+  const requested = opts.tag ?? await resolveLatestTag();
+  try {
+    return await fetchBundle(requested, opts.onProgress);
+  } catch (err2) {
+    if (opts.tag && /\b404\b/.test(err2?.message ?? "")) {
+      const latest = await resolveLatestTag();
+      if (latest && latest !== requested) {
+        return await fetchBundle(latest, opts.onProgress);
+      }
+    }
+    throw err2;
   }
-  const tag = opts.tag ?? await resolveLatestTag();
+}
+async function fetchBundle(tag, onProgress) {
   const dir = join3(DASHBOARD_CACHE, tag);
   const cwd = join3(dir, "apps", "dashboard");
   const entry = join3(cwd, "server.js");
@@ -2501,7 +2523,7 @@ async function ensureDashboard(opts = {}) {
   mkdirSync3(dir, { recursive: true });
   const name = assetName(tag);
   const tarball = join3(dir, name);
-  const { sha256 } = await downloadToFile(assetUrl(tag, name), tarball, opts.onProgress);
+  const { sha256 } = await downloadToFile(assetUrl(tag, name), tarball, onProgress);
   const expected = await expectedSha256(tag, name);
   if (!expected) {
     throw new Error(
@@ -2527,7 +2549,7 @@ async function ensureDashboard(opts = {}) {
 
 // src/lib/service.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2, readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4, resolve } from "path";
 var HOME = homedir3();
@@ -2563,6 +2585,19 @@ function run(cmd, args) {
   const r = spawnSync2(cmd, args, { encoding: "utf8" });
   return { ok: r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
 }
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function launchdPid() {
+  const r = run("launchctl", ["list", MAC_LABEL]);
+  if (!r.ok) return null;
+  const m = r.out.match(/"PID"\s*=\s*(\d+)/);
+  return m ? Number(m[1]) : null;
+}
+function launchdLastExit() {
+  const m = run("launchctl", ["list", MAC_LABEL]).out.match(/"LastExitStatus"\s*=\s*(-?\d+)/);
+  return m ? Number(m[1]) : null;
+}
 function isRoot() {
   return typeof process.getuid === "function" && process.getuid() === 0;
 }
@@ -2683,7 +2718,16 @@ function restart() {
     if (!existsSync3(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
     const uid = String(process.getuid?.() ?? "");
     const r = run("launchctl", ["kickstart", "-k", `gui/${uid}/${MAC_LABEL}`]);
-    return { restarted: r.ok, detail: r.ok ? `restarted ${MAC_LABEL}` : r.out };
+    if (!r.ok) return { restarted: false, detail: r.out || "launchctl kickstart failed" };
+    for (let i = 0; i < 6; i++) {
+      sleepSync(500);
+      if (launchdPid() != null) return { restarted: true, detail: `restarted ${MAC_LABEL}` };
+    }
+    const exit = launchdLastExit();
+    return {
+      restarted: false,
+      detail: `${MAC_LABEL} was killed but didn't stay up${exit != null ? ` (last exit ${exit})` : ""} \u2014 check logs in ${LOG_DIR}`
+    };
   }
   if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
@@ -2699,27 +2743,163 @@ function restart() {
   }
   return { restarted: false, detail: "no supported service manager" };
 }
+function serviceStatus() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    return { kind, installed: existsSync3(MAC_PLIST), running: launchdPid() != null };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    return {
+      kind,
+      installed: existsSync3(unitPath),
+      running: run("systemctl", [...sysArgs, "is-active", SYSTEMD_NAME]).out.trim() === "active"
+    };
+  }
+  if (kind === "schtasks") {
+    const q = run("schtasks", ["/Query", "/TN", WIN_TASK]);
+    return { kind, installed: q.ok, running: q.ok && /Running/i.test(q.out) };
+  }
+  return { kind, installed: false, running: false };
+}
+function sweepOrphanPorts() {
+  if (process.platform === "win32") return;
+  let ports = [];
+  try {
+    const raw = readFileSync2(join4(HOME, ".openship", "ports.json"), "utf8");
+    const p = JSON.parse(raw);
+    ports = [p.api, p.dashboard].filter((n) => typeof n === "number");
+  } catch {
+    return;
+  }
+  const self = process.pid;
+  for (const port of ports) {
+    const q = run("lsof", ["-ti", `tcp:${port}`]);
+    if (!q.ok) continue;
+    for (const token of q.out.split(/\s+/).filter(Boolean)) {
+      const pid = Number(token);
+      if (Number.isInteger(pid) && pid > 1 && pid !== self) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+      }
+    }
+  }
+}
 function stop() {
   const kind = detectKind();
+  let result;
   if (kind === "launchd") {
     run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
     if (existsSync3(MAC_PLIST)) rmSync2(MAC_PLIST, { force: true });
-    return { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
-  }
-  if (kind === "systemd-user" || kind === "systemd-system") {
+    result = { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
+  } else if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
     run("systemctl", [...sysArgs, "disable", "--now", SYSTEMD_NAME]);
     const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
     if (existsSync3(unitPath)) rmSync2(unitPath, { force: true });
     run("systemctl", [...sysArgs, "daemon-reload"]);
-    return { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
-  }
-  if (kind === "schtasks") {
+    result = { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
+  } else if (kind === "schtasks") {
     run("schtasks", ["/End", "/TN", WIN_TASK]);
     run("schtasks", ["/Delete", "/TN", WIN_TASK, "/F"]);
-    return { kind, detail: `Scheduled Task ${WIN_TASK} stopped + removed` };
+    result = { kind, detail: `Scheduled Task ${WIN_TASK} stopped + removed` };
+  } else {
+    result = { kind, detail: "no supported service manager \u2014 nothing to stop" };
   }
-  return { kind, detail: "no supported service manager \u2014 nothing to stop" };
+  sweepOrphanPorts();
+  return result;
+}
+
+// src/lib/ports.ts
+import { createServer } from "net";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+var OS_DIR2 = join5(homedir4(), ".openship");
+var PORTS_FILE = join5(OS_DIR2, "ports.json");
+var INSTANCE_FILE = join5(OS_DIR2, "instance.json");
+function saveInstanceUrl(publicUrl) {
+  try {
+    if (!existsSync4(OS_DIR2)) mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+    writeFileSync4(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
+  } catch {
+  }
+}
+function readInstanceUrl() {
+  try {
+    return JSON.parse(readFileSync3(INSTANCE_FILE, "utf8")).publicUrl ?? null;
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_API = 4e3;
+var DEFAULT_DASHBOARD = 3001;
+function isPortFree(port) {
+  return new Promise((resolve2) => {
+    const srv = createServer();
+    srv.once("error", () => resolve2(false));
+    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(true)));
+  });
+}
+async function waitPortFree(port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e3;
+  const intervalMs = opts.intervalMs ?? 250;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (await isPortFree(port)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+function getFreePort() {
+  return new Promise((resolve2, reject2) => {
+    const srv = createServer();
+    srv.once("error", reject2);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => port ? resolve2(port) : reject2(new Error("no free port")));
+    });
+  });
+}
+function loadStoredPorts() {
+  try {
+    return JSON.parse(readFileSync3(PORTS_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveStoredPorts(api, dashboard) {
+  try {
+    if (!existsSync4(OS_DIR2)) mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+    writeFileSync4(PORTS_FILE, JSON.stringify({ api, dashboard }));
+  } catch {
+  }
+}
+async function resolvePorts(prefs) {
+  const stored = loadStoredPorts();
+  const apiPref = prefs.api ?? stored.api ?? DEFAULT_API;
+  const dashPref = prefs.dashboard ?? stored.dashboard ?? DEFAULT_DASHBOARD;
+  const apiRemembered = prefs.api === void 0 && stored.api === apiPref;
+  const dashRemembered = prefs.dashboard === void 0 && stored.dashboard === dashPref;
+  let api;
+  if (await isPortFree(apiPref)) api = apiPref;
+  else if (apiRemembered && await waitPortFree(apiPref)) api = apiPref;
+  else api = await getFreePort();
+  let dashboard;
+  if (dashPref !== api && await isPortFree(dashPref)) dashboard = dashPref;
+  else if (dashPref !== api && dashRemembered && await waitPortFree(dashPref)) dashboard = dashPref;
+  else dashboard = await getFreePort();
+  if (dashboard === api) dashboard = await getFreePort();
+  saveStoredPorts(api, dashboard);
+  return {
+    api,
+    dashboard,
+    switched: { api: api !== apiPref, dashboard: dashboard !== dashPref }
+  };
 }
 
 // src/commands/up.ts
@@ -2744,22 +2924,22 @@ function normalizePublicUrl(raw) {
   return url;
 }
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
-var SERVER_DIR = join5(DIST_DIR, "server");
-var OS_DIR2 = join5(homedir4(), ".openship");
+var SERVER_DIR = join6(DIST_DIR, "server");
+var OS_DIR3 = join6(homedir5(), ".openship");
 function ensureAuthSecret() {
-  const path2 = join5(OS_DIR2, "auth-secret");
-  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
-  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+  const path2 = join6(OS_DIR3, "auth-secret");
+  if (existsSync5(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync6(OS_DIR3, { recursive: true, mode: 448 });
   const secret = randomBytes(32).toString("hex");
-  writeFileSync4(path2, secret, { mode: 384 });
+  writeFileSync5(path2, secret, { mode: 384 });
   return secret;
 }
 function ensureInternalToken() {
-  const path2 = join5(OS_DIR2, "internal-token");
-  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
-  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+  const path2 = join6(OS_DIR3, "internal-token");
+  if (existsSync5(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync6(OS_DIR3, { recursive: true, mode: 448 });
   const token = randomBytes(32).toString("hex");
-  writeFileSync4(path2, token, { mode: 384 });
+  writeFileSync5(path2, token, { mode: 384 });
   return token;
 }
 var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
@@ -2773,16 +2953,45 @@ var upCommand = new Command4("up").description("Start Openship as a persistent s
   "Managed edge: install OpenResty + a free Let's Encrypt cert on this box and route --public-url's domain to the dashboard (no reverse proxy needed)"
 ).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").action(async (opts) => {
   if (opts.foreground) return runForeground(opts);
-  startService(opts);
+  await startService(opts);
 });
-function startService(opts, runOpts = {}) {
+async function startService(opts, runOpts = {}) {
   const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
-  const port = String(opts.port || "4000");
-  const dashPort = String(opts.dashboardPort || "3001");
+  if (opts.dryRun) {
+    const p = preview({
+      port: opts.port,
+      dataDir: opts.dataDir,
+      dashboardPort: opts.dashboardPort,
+      ui: opts.ui,
+      uiVersion: opts.uiVersion,
+      publicUrl,
+      trustProxy: opts.trustProxy || opts.managedEdge,
+      managedEdge: opts.managedEdge,
+      acmeEmail: opts.acmeEmail
+    });
+    console.log(
+      chalk5.dim(`
+  service manager: ${p.kind}
+  path: ${p.path}
+
+`) + p.content + "\n"
+    );
+    return {
+      port: String(opts.port || "4000"),
+      dashPort: String(opts.dashboardPort || "3001"),
+      publicUrl
+    };
+  }
+  const resolved = await resolvePorts({
+    api: opts.port ? Number(opts.port) : void 0,
+    dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+  });
+  const port = String(resolved.api);
+  const dashPort = String(resolved.dashboard);
   const flags = {
-    port: opts.port,
+    port,
     dataDir: opts.dataDir,
-    dashboardPort: opts.dashboardPort,
+    dashboardPort: dashPort,
     ui: opts.ui,
     uiVersion: opts.uiVersion,
     publicUrl,
@@ -2791,20 +3000,15 @@ function startService(opts, runOpts = {}) {
     managedEdge: opts.managedEdge,
     acmeEmail: opts.acmeEmail
   };
-  if (opts.dryRun) {
-    const p = preview(flags);
-    console.log(
-      chalk5.dim(`
-  service manager: ${p.kind}
-  path: ${p.path}
-
-`) + p.content + "\n"
-    );
-    return { port, dashPort, publicUrl };
-  }
   try {
     const res = installAndStart(flags);
     if (!runOpts.quiet) {
+      if (resolved.switched.api || resolved.switched.dashboard) {
+        console.log(
+          chalk5.yellow(`
+  A preferred port was busy \u2014 using API ${port}, dashboard ${dashPort}.`)
+        );
+      }
       const dashboardLine = publicUrl ? chalk5.dim(`  Dashboard: ${publicUrl}  (login required)
 `) : chalk5.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
 `);
@@ -2826,19 +3030,27 @@ function startService(opts, runOpts = {}) {
   }
 }
 async function runForeground(opts) {
-  const serverEntry = join5(SERVER_DIR, "index.js");
-  if (!existsSync4(serverEntry)) {
+  const serverEntry = join6(SERVER_DIR, "index.js");
+  if (!existsSync5(serverEntry)) {
     console.error(
       chalk5.red("\n  Bundled server not found in this install.") + chalk5.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
     );
     process.exit(1);
   }
-  const port = String(opts.port || "4000");
-  const dashPort = String(opts.dashboardPort || "3001");
+  const resolved = await resolvePorts({
+    api: opts.port ? Number(opts.port) : void 0,
+    dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+  });
+  const port = String(resolved.api);
+  const dashPort = String(resolved.dashboard);
   const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
-  const dataDir = opts.dataDir || join5(OS_DIR2, "data");
-  mkdirSync5(dataDir, { recursive: true });
+  const dataDir = opts.dataDir || join6(OS_DIR3, "data");
+  mkdirSync6(dataDir, { recursive: true });
+  const logDir = join6(OS_DIR3, "logs");
+  mkdirSync6(logDir, { recursive: true });
+  const instanceLogPath = join6(logDir, "instance.log");
+  const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
     ...process.env,
     PORT: port,
@@ -2848,13 +3060,15 @@ async function runForeground(opts) {
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
     PGLITE_DATA_DIR: dataDir,
-    OPENSHIP_MIGRATIONS_DIR: join5(SERVER_DIR, "migrations"),
-    OPENSHIP_PGLITE_ASSETS_DIR: join5(SERVER_DIR, "pglite"),
+    OPENSHIP_MIGRATIONS_DIR: join6(SERVER_DIR, "migrations"),
+    OPENSHIP_PGLITE_ASSETS_DIR: join6(SERVER_DIR, "pglite"),
     BETTER_AUTH_SECRET: ensureAuthSecret()
   };
   env.OPENSHIP_REQUIRE_AUTH = "true";
   env.INTERNAL_TOKEN = ensureInternalToken();
   env.OPENSHIP_API_HOST = "127.0.0.1";
+  env.OPENSHIP_DASHBOARD_PORT = dashPort;
+  env.OPENSHIP_INSTANCE_LOG = instanceLogPath;
   delete env.OPENSHIP_ALLOW_ZERO_AUTH;
   if (publicUrl) {
     env.OPENSHIP_PUBLIC_URL = publicUrl;
@@ -2868,7 +3082,13 @@ async function runForeground(opts) {
   delete env.DATABASE_URL;
   delete env.POSTGRES_URL;
   const spinner3 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
-  const child = spawn(process.execPath, [serverEntry], { env, stdio: ["ignore", "pipe", "pipe"] });
+  const child = spawn(process.execPath, [serverEntry], {
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: process.platform !== "win32"
+  });
+  child.stdout.on("data", (d) => instanceLog.write(d));
+  child.stderr.on("data", (d) => instanceLog.write(d));
   let buffered = "";
   const buffer = (d) => {
     buffered += d.toString();
@@ -2903,26 +3123,33 @@ async function runForeground(opts) {
   }
   spinner3.succeed(`Openship API running at http://localhost:${port}`);
   const children = [child];
-  const stopAll = () => {
-    for (const c of children) {
-      try {
-        c.kill("SIGTERM");
-      } catch {
-      }
-      setTimeout(() => {
-        try {
-          c.kill("SIGKILL");
-        } catch {
-        }
-      }, 5e3).unref?.();
+  const killTree = (c, sig) => {
+    try {
+      if (c.pid && process.platform !== "win32") process.kill(-c.pid, sig);
+      else c.kill(sig);
+    } catch {
     }
   };
+  let stopping = false;
+  const stopAll = (exitCode = 0) => {
+    if (stopping) return;
+    stopping = true;
+    try {
+      instanceLog.end();
+    } catch {
+    }
+    for (const c of children) killTree(c, "SIGTERM");
+    setTimeout(() => {
+      for (const c of children) killTree(c, "SIGKILL");
+      process.exit(exitCode);
+    }, 1500);
+  };
   let dashboardUrl = null;
   if (opts.ui !== false) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: opts.uiVersion || `v${"0.2.1"}`,
+        tag: opts.uiVersion || `v${"0.2.2"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2932,6 +3159,7 @@ async function runForeground(opts) {
       uiSpinner.text = "Starting the dashboard\u2026";
       const dash = spawn(process.execPath, [bundle.entry], {
         cwd: bundle.cwd,
+        detached: process.platform !== "win32",
         env: {
           ...process.env,
           NODE_ENV: "production",
@@ -2946,13 +3174,24 @@ async function runForeground(opts) {
           // the browser never needs to know where the API lives. Set in every
           // mode; loopback because the dashboard runs on the same box.
           INTERNAL_API_URL: `http://127.0.0.1:${port}`,
-          // Public URL feeds the SSR proxy-origin resolver; local mode keeps
-          // the window.__OPENSHIP_API_ORIGIN__ fallback for direct API calls.
-          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : { OPENSHIP_LOCAL_API_URL: `http://127.0.0.1:${port}` }
+          // ALWAYS tell the dashboard the real loopback API origin. The API port
+          // is dynamic, so a browser opened on THIS box must learn it via
+          // window.__OPENSHIP_API_ORIGIN__ (layout.tsx) — otherwise it falls back
+          // to the static default :4000 and every call 404s. Use `localhost` (NOT
+          // 127.0.0.1) to MATCH the host the dashboard is opened on — a host-only
+          // SameSite session cookie set on 127.0.0.1 is never sent to localhost
+          // (they're different sites to a browser), which is the login-reload loop.
+          // Older dashboards use this origin verbatim; newer ones align it anyway.
+          // `localhost` still reaches the 127.0.0.1-bound API. In proxy mode this
+          // is just a fallback (sameOriginProxyOrigin wins for remote browsers).
+          OPENSHIP_LOCAL_API_URL: `http://localhost:${port}`,
+          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : {}
         },
         stdio: ["ignore", "pipe", "pipe"]
       });
       children.push(dash);
+      dash.stdout.on("data", (d) => instanceLog.write(d));
+      dash.stderr.on("data", (d) => instanceLog.write(d));
       let dashBuf = "";
       const onDash = (d) => {
         dashBuf += d.toString();
@@ -3009,12 +3248,9 @@ async function runForeground(opts) {
   child.stderr.off("data", buffer);
   child.stdout.on("data", (d) => process.stdout.write(d));
   child.stderr.on("data", (d) => process.stderr.write(d));
-  process.on("SIGINT", stopAll);
-  process.on("SIGTERM", stopAll);
-  child.on("exit", (code) => {
-    stopAll();
-    process.exit(code ?? 0);
-  });
+  process.on("SIGINT", () => stopAll(0));
+  process.on("SIGTERM", () => stopAll(0));
+  child.on("exit", (code) => stopAll(code ?? 0));
 }
 
 // src/commands/stop.ts
@@ -3035,15 +3271,15 @@ var stopCommand = new Command5("stop").description("Stop the Openship service (s
 
 // src/commands/init.ts
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output2 } from "process";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var initCommand = new Command6("init").description("Link the current directory to an Openship project (.openship/project.json)").option("--project <id>", "Project id to link (skips the picker)").option("--environment <name>", "Default deploy environment", "production").option("--dir <path>", "Directory to initialize", process.cwd()).option("--force", "Overwrite an existing project link").option("-y, --yes", "Non-interactive: fail instead of prompting").action(async (opts) => {
   const root = opts.dir || process.cwd();
-  const linkDir = join6(root, ".openship");
-  const linkPath = join6(linkDir, "project.json");
-  if (existsSync5(linkPath) && !opts.force) {
+  const linkDir = join7(root, ".openship");
+  const linkPath = join7(linkDir, "project.json");
+  if (existsSync6(linkPath) && !opts.force) {
     err(`Already linked (${linkPath}). Re-run with --force to overwrite.`);
     process.exit(1);
   }
@@ -3096,8 +3332,8 @@ var initCommand = new Command6("init").description("Link the current directory t
     context: getActiveContext(),
     defaults: { environment: opts.environment || "production" }
   };
-  mkdirSync6(linkDir, { recursive: true });
-  writeFileSync5(linkPath, JSON.stringify(link, null, 2) + "\n");
+  mkdirSync7(linkDir, { recursive: true });
+  writeFileSync6(linkPath, JSON.stringify(link, null, 2) + "\n");
   if (isJsonMode()) {
     printJson({ path: linkPath, link });
     return;
@@ -3161,39 +3397,53 @@ var contextCommand = new Command7("context").alias("ctx").description("Manage co
 // src/commands/status.ts
 import { Command as Command8 } from "commander";
 import chalk7 from "chalk";
-var statusCommand = new Command8("status").description("Show the active context's API health and deployment info").action(async () => {
+import { readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
+function readPorts() {
+  try {
+    return JSON.parse(readFileSync5(join8(homedir6(), ".openship", "ports.json"), "utf8"));
+  } catch {
+    return {};
+  }
+}
+var statusCommand = new Command8("status").description("Show the local Openship service (installed/running, ports) and the active context's API health").action(async () => {
   const context = getActiveContext();
   const apiUrl = getApiUrl2();
-  let health;
-  let envInfo;
+  const svc = serviceStatus();
+  const ports = readPorts();
+  let health = null;
+  let envInfo = null;
+  let reachable = true;
+  let unreachableMsg = "";
   try {
     health = await apiRequest("/health", { signal: AbortSignal.timeout(8e3) });
     envInfo = await apiRequest("/health/env", { signal: AbortSignal.timeout(8e3) });
   } catch (e) {
-    if (isJsonMode()) {
-      printJson({ context, apiUrl, reachable: false });
-    } else {
-      const msg = e instanceof ApiError ? e.message : e.message;
-      err(`
-  Cannot reach the API at ${apiUrl}: ${msg}
-`);
-    }
-    process.exit(1);
+    reachable = false;
+    unreachableMsg = e instanceof ApiError ? e.message : e.message;
   }
   if (isJsonMode()) {
-    printJson({ context, apiUrl, reachable: true, health, env: envInfo });
-    return;
+    printJson({ context, apiUrl, service: svc, ports, reachable, health, env: envInfo });
+    process.exit(reachable ? 0 : 1);
   }
   const row = (label, value) => `  ${chalk7.dim(label.padEnd(14))}${value ?? chalk7.dim("-")}
 `;
-  process.stdout.write(
-    chalk7.bold("\n  Openship status\n\n") + row("Context", context) + row("API", apiUrl) + row("Health", chalk7.green(health.status ?? "ok")) + row("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row("Deploy", envInfo.deployMode) + row("Auth", envInfo.authMode) + row("Team", envInfo.teamMode) + (envInfo.hostDomain ? row("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row("Machine", envInfo.machineName) : "") + "\n"
-  );
+  const serviceState = svc.running ? chalk7.green("running") : svc.installed ? chalk7.yellow("installed \xB7 stopped") : chalk7.dim("not installed");
+  let out = chalk7.bold("\n  Openship status\n\n") + row("Service", serviceState) + row("Manager", svc.kind === "unsupported" ? chalk7.dim("none") : svc.kind) + (ports.api ? row("API port", ports.api) : "") + (ports.dashboard ? row("Dashboard port", ports.dashboard) : "") + row("Context", context) + row("API", apiUrl);
+  if (reachable && health && envInfo) {
+    out += row("Health", chalk7.green(health.status ?? "ok")) + row("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row("Deploy", envInfo.deployMode) + row("Auth", envInfo.authMode) + row("Team", envInfo.teamMode) + (envInfo.hostDomain ? row("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row("Machine", envInfo.machineName) : "");
+  } else {
+    out += row("Health", chalk7.red("not reachable")) + chalk7.dim(`  ${unreachableMsg}
+`) + chalk7.dim(svc.running ? "  (service is up \u2014 it may still be starting)\n" : "  Start it with `openship up`.\n");
+  }
+  process.stdout.write(out + "\n");
+  if (!reachable) process.exit(1);
 });
 
 // src/commands/doctor.ts
 import { Command as Command9 } from "commander";
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { execFileSync } from "child_process";
 import chalk8 from "chalk";
 function bunVersion() {
@@ -3207,7 +3457,7 @@ function bunVersion() {
 }
 var doctorCommand = new Command9("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
   const checks = [];
-  const hasConfig = existsSync6(CONFIG_PATH);
+  const hasConfig = existsSync7(CONFIG_PATH);
   checks.push({
     name: "config",
     status: hasConfig ? "pass" : "warn",
@@ -3260,15 +3510,15 @@ import { execFileSync as execFileSync3 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync3, existsSync as existsSync7 } from "fs";
-import { join as join7, dirname as dirname3, parse } from "path";
-var LINK_REL = join7(".openship", "project.json");
+import { readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
+import { join as join9, dirname as dirname3, parse } from "path";
+var LINK_REL = join9(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
   let dir = from;
   const root = parse(dir).root;
   for (; ; ) {
-    const candidate = join7(dir, LINK_REL);
-    if (existsSync7(candidate)) return candidate;
+    const candidate = join9(dir, LINK_REL);
+    if (existsSync8(candidate)) return candidate;
     if (dir === root) return null;
     dir = dirname3(dir);
   }
@@ -3277,7 +3527,7 @@ function readProjectLink(from) {
   const path2 = findProjectLinkPath(from);
   if (!path2) return null;
   try {
-    return JSON.parse(readFileSync3(path2, "utf8"));
+    return JSON.parse(readFileSync6(path2, "utf8"));
   } catch {
     return null;
   }
@@ -3285,21 +3535,21 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { readFileSync as readFileSync4, existsSync as existsSync8, rmSync as rmSync3 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync9, rmSync as rmSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join8, basename } from "path";
+import { join as join10, basename } from "path";
 function detectPackageManager(dir) {
-  if (existsSync8(join8(dir, "bun.lockb")) || existsSync8(join8(dir, "bun.lock"))) return "bun";
-  if (existsSync8(join8(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join8(dir, "yarn.lock"))) return "yarn";
-  if (existsSync8(join8(dir, "package.json"))) return "npm";
+  if (existsSync9(join10(dir, "bun.lockb")) || existsSync9(join10(dir, "bun.lock"))) return "bun";
+  if (existsSync9(join10(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync9(join10(dir, "yarn.lock"))) return "yarn";
+  if (existsSync9(join10(dir, "package.json"))) return "npm";
   return void 0;
 }
 function detectStack(dir) {
-  if (existsSync8(join8(dir, "go.mod"))) return "go";
-  if (existsSync8(join8(dir, "Cargo.toml"))) return "rust";
-  if (existsSync8(join8(dir, "requirements.txt")) || existsSync8(join8(dir, "pyproject.toml"))) return "python";
-  if (existsSync8(join8(dir, "package.json"))) return "node";
+  if (existsSync9(join10(dir, "go.mod"))) return "go";
+  if (existsSync9(join10(dir, "Cargo.toml"))) return "rust";
+  if (existsSync9(join10(dir, "requirements.txt")) || existsSync9(join10(dir, "pyproject.toml"))) return "python";
+  if (existsSync9(join10(dir, "package.json"))) return "node";
   return void 0;
 }
 async function deployFolder(opts) {
@@ -3316,7 +3566,7 @@ async function deployFolder(opts) {
     throw new Error(session.error || "Failed to open upload session");
   }
   step("Packaging folder");
-  const tarball = join8(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
+  const tarball = join10(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
   execFileSync2(
     "tar",
     [
@@ -3335,7 +3585,7 @@ async function deployFolder(opts) {
   );
   step("Uploading source");
   try {
-    const body = readFileSync4(tarball);
+    const body = readFileSync7(tarball);
     const up = session.upload;
     const method = up.method || "POST";
     const res = /^https?:\/\//i.test(up.url) ? await fetch(up.url, { method, headers: up.headers, body }) : await apiRaw(`/${up.url.replace(/^\/+/, "")}`, { method, headers: up.headers, body });
@@ -5091,6 +5341,50 @@ server.command("check <serverId>").description("Run component health checks agai
     else err(`  Missing required components: ${res.missing.join(", ") || "none"}`);
   })
 );
+server.command("update <serverId>").description("Check for and apply native-module migrations (OpenResty, \u2026)").option("-c, --component <name...>", "Limit to specific modules").option("--check", "Only report drift; don't apply").action(
+  guard(async (serverId, o) => {
+    const base = `/system/servers/${encodeURIComponent(serverId)}/modules`;
+    await apiRequest(`${base}/scan`, { method: "POST", body: "{}" }).catch(() => {
+    });
+    let mods = await apiRequest(base);
+    if (o.component?.length) mods = mods.filter((m) => o.component.includes(m.moduleName));
+    if (o.check) {
+      if (isJsonMode()) return printJson(mods);
+      printTable(
+        mods.map((m) => ({
+          module: m.moduleName,
+          installed: m.installedVersion ?? "-",
+          current: m.migrationVersion ?? "-",
+          available: m.availableVersion ?? "-",
+          behind: m.behind ? "yes" : "no",
+          consent: String(m.detail?.pendingConsent?.length ?? 0)
+        })),
+        ["module", "installed", "current", "available", "behind", "consent"]
+      );
+      return;
+    }
+    const behind = mods.filter((m) => m.behind);
+    if (!behind.length) return ok("  All modules up to date.");
+    for (const m of behind) {
+      const consent = m.detail?.pendingConsent ?? [];
+      if (consent.length && !isJsonMode()) {
+        info(`  ${m.moduleName}: includes consent migrations \u2014 ${consent.map((c) => c.warning ?? c.id).join("; ")}`);
+      }
+      const spinner3 = isJsonMode() ? null : ora4(`Updating ${m.moduleName}\u2026`).start();
+      const res = await apiRequest(`${base}/${encodeURIComponent(m.moduleName)}/apply`, {
+        method: "POST",
+        body: "{}"
+      });
+      spinner3?.stop();
+      if (isJsonMode()) {
+        printJson(res);
+        continue;
+      }
+      if (res.ok) ok(`  ${m.moduleName}: ${res.fromVersion} \u2192 ${res.toVersion} (${res.appliedSteps.length} step(s))`);
+      else err(`  ${m.moduleName}: ${res.error ?? "update failed"}`);
+    }
+  })
+);
 server.command("install <serverId>").description("Install components on a server").requiredOption("-c, --component <name...>", `Components to install (${INSTALLABLE.join("|")})`).option("--follow", "Stream install logs live (SSE)").action(
   guard(async (serverId, o) => {
     const components = o.component;
@@ -5233,7 +5527,7 @@ var serverCommand = server;
 // src/commands/system.ts
 import { Command as Command17 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -5533,7 +5827,7 @@ dataTransferCommand.command("export").description("Export the entire instance to
       );
       spin4?.succeed("Export ready.");
       if (opts.out) {
-        writeFileSync6(opts.out, JSON.stringify(file));
+        writeFileSync7(opts.out, JSON.stringify(file));
         const tables = Object.keys(file.dump?.tables ?? {}).length;
         report2(
           { out: opts.out, tables },
@@ -5559,7 +5853,7 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
     let file;
     try {
-      file = JSON.parse(readFileSync5(opts.file, "utf8"));
+      file = JSON.parse(readFileSync8(opts.file, "utf8"));
     } catch {
       err(`
   Could not read or parse ${opts.file}.
@@ -5902,7 +6196,7 @@ var mailCommand = new Command18("mail").description("Self-hosted mail server (iR
 // src/commands/backup.ts
 import { Command as Command19 } from "commander";
 import ora7 from "ora";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 async function guard3(fn) {
   try {
     await fn();
@@ -6195,7 +6489,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
     let sftpPrivateKey = opts.sftpPrivateKey;
     if (opts.sftpPrivateKeyFile) {
       try {
-        sftpPrivateKey = readFileSync6(opts.sftpPrivateKeyFile, "utf8");
+        sftpPrivateKey = readFileSync9(opts.sftpPrivateKeyFile, "utf8");
       } catch {
         throw new Error(`Cannot read key file: ${opts.sftpPrivateKeyFile}`);
       }
@@ -6383,12 +6677,73 @@ var apiCommand = new Command21("api").description("Make an authenticated request
   }
 });
 
-// src/commands/install.ts
+// src/commands/reset-admin.ts
 import { Command as Command22 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import chalk16 from "chalk";
+import { intro, outro, password as passwordPrompt, isCancel, cancel as cancel2, log } from "@clack/prompts";
+import { readFileSync as readFileSync10 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join11 } from "path";
+function resolvedApiPort() {
+  try {
+    return JSON.parse(readFileSync10(join11(homedir7(), ".openship", "ports.json"), "utf8")).api;
+  } catch {
+    return void 0;
+  }
+}
+var resetAdminCommand = new Command22("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the resolved port from ~/.openship/ports.json, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
+  intro(chalk16.cyan("Reset Openship admin password"));
+  let pw = opts.password;
+  if (!pw) {
+    if (!process.stdin.isTTY) {
+      log.error("--password is required in non-interactive mode.");
+      process.exit(1);
+    }
+    const entered = await passwordPrompt({
+      message: "New admin password",
+      validate: (v) => v && v.length >= 8 && v.length <= 128 ? void 0 : "8\u2013128 characters"
+    });
+    if (isCancel(entered)) {
+      cancel2("Cancelled.");
+      process.exit(0);
+    }
+    const confirm3 = await passwordPrompt({
+      message: "Confirm password",
+      validate: (v) => v === entered ? void 0 : "Passwords don't match"
+    });
+    if (isCancel(confirm3)) {
+      cancel2("Cancelled.");
+      process.exit(0);
+    }
+    pw = entered;
+  }
+  const port = String(opts.port || resolvedApiPort() || 4e3);
+  let res;
+  try {
+    res = await fetch(`http://127.0.0.1:${port}/api/system/reset-admin-password`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": ensureInternalToken() },
+      body: JSON.stringify({ password: pw, email: opts.email, name: opts.name })
+    });
+  } catch {
+    log.error(`Couldn't reach the Openship API on port ${port}. Is it running? (openship status)`);
+    log.info("If it's listening on another port, pass --port <n>.");
+    process.exit(1);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.ok) {
+    log.error(`Reset failed: ${data.error || res.statusText}`);
+    process.exit(1);
+  }
+  outro(chalk16.green(`Password reset. Log in as ${data.email} with your new password.`));
+});
+
+// src/commands/install.ts
+import { Command as Command23 } from "commander";
+import { chmodSync as chmodSync2, existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
 import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
-import { homedir as homedir5 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join12 } from "path";
 import ora9 from "ora";
 function assetForPlatform() {
   const { platform, arch } = process;
@@ -6400,10 +6755,10 @@ function assetForPlatform() {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 function installDmg(dmg) {
-  const homeApps = join9(homedir5(), "Applications");
+  const homeApps = join12(homedir8(), "Applications");
   let dest = homeApps;
   try {
-    mkdirSync7(homeApps, { recursive: true });
+    mkdirSync8(homeApps, { recursive: true });
   } catch {
     dest = "/Applications";
   }
@@ -6413,14 +6768,14 @@ function installDmg(dmg) {
   if (attach.status !== 0) throw new Error(`hdiutil attach failed: ${attach.stderr?.trim()}`);
   const mount = (attach.stdout.match(/\/Volumes\/[^\n]*/g) ?? []).pop()?.trim();
   if (!mount) throw new Error("Could not determine the mounted volume");
-  let target = join9(dest, "Openship.app");
+  let target = join12(dest, "Openship.app");
   try {
-    const appInDmg = join9(mount, "Openship.app");
-    if (!existsSync9(appInDmg)) throw new Error("Openship.app not found in the disk image");
+    const appInDmg = join12(mount, "Openship.app");
+    if (!existsSync10(appInDmg)) throw new Error("Openship.app not found in the disk image");
     spawnSync4("rm", ["-rf", target]);
     let copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
     if (copy.status !== 0 && dest === homeApps) {
-      target = join9("/Applications", "Openship.app");
+      target = join12("/Applications", "Openship.app");
       spawnSync4("rm", ["-rf", target]);
       copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
     }
@@ -6435,9 +6790,9 @@ function installAppImage(appImage) {
   return appImage;
 }
 function installZip(zip) {
-  const localAppData = process.env.LOCALAPPDATA || join9(homedir5(), "AppData", "Local");
-  const target = join9(localAppData, "Programs", "Openship");
-  mkdirSync7(target, { recursive: true });
+  const localAppData = process.env.LOCALAPPDATA || join12(homedir8(), "AppData", "Local");
+  const target = join12(localAppData, "Programs", "Openship");
+  mkdirSync8(target, { recursive: true });
   const expand = spawnSync4(
     "powershell",
     [
@@ -6464,11 +6819,11 @@ function launch(kind, target) {
     child.unref();
     return;
   }
-  const exe = join9(target, "Openship.exe");
-  const path2 = existsSync9(exe) ? exe : target;
+  const exe = join12(target, "Openship.exe");
+  const path2 = existsSync10(exe) ? exe : target;
   spawnSync4("cmd", ["/c", "start", "", path2]);
 }
-var installCommand = new Command22("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
+var installCommand = new Command23("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
   let asset;
   try {
     asset = assetForPlatform();
@@ -6491,13 +6846,13 @@ var installCommand = new Command22("install").description("Download and install
     process.exit(1);
   }
   const dir = releaseDir(tag);
-  const assetPath = join9(dir, asset.name);
+  const assetPath = join12(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
   const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
-  const cachedUsable = !opts.force && existsSync9(assetPath) && (existsSync9(sidecarPath) || opts.verify === false);
+  const cachedUsable = !opts.force && existsSync10(assetPath) && (existsSync10(sidecarPath) || opts.verify === false);
   if (cachedUsable) {
     info(`  Using cached ${asset.name} (${tag}).`);
   } else {
@@ -6519,8 +6874,8 @@ var installCommand = new Command22("install").description("Download and install
     const s2 = spin4("Verifying checksum\u2026");
     try {
       let sidecarBody;
-      if (existsSync9(sidecarPath) && !downloaded) {
-        sidecarBody = readFileSync7(sidecarPath, "utf8");
+      if (existsSync10(sidecarPath) && !downloaded) {
+        sidecarBody = readFileSync11(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
       }
@@ -6543,8 +6898,8 @@ var installCommand = new Command22("install").description("Download and install
         err(`Expected ${expected}, got ${actual}. The download may be corrupt or tampered with.`);
         process.exit(1);
       }
-      mkdirSync7(dir, { recursive: true });
-      writeFileSync7(sidecarPath, sidecarBody);
+      mkdirSync8(dir, { recursive: true });
+      writeFileSync8(sidecarPath, sidecarBody);
       s2?.succeed("Checksum verified");
     } catch (e) {
       s2?.fail("Verification failed");
@@ -6583,15 +6938,15 @@ var installCommand = new Command22("install").description("Download and install
 });
 
 // src/commands/update.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 import { spawnSync as spawnSync5 } from "child_process";
 function detectPackageManager2(override) {
   if (override === "bun" || override === "npm") return override;
   const hasBun = spawnSync5("bun", ["--version"], { stdio: "ignore" }).status === 0;
   return hasBun ? "bun" : "npm";
 }
-var updateCommand = new Command23("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
-  const current = "0.2.1";
+var updateCommand = new Command24("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
+  const current = "0.2.2";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6636,18 +6991,18 @@ var updateCommand = new Command23("update").description("Update the Openship CLI
 });
 
 // src/commands/cache.ts
-import { Command as Command24 } from "commander";
-import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync8, rmSync as rmSync4, statSync } from "fs";
-import { join as join10 } from "path";
+import { Command as Command25 } from "commander";
+import { existsSync as existsSync11, readdirSync, readFileSync as readFileSync12, rmSync as rmSync4, statSync } from "fs";
+import { join as join13 } from "path";
 function listAssets() {
-  if (!existsSync10(RELEASES_DIR)) return [];
+  if (!existsSync11(RELEASES_DIR)) return [];
   const out = [];
   for (const tag of readdirSync(RELEASES_DIR)) {
     const dir = releaseDir(tag);
     if (!statSync(dir).isDirectory()) continue;
     for (const name of readdirSync(dir)) {
       if (name.endsWith(".sha256")) continue;
-      const path2 = join10(dir, name);
+      const path2 = join13(dir, name);
       const st = statSync(path2);
       if (!st.isFile()) continue;
       out.push({
@@ -6655,17 +7010,17 @@ function listAssets() {
         name,
         path: path2,
         size: st.size,
-        hasSidecar: existsSync10(`${path2}.sha256`)
+        hasSidecar: existsSync11(`${path2}.sha256`)
       });
     }
   }
   return out;
 }
-var pathCmd = new Command24("path").description("Print the cache directory path").action(() => {
+var pathCmd = new Command25("path").description("Print the cache directory path").action(() => {
   if (isJsonMode()) printJson({ path: CACHE_DIR });
   else process.stdout.write(CACHE_DIR + "\n");
 });
-var listCmd6 = new Command24("list").alias("ls").description("List cached release assets").action(() => {
+var listCmd6 = new Command25("list").alias("ls").description("List cached release assets").action(() => {
   const assets = listAssets();
   printTable(
     assets.map((a) => ({
@@ -6677,7 +7032,7 @@ var listCmd6 = new Command24("list").alias("ls").description("List cached releas
     ["tag", "asset", "size", "sidecar"]
   );
 });
-var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
+var verifyCmd2 = new Command25("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
   const assets = listAssets().filter((a) => !tag || a.tag === tag);
   const results = [];
   let bad = 0;
@@ -6686,7 +7041,7 @@ var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and
       results.push({ tag: a.tag, asset: a.name, result: "no-sidecar" });
       continue;
     }
-    const expected = parseSha256(readFileSync8(`${a.path}.sha256`, "utf8"));
+    const expected = parseSha256(readFileSync12(`${a.path}.sha256`, "utf8"));
     const actual = await hashFile(a.path);
     const okMatch = expected !== null && expected === actual;
     if (!okMatch) bad += 1;
@@ -6700,9 +7055,9 @@ var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and
   }
   if (bad > 0) process.exit(1);
 });
-var cleanCmd = new Command24("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
+var cleanCmd = new Command25("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
   const target = tag ? releaseDir(tag) : RELEASES_DIR;
-  if (!existsSync10(target)) {
+  if (!existsSync11(target)) {
     if (isJsonMode()) printJson({ removed: false, path: target });
     else info(`  Nothing to clean (${target}).`);
     return;
@@ -6713,32 +7068,34 @@ var cleanCmd = new Command24("clean").description("Delete cached release assets"
   Removed ${target}
 `);
 });
-var cacheCommand = new Command24("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
+var cacheCommand = new Command25("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
   err("Specify a subcommand: path | list | verify | clean");
   process.exit(1);
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
 
 // src/commands/wizard.ts
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import open from "open";
-import { createServer } from "http";
+import { createServer as createServer2 } from "http";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync12, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join14 } from "path";
 import {
-  intro,
-  outro,
+  intro as intro2,
+  outro as outro2,
   text,
   password,
   select,
-  confirm as confirm3,
   spinner as spinner2,
   note,
-  log,
-  cancel as cancel2,
-  isCancel
+  log as log2,
+  cancel as cancel3,
+  isCancel as isCancel2
 } from "@clack/prompts";
 function ensure(value) {
-  if (isCancel(value)) {
-    cancel2("Setup cancelled.");
+  if (isCancel2(value)) {
+    cancel3("Setup cancelled.");
     process.exit(0);
   }
   return value;
@@ -6776,6 +7133,19 @@ async function bootstrapAdmin(apiPort, admin) {
   if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
   return { ok: false, message: data?.error || "failed" };
 }
+function lastServiceError() {
+  for (const name of ["up.err.log", "up.log"]) {
+    const p = join14(homedir9(), ".openship", "logs", name);
+    if (!existsSync12(p)) continue;
+    try {
+      const lines = readFileSync13(p, "utf8").trim().split("\n");
+      const hit = [...lines].reverse().find((l) => /error|locked|EADDRINUSE|throw|cannot/i.test(l));
+      if (hit) return hit.trim().slice(0, 200);
+    } catch {
+    }
+  }
+  return null;
+}
 async function waitHealthy(apiPort, seconds = 90) {
   for (let i = 0; i < seconds; i++) {
     await new Promise((r) => setTimeout(r, 1e3));
@@ -6787,6 +7157,20 @@ async function waitHealthy(apiPort, seconds = 90) {
   }
   return false;
 }
+async function waitDashboard(dashPort, seconds = 45) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (res.status > 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
 async function detectPublicIp() {
   for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
     try {
@@ -6803,20 +7187,26 @@ var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g,
 async function connectOpenshipCloud(port) {
   const already = await internalGet(port, "/api/system/cloud-status");
   if (already?.connected) {
-    log.success(`Already connected to Openship Cloud${already.user?.email ? ` as ${already.user.email}` : ""}.`);
-    return true;
+    log2.success(`Already connected to Openship Cloud${already.user?.email ? ` as ${already.user.email}` : ""}.`);
+    return { email: already.user?.email ?? null };
   }
   const capsEnv = await internalGet(port, "/api/health/env");
   const cloudApiUrl = capsEnv?.cloudApiUrl;
   if (!cloudApiUrl) {
-    log.error("Couldn't discover the Openship Cloud URL \u2014 free domain unavailable. Use a custom domain instead.");
-    return false;
+    log2.error("Couldn't discover the Openship Cloud URL \u2014 free domain unavailable. Use a custom domain instead.");
+    return null;
   }
   const verifier = b64url(randomBytes2(32));
   const challenge = b64url(createHash2("sha256").update(verifier).digest());
   const state = b64url(randomBytes2(16));
   const codePromise = new Promise((resolve2) => {
-    const server2 = createServer((req, res2) => {
+    const page = (ok3) => {
+      const icon = ok3 ? '<path d="M20 6 9 17l-5-5"/>' : '<path d="M18 6 6 18M6 6l12 12"/>';
+      const title = ok3 ? "Connected to Openship Cloud" : "Connection didn\u2019t complete";
+      const msg = ok3 ? "Your instance is now linked to your Openship Cloud account." : "Something went wrong. Return to your terminal and run the connect step again.";
+      return `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Openship</title><style>:root{color-scheme:dark}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;background:#09090b;color:#e7e7ea;font:15px/1.55 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif}.card{width:min(92vw,420px);padding:40px 36px;text-align:center}.badge{margin:0 auto 20px;display:grid;place-items:center}svg{width:40px;height:40px}h1{margin:0 0 8px;font-size:19px;font-weight:600;letter-spacing:-.2px}p{margin:0;color:#9a9aa2;font-size:14px}.hint{margin-top:22px;font-size:12.5px;color:#6a6a72}</style></head><body><div class="card"><div class="badge"><svg viewBox="0 0 24 24" fill="none" stroke="#e7e7ea" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round">${icon}</svg></div><h1>${title}</h1><p>${msg}</p><div class="hint">You can close this tab and return to your terminal.</div></div><script>setTimeout(function(){try{window.close()}catch(e){}},1200)</script></body></html>`;
+    };
+    const server2 = createServer2((req, res2) => {
       const u = new URL(req.url || "/", "http://127.0.0.1");
       if (!u.pathname.startsWith("/callback")) {
         res2.writeHead(404).end();
@@ -6824,11 +7214,10 @@ async function connectOpenshipCloud(port) {
       }
       const code2 = u.searchParams.get("code");
       const gotState = u.searchParams.get("state");
-      res2.writeHead(200, { "Content-Type": "text/html" }).end(
-        "<html><body style='font:16px system-ui;padding:3rem;text-align:center'><h2>Openship Cloud connected</h2><p>You can close this window and return to your terminal.</p></body></html>"
-      );
+      const ok3 = !!(code2 && gotState === state);
+      res2.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(page(ok3));
       server2.close();
-      resolve2(code2 && gotState === state ? code2 : null);
+      resolve2(ok3 ? code2 : null);
     });
     server2.on("error", () => resolve2(null));
     server2.listen(0, "127.0.0.1", () => {
@@ -6852,16 +7241,16 @@ async function connectOpenshipCloud(port) {
   const code = await codePromise;
   if (!code) {
     s.stop("Openship Cloud wasn't authorized.", 1);
-    return false;
+    return null;
   }
   s.message("Linking this instance to Openship Cloud");
   const res = await internalPost(port, "/api/system/cloud-connect", { code, codeVerifier: verifier });
   if (!res.ok) {
     s.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
-    return false;
+    return null;
   }
-  s.stop("Connected to Openship Cloud.");
-  return true;
+  s.stop(`Connected to Openship Cloud${res.data?.email ? ` as ${res.data.email}` : ""}.`);
+  return { email: res.data?.email ?? null };
 }
 async function promptLocalAdmin() {
   const name = ensure(await text({ message: "Your name", validate: (v) => v?.trim() ? void 0 : "Required" })).trim();
@@ -6922,161 +7311,315 @@ async function streamProvision(port, sessionId, s) {
   return ok3;
 }
 async function runWizard() {
-  intro(`${chalk16.bgCyan(chalk16.black(" Openship "))}${chalk16.dim(" setup")}`);
-  log.message(
-    chalk16.dim(
+  intro2(`${chalk17.bgCyan(chalk17.black(" Openship "))}${chalk17.dim(" setup")}`);
+  log2.message(
+    chalk17.dim(
       "Deploy Openship on this machine \u2014 a few questions, then it installs itself\nas a service, registers as an app, and prints the URL to log in."
     )
   );
+  log2.message(chalk17.dim("First, your instance login (email + password) \u2014 this is how you sign in. Domain and Openship Cloud come next and never replace it."));
+  const admin = await promptLocalAdmin();
+  let cloudEmail = null;
   let publicUrl;
   let behindProxy = false;
   let managedEdge = false;
   let domainPlan = { type: "none" };
-  const reach = ensure(
-    await select({
-      message: "How should this instance be reachable?",
-      initialValue: "private",
-      options: [
-        { value: "private", label: "Private", hint: "this machine only (localhost)" },
-        { value: "public", label: "Public", hint: "a server / VPS, reachable from other machines" }
-      ]
-    })
-  );
-  if (reach === "public") {
-    const canManage = process.platform === "linux";
-    const domainType = ensure(
-      await select({
-        message: "How do you want a domain + HTTPS?",
-        initialValue: "free",
-        options: [
-          { value: "free", label: "Free domain", hint: "name.opsh.io via Openship Cloud \u2014 HTTPS handled for you" },
-          ...canManage ? [{ value: "custom", label: "Custom domain", hint: "your domain + free Let's Encrypt on this box" }] : [],
-          { value: "byo", label: "Bring your own", hint: "your domain, behind your own reverse proxy" }
-        ]
+  const canManage = process.platform === "linux";
+  const BACK = "__back__";
+  let slug = "";
+  let customDomainInput = "";
+  let byoDomainInput = "";
+  let publicHost = null;
+  async function resolvePublicHost() {
+    if (publicHost) return publicHost;
+    const sp = spinner2();
+    sp.start("Detecting this server's public IP");
+    const detected = await detectPublicIp();
+    if (detected) {
+      sp.stop(`Public IP: ${chalk17.bold(detected)}`);
+      publicHost = detected;
+      return detected;
+    }
+    sp.stop("Couldn't detect the public IP automatically.", 1);
+    publicHost = ensure(
+      await text({
+        message: "This server's public IP or hostname",
+        placeholder: "203.0.113.10",
+        validate: (v) => v?.trim() ? void 0 : "Required \u2014 the edge proxy routes traffic to this address"
       })
-    );
-    if (domainType === "free") {
-      const slug = ensure(
+    ).trim();
+    return publicHost;
+  }
+  let stage = "reach";
+  log2.message(chalk17.dim("These are just starting choices \u2014 domain, Cloud, team, and the rest are all editable later in Settings."));
+  planning: while (true) {
+    if (stage === "reach") {
+      const reach = ensure(
+        await select({
+          message: "How should this instance be reachable?",
+          // Default to public — most people setting up on a server/VPS want a
+          // domain + HTTPS; localhost-only is the deliberate opt-out.
+          initialValue: "public",
+          options: [
+            { value: "public", label: "Public (server / VPS)", hint: "a domain + HTTPS, reachable from anywhere" },
+            { value: "private", label: "This machine only", hint: "localhost \u2014 no domain, log in on this box" }
+          ]
+        })
+      );
+      if (reach === "private") {
+        domainPlan = { type: "none" };
+        publicUrl = void 0;
+        behindProxy = false;
+        managedEdge = false;
+        break planning;
+      }
+      stage = "type";
+      continue;
+    }
+    if (stage === "type") {
+      const domainType = ensure(
+        await select({
+          message: "How do you want a domain + HTTPS?",
+          initialValue: "free",
+          options: [
+            { value: "free", label: "Free domain", hint: "name.opsh.io via Openship Cloud \u2014 HTTPS handled for you" },
+            ...canManage ? [{ value: "custom", label: "Custom domain", hint: "your domain + free Let's Encrypt on this box" }] : [],
+            { value: "byo", label: "Bring your own", hint: "your domain, behind your own reverse proxy" },
+            { value: BACK, label: "\u2190 Back" }
+          ]
+        })
+      );
+      if (domainType === BACK) {
+        stage = "reach";
+        continue;
+      }
+      stage = domainType;
+      continue;
+    }
+    if (stage === "free") {
+      slug = ensure(
         await text({
           message: "Choose your subdomain",
           placeholder: "my-openship",
+          initialValue: slug || void 0,
           validate: (v) => v && SLUG_RE.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
         })
       ).trim().toLowerCase();
-      const s2 = spinner2();
-      s2.start("Detecting this server's public IP");
-      const publicHost = await detectPublicIp();
-      s2.stop(publicHost ? `Public IP: ${chalk16.bold(publicHost)}` : "Couldn't detect the public IP automatically.");
+      const host = await resolvePublicHost();
+      note(
+        `${chalk17.cyan(`https://${slug}.opsh.io`)}
+
+  ${chalk17.dim("served via")}  Openship Cloud edge  ${chalk17.dim("\u2192")}  ${chalk17.cyan(host)}
+
+` + chalk17.dim("Openship Cloud terminates HTTPS and forwards to this server."),
+        "Confirm free domain"
+      );
+      const go2 = ensure(
+        await select({
+          message: "Create this free domain?",
+          options: [
+            { value: "go", label: "Create it" },
+            { value: BACK, label: "\u2190 Back", hint: "change subdomain or IP" }
+          ]
+        })
+      );
+      if (go2 === BACK) {
+        stage = "type";
+        continue;
+      }
       publicUrl = `https://${slug}.opsh.io`;
       behindProxy = true;
-      domainPlan = { type: "free", slug, publicHost };
-    } else if (domainType === "custom") {
-      const raw = ensure(
+      domainPlan = { type: "free", slug, publicHost: host };
+      break planning;
+    }
+    if (stage === "custom") {
+      const raw2 = ensure(
         await text({
           message: "Your domain",
           placeholder: "ops.example.com",
+          initialValue: customDomainInput || void 0,
           validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
         })
       );
-      publicUrl = normalizeUrl(raw).replace(/^http:/i, "https:");
-      const hostname = new URL(publicUrl).hostname;
-      managedEdge = true;
-      behindProxy = true;
+      customDomainInput = raw2;
+      const url2 = normalizeUrl(raw2).replace(/^http:/i, "https:");
+      const hostname2 = new URL(url2).hostname;
       if (typeof process.getuid === "function" && process.getuid() !== 0) {
-        log.warn("Managed HTTPS installs OpenResty + certbot \u2014 that needs root. Re-run with sudo if it can't install.");
+        log2.warn("Managed HTTPS installs OpenResty + certbot \u2014 that needs root. Re-run with sudo if it can't install.");
       }
-      const s2 = spinner2();
-      s2.start("Detecting this server's public IP");
-      const ip = await detectPublicIp();
-      s2.stop(ip ? `Public IP: ${chalk16.bold(ip)}` : "Couldn't detect the public IP automatically.");
+      const host = await resolvePublicHost();
       note(
-        `Add a DNS ${chalk16.bold("A record")}:
+        `Add a DNS ${chalk17.bold("A record")}:
 
-  ${chalk16.cyan(hostname)}  \u2192  ${chalk16.cyan(ip ?? "<this server's public IP>")}
+  ${chalk17.cyan(hostname2)}  \u2192  ${chalk17.cyan(host)}
 
-` + chalk16.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
+` + chalk17.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
         "DNS"
       );
-      ensure(await confirm3({ message: "A record set? (continue either way \u2014 it retries)", initialValue: true }));
-      domainPlan = { type: "custom", hostname };
-    } else {
-      const raw = ensure(
-        await text({
-          message: "Your domain (served behind your proxy)",
-          placeholder: "ops.example.com",
-          validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+      const go2 = ensure(
+        await select({
+          message: "A record added?",
+          options: [
+            { value: "go", label: "Continue", hint: "HTTPS provisions once DNS resolves \u2014 it retries" },
+            { value: BACK, label: "\u2190 Back", hint: "change the domain" }
+          ]
         })
       );
-      publicUrl = normalizeUrl(raw);
-      behindProxy = true;
-      if (publicUrl.startsWith("http://")) {
-        log.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
+      if (go2 === BACK) {
+        stage = "type";
+        continue;
       }
-      domainPlan = { type: "byo", hostname: new URL(publicUrl).hostname };
+      publicUrl = url2;
+      managedEdge = true;
+      behindProxy = true;
+      domainPlan = { type: "custom", hostname: hostname2 };
+      break planning;
+    }
+    const raw = ensure(
+      await text({
+        message: "Your domain (served behind your proxy)",
+        placeholder: "ops.example.com",
+        initialValue: byoDomainInput || void 0,
+        validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+      })
+    );
+    byoDomainInput = raw;
+    const url = normalizeUrl(raw);
+    const hostname = new URL(url).hostname;
+    if (url.startsWith("http://")) {
+      log2.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
+    }
+    note(
+      `${chalk17.cyan(url)}
+
+` + chalk17.dim("Point your reverse proxy at the dashboard port shown at the end."),
+      "Confirm"
+    );
+    const go = ensure(
+      await select({
+        message: "Continue?",
+        options: [
+          { value: "go", label: "Continue" },
+          { value: BACK, label: "\u2190 Back", hint: "change the domain" }
+        ]
+      })
+    );
+    if (go === BACK) {
+      stage = "type";
+      continue;
     }
+    publicUrl = url;
+    behindProxy = true;
+    domainPlan = { type: "byo", hostname };
+    break planning;
+  }
+  const uiTag = `v${"0.2.2"}`;
+  const dl = spinner2();
+  dl.start("Pulling the Openship dist from GitHub");
+  try {
+    await ensureDashboard({
+      tag: uiTag,
+      onProgress: (received, total) => {
+        if (total) dl.message(`Pulling the Openship dist from GitHub \u2014 ${Math.round(received / total * 100)}%`);
+      }
+    });
+    dl.stop("Openship dist ready.");
+  } catch (e) {
+    dl.stop(`Couldn't pull the Openship dist: ${e.message}`, 1);
+    log2.info("Check your network / that this release published its dashboard asset, then re-run `openship`.");
+    process.exit(1);
   }
-  const isCloudDomain = domainPlan.type === "free";
-  const admin = isCloudDomain ? null : await promptLocalAdmin();
   const s = spinner2();
   s.start("Installing Openship as a service");
   let started;
   try {
-    started = startService(
-      { publicUrl, trustProxy: behindProxy, managedEdge, acmeEmail: managedEdge ? admin?.email : void 0 },
+    started = await startService(
+      { publicUrl, trustProxy: behindProxy, managedEdge, acmeEmail: managedEdge ? admin.email : void 0, uiVersion: uiTag },
       { quiet: true }
     );
   } catch (e) {
     s.stop("Couldn't install the service.", 1);
-    log.error(e.message);
-    log.info("Run `openship up --foreground` to run it attached and see the error.");
+    log2.error(e.message);
+    log2.info("Run `openship up --foreground` to run it attached and see the error.");
     process.exit(1);
   }
-  s.message("Waiting for Openship to come up");
+  s.message("Waiting for the Openship API");
   if (!await waitHealthy(started.port)) {
     s.stop("Openship didn't become healthy in time.", 1);
-    log.info("Check logs: `openship logs` (or `openship up --foreground`).");
+    const reason = lastServiceError();
+    if (reason) log2.error(reason);
+    if (reason && /lock/i.test(reason)) {
+      log2.info("The database is locked by another instance \u2014 run `openship stop`, then re-run `openship`.");
+    } else {
+      log2.info("Check logs: `openship logs` (or `openship up --foreground`).");
+    }
+    process.exit(1);
+  }
+  s.message("Creating your admin account");
+  const adminRes = await bootstrapAdmin(started.port, admin);
+  if (!adminRes.ok) {
+    s.stop(`Couldn't create the admin account: ${adminRes.message}`, 1);
     process.exit(1);
   }
-  if (admin) {
-    s.message("Creating your admin account");
-    const adminRes = await bootstrapAdmin(started.port, admin);
-    if (!adminRes.ok) {
-      s.stop(`Couldn't create the admin account: ${adminRes.message}`, 1);
+  if (adminRes.message === "already-exists") {
+    s.message("Applying your admin login");
+    const rr = await internalPost(started.port, "/api/system/reset-admin-password", {
+      email: admin.email,
+      name: admin.name,
+      password: admin.password
+    });
+    if (!rr.ok) {
+      s.stop(`Couldn't set your admin login: ${rr.data?.error || "failed"}`, 1);
       process.exit(1);
     }
-    s.stop(
-      adminRes.message === "already-exists" ? "An admin already exists \u2014 use your existing login." : `Admin account created for ${admin.email}.`
-    );
-  } else {
-    s.stop("Openship is up.");
   }
+  s.message(`Admin ready for ${admin.email}`);
+  s.message("Starting the Openship dashboard");
+  await waitDashboard(started.dashPort);
+  s.stop("Deployed.");
   let liveUrl = publicUrl ?? `http://localhost:${started.dashPort}`;
   const port = started.port;
   if (domainPlan.type === "free") {
-    const linked = await connectOpenshipCloud(port);
-    if (!linked) {
-      log.warn("Openship Cloud wasn't connected \u2014 set up a local admin instead. You can add the free domain later in Settings \u2192 Cloud.");
-      const fb = await promptLocalAdmin();
-      const abr = await bootstrapAdmin(port, fb);
-      if (!abr.ok) {
-        log.error(`Couldn't create the admin account: ${abr.message}`);
-        process.exit(1);
-      }
+    const cloud = await connectOpenshipCloud(port);
+    if (!cloud) {
+      log2.warn("Openship Cloud wasn't connected \u2014 skipping the free domain. Your local admin login still works; add the domain later in Settings \u2192 Cloud.");
       await internalPost(port, "/api/system/self-register", { domainType: "byo" });
     } else {
-      const s2 = spinner2();
-      s2.start("Registering your free domain with Openship Cloud");
-      const res = await internalPost(port, "/api/system/self-register", {
-        domainType: "free",
-        slug: domainPlan.slug,
-        publicHost: domainPlan.publicHost,
-        dashPort: Number(started.dashPort)
-      });
-      if (res.ok && res.data?.url) {
-        liveUrl = res.data.url;
-        s2.stop(`Free domain live: ${res.data.url}`);
-      } else {
-        s2.stop(`Couldn't register the free domain: ${res.data?.error || "failed"}`, 1);
+      cloudEmail = cloud.email;
+      let regSlug = domainPlan.slug;
+      while (true) {
+        const s2 = spinner2();
+        s2.start(`Registering ${chalk17.bold(`${regSlug}.opsh.io`)} with Openship Cloud`);
+        const res = await internalPost(port, "/api/system/self-register", {
+          domainType: "free",
+          slug: regSlug,
+          publicHost: domainPlan.publicHost,
+          dashPort: Number(started.dashPort)
+        });
+        if (res.ok && res.data?.url) {
+          liveUrl = res.data.url;
+          s2.stop(`Free domain live: ${res.data.url}`);
+          break;
+        }
+        s2.stop(`Couldn't register ${regSlug}.opsh.io: ${res.data?.error || "failed"}`, 1);
+        const next = ensure(
+          await select({
+            message: "Try a different subdomain?",
+            options: [
+              { value: "retry", label: "Pick another subdomain" },
+              { value: "skip", label: "Skip for now", hint: "log in on this server; add a domain later in Settings \u2192 Cloud" }
+            ]
+          })
+        );
+        if (next === "skip") break;
+        regSlug = ensure(
+          await text({
+            message: "Choose your subdomain",
+            placeholder: "my-openship",
+            initialValue: regSlug,
+            validate: (v) => v && SLUG_RE.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
+          })
+        ).trim().toLowerCase();
       }
     }
   } else if (domainPlan.type === "custom") {
@@ -7115,7 +7658,7 @@ async function runWizard() {
       else edgeTakeover = true;
     }
     if (!proceedCustom) {
-      log.warn(
+      log2.warn(
         "Left the existing proxy on 80/443 running. Registering Openship without managed HTTPS \u2014 front it with your proxy, or re-run setup to take over."
       );
       await internalPost(port, "/api/system/self-register", {
@@ -7140,7 +7683,7 @@ async function runWizard() {
         if (done) s2.stop(`HTTPS ready: ${liveUrl}`);
         else s2.stop("HTTPS isn't ready yet \u2014 it retries on reboot; the site serves over HTTP meanwhile.", 1);
       } else {
-        log.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
+        log2.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
       }
     }
   } else if (domainPlan.type === "byo") {
@@ -7152,23 +7695,105 @@ async function runWizard() {
   } else {
     await internalPost(port, "/api/system/self-register", { domainType: "byo" });
   }
+  saveInstanceUrl(liveUrl);
+  const pad = (label) => chalk17.dim(label.padEnd(11));
+  log2.success(chalk17.bold("Openship is live"));
+  log2.message(
+    `${pad("URL")}${chalk17.bold(liveUrl)}
+${pad("Dashboard")}http://localhost:${started.dashPort}
+${pad("API")}http://localhost:${started.port}
+${pad("Login")}${admin.email} ${chalk17.dim("(email + password you set)")}
+` + (cloudEmail ? `${pad("Cloud")}${chalk17.dim("connected as ")}${cloudEmail}${chalk17.dim(" \u2014 free domain + mail only")}
+` : "") + `${pad("Status")}${chalk17.green("running")} ${chalk17.dim("\xB7 service (restarts on boot)")}`
+  );
+  log2.message(
+    chalk17.dim("Sign in with the email + password you just set. Openship appears under your Apps.\n") + chalk17.dim("Change the domain, Openship Cloud, team, and everything else anytime in Settings.\n") + chalk17.dim(`Locked out? Run ${chalk17.reset("openship reset-admin-password")}${chalk17.dim(" on this machine \u2014 resets your login without signing in.")}`)
+  );
+  outro2(
+    domainPlan.type === "byo" ? chalk17.dim("Point your reverse proxy at the dashboard port above.") : chalk17.green("Happy shipping.")
+  );
+}
+function storedPorts() {
+  const p = join14(homedir9(), ".openship", "ports.json");
+  try {
+    return existsSync12(p) ? JSON.parse(readFileSync13(p, "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+async function runControl() {
+  const svc = serviceStatus();
+  const ports = storedPorts();
+  const apiPort = String(ports.api ?? 4e3);
+  const dashUrl = `http://localhost:${ports.dashboard ?? 3001}`;
+  const publicUrl = readInstanceUrl();
+  const primaryUrl = publicUrl && !/^https?:\/\/localhost/i.test(publicUrl) ? publicUrl : dashUrl;
+  intro2(`${chalk17.bgCyan(chalk17.black(" Openship "))}${chalk17.dim(" control")}`);
   note(
-    `${chalk16.bold(liveUrl)}
-
-` + chalk16.dim(`${admin ? `Log in as ${admin.email}` : "Log in with Openship Cloud"}. Openship now appears under your Apps, and runs as a service (restarts on boot).`),
-    "Openship is live"
+    `${chalk17.dim("URL".padEnd(11))}${chalk17.bold(primaryUrl)}
+${chalk17.dim("Service".padEnd(11))}${svc.running ? chalk17.green("running") : chalk17.yellow("stopped")}
+${chalk17.dim("Dashboard".padEnd(11))}${dashUrl}
+` + (ports.api ? `${chalk17.dim("API".padEnd(11))}http://localhost:${ports.api}
+` : "") + `${chalk17.dim("Manager".padEnd(11))}${svc.kind === "unsupported" ? "none" : svc.kind}`,
+    "Openship is already set up"
   );
-  outro(
-    domainPlan.type === "byo" ? chalk16.dim("Point your reverse proxy at the dashboard port above.") : chalk16.green("Happy shipping.")
+  const action2 = ensure(
+    await select({
+      message: "What would you like to do?",
+      options: [
+        { value: "open", label: "Open the dashboard" },
+        svc.running ? { value: "restart", label: "Restart the service" } : { value: "start", label: "Start the service" },
+        { value: "stop", label: "Stop the service", hint: "won't restart on boot" },
+        { value: "reset", label: "Reset admin password", hint: "sets a local email + password login" },
+        { value: "reconfigure", label: "Re-run setup", hint: "reconfigure domain / cloud / admin" },
+        { value: "quit", label: "Quit" }
+      ]
+    })
   );
+  switch (action2) {
+    case "open":
+      await open(primaryUrl).catch(() => {
+      });
+      outro2(chalk17.dim(`Opening ${primaryUrl}`));
+      return;
+    case "start":
+      await startService({});
+      return;
+    case "restart": {
+      const r = restart();
+      outro2(r.restarted ? chalk17.green("Restarted.") : chalk17.yellow(r.detail));
+      return;
+    }
+    case "stop": {
+      const r = stop();
+      outro2(chalk17.green(`Stopped. ${chalk17.dim(r.detail)}`));
+      return;
+    }
+    case "reset": {
+      const pw = ensure(
+        await password({ message: "New admin password", validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters" })
+      );
+      const rr = await internalPost(apiPort, "/api/system/reset-admin-password", { password: pw });
+      outro2(
+        rr.ok ? chalk17.green(`Password reset. Sign in at ${dashUrl} with your email + new password.`) : chalk17.red(`Couldn't reset: ${rr.data?.error || "failed"}`)
+      );
+      return;
+    }
+    case "reconfigure":
+      await runWizard();
+      return;
+    default:
+      outro2(chalk17.dim("Nothing changed."));
+  }
 }
 
 // src/index.ts
-var program = new Command25();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.1").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+var program = new Command26();
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.2").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
-  await runWizard();
+  if (serviceStatus().installed) await runControl();
+  else await runWizard();
 });
 program.addCommand(upCommand);
 program.addCommand(stopCommand);
@@ -7193,5 +7818,6 @@ program.addCommand(mailCommand);
 program.addCommand(backupCommand);
 program.addCommand(tokenCommand);
 program.addCommand(apiCommand);
+program.addCommand(resetAdminCommand);
 installCommand.addCommand(cacheCommand);
 program.parse();