openship 0.4.5 → 0.4.7

package/dist/{chunk-R74UB4X4.js → chunk-SJIFLLX4.js}

@@ -1,3 +1,5 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
@@ -5,8 +7,9 @@ import {
   generateDockerfile,
   prepareSourceTree,
   resolveDockerfileCandidates,
-  resolveServiceDockerfile
-} from "./chunk-HDV4NSA3.js";
+  resolveServiceDockerfile,
+  staticBuilderOutputPath
+} from "./chunk-V6AN6XLZ.js";
 import {
   BuildLogger,
   assembleGitClone,
@@ -15,20 +18,20 @@ import {
   shellGitSshWriter,
   sq,
   transferLocalDirectory
-} from "./chunk-JXQCFTDV.js";
+} from "./chunk-4Z5QO7N6.js";
 import {
   connectSshClient,
   execSshCommand,
   openSshExecChannel,
   openSshUnixSocket
-} from "./chunk-C4FOQJ63.js";
+} from "./chunk-OXWDY22G.js";
 import {
   isRuntimeNotFoundError
-} from "./chunk-JYAGTMSJ.js";
+} from "./chunk-RPHRPFEH.js";
 import {
   safeErrorMessage,
   withTimeout
-} from "./chunk-3LCRNQ2C.js";
+} from "./chunk-6APULWSU.js";
 
 // ../../packages/adapters/src/runtime/docker.ts
 import Dockerode from "dockerode";
@@ -79,12 +82,133 @@ function scopeVolumeBinds(slug, rawVolumes, enabled) {
   });
 }
 
-// ../../packages/adapters/src/runtime/docker-ssh-agent.ts
+// ../../packages/adapters/src/runtime/docker-exec-stream.ts
 import net from "net";
+import tls from "tls";
+import { Duplex } from "stream";
+var HEADER_END = "\r\n\r\n";
+var UPGRADE_TIMEOUT_MS = 2e4;
+function connect(conn) {
+  if (conn.socketPath) return net.connect({ path: conn.socketPath });
+  const port = Number(conn.port ?? (conn.protocol === "https" ? 443 : 80));
+  const host = conn.host ?? "127.0.0.1";
+  if (conn.protocol === "https") {
+    return tls.connect({ host, port, ca: conn.ca, cert: conn.cert, key: conn.key });
+  }
+  return net.connect({ port, host });
+}
+function bridgeSocket(socket, leftover) {
+  const out = new Duplex({
+    read() {
+      socket.resume();
+    },
+    write(chunk, _enc, cb) {
+      socket.write(chunk, (err) => cb(err ?? null));
+    },
+    final(cb) {
+      if (!socket.destroyed) socket.end();
+      cb();
+    },
+    destroy(err, cb) {
+      socket.destroy(err ?? void 0);
+      cb(err);
+    }
+  });
+  let readEnded = false;
+  const endRead = () => {
+    if (readEnded) return;
+    readEnded = true;
+    out.push(null);
+  };
+  if (leftover.length > 0) out.push(leftover);
+  socket.on("data", (chunk) => {
+    if (!out.push(chunk)) socket.pause();
+  });
+  socket.on("end", endRead);
+  socket.on("error", (err) => out.destroy(err));
+  socket.on("close", () => {
+    endRead();
+    if (!out.writableEnded) out.end();
+  });
+  return out;
+}
+function startExecStream(conn, execId, opts) {
+  return new Promise((resolve, reject) => {
+    const socket = connect(conn);
+    let settled = false;
+    let head = Buffer.alloc(0);
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      reject(err);
+    };
+    const timer = setTimeout(
+      () => fail(new Error(`docker exec upgrade timed out after ${UPGRADE_TIMEOUT_MS}ms`)),
+      UPGRADE_TIMEOUT_MS
+    );
+    const onData = (chunk) => {
+      if (settled) return;
+      head = head.length === 0 ? Buffer.from(chunk) : Buffer.concat([head, chunk]);
+      const text = head.toString("latin1");
+      const end = text.indexOf(HEADER_END);
+      if (end === -1) {
+        if (head.length > 64 * 1024) fail(new Error("docker exec upgrade: response head too large"));
+        return;
+      }
+      const statusLine = text.slice(0, text.indexOf("\r\n"));
+      if (!/ 101 /.test(statusLine)) {
+        const body2 = text.slice(end + HEADER_END.length).trim();
+        fail(new Error(`docker exec start failed: ${statusLine}${body2 ? ` \u2014 ${body2}` : ""}`));
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      socket.removeListener("data", onData);
+      socket.removeListener("error", fail);
+      socket.removeListener("close", onEarlyClose);
+      const headBytes = Buffer.byteLength(text.slice(0, end + HEADER_END.length), "latin1");
+      resolve(bridgeSocket(socket, head.subarray(headBytes)));
+    };
+    const onEarlyClose = () => fail(new Error("docker exec start: connection closed before upgrade"));
+    socket.on("data", onData);
+    socket.on("error", fail);
+    socket.on("close", onEarlyClose);
+    const body = JSON.stringify({ Detach: false, Tty: opts.tty });
+    socket.write(
+      `POST /exec/${execId}/start HTTP/1.1\r
+Host: ${conn.socketPath ? "localhost" : conn.host ?? "localhost"}\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: Upgrade\r
+Upgrade: tcp\r
+\r
+` + body
+    );
+  });
+}
+function daemonConnectionFrom(docker) {
+  const m = docker.modem ?? {};
+  return {
+    socketPath: typeof m.socketPath === "string" ? m.socketPath : void 0,
+    host: typeof m.host === "string" ? m.host : void 0,
+    port: typeof m.port === "number" || typeof m.port === "string" ? m.port : void 0,
+    protocol: typeof m.protocol === "string" ? m.protocol : void 0,
+    ca: m.ca,
+    cert: m.cert,
+    key: m.key
+  };
+}
+
+// ../../packages/adapters/src/runtime/docker-ssh-agent.ts
+import net2 from "net";
 var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var resolvedDockerSocketPathCache = /* @__PURE__ */ new WeakMap();
 var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
 var STREAMLOCAL_PROBE_TIMEOUT_MS = 8e3;
+var STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3e3;
+var VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
 function toSshConfig(opts) {
   return {
     host: opts.host ?? "",
@@ -182,13 +306,107 @@ async function openStreamlocalUpstream(opts) {
     throw error;
   }
 }
+function pipeThrough(client, upstream) {
+  const teardown = () => {
+    client.destroy();
+    upstream.destroy();
+  };
+  client.on("error", teardown);
+  upstream.on("error", teardown);
+  client.once("close", () => upstream.destroy());
+  upstream.once("close", () => client.destroy());
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+function awaitFirstByte(upstream, ms) {
+  return new Promise((resolve) => {
+    const finish = (chunk) => {
+      clearTimeout(timer);
+      upstream.removeListener("data", onData);
+      upstream.removeListener("error", onFail);
+      upstream.removeListener("close", onFail);
+      resolve(chunk);
+    };
+    const onData = (chunk) => finish(chunk);
+    const onFail = () => finish(null);
+    const timer = setTimeout(() => finish(null), ms);
+    upstream.on("data", onData);
+    upstream.once("error", onFail);
+    upstream.once("close", onFail);
+  });
+}
+function captureClient(client) {
+  const chunks = [];
+  let bytes = 0;
+  let overflowed = false;
+  let closed = false;
+  let live = null;
+  const onData = (chunk) => {
+    if (live) live.write(chunk);
+    if (overflowed) return;
+    chunks.push(chunk);
+    bytes += chunk.length;
+    if (bytes >= VERIFY_BUFFER_CAP_BYTES) {
+      overflowed = true;
+      client.pause();
+    }
+  };
+  const onGone = () => {
+    closed = true;
+  };
+  client.on("data", onData);
+  client.once("error", onGone);
+  client.once("close", onGone);
+  const detach = () => {
+    client.removeListener("data", onData);
+    client.removeListener("error", onGone);
+    client.removeListener("close", onGone);
+  };
+  return {
+    get closed() {
+      return closed;
+    },
+    get overflowed() {
+      return overflowed;
+    },
+    /** Replay everything buffered so far onto `upstream` and forward the rest
+     *  live. Safe to call again on a different upstream (the fallback): the full
+     *  buffer is retained until `commit`, so the replay is complete each time. */
+    feed(upstream) {
+      for (const chunk of chunks) upstream.write(chunk);
+      live = upstream;
+    },
+    /** Stop forwarding to the current upstream (keep buffering) — used before
+     *  destroying a dead channel so late bytes never hit a torn-down stream. */
+    stop() {
+      live = null;
+    },
+    /** Terminal: detach and hand the socket to the (already-fed) `upstream` via a
+     *  bidi pipe, or destroy it if the client already went away. */
+    commit(upstream) {
+      detach();
+      chunks.length = 0;
+      if (closed) {
+        upstream.destroy();
+        return;
+      }
+      pipeThrough(client, upstream);
+    },
+    /** Terminal: no usable upstream — surface the error to dockerode. */
+    fail(err) {
+      detach();
+      client.destroy(err instanceof Error ? err : new Error(String(err)));
+    }
+  };
+}
 function createDockerSshBridge(opts) {
   const clients = /* @__PURE__ */ new Set();
   let upstreamMode = null;
   let modeDecision = null;
   let dialClient = null;
-  const openDialStdioUpstream = async () => {
-    if (opts.executor?.openDockerDialStdio) {
+  let pooledUnreliable = false;
+  const openDialStdioUpstream = async (forceEphemeral = false) => {
+    if (!forceEphemeral && opts.executor?.openDockerDialStdio) {
       const stream = await opts.executor.openDockerDialStdio();
       stream.once(
         "error",
@@ -251,29 +469,57 @@ function createDockerSshBridge(opts) {
     modeDecision ??= decideMode().then((mode) => upstreamMode = mode);
     return modeDecision;
   };
-  const openUpstream = async () => {
-    const mode = await ensureMode();
-    return mode === "dialstdio" ? openDialStdioUpstream() : openStreamlocalUpstream(opts);
+  const downgradeToDialStdio = async (capture, reason) => {
+    console.warn(
+      `[docker-ssh] streamlocal unusable (${opts.host ?? "?"}): ${reason} \u2014 downgrading this bridge to dial-stdio (fresh connection) and replaying the buffered request.`
+    );
+    upstreamMode = "dialstdio";
+    pooledUnreliable = true;
+    const upstream = await openDialStdioUpstream(true);
+    capture.feed(upstream);
+    capture.commit(upstream);
+  };
+  const bridgeClient = async (client) => {
+    const capture = captureClient(client);
+    try {
+      const mode = await ensureMode();
+      if (mode === "dialstdio") {
+        const upstream = await openDialStdioUpstream(pooledUnreliable);
+        capture.feed(upstream);
+        capture.commit(upstream);
+        return;
+      }
+      let channel;
+      try {
+        channel = await withTimeout(
+          openStreamlocalUpstream(opts),
+          STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS,
+          `channel open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1e3}s`
+        );
+      } catch (err) {
+        await downgradeToDialStdio(capture, safeErrorMessage(err));
+        return;
+      }
+      capture.feed(channel);
+      const firstByte = capture.overflowed ? null : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
+      if (capture.overflowed || firstByte) {
+        if (firstByte) client.write(firstByte);
+        capture.commit(channel);
+        return;
+      }
+      capture.stop();
+      channel.destroy();
+      await downgradeToDialStdio(capture, "channel opened but no data flowed");
+    } catch (err) {
+      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+      capture.fail(err);
+    }
   };
-  const server = net.createServer((client) => {
+  const server = net2.createServer((client) => {
     clients.add(client);
     client.setNoDelay(true);
     client.once("close", () => clients.delete(client));
-    openUpstream().then((upstream) => {
-      const teardown = () => {
-        client.destroy();
-        upstream.destroy();
-      };
-      client.on("error", teardown);
-      upstream.on("error", teardown);
-      client.once("close", () => upstream.destroy());
-      upstream.once("close", () => client.destroy());
-      client.pipe(upstream);
-      upstream.pipe(client);
-    }).catch((error) => {
-      console.warn(`[docker-ssh] bridge upstream open failed: ${safeErrorMessage(error)}`);
-      client.destroy(error instanceof Error ? error : new Error(String(error)));
-    });
+    void bridgeClient(client);
   });
   return {
     start: () => new Promise((resolve, reject) => {
@@ -557,16 +803,16 @@ function parseTimestampedLine(line) {
   };
 }
 function firstNetworkIp(networks) {
-  for (const net2 of Object.values(networks ?? {})) {
-    if (net2?.IPAddress) return net2.IPAddress;
+  for (const net3 of Object.values(networks ?? {})) {
+    if (net3?.IPAddress) return net3.IPAddress;
   }
   return void 0;
 }
 function extractNetworkInfo(data) {
   let ip;
-  for (const net2 of Object.values(data.NetworkSettings.Networks ?? {})) {
-    if (net2.IPAddress) {
-      ip = net2.IPAddress;
+  for (const net3 of Object.values(data.NetworkSettings.Networks ?? {})) {
+    if (net3.IPAddress) {
+      ip = net3.IPAddress;
       break;
     }
   }
@@ -1225,11 +1471,43 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   /**
-   * Build a STATIC app in a Docker sandbox, then extract its doc-root onto a
-   * host directory the edge serves via nginx `root`. Reuses `build()` — so
-   * Docker is auto-ensured (ensureDockerFeature) and the static nginx image is
-   * produced (`generateStaticDockerfile` COPYs the output to the fixed
-   * `/usr/share/nginx/html`) — then extracts those files and discards the image.
+   * Move an extract-only static build's files out of its builder image onto
+   * `hostOutDir`, then delete the image.
+   *
+   * The ONE place this happens, shared by the single-app path
+   * ({@link buildStaticToHost}) and the compose batch path ({@link buildImages}) —
+   * they used to be destined to diverge, and the source path is subtle enough
+   * (see `staticBuilderOutputPath`) that two copies would drift into extracting an
+   * empty directory.
+   */
+  async moveStaticBuildToHost(tag, config, hostOutDir, log) {
+    const docRoot = staticBuilderOutputPath(config);
+    const sshExecutor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
+    log.log("Moving built files out of the build container...\n");
+    try {
+      if (sshExecutor) {
+        await this.extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir);
+      } else {
+        await this.extractDocRootViaDaemon(tag, docRoot, hostOutDir);
+      }
+      log.log(`Static files ready at ${hostOutDir}
+`);
+    } finally {
+      await this.removeImage(tag).catch(() => {
+      });
+    }
+  }
+  /**
+   * Build a STATIC app in a Docker sandbox, then move the built files onto a host
+   * directory the edge serves via nginx `root`. Reuses `build()` so Docker is
+   * auto-ensured (ensureDockerFeature).
+   *
+   * NO RUNTIME IMAGE. `staticExtractOnly` stops the recipe at the builder stage and
+   * the files are copied straight out of it. This used to build a full
+   * `nginx:alpine` runtime stage — pulling that image, running six more steps, and
+   * writing an nginx config nothing reads — only to `docker cp` the doc-root out
+   * and delete the whole thing moments later. The edge already serves these files;
+   * a second web server was never going to run.
    * Returns the host dir as `imageRef`, matching BareRuntime.build's host-dir
    * contract so the existing file-backed serve path (deployStatic /
    * resolveStaticRoot) consumes it unchanged. Never leaves a long-lived
@@ -1237,51 +1515,17 @@ var DockerRuntime = class _DockerRuntime {
    */
   async buildStaticToHost(config, hostOutDir, logger) {
     const log = logger ?? new BuildLogger();
-    const buildResult = await this.build({ ...config, isStatic: true }, log);
+    const buildResult = await this.build(
+      { ...config, isStatic: true, staticExtractOnly: true },
+      log
+    );
     if (buildResult.status !== "deploying" || !buildResult.imageRef) {
       return buildResult;
     }
     const tag = buildResult.imageRef;
     const extractStart = Date.now();
-    const DOC_ROOT = "/usr/share/nginx/html";
     try {
-      const sshExecutor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
-      log.log("Extracting static files from the build sandbox...\n");
-      if (sshExecutor) {
-        const cid = (await sshExecutor.exec(`docker create ${sq(tag)}`)).trim();
-        try {
-          await sshExecutor.exec(`mkdir -p ${sq(hostOutDir)}`);
-          await sshExecutor.exec(`docker cp ${sq(`${cid}:${DOC_ROOT}/.`)} ${sq(hostOutDir)}`);
-        } finally {
-          await sshExecutor.exec(`docker rm ${sq(cid)}`).catch(() => {
-          });
-        }
-      } else {
-        const { mkdir } = await import("fs/promises");
-        const { spawn } = await import("child_process");
-        await mkdir(hostOutDir, { recursive: true });
-        const container = await this.docker.createContainer({ Image: tag });
-        try {
-          const tarStream = await container.getArchive({ path: DOC_ROOT });
-          await new Promise((resolve, reject) => {
-            const extract = spawn("tar", ["-x", "--strip-components=1", "-C", hostOutDir]);
-            let errBuf = "";
-            extract.stderr.on("data", (d) => errBuf += d.toString());
-            extract.on("error", reject);
-            tarStream.on("error", reject);
-            tarStream.pipe(extract.stdin);
-            extract.on(
-              "close",
-              (code) => code === 0 ? resolve() : reject(new Error(`static extract failed (tar ${code}): ${errBuf.trim().slice(-500)}`))
-            );
-          });
-        } finally {
-          await container.remove({ force: true }).catch(() => {
-          });
-        }
-      }
-      log.log(`Static files ready at ${hostOutDir}
-`);
+      await this.moveStaticBuildToHost(tag, config, hostOutDir, log);
       return {
         sessionId: config.sessionId,
         status: "deploying",
@@ -1297,8 +1541,58 @@ var DockerRuntime = class _DockerRuntime {
         durationMs: (buildResult.durationMs ?? 0) + (Date.now() - extractStart),
         errorMessage: `Static extract failed: ${msg}`
       };
+    }
+  }
+  /**
+   * THE CONTRACT both extractors satisfy: after either one returns, `hostOutDir`
+   * holds the doc-root's CONTENTS directly — `index.html` at the top, no wrapping
+   * `html/` directory. OpenResty's `root` points straight at it, so a stray extra
+   * level is a silent 404 for the whole site.
+   *
+   * The two paths reach that same shape differently, which is why the rule is
+   * stated here once instead of in each branch:
+   *   - `docker cp <cid>:<root>/.` — the trailing `/.` means "contents of", so
+   *     there is nothing to strip.
+   *   - `getArchive({path: <root>})` — the tar IS rooted at `html/`, so exactly
+   *     one leading component must be stripped.
+   */
+  /** Remote host: disk-to-disk via the host's own docker CLI — never stream a
+   *  large tar over the SSH dockerode bridge (same rationale as saveImage/pullImage). */
+  async extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir) {
+    const cid = (await sshExecutor.exec(`docker create ${sq(tag)}`)).trim();
+    try {
+      await sshExecutor.exec(`mkdir -p ${sq(hostOutDir)}`);
+      await sshExecutor.exec(`docker cp ${sq(`${cid}:${docRoot}/.`)} ${sq(hostOutDir)}`);
     } finally {
-      await this.removeImage(tag).catch(() => {
+      await sshExecutor.exec(`docker rm ${sq(cid)}`).catch(() => {
+      });
+    }
+  }
+  /** Local socket / remote TCP: pull the tar through dockerode (portable to a TCP
+   *  daemon where a local `docker` CLI wouldn't apply) and extract onto THIS
+   *  process's filesystem — in docker-edge mode that's /opt/openship/static,
+   *  bind-mounted into both the api and the edge at the same path. */
+  async extractDocRootViaDaemon(tag, docRoot, hostOutDir) {
+    const { mkdir } = await import("fs/promises");
+    const { spawn } = await import("child_process");
+    await mkdir(hostOutDir, { recursive: true });
+    const container = await this.docker.createContainer({ Image: tag });
+    try {
+      const tarStream = await container.getArchive({ path: docRoot });
+      await new Promise((resolve, reject) => {
+        const extract = spawn("tar", ["-x", "--strip-components=1", "-C", hostOutDir]);
+        let errBuf = "";
+        extract.stderr.on("data", (d) => errBuf += d.toString());
+        extract.on("error", reject);
+        tarStream.on("error", reject);
+        tarStream.pipe(extract.stdin);
+        extract.on(
+          "close",
+          (code) => code === 0 ? resolve() : reject(new Error(`static extract failed (tar ${code}): ${errBuf.trim().slice(-500)}`))
+        );
+      });
+    } finally {
+      await container.remove({ force: true }).catch(() => {
       });
     }
   }
@@ -1429,6 +1723,23 @@ var DockerRuntime = class _DockerRuntime {
             await this.streamDockerodeBuild(stream, spec.logger);
           }
           await this.verifyImageBuilt(tag);
+          if (spec.config.staticExtractOnly && spec.config.staticOutDir) {
+            await this.moveStaticBuildToHost(
+              tag,
+              spec.config,
+              spec.config.staticOutDir,
+              spec.logger
+            );
+            const result2 = {
+              sessionId: spec.config.sessionId,
+              status: "deploying",
+              imageRef: spec.config.staticOutDir,
+              durationMs: Date.now() - startedAt
+            };
+            spec.onResult?.(result2);
+            results.push({ serviceName: spec.serviceName, result: result2 });
+            continue;
+          }
           spec.logger.log(`Image ${tag} is ready.
 `);
           const result = {
@@ -2107,8 +2418,8 @@ var DockerRuntime = class _DockerRuntime {
   async getContainerIp(containerId) {
     const container = this.docker.getContainer(containerId);
     const data = await container.inspect();
-    for (const net2 of Object.values(data.NetworkSettings.Networks ?? {})) {
-      if (net2.IPAddress) return net2.IPAddress;
+    for (const net3 of Object.values(data.NetworkSettings.Networks ?? {})) {
+      if (net3.IPAddress) return net3.IPAddress;
     }
     return null;
   }
@@ -2145,11 +2456,11 @@ var DockerRuntime = class _DockerRuntime {
       Cmd: ["/bin/sh", "-lc", "exec $(command -v bash || echo /bin/sh)"],
       Env: [`TERM=${term}`]
     });
-    const duplex = await exec.start({
-      hijack: true,
-      stdin: true,
-      Tty: true
-    });
+    const duplex = await startExecStream(
+      daemonConnectionFrom(this.docker),
+      exec.id,
+      { tty: true, stdin: true }
+    );
     try {
       await exec.resize({ h: rows, w: cols });
     } catch {
@@ -2157,6 +2468,7 @@ var DockerRuntime = class _DockerRuntime {
     const stdout = new PassThrough();
     const stderr = new PassThrough();
     duplex.on("data", (chunk) => stdout.write(chunk));
+    duplex.resume();
     duplex.on("end", () => {
       stdout.end();
       stderr.end();

package/dist/{chunk-HYL4QYZM.js → chunk-TGIINPVM.js}

@@ -1,12 +1,14 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   LocalExecutor
-} from "./chunk-SYCZE6FQ.js";
+} from "./chunk-TYVME3XD.js";
 import {
   logEntry,
   sq
-} from "./chunk-Z6EKX6CX.js";
+} from "./chunk-FPRHYBY2.js";
 
 // ../../packages/adapters/src/system/docker-edge-executor.ts
 import Dockerode from "dockerode";
@@ -74,6 +76,15 @@ var DockerEdgeExecutor = class {
   // ── File ops ─────────────────────────────────────────────────────────────
   // "mounted": the shared volume is in this process's filesystem → node:fs.
   // "container": reach it through the daemon → `docker exec` in the edge.
+  /** Same fileMode split as every other file op — never a bare `docker exec mv`. */
+  async rename(from, to) {
+    if (this.fileMode === "mounted") {
+      await this.files.rename(from, to);
+      return;
+    }
+    const { code, stderr } = await this.run(`mv ${sq(from)} ${sq(to)}`);
+    if (code !== 0) throw new Error(stderr.trim() || `Failed to rename ${from}`);
+  }
   async writeFile(path, content) {
     if (this.fileMode === "mounted") return this.files.writeFile(path, content);
     const encoded = Buffer.from(content, "utf8").toString("base64");

package/dist/{chunk-SYCZE6FQ.js → chunk-TYVME3XD.js}

@@ -1,3 +1,5 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
@@ -6,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-Z6EKX6CX.js";
+} from "./chunk-FPRHYBY2.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";
@@ -14,6 +16,7 @@ import {
   access,
   mkdir as fsMkdir,
   readFile as fsReadFile,
+  rename as fsRename,
   rm as fsRm,
   writeFile as fsWriteFile
 } from "fs/promises";
@@ -66,6 +69,9 @@ var LocalExecutor = class {
     await fsMkdir(dirname(path), { recursive: true });
     await fsWriteFile(path, content, "utf-8");
   }
+  async rename(from, to) {
+    await fsRename(from, to);
+  }
   async readFile(path) {
     return fsReadFile(path, "utf-8");
   }