openship 0.4.6 → 0.4.7

package/dist/{chunk-3JQTL4R4.js → chunk-IMBD5PZ5.js}

@@ -101,10 +101,10 @@ import {
 } from "./chunk-W73X43R7.js";
 import {
   CloudRuntime
-} from "./chunk-5FNIWBFI.js";
+} from "./chunk-XFCDYZUQ.js";
 import {
   systemCatalog
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-UXWAVM4C.js";
 import {
   AwsCrc32,
   __awaiter,
@@ -139,13 +139,18 @@ import {
   DockerRuntime,
   isHostPathSource,
   scopedVolumeName
-} from "./chunk-2ZLR7ULL.js";
+} from "./chunk-SJIFLLX4.js";
 import {
   BareRuntime
 } from "./chunk-VDMQJHPI.js";
 import {
+  LocalExecutor
+} from "./chunk-TYVME3XD.js";
+import {
+  EDGE_CONTAINER_NAME,
+  edgeCrashReason,
   invalidateEdgeContainer
-} from "./chunk-FQGJZ2HS.js";
+} from "./chunk-R5BHFFAV.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
@@ -159,13 +164,6 @@ import {
 import chalk from "chalk";
 import ora from "ora";
 
-// src/lib/compose.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir2, userInfo } from "os";
-import { join as join6 } from "path";
-
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
 
@@ -12668,6 +12666,13 @@ var SftpDestinationImpl = class {
 registerDestination("sftp", (row) => new SftpDestinationImpl(row));
 registerDestination("openship_server", (row) => new SftpDestinationImpl(row));
 
+// src/lib/compose.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { randomBytes as randomBytes5 } from "crypto";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2, userInfo } from "os";
+import { join as join6 } from "path";
+
 // src/lib/paths.ts
 import { homedir } from "os";
 import { join as join3, resolve as resolve2 } from "path";
@@ -13229,7 +13234,7 @@ function renderEnv(opts, host, cfg) {
     // (hides the local row). Written explicitly so the policy is visible in .env.
     `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
     `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.6" : "latest")}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.7" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
     `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
@@ -13435,11 +13440,17 @@ async function importMigratedSites(apiPort, sites, certPems) {
         `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
       );
       for (const w2 of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w2}`));
+      const edgeLog = await edgeCrashReason(new LocalExecutor());
+      if (edgeLog) {
+        console.log(chalk.red(`
+  The edge container is not running. Its log says:`));
+        console.log(chalk.red(`    ${edgeLog}`));
+      }
       console.log(
         chalk.yellow(
           `
   Retry the import with \`openship up\` once the cause above is fixed, or put your
-  previous proxy back:  docker stop openship-edge && sudo systemctl enable --now nginx
+  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && sudo systemctl enable --now nginx
 `
         )
       );

package/dist/{chunk-C5OHTYEF.js → chunk-IPYPMI3S.js}

@@ -6,7 +6,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-UXWAVM4C.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";

package/dist/{chunk-FQGJZ2HS.js → chunk-R5BHFFAV.js}

@@ -59,6 +59,36 @@ function sq(value) {
 function isOurEdgeContainer(name, image) {
   return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
 }
+async function edgeIsServing(executor, port = 80) {
+  const running = await tryExec(
+    executor,
+    `docker inspect -f '{{.State.Running}}' ${sq(EDGE_CONTAINER_NAME)} 2>/dev/null`
+  );
+  if ((running ?? "").trim() !== "true") return false;
+  const probe = await tryExec(
+    executor,
+    containerShell(`wget -q -O /dev/null -T 3 http://127.0.0.1:${port}/ >/dev/null 2>&1; echo $?`)
+  );
+  const code = (probe ?? "").trim().split("\n").pop() ?? "1";
+  return code === "0" || code === "8";
+}
+function containerShell(command) {
+  return `docker exec ${sq(EDGE_CONTAINER_NAME)} sh -c ${sq(command)}`;
+}
+async function edgeCrashReason(executor) {
+  const logs = await tryExec(
+    executor,
+    `docker logs --tail 40 ${sq(EDGE_CONTAINER_NAME)} 2>&1`
+  );
+  return logs ? edgeFailureReason(logs) : null;
+}
+function edgeFailureReason(containerLog) {
+  const lines = containerLog.split("\n").map((l) => l.trim()).filter(Boolean);
+  const emerg = lines.find((l) => l.includes("[emerg]"));
+  if (emerg) return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
+  return lines.at(-1) ?? null;
+}
+var EDGE_CONTAINER_NAME = "openship-edge";
 async function ourEdgeContainerRunning(executor) {
   return Boolean(await resolveOurEdgeContainer(executor));
 }
@@ -238,6 +268,10 @@ export {
   classifyProxy,
   sq,
   isOurEdgeContainer,
+  edgeIsServing,
+  edgeCrashReason,
+  edgeFailureReason,
+  EDGE_CONTAINER_NAME,
   ourEdgeContainerRunning,
   invalidateEdgeContainer,
   resolveOurEdgeContainer,

package/dist/{chunk-2ZLR7ULL.js → chunk-SJIFLLX4.js}

@@ -207,6 +207,8 @@ var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var resolvedDockerSocketPathCache = /* @__PURE__ */ new WeakMap();
 var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
 var STREAMLOCAL_PROBE_TIMEOUT_MS = 8e3;
+var STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3e3;
+var VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
 function toSshConfig(opts) {
   return {
     host: opts.host ?? "",
@@ -304,13 +306,107 @@ async function openStreamlocalUpstream(opts) {
     throw error;
   }
 }
+function pipeThrough(client, upstream) {
+  const teardown = () => {
+    client.destroy();
+    upstream.destroy();
+  };
+  client.on("error", teardown);
+  upstream.on("error", teardown);
+  client.once("close", () => upstream.destroy());
+  upstream.once("close", () => client.destroy());
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+function awaitFirstByte(upstream, ms) {
+  return new Promise((resolve) => {
+    const finish = (chunk) => {
+      clearTimeout(timer);
+      upstream.removeListener("data", onData);
+      upstream.removeListener("error", onFail);
+      upstream.removeListener("close", onFail);
+      resolve(chunk);
+    };
+    const onData = (chunk) => finish(chunk);
+    const onFail = () => finish(null);
+    const timer = setTimeout(() => finish(null), ms);
+    upstream.on("data", onData);
+    upstream.once("error", onFail);
+    upstream.once("close", onFail);
+  });
+}
+function captureClient(client) {
+  const chunks = [];
+  let bytes = 0;
+  let overflowed = false;
+  let closed = false;
+  let live = null;
+  const onData = (chunk) => {
+    if (live) live.write(chunk);
+    if (overflowed) return;
+    chunks.push(chunk);
+    bytes += chunk.length;
+    if (bytes >= VERIFY_BUFFER_CAP_BYTES) {
+      overflowed = true;
+      client.pause();
+    }
+  };
+  const onGone = () => {
+    closed = true;
+  };
+  client.on("data", onData);
+  client.once("error", onGone);
+  client.once("close", onGone);
+  const detach = () => {
+    client.removeListener("data", onData);
+    client.removeListener("error", onGone);
+    client.removeListener("close", onGone);
+  };
+  return {
+    get closed() {
+      return closed;
+    },
+    get overflowed() {
+      return overflowed;
+    },
+    /** Replay everything buffered so far onto `upstream` and forward the rest
+     *  live. Safe to call again on a different upstream (the fallback): the full
+     *  buffer is retained until `commit`, so the replay is complete each time. */
+    feed(upstream) {
+      for (const chunk of chunks) upstream.write(chunk);
+      live = upstream;
+    },
+    /** Stop forwarding to the current upstream (keep buffering) — used before
+     *  destroying a dead channel so late bytes never hit a torn-down stream. */
+    stop() {
+      live = null;
+    },
+    /** Terminal: detach and hand the socket to the (already-fed) `upstream` via a
+     *  bidi pipe, or destroy it if the client already went away. */
+    commit(upstream) {
+      detach();
+      chunks.length = 0;
+      if (closed) {
+        upstream.destroy();
+        return;
+      }
+      pipeThrough(client, upstream);
+    },
+    /** Terminal: no usable upstream — surface the error to dockerode. */
+    fail(err) {
+      detach();
+      client.destroy(err instanceof Error ? err : new Error(String(err)));
+    }
+  };
+}
 function createDockerSshBridge(opts) {
   const clients = /* @__PURE__ */ new Set();
   let upstreamMode = null;
   let modeDecision = null;
   let dialClient = null;
-  const openDialStdioUpstream = async () => {
-    if (opts.executor?.openDockerDialStdio) {
+  let pooledUnreliable = false;
+  const openDialStdioUpstream = async (forceEphemeral = false) => {
+    if (!forceEphemeral && opts.executor?.openDockerDialStdio) {
       const stream = await opts.executor.openDockerDialStdio();
       stream.once(
         "error",
@@ -373,29 +469,57 @@ function createDockerSshBridge(opts) {
     modeDecision ??= decideMode().then((mode) => upstreamMode = mode);
     return modeDecision;
   };
-  const openUpstream = async () => {
-    const mode = await ensureMode();
-    return mode === "dialstdio" ? openDialStdioUpstream() : openStreamlocalUpstream(opts);
+  const downgradeToDialStdio = async (capture, reason) => {
+    console.warn(
+      `[docker-ssh] streamlocal unusable (${opts.host ?? "?"}): ${reason} \u2014 downgrading this bridge to dial-stdio (fresh connection) and replaying the buffered request.`
+    );
+    upstreamMode = "dialstdio";
+    pooledUnreliable = true;
+    const upstream = await openDialStdioUpstream(true);
+    capture.feed(upstream);
+    capture.commit(upstream);
+  };
+  const bridgeClient = async (client) => {
+    const capture = captureClient(client);
+    try {
+      const mode = await ensureMode();
+      if (mode === "dialstdio") {
+        const upstream = await openDialStdioUpstream(pooledUnreliable);
+        capture.feed(upstream);
+        capture.commit(upstream);
+        return;
+      }
+      let channel;
+      try {
+        channel = await withTimeout(
+          openStreamlocalUpstream(opts),
+          STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS,
+          `channel open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1e3}s`
+        );
+      } catch (err) {
+        await downgradeToDialStdio(capture, safeErrorMessage(err));
+        return;
+      }
+      capture.feed(channel);
+      const firstByte = capture.overflowed ? null : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
+      if (capture.overflowed || firstByte) {
+        if (firstByte) client.write(firstByte);
+        capture.commit(channel);
+        return;
+      }
+      capture.stop();
+      channel.destroy();
+      await downgradeToDialStdio(capture, "channel opened but no data flowed");
+    } catch (err) {
+      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+      capture.fail(err);
+    }
   };
   const server = net2.createServer((client) => {
     clients.add(client);
     client.setNoDelay(true);
     client.once("close", () => clients.delete(client));
-    openUpstream().then((upstream) => {
-      const teardown = () => {
-        client.destroy();
-        upstream.destroy();
-      };
-      client.on("error", teardown);
-      upstream.on("error", teardown);
-      client.once("close", () => upstream.destroy());
-      upstream.once("close", () => client.destroy());
-      client.pipe(upstream);
-      upstream.pipe(client);
-    }).catch((error) => {
-      console.warn(`[docker-ssh] bridge upstream open failed: ${safeErrorMessage(error)}`);
-      client.destroy(error instanceof Error ? error : new Error(String(error)));
-    });
+    void bridgeClient(client);
   });
   return {
     start: () => new Promise((resolve, reject) => {

package/dist/{chunk-SQ77DZOI.js → chunk-UXWAVM4C.js}

@@ -22,8 +22,10 @@ import {
   sq
 } from "./chunk-FPRHYBY2.js";
 import {
+  EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
+  edgeFailureReason,
   freeEdgeTargets,
   invalidateEdgeContainer,
   ourLuaOnHost,
@@ -31,7 +33,7 @@ import {
   resolveOurEdgeContainer,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-FQGJZ2HS.js";
+} from "./chunk-R5BHFFAV.js";
 import {
   waitForPortListening
 } from "./chunk-ILFETZOM.js";
@@ -976,6 +978,8 @@ async function readJournal(executor) {
 }
 async function rollback(executor, journal, onLog) {
   onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  await tryExec2(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec2(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
   await tryExec2(
     executor,
     "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
@@ -1000,6 +1004,24 @@ async function rollback(executor, journal, onLog) {
       onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
     }
   }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(
+      log(
+        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
+        "error"
+      )
+    );
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex = port.toString(16).toUpperCase().padStart(4, "0");
+  const out = await tryExec2(
+    executor,
+    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
+  );
+  return (out ?? "").includes("yes");
 }
 async function beginEdgeTakeover(executor, status, onLog) {
   await writeJournal(executor, await buildJournal(executor, status));
@@ -1008,9 +1030,9 @@ async function beginEdgeTakeover(executor, status, onLog) {
 async function rollbackEdgeTakeover(executor, onLog) {
   const journal = await readJournal(executor);
   if (!journal || journal.completed) return false;
-  await rollback(executor, journal, onLog);
+  const restored = await rollback(executor, journal, onLog);
   await clearJournal(executor);
-  return true;
+  return restored;
 }
 async function completeEdgeTakeover(executor) {
   const journal = await readJournal(executor);
@@ -1802,7 +1824,6 @@ async function ensureEdgeClear(executor, config, onLog) {
 }
 
 // ../../packages/adapters/src/system/proxy/ensure-container-edge.ts
-var EDGE_CONTAINER_NAME = "openship-edge";
 function log4(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
@@ -1821,7 +1842,7 @@ async function runningImage(executor, container) {
   return out.trim() || null;
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-2GTRUIDE.js");
+  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -1836,7 +1857,7 @@ async function containerEdgeProvider(executor, container, opts) {
 }
 async function localContainerEdgeProvider(container, opts) {
   const { DockerEdgeExecutor } = await import("./docker-edge-executor-VHW3JPJS.js");
-  const { NginxProvider: Provider } = await import("./nginx-2GTRUIDE.js");
+  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -1893,6 +1914,35 @@ async function swapEdgeImage(executor, container, from, to, opts) {
   onLog(log4(`Rollback to ${from} ALSO failed \u2014 the edge is down on this server.`, "error"));
   return { swapped: false, edgeDown: true };
 }
+async function listDir(executor, dir) {
+  const out = await executor.exec(`ls -1 ${sq(dir)} 2>/dev/null || true`).catch(() => "");
+  return new Set(
+    out.split("\n").map((l) => l.trim()).filter(Boolean)
+  );
+}
+async function sanitizeCarriedVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    // A real server_name is anything that isn't the `_` wildcard.
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -i -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out = await executor.exec(script).catch(() => "");
+  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [action, file] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(log4(`Dropped the bare edge's catch-all ${file} \u2014 the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(log4(`Removed default_server from ${file} \u2014 the edge image owns it.`, "warn"));
+    }
+  }
+}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -1931,16 +1981,28 @@ async function ensureContainerEdge(executor, opts) {
     });
   }
   const sitesTarget = EDGE_HOST_PATHS.sitesDir;
+  let beforeCarry = null;
   if (bareWasOurs) {
     const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
     if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
       onLog(log4(`Carrying vhosts from ${barePaths.sitesDir}...`));
+      beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
       });
+      await sanitizeCarriedVhosts(executor, sitesTarget, onLog);
     }
   }
   const restoreBare = async () => {
     if (!bareWasOurs) return;
+    if (beforeCarry) {
+      const now = await listDir(executor, sitesTarget);
+      const added = [...now].filter((name) => !beforeCarry.has(name));
+      if (added.length > 0) {
+        await executor.exec(`rm -f ${added.map((n) => sq(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {
+        });
+        onLog(log4(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
+      }
+    }
     onLog(log4("Restoring the host OpenResty edge...", "warn"));
     await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {
     });
@@ -1982,7 +2044,8 @@ ${logs}`, "error"));
     });
     invalidateEdgeContainer(executor);
     await restoreBare();
-    throw new Error(`Edge container setup failed: ${msg}`);
+    const reason = edgeFailureReason(logs);
+    throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
 
@@ -2000,7 +2063,6 @@ export {
   rollbackEdgeTakeover,
   completeEdgeTakeover,
   recoverInterruptedTakeover,
-  EDGE_CONTAINER_NAME,
   setDefaultEdgeImage,
   resolveEdgeImage,
   dockerAvailable,

package/dist/{chunk-5FNIWBFI.js → chunk-XFCDYZUQ.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-UXWAVM4C.js";
 import {
   createDockerBuildContext,
   normalizeDockerRelativePath,

package/dist/{cloud-ZSKOS4GY.js → cloud-2KXREXMO.js}

@@ -6,8 +6,8 @@ import {
   CloudRuntime,
   PAGE_CONTAINER_PREFIX,
   provisionCloudWorkspace
-} from "./chunk-5FNIWBFI.js";
-import "./chunk-SQ77DZOI.js";
+} from "./chunk-XFCDYZUQ.js";
+import "./chunk-UXWAVM4C.js";
 import "./chunk-V6AN6XLZ.js";
 import "./chunk-MZ2WEHHY.js";
 import "./chunk-L2VOGB2X.js";
@@ -18,7 +18,7 @@ import "./chunk-RPHRPFEH.js";
 import "./chunk-TYVME3XD.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-FQGJZ2HS.js";
+import "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/{detect-SH4FHFBI.js → detect-2XSCFFTF.js}

@@ -3,9 +3,13 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
   classifyProxy,
+  edgeCrashReason,
+  edgeFailureReason,
+  edgeIsServing,
   freeEdgeTargets,
   invalidateEdgeContainer,
   isOurEdgeContainer,
@@ -15,15 +19,19 @@ import {
   resolveOurEdgeContainer,
   sq,
   stopTargetsForStatus
-} from "./chunk-FQGJZ2HS.js";
+} from "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";
 import "./chunk-KI2EY3WB.js";
 export {
+  EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
   classifyProxy,
+  edgeCrashReason,
+  edgeFailureReason,
+  edgeIsServing,
   freeEdgeTargets,
   invalidateEdgeContainer,
   isOurEdgeContainer,

package/dist/{docker-U7AF5PTA.js → docker-LODK5Y2S.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   DockerRuntime
-} from "./chunk-2ZLR7ULL.js";
+} from "./chunk-SJIFLLX4.js";
 import "./chunk-V6AN6XLZ.js";
 import "./chunk-4Z5QO7N6.js";
 import "./chunk-OXWDY22G.js";

package/dist/{edge-import-V5CBA47C.js → edge-import-ZQ4Y5HEA.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   importMigratedSites,
   waitForApiHealth
-} from "./chunk-3JQTL4R4.js";
+} from "./chunk-IMBD5PZ5.js";
 import "./chunk-FRNAR33O.js";
 import "./chunk-EI575GHN.js";
 import "./chunk-6APIPIJY.js";
@@ -14,15 +14,15 @@ import "./chunk-OWED2GRM.js";
 import "./chunk-VWPEKOH6.js";
 import "./chunk-W73X43R7.js";
 import "./chunk-TGIINPVM.js";
-import "./chunk-5FNIWBFI.js";
+import "./chunk-XFCDYZUQ.js";
 import "./chunk-AVIB7CT7.js";
 import "./chunk-5MZ624VX.js";
 import "./chunk-Q2CIRAOK.js";
-import "./chunk-C5OHTYEF.js";
-import "./chunk-SQ77DZOI.js";
+import "./chunk-IPYPMI3S.js";
+import "./chunk-UXWAVM4C.js";
 import "./chunk-O6ZZF52V.js";
 import "./chunk-JYGD5WSN.js";
-import "./chunk-2ZLR7ULL.js";
+import "./chunk-SJIFLLX4.js";
 import "./chunk-V6AN6XLZ.js";
 import "./chunk-VDMQJHPI.js";
 import "./chunk-MZ2WEHHY.js";
@@ -34,7 +34,7 @@ import "./chunk-RPHRPFEH.js";
 import "./chunk-TYVME3XD.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-FQGJZ2HS.js";
+import "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/{ensure-container-edge-CMYROUSI.js → ensure-container-edge-ED25XL3Z.js}

@@ -3,7 +3,6 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  EDGE_CONTAINER_NAME,
   buildEdgeRunCommand,
   containerEdgeProvider,
   dockerAvailable,
@@ -11,18 +10,17 @@ import {
   localContainerEdgeProvider,
   resolveEdgeImage,
   setDefaultEdgeImage
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-UXWAVM4C.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-FQGJZ2HS.js";
+import "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";
 import "./chunk-KI2EY3WB.js";
 export {
-  EDGE_CONTAINER_NAME,
   buildEdgeRunCommand,
   containerEdgeProvider,
   dockerAvailable,

package/dist/index.js

@@ -25,7 +25,7 @@ import {
   remoteSha,
   shortSha,
   sourceBuildDir
-} from "./chunk-3JQTL4R4.js";
+} from "./chunk-IMBD5PZ5.js";
 import "./chunk-FRNAR33O.js";
 import "./chunk-EI575GHN.js";
 import "./chunk-6APIPIJY.js";
@@ -34,11 +34,11 @@ import "./chunk-OWED2GRM.js";
 import "./chunk-VWPEKOH6.js";
 import "./chunk-W73X43R7.js";
 import "./chunk-TGIINPVM.js";
-import "./chunk-5FNIWBFI.js";
+import "./chunk-XFCDYZUQ.js";
 import "./chunk-AVIB7CT7.js";
 import "./chunk-5MZ624VX.js";
 import "./chunk-Q2CIRAOK.js";
-import "./chunk-C5OHTYEF.js";
+import "./chunk-IPYPMI3S.js";
 import {
   beginEdgeTakeover,
   collectProxyCerts,
@@ -51,10 +51,10 @@ import {
   recoverInterruptedTakeover,
   rollbackEdgeTakeover,
   scanImportableSites
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-UXWAVM4C.js";
 import "./chunk-O6ZZF52V.js";
 import "./chunk-JYGD5WSN.js";
-import "./chunk-2ZLR7ULL.js";
+import "./chunk-SJIFLLX4.js";
 import "./chunk-V6AN6XLZ.js";
 import "./chunk-VDMQJHPI.js";
 import "./chunk-MZ2WEHHY.js";
@@ -69,8 +69,10 @@ import {
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
 import {
+  edgeCrashReason,
+  edgeIsServing,
   ourEdgeContainerRunning
-} from "./chunk-FQGJZ2HS.js";
+} from "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import {
@@ -1722,6 +1724,27 @@ async function runCompose(opts) {
     process.exit(1);
   }
   spinner5.succeed("Openship is running via Docker Compose.");
+  if (edgePlan.action && !await edgeIsServing(new LocalExecutor())) {
+    const reason = await edgeCrashReason(new LocalExecutor());
+    console.error(
+      chalk6.red(`
+  Openship's edge is not serving :80${reason ? ` \u2014 ${reason}` : "."}`)
+    );
+    const restored = await rollbackHostEdge();
+    console.error(
+      restored ? chalk6.yellow(
+        `  Your previous proxy has been restarted \u2014 the box is serving again, on it.
+  Nothing was migrated. Fix the cause above, then re-run \`openship up\`.
+`
+      ) : chalk6.red(
+        `  AND your previous proxy could NOT be restarted automatically \u2014 the box is
+  serving nothing right now. Start it by hand:
+    docker stop openship-edge && sudo systemctl enable --now nginx
+`
+      )
+    );
+    process.exit(1);
+  }
   let importedOk = true;
   if (edgePlan.action === "migrate" && edgePlan.sites?.length) {
     const outcome = await importMigratedSites(res.apiPort, edgePlan.sites, edgePlan.certPems);
@@ -1973,7 +1996,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.4.6"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.4.7"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -6582,7 +6605,7 @@ function detectPackageManager2(override) {
 var updateCommand = new Command26("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").option("--rebuild", "From-source installs: rebuild even if already at the remote tip").action(async (opts) => {
   const source = readSourceInstall();
   if (source) return runSourceUpdate(source, opts);
-  const current = "0.4.6";
+  const current = "0.4.7";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -7149,7 +7172,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.4.6"}`;
+  const uiTag = `v${"0.4.7"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7217,7 +7240,7 @@ async function runWizard() {
     const up = composeUp({
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.4.6",
+      version: "0.4.7",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7554,7 +7577,7 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.6").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.7").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/{nginx-2GTRUIDE.js → nginx-XWJAOGS4.js}

@@ -10,7 +10,7 @@ import {
   summarizeCertbotFailure
 } from "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-FQGJZ2HS.js";
+import "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/server/index.js

@@ -21998,13 +21998,102 @@ async function openStreamlocalUpstream(opts) {
     throw error51;
   }
 }
+function pipeThrough(client, upstream) {
+  const teardown = () => {
+    client.destroy();
+    upstream.destroy();
+  };
+  client.on("error", teardown);
+  upstream.on("error", teardown);
+  client.once("close", () => upstream.destroy());
+  upstream.once("close", () => client.destroy());
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+function awaitFirstByte(upstream, ms) {
+  return new Promise((resolve2) => {
+    const finish = (chunk) => {
+      clearTimeout(timer);
+      upstream.removeListener("data", onData);
+      upstream.removeListener("error", onFail);
+      upstream.removeListener("close", onFail);
+      resolve2(chunk);
+    };
+    const onData = (chunk) => finish(chunk);
+    const onFail = () => finish(null);
+    const timer = setTimeout(() => finish(null), ms);
+    upstream.on("data", onData);
+    upstream.once("error", onFail);
+    upstream.once("close", onFail);
+  });
+}
+function captureClient(client) {
+  const chunks = [];
+  let bytes = 0;
+  let overflowed = false;
+  let closed = false;
+  let live = null;
+  const onData = (chunk) => {
+    if (live)
+      live.write(chunk);
+    if (overflowed)
+      return;
+    chunks.push(chunk);
+    bytes += chunk.length;
+    if (bytes >= VERIFY_BUFFER_CAP_BYTES) {
+      overflowed = true;
+      client.pause();
+    }
+  };
+  const onGone = () => {
+    closed = true;
+  };
+  client.on("data", onData);
+  client.once("error", onGone);
+  client.once("close", onGone);
+  const detach = () => {
+    client.removeListener("data", onData);
+    client.removeListener("error", onGone);
+    client.removeListener("close", onGone);
+  };
+  return {
+    get closed() {
+      return closed;
+    },
+    get overflowed() {
+      return overflowed;
+    },
+    feed(upstream) {
+      for (const chunk of chunks)
+        upstream.write(chunk);
+      live = upstream;
+    },
+    stop() {
+      live = null;
+    },
+    commit(upstream) {
+      detach();
+      chunks.length = 0;
+      if (closed) {
+        upstream.destroy();
+        return;
+      }
+      pipeThrough(client, upstream);
+    },
+    fail(err2) {
+      detach();
+      client.destroy(err2 instanceof Error ? err2 : new Error(String(err2)));
+    }
+  };
+}
 function createDockerSshBridge(opts) {
   const clients = new Set;
   let upstreamMode = null;
   let modeDecision = null;
   let dialClient = null;
-  const openDialStdioUpstream = async () => {
-    if (opts.executor?.openDockerDialStdio) {
+  let pooledUnreliable = false;
+  const openDialStdioUpstream = async (forceEphemeral = false) => {
+    if (!forceEphemeral && opts.executor?.openDockerDialStdio) {
       const stream = await opts.executor.openDockerDialStdio();
       stream.once("error", (e) => console.warn(`[docker-ssh] dial-stdio channel error: ${safeErrorMessage(e)}`));
       return stream;
@@ -22061,29 +22150,52 @@ Host: localhost\r
     modeDecision ??= decideMode().then((mode) => upstreamMode = mode);
     return modeDecision;
   };
-  const openUpstream = async () => {
-    const mode = await ensureMode();
-    return mode === "dialstdio" ? openDialStdioUpstream() : openStreamlocalUpstream(opts);
+  const downgradeToDialStdio = async (capture, reason) => {
+    console.warn(`[docker-ssh] streamlocal unusable (${opts.host ?? "?"}): ${reason} — ` + "downgrading this bridge to dial-stdio (fresh connection) and replaying the buffered request.");
+    upstreamMode = "dialstdio";
+    pooledUnreliable = true;
+    const upstream = await openDialStdioUpstream(true);
+    capture.feed(upstream);
+    capture.commit(upstream);
+  };
+  const bridgeClient = async (client) => {
+    const capture = captureClient(client);
+    try {
+      const mode = await ensureMode();
+      if (mode === "dialstdio") {
+        const upstream = await openDialStdioUpstream(pooledUnreliable);
+        capture.feed(upstream);
+        capture.commit(upstream);
+        return;
+      }
+      let channel;
+      try {
+        channel = await withTimeout(openStreamlocalUpstream(opts), STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS, `channel open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1000}s`);
+      } catch (err2) {
+        await downgradeToDialStdio(capture, safeErrorMessage(err2));
+        return;
+      }
+      capture.feed(channel);
+      const firstByte = capture.overflowed ? null : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
+      if (capture.overflowed || firstByte) {
+        if (firstByte)
+          client.write(firstByte);
+        capture.commit(channel);
+        return;
+      }
+      capture.stop();
+      channel.destroy();
+      await downgradeToDialStdio(capture, "channel opened but no data flowed");
+    } catch (err2) {
+      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err2)}`);
+      capture.fail(err2);
+    }
   };
   const server = net2.createServer((client) => {
     clients.add(client);
     client.setNoDelay(true);
     client.once("close", () => clients.delete(client));
-    openUpstream().then((upstream) => {
-      const teardown = () => {
-        client.destroy();
-        upstream.destroy();
-      };
-      client.on("error", teardown);
-      upstream.on("error", teardown);
-      client.once("close", () => upstream.destroy());
-      upstream.once("close", () => client.destroy());
-      client.pipe(upstream);
-      upstream.pipe(client);
-    }).catch((error51) => {
-      console.warn(`[docker-ssh] bridge upstream open failed: ${safeErrorMessage(error51)}`);
-      client.destroy(error51 instanceof Error ? error51 : new Error(String(error51)));
-    });
+    bridgeClient(client);
   });
   return {
     start: () => new Promise((resolve2, reject) => {
@@ -22113,11 +22225,12 @@ Host: localhost\r
     }
   };
 }
-var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock", resolvedDockerSocketPathCache, DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio", STREAMLOCAL_PROBE_TIMEOUT_MS = 8000, DOCKER_SOCKET_DISCOVERY_SCRIPT;
+var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock", resolvedDockerSocketPathCache, DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio", STREAMLOCAL_PROBE_TIMEOUT_MS = 8000, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3000, VERIFY_BUFFER_CAP_BYTES, DOCKER_SOCKET_DISCOVERY_SCRIPT;
 var init_docker_ssh_agent = __esm(() => {
   init_ssh_client();
   init_src();
   resolvedDockerSocketPathCache = new WeakMap;
+  VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
   DOCKER_SOCKET_DISCOVERY_SCRIPT = [
     "set -eu",
     'uid="$(id -u 2>/dev/null || printf 0)"',
@@ -29262,9 +29375,13 @@ __export(exports_detect, {
   isOurEdgeContainer: () => isOurEdgeContainer,
   invalidateEdgeContainer: () => invalidateEdgeContainer,
   freeEdgeTargets: () => freeEdgeTargets,
+  edgeIsServing: () => edgeIsServing,
+  edgeFailureReason: () => edgeFailureReason,
+  edgeCrashReason: () => edgeCrashReason,
   classifyProxy: () => classifyProxy,
   EdgeMigrateRequested: () => EdgeMigrateRequested,
-  EdgeConflictError: () => EdgeConflictError
+  EdgeConflictError: () => EdgeConflictError,
+  EDGE_CONTAINER_NAME: () => EDGE_CONTAINER_NAME
 });
 async function tryExec3(executor, command) {
   try {
@@ -29297,6 +29414,30 @@ function sq3(value) {
 function isOurEdgeContainer(name2, image) {
   return /openship-edge/i.test(`${name2 ?? ""} ${image ?? ""}`);
 }
+async function edgeIsServing(executor, port = 80) {
+  const running = await tryExec3(executor, `docker inspect -f '{{.State.Running}}' ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null`);
+  if ((running ?? "").trim() !== "true")
+    return false;
+  const probe = await tryExec3(executor, containerShell(`wget -q -O /dev/null -T 3 http://127.0.0.1:${port}/ >/dev/null 2>&1; echo $?`));
+  const code = (probe ?? "").trim().split(`
+`).pop() ?? "1";
+  return code === "0" || code === "8";
+}
+function containerShell(command) {
+  return `docker exec ${sq3(EDGE_CONTAINER_NAME)} sh -c ${sq3(command)}`;
+}
+async function edgeCrashReason(executor) {
+  const logs = await tryExec3(executor, `docker logs --tail 40 ${sq3(EDGE_CONTAINER_NAME)} 2>&1`);
+  return logs ? edgeFailureReason(logs) : null;
+}
+function edgeFailureReason(containerLog) {
+  const lines = containerLog.split(`
+`).map((l) => l.trim()).filter(Boolean);
+  const emerg = lines.find((l) => l.includes("[emerg]"));
+  if (emerg)
+    return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
+  return lines.at(-1) ?? null;
+}
 async function ourEdgeContainerRunning(executor) {
   return Boolean(await resolveOurEdgeContainer(executor));
 }
@@ -29466,7 +29607,7 @@ async function freeEdgeTargets(executor, targets, onLog) {
   }
   await new Promise((r) => setTimeout(r, 1000));
 }
-var EDGE_PORTS, EdgeConflictError, EdgeMigrateRequested, EDGE_CONTAINER_TTL_MS = 20000, edgeContainerMemo, edgeMemoGeneration = 0, WORKER_RE, MASTER_RE;
+var EDGE_PORTS, EdgeConflictError, EdgeMigrateRequested, EDGE_CONTAINER_NAME = "openship-edge", EDGE_CONTAINER_TTL_MS = 20000, edgeContainerMemo, edgeMemoGeneration = 0, WORKER_RE, MASTER_RE;
 var init_detect2 = __esm(() => {
   init_src();
   init_port_conflict();
@@ -31222,6 +31363,8 @@ async function readJournal(executor) {
 }
 async function rollback(executor, journal, onLog) {
   onLog(log("Rolling back — restoring the previous proxy...", "warn"));
+  await tryExec7(executor, `docker update --restart=no ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec7(executor, `docker stop ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
   await tryExec7(executor, "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; " + "systemctl reset-failed openresty 2>/dev/null || true");
   for (const u of journal.units) {
     await tryExec7(executor, u.wasEnabled ? `systemctl enable --now ${sq3(u.unit)} 2>/dev/null || true` : `systemctl start ${sq3(u.unit)} 2>/dev/null || true`);
@@ -31237,6 +31380,16 @@ async function rollback(executor, journal, onLog) {
       onLog(log(`Could not restore process ${p.pid} — no command captured.`, "warn"));
     }
   }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(log("Nothing is listening on :80 after the restore — the box is NOT serving. " + "Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).", "error"));
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex3 = port.toString(16).toUpperCase().padStart(4, "0");
+  const out2 = await tryExec7(executor, `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || ` + `(grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex3}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`);
+  return (out2 ?? "").includes("yes");
 }
 async function beginEdgeTakeover(executor, status, onLog) {
   await writeJournal(executor, await buildJournal(executor, status));
@@ -31246,9 +31399,9 @@ async function rollbackEdgeTakeover(executor, onLog) {
   const journal = await readJournal(executor);
   if (!journal || journal.completed)
     return false;
-  await rollback(executor, journal, onLog);
+  const restored = await rollback(executor, journal, onLog);
   await clearJournal(executor);
-  return true;
+  return restored;
 }
 async function completeEdgeTakeover(executor) {
   const journal = await readJournal(executor);
@@ -32152,8 +32305,7 @@ __export(exports_ensure_container_edge, {
   ensureContainerEdge: () => ensureContainerEdge,
   dockerAvailable: () => dockerAvailable,
   containerEdgeProvider: () => containerEdgeProvider,
-  buildEdgeRunCommand: () => buildEdgeRunCommand,
-  EDGE_CONTAINER_NAME: () => EDGE_CONTAINER_NAME
+  buildEdgeRunCommand: () => buildEdgeRunCommand
 });
 function log2(message, level = "info") {
   return { timestamp: new Date().toISOString(), message, level };
@@ -32231,6 +32383,34 @@ async function swapEdgeImage(executor, container, from, to, opts) {
   onLog(log2(`Rollback to ${from} ALSO failed — the edge is down on this server.`, "error"));
   return { swapped: false, edgeDown: true };
 }
+async function listDir(executor, dir) {
+  const out2 = await executor.exec(`ls -1 ${sq2(dir)} 2>/dev/null || true`).catch(() => "");
+  return new Set(out2.split(`
+`).map((l) => l.trim()).filter(Boolean));
+}
+async function sanitizeCarriedVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq2(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -i -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out2 = await executor.exec(script).catch(() => "");
+  for (const line of out2.split(`
+`).map((l) => l.trim()).filter(Boolean)) {
+    const [action, file3] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(log2(`Dropped the bare edge's catch-all ${file3} — the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(log2(`Removed default_server from ${file3} — the edge image owns it.`, "warn"));
+    }
+  }
+}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -32264,16 +32444,27 @@ async function ensureContainerEdge(executor, opts) {
     await executor.exec(`mkdir -p ${sq2(mount.host)}`).catch(() => {});
   }
   const sitesTarget = EDGE_HOST_PATHS.sitesDir;
+  let beforeCarry = null;
   if (bareWasOurs) {
     const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
     if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
       onLog(log2(`Carrying vhosts from ${barePaths.sitesDir}...`));
+      beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq2(`${barePaths.sitesDir}/.`)} ${sq2(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {});
+      await sanitizeCarriedVhosts(executor, sitesTarget, onLog);
     }
   }
   const restoreBare = async () => {
     if (!bareWasOurs)
       return;
+    if (beforeCarry) {
+      const now2 = await listDir(executor, sitesTarget);
+      const added = [...now2].filter((name2) => !beforeCarry.has(name2));
+      if (added.length > 0) {
+        await executor.exec(`rm -f ${added.map((n) => sq2(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {});
+        onLog(log2(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
+      }
+    }
     onLog(log2("Restoring the host OpenResty edge...", "warn"));
     await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {});
   };
@@ -32309,10 +32500,11 @@ ${logs}`, "error"));
     await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
     invalidateEdgeContainer(executor);
     await restoreBare();
-    throw new Error(`Edge container setup failed: ${msg}`);
+    const reason = edgeFailureReason(logs);
+    throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
-var EDGE_CONTAINER_NAME = "openship-edge", injectedDefaultImage;
+var injectedDefaultImage;
 var init_ensure_container_edge = __esm(() => {
   init_src();
   init_openresty_lua();
@@ -32417,9 +32609,9 @@ async function runEdgeTakeover(executor, opts, onLog) {
     edgeImage: opts.edgeImage
   });
   if (!install.success) {
-    await rollback(executor, journal, onLog);
+    const rolledBack = await rollback(executor, journal, onLog);
     await clearJournal(executor);
-    return { ok: false, rolledBack: true, registered: [], warnings: [install.error ?? "Edge install failed"] };
+    return { ok: false, rolledBack, registered: [], warnings: [install.error ?? "Edge install failed"] };
   }
   try {
     const container = await resolveOurEdgeContainer(executor, { fresh: true });
@@ -32454,9 +32646,11 @@ async function runEdgeTakeover(executor, opts, onLog) {
     return { ok: true, rolledBack: false, registered, warnings };
   } catch (err2) {
     warnings.push(safeErrorMessage(err2));
-    await rollback(executor, journal, onLog);
+    const rolledBack = await rollback(executor, journal, onLog);
     await clearJournal(executor);
-    return { ok: false, rolledBack: true, registered: [], warnings };
+    if (!rolledBack)
+      warnings.push("The previous proxy did NOT come back — nothing is serving :80.");
+    return { ok: false, rolledBack, registered: [], warnings };
   }
 }
 var DOMAIN_RE2;
@@ -80000,7 +80194,6 @@ __export(exports_src, {
   EdgeConflictError: () => EdgeConflictError,
   EDGE_HOST_STATE_DIR: () => EDGE_HOST_STATE_DIR,
   EDGE_HOST_PATHS: () => EDGE_HOST_PATHS,
-  EDGE_CONTAINER_NAME: () => EDGE_CONTAINER_NAME,
   EDGE_CONTAINER_MOUNTS: () => EDGE_CONTAINER_MOUNTS,
   DockerRuntime: () => DockerRuntime,
   DockerEdgeExecutor: () => DockerEdgeExecutor,
@@ -191353,7 +191546,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@repo/api",
-    version: "0.4.6",
+    version: "0.4.7",
     license: "Apache-2.0",
     private: true,
     type: "module",

package/dist/{setup-HQIZLUOJ.js → setup-2DMFIA74.js}

@@ -4,13 +4,13 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-C5OHTYEF.js";
-import "./chunk-SQ77DZOI.js";
+} from "./chunk-IPYPMI3S.js";
+import "./chunk-UXWAVM4C.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-FQGJZ2HS.js";
+import "./chunk-R5BHFFAV.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {