openship 0.4.6 → 0.4.8

package/dist/{bare-2HYDXQEH.js → bare-JY5Y5ELU.js}

@@ -9,7 +9,7 @@ import {
 import "./chunk-MZ2WEHHY.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-4Z5QO7N6.js";
-import "./chunk-4TJC4JZQ.js";
+import "./chunk-XPPZ7B2J.js";
 import "./chunk-OXWDY22G.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-TYVME3XD.js";

package/dist/{chunk-FQGJZ2HS.js → chunk-2D3I5G6P.js}

@@ -59,6 +59,54 @@ function sq(value) {
 function isOurEdgeContainer(name, image) {
   return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
 }
+function vhostLog(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function sanitizeEdgeVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    // A real server_name is anything that isn't the `_` wildcard.
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" > "$f.osh" && mv "$f.osh" "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out = await executor.exec(script).catch(() => "");
+  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [action, file] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(vhostLog(`Dropped catch-all vhost ${file} \u2014 the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(vhostLog(`Removed default_server from ${file} \u2014 the edge image owns it.`, "warn"));
+    }
+  }
+}
+async function edgeIsBroken(executor) {
+  const status = await tryExec(
+    executor,
+    `docker inspect -f '{{.State.Status}}' ${sq(EDGE_CONTAINER_NAME)} 2>/dev/null`
+  );
+  const state = (status ?? "").trim();
+  return state === "restarting" || state === "exited" || state === "dead";
+}
+async function edgeCrashReason(executor) {
+  const logs = await tryExec(
+    executor,
+    `docker logs --tail 40 ${sq(EDGE_CONTAINER_NAME)} 2>&1`
+  );
+  return logs ? edgeFailureReason(logs) : null;
+}
+function edgeFailureReason(containerLog) {
+  const lines = containerLog.split("\n").map((l) => l.trim()).filter(Boolean);
+  const emerg = lines.find((l) => l.includes("[emerg]"));
+  if (emerg) return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
+  return null;
+}
+var EDGE_CONTAINER_NAME = "openship-edge";
 async function ourEdgeContainerRunning(executor) {
   return Boolean(await resolveOurEdgeContainer(executor));
 }
@@ -238,6 +286,11 @@ export {
   classifyProxy,
   sq,
   isOurEdgeContainer,
+  sanitizeEdgeVhosts,
+  edgeIsBroken,
+  edgeCrashReason,
+  edgeFailureReason,
+  EDGE_CONTAINER_NAME,
   ourEdgeContainerRunning,
   invalidateEdgeContainer,
   resolveOurEdgeContainer,

package/dist/{chunk-5FNIWBFI.js → chunk-5NYUCONN.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-SLTYVHU7.js";
 import {
   createDockerBuildContext,
   normalizeDockerRelativePath,

package/dist/{chunk-3JQTL4R4.js → chunk-BBHX7T4R.js}

@@ -101,10 +101,10 @@ import {
 } from "./chunk-W73X43R7.js";
 import {
   CloudRuntime
-} from "./chunk-5FNIWBFI.js";
+} from "./chunk-5NYUCONN.js";
 import {
   systemCatalog
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-SLTYVHU7.js";
 import {
   AwsCrc32,
   __awaiter,
@@ -139,13 +139,19 @@ import {
   DockerRuntime,
   isHostPathSource,
   scopedVolumeName
-} from "./chunk-2ZLR7ULL.js";
+} from "./chunk-SJIFLLX4.js";
 import {
   BareRuntime
 } from "./chunk-VDMQJHPI.js";
 import {
-  invalidateEdgeContainer
-} from "./chunk-FQGJZ2HS.js";
+  LocalExecutor
+} from "./chunk-TYVME3XD.js";
+import {
+  EDGE_CONTAINER_NAME,
+  edgeCrashReason,
+  invalidateEdgeContainer,
+  sanitizeEdgeVhosts
+} from "./chunk-2D3I5G6P.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
@@ -159,13 +165,6 @@ import {
 import chalk from "chalk";
 import ora from "ora";
 
-// src/lib/compose.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir2, userInfo } from "os";
-import { join as join6 } from "path";
-
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
 
@@ -12668,6 +12667,13 @@ var SftpDestinationImpl = class {
 registerDestination("sftp", (row) => new SftpDestinationImpl(row));
 registerDestination("openship_server", (row) => new SftpDestinationImpl(row));
 
+// src/lib/compose.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { randomBytes as randomBytes5 } from "crypto";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2, userInfo } from "os";
+import { join as join6 } from "path";
+
 // src/lib/paths.ts
 import { homedir } from "os";
 import { join as join3, resolve as resolve2 } from "path";
@@ -13229,7 +13235,7 @@ function renderEnv(opts, host, cfg) {
     // (hides the local row). Written explicitly so the policy is visible in .env.
     `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
     `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.6" : "latest")}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.8" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
     `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
@@ -13302,7 +13308,14 @@ function compose(args, opts) {
   });
   return r2.status ?? 1;
 }
-function composeUp(opts) {
+function composePrefetch(opts) {
+  const { buildDir } = materialize(opts);
+  if (buildDir) {
+    return compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0;
+  }
+  return compose(["pull"]) === 0;
+}
+async function composeUp(opts) {
   const { buildDir, cfg, envChanged } = materialize(opts);
   const apiPort = cfg.apiPort;
   const dashPort = cfg.dashPort;
@@ -13318,12 +13331,20 @@ function composeUp(opts) {
   if (dbVolumeExists(project)) {
     reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
   }
+  await sanitizeEdgeVhosts(
+    new LocalExecutor(),
+    EDGE_SITES_HOST_DIR,
+    (l2) => console.log(`  ${l2.message}`)
+  ).catch(() => {
+  });
   if (buildDir) {
-    if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
-    }
-    if (compose(["build"], { withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
+    if (!opts.alreadyFetched) {
+      if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
+        return { ok: false, apiPort, dashPort };
+      }
+      if (compose(["build"], { withBuildOverride: true }) !== 0) {
+        return { ok: false, apiPort, dashPort };
+      }
     }
     if (up({ withBuildOverride: true }) !== 0) {
       return { ok: false, apiPort, dashPort };
@@ -13332,7 +13353,9 @@ function composeUp(opts) {
     writeInstallMethod("compose");
     return { ok: true, apiPort, dashPort };
   }
-  if (compose(["pull"]) !== 0) return { ok: false, apiPort, dashPort };
+  if (!opts.alreadyFetched && compose(["pull"]) !== 0) {
+    return { ok: false, apiPort, dashPort };
+  }
   if (up() !== 0) return { ok: false, apiPort, dashPort };
   onEdgeContainerChanged();
   writeInstallMethod("compose");
@@ -13361,9 +13384,9 @@ function composeUninstall(opts = {}) {
   }
   return { ok, removedImages };
 }
-function composeUpdate(version) {
+async function composeUpdate(version) {
   if (!existsSync3(COMPOSE_FILE)) return false;
-  return composeUp(version ? { version } : {}).ok;
+  return (await composeUp(version ? { version } : {})).ok;
 }
 function composePs() {
   return compose(["ps"]);
@@ -13435,11 +13458,17 @@ async function importMigratedSites(apiPort, sites, certPems) {
         `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
       );
       for (const w2 of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w2}`));
+      const edgeLog = await edgeCrashReason(new LocalExecutor());
+      if (edgeLog) {
+        console.log(chalk.red(`
+  The edge container is not running. Its log says:`));
+        console.log(chalk.red(`    ${edgeLog}`));
+      }
       console.log(
         chalk.yellow(
           `
   Retry the import with \`openship up\` once the cause above is fixed, or put your
-  previous proxy back:  docker stop openship-edge && sudo systemctl enable --now nginx
+  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && sudo systemctl enable --now nginx
 `
         )
       );
@@ -13477,6 +13506,7 @@ export {
   composeIsViableDefault,
   ensureDocker,
   sourceBuildDir,
+  composePrefetch,
   composeUp,
   composeDown,
   composeUninstall,

package/dist/{chunk-C5OHTYEF.js → chunk-GKHUSZCD.js}

@@ -6,7 +6,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-SQ77DZOI.js";
+} from "./chunk-SLTYVHU7.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";

package/dist/{chunk-2ZLR7ULL.js → chunk-SJIFLLX4.js}

@@ -207,6 +207,8 @@ var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var resolvedDockerSocketPathCache = /* @__PURE__ */ new WeakMap();
 var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
 var STREAMLOCAL_PROBE_TIMEOUT_MS = 8e3;
+var STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3e3;
+var VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
 function toSshConfig(opts) {
   return {
     host: opts.host ?? "",
@@ -304,13 +306,107 @@ async function openStreamlocalUpstream(opts) {
     throw error;
   }
 }
+function pipeThrough(client, upstream) {
+  const teardown = () => {
+    client.destroy();
+    upstream.destroy();
+  };
+  client.on("error", teardown);
+  upstream.on("error", teardown);
+  client.once("close", () => upstream.destroy());
+  upstream.once("close", () => client.destroy());
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+function awaitFirstByte(upstream, ms) {
+  return new Promise((resolve) => {
+    const finish = (chunk) => {
+      clearTimeout(timer);
+      upstream.removeListener("data", onData);
+      upstream.removeListener("error", onFail);
+      upstream.removeListener("close", onFail);
+      resolve(chunk);
+    };
+    const onData = (chunk) => finish(chunk);
+    const onFail = () => finish(null);
+    const timer = setTimeout(() => finish(null), ms);
+    upstream.on("data", onData);
+    upstream.once("error", onFail);
+    upstream.once("close", onFail);
+  });
+}
+function captureClient(client) {
+  const chunks = [];
+  let bytes = 0;
+  let overflowed = false;
+  let closed = false;
+  let live = null;
+  const onData = (chunk) => {
+    if (live) live.write(chunk);
+    if (overflowed) return;
+    chunks.push(chunk);
+    bytes += chunk.length;
+    if (bytes >= VERIFY_BUFFER_CAP_BYTES) {
+      overflowed = true;
+      client.pause();
+    }
+  };
+  const onGone = () => {
+    closed = true;
+  };
+  client.on("data", onData);
+  client.once("error", onGone);
+  client.once("close", onGone);
+  const detach = () => {
+    client.removeListener("data", onData);
+    client.removeListener("error", onGone);
+    client.removeListener("close", onGone);
+  };
+  return {
+    get closed() {
+      return closed;
+    },
+    get overflowed() {
+      return overflowed;
+    },
+    /** Replay everything buffered so far onto `upstream` and forward the rest
+     *  live. Safe to call again on a different upstream (the fallback): the full
+     *  buffer is retained until `commit`, so the replay is complete each time. */
+    feed(upstream) {
+      for (const chunk of chunks) upstream.write(chunk);
+      live = upstream;
+    },
+    /** Stop forwarding to the current upstream (keep buffering) — used before
+     *  destroying a dead channel so late bytes never hit a torn-down stream. */
+    stop() {
+      live = null;
+    },
+    /** Terminal: detach and hand the socket to the (already-fed) `upstream` via a
+     *  bidi pipe, or destroy it if the client already went away. */
+    commit(upstream) {
+      detach();
+      chunks.length = 0;
+      if (closed) {
+        upstream.destroy();
+        return;
+      }
+      pipeThrough(client, upstream);
+    },
+    /** Terminal: no usable upstream — surface the error to dockerode. */
+    fail(err) {
+      detach();
+      client.destroy(err instanceof Error ? err : new Error(String(err)));
+    }
+  };
+}
 function createDockerSshBridge(opts) {
   const clients = /* @__PURE__ */ new Set();
   let upstreamMode = null;
   let modeDecision = null;
   let dialClient = null;
-  const openDialStdioUpstream = async () => {
-    if (opts.executor?.openDockerDialStdio) {
+  let pooledUnreliable = false;
+  const openDialStdioUpstream = async (forceEphemeral = false) => {
+    if (!forceEphemeral && opts.executor?.openDockerDialStdio) {
       const stream = await opts.executor.openDockerDialStdio();
       stream.once(
         "error",
@@ -373,29 +469,57 @@ function createDockerSshBridge(opts) {
     modeDecision ??= decideMode().then((mode) => upstreamMode = mode);
     return modeDecision;
   };
-  const openUpstream = async () => {
-    const mode = await ensureMode();
-    return mode === "dialstdio" ? openDialStdioUpstream() : openStreamlocalUpstream(opts);
+  const downgradeToDialStdio = async (capture, reason) => {
+    console.warn(
+      `[docker-ssh] streamlocal unusable (${opts.host ?? "?"}): ${reason} \u2014 downgrading this bridge to dial-stdio (fresh connection) and replaying the buffered request.`
+    );
+    upstreamMode = "dialstdio";
+    pooledUnreliable = true;
+    const upstream = await openDialStdioUpstream(true);
+    capture.feed(upstream);
+    capture.commit(upstream);
+  };
+  const bridgeClient = async (client) => {
+    const capture = captureClient(client);
+    try {
+      const mode = await ensureMode();
+      if (mode === "dialstdio") {
+        const upstream = await openDialStdioUpstream(pooledUnreliable);
+        capture.feed(upstream);
+        capture.commit(upstream);
+        return;
+      }
+      let channel;
+      try {
+        channel = await withTimeout(
+          openStreamlocalUpstream(opts),
+          STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS,
+          `channel open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1e3}s`
+        );
+      } catch (err) {
+        await downgradeToDialStdio(capture, safeErrorMessage(err));
+        return;
+      }
+      capture.feed(channel);
+      const firstByte = capture.overflowed ? null : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
+      if (capture.overflowed || firstByte) {
+        if (firstByte) client.write(firstByte);
+        capture.commit(channel);
+        return;
+      }
+      capture.stop();
+      channel.destroy();
+      await downgradeToDialStdio(capture, "channel opened but no data flowed");
+    } catch (err) {
+      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+      capture.fail(err);
+    }
   };
   const server = net2.createServer((client) => {
     clients.add(client);
     client.setNoDelay(true);
     client.once("close", () => clients.delete(client));
-    openUpstream().then((upstream) => {
-      const teardown = () => {
-        client.destroy();
-        upstream.destroy();
-      };
-      client.on("error", teardown);
-      upstream.on("error", teardown);
-      client.once("close", () => upstream.destroy());
-      upstream.once("close", () => client.destroy());
-      client.pipe(upstream);
-      upstream.pipe(client);
-    }).catch((error) => {
-      console.warn(`[docker-ssh] bridge upstream open failed: ${safeErrorMessage(error)}`);
-      client.destroy(error instanceof Error ? error : new Error(String(error)));
-    });
+    void bridgeClient(client);
   });
   return {
     start: () => new Promise((resolve, reject) => {

package/dist/{chunk-SQ77DZOI.js → chunk-SLTYVHU7.js}

@@ -22,16 +22,19 @@ import {
   sq
 } from "./chunk-FPRHYBY2.js";
 import {
+  EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
+  edgeFailureReason,
   freeEdgeTargets,
   invalidateEdgeContainer,
   ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
+  sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-FQGJZ2HS.js";
+} from "./chunk-2D3I5G6P.js";
 import {
   waitForPortListening
 } from "./chunk-ILFETZOM.js";
@@ -976,6 +979,8 @@ async function readJournal(executor) {
 }
 async function rollback(executor, journal, onLog) {
   onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  await tryExec2(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec2(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
   await tryExec2(
     executor,
     "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
@@ -1000,6 +1005,24 @@ async function rollback(executor, journal, onLog) {
       onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
     }
   }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(
+      log(
+        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
+        "error"
+      )
+    );
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex = port.toString(16).toUpperCase().padStart(4, "0");
+  const out = await tryExec2(
+    executor,
+    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
+  );
+  return (out ?? "").includes("yes");
 }
 async function beginEdgeTakeover(executor, status, onLog) {
   await writeJournal(executor, await buildJournal(executor, status));
@@ -1008,9 +1031,9 @@ async function beginEdgeTakeover(executor, status, onLog) {
 async function rollbackEdgeTakeover(executor, onLog) {
   const journal = await readJournal(executor);
   if (!journal || journal.completed) return false;
-  await rollback(executor, journal, onLog);
+  const restored = await rollback(executor, journal, onLog);
   await clearJournal(executor);
-  return true;
+  return restored;
 }
 async function completeEdgeTakeover(executor) {
   const journal = await readJournal(executor);
@@ -1802,7 +1825,6 @@ async function ensureEdgeClear(executor, config, onLog) {
 }
 
 // ../../packages/adapters/src/system/proxy/ensure-container-edge.ts
-var EDGE_CONTAINER_NAME = "openship-edge";
 function log4(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
@@ -1821,7 +1843,7 @@ async function runningImage(executor, container) {
   return out.trim() || null;
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-2GTRUIDE.js");
+  const { NginxProvider: Provider } = await import("./nginx-3L4SIBJA.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -1836,7 +1858,7 @@ async function containerEdgeProvider(executor, container, opts) {
 }
 async function localContainerEdgeProvider(container, opts) {
   const { DockerEdgeExecutor } = await import("./docker-edge-executor-VHW3JPJS.js");
-  const { NginxProvider: Provider } = await import("./nginx-2GTRUIDE.js");
+  const { NginxProvider: Provider } = await import("./nginx-3L4SIBJA.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -1846,6 +1868,18 @@ async function localContainerEdgeProvider(container, opts) {
     pinPaths: true
   });
 }
+async function startEdgeContainer(executor, container, image, onLog) {
+  await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {
+  });
+  await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+  });
+  const run = await executor.streamExec(
+    buildEdgeRunCommand(container, image),
+    onLog
+  );
+  invalidateEdgeContainer(executor);
+  return run.code === 0;
+}
 function buildEdgeRunCommand(container, image) {
   const mounts = EDGE_CONTAINER_MOUNTS.map(
     // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
@@ -1869,14 +1903,7 @@ async function swapEdgeImage(executor, container, from, to, opts) {
     return { swapped: false, edgeDown: false };
   }
   const start = async (image) => {
-    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
-    });
-    const run = await executor.streamExec(
-      buildEdgeRunCommand(container, image),
-      onLog
-    );
-    invalidateEdgeContainer(executor);
-    if (run.code !== 0) return false;
+    if (!await startEdgeContainer(executor, container, image, onLog)) return false;
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
@@ -1893,6 +1920,12 @@ async function swapEdgeImage(executor, container, from, to, opts) {
   onLog(log4(`Rollback to ${from} ALSO failed \u2014 the edge is down on this server.`, "error"));
   return { swapped: false, edgeDown: true };
 }
+async function listDir(executor, dir) {
+  const out = await executor.exec(`ls -1 ${sq(dir)} 2>/dev/null || true`).catch(() => "");
+  return new Set(
+    out.split("\n").map((l) => l.trim()).filter(Boolean)
+  );
+}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -1931,16 +1964,27 @@ async function ensureContainerEdge(executor, opts) {
     });
   }
   const sitesTarget = EDGE_HOST_PATHS.sitesDir;
+  let beforeCarry = null;
   if (bareWasOurs) {
     const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
     if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
       onLog(log4(`Carrying vhosts from ${barePaths.sitesDir}...`));
+      beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
       });
     }
   }
   const restoreBare = async () => {
     if (!bareWasOurs) return;
+    if (beforeCarry) {
+      const now = await listDir(executor, sitesTarget);
+      const added = [...now].filter((name) => !beforeCarry.has(name));
+      if (added.length > 0) {
+        await executor.exec(`rm -f ${added.map((n) => sq(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {
+        });
+        onLog(log4(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
+      }
+    }
     onLog(log4("Restoring the host OpenResty edge...", "warn"));
     await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {
     });
@@ -1953,15 +1997,10 @@ async function ensureContainerEdge(executor, opts) {
       await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {
       });
     }
-    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
-    });
     onLog(log4("Starting the edge container..."));
-    const run = await executor.streamExec(
-      buildEdgeRunCommand(container, image),
-      onLog
-    );
-    invalidateEdgeContainer(executor);
-    if (run.code !== 0) throw new Error("the edge container failed to start");
+    if (!await startEdgeContainer(executor, container, image, onLog)) {
+      throw new Error("the edge container failed to start");
+    }
     await executor.exec(containerCommand(container, "openresty -t"));
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
@@ -1982,7 +2021,8 @@ ${logs}`, "error"));
     });
     invalidateEdgeContainer(executor);
     await restoreBare();
-    throw new Error(`Edge container setup failed: ${msg}`);
+    const reason = edgeFailureReason(logs);
+    throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
 
@@ -2000,7 +2040,6 @@ export {
   rollbackEdgeTakeover,
   completeEdgeTakeover,
   recoverInterruptedTakeover,
-  EDGE_CONTAINER_NAME,
   setDefaultEdgeImage,
   resolveEdgeImage,
   dockerAvailable,