openship 0.4.6 → 0.4.8

package/dist/server/index.js

@@ -21998,13 +21998,102 @@ async function openStreamlocalUpstream(opts) {
     throw error51;
   }
 }
+function pipeThrough(client, upstream) {
+  const teardown = () => {
+    client.destroy();
+    upstream.destroy();
+  };
+  client.on("error", teardown);
+  upstream.on("error", teardown);
+  client.once("close", () => upstream.destroy());
+  upstream.once("close", () => client.destroy());
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+function awaitFirstByte(upstream, ms) {
+  return new Promise((resolve2) => {
+    const finish = (chunk) => {
+      clearTimeout(timer);
+      upstream.removeListener("data", onData);
+      upstream.removeListener("error", onFail);
+      upstream.removeListener("close", onFail);
+      resolve2(chunk);
+    };
+    const onData = (chunk) => finish(chunk);
+    const onFail = () => finish(null);
+    const timer = setTimeout(() => finish(null), ms);
+    upstream.on("data", onData);
+    upstream.once("error", onFail);
+    upstream.once("close", onFail);
+  });
+}
+function captureClient(client) {
+  const chunks = [];
+  let bytes = 0;
+  let overflowed = false;
+  let closed = false;
+  let live = null;
+  const onData = (chunk) => {
+    if (live)
+      live.write(chunk);
+    if (overflowed)
+      return;
+    chunks.push(chunk);
+    bytes += chunk.length;
+    if (bytes >= VERIFY_BUFFER_CAP_BYTES) {
+      overflowed = true;
+      client.pause();
+    }
+  };
+  const onGone = () => {
+    closed = true;
+  };
+  client.on("data", onData);
+  client.once("error", onGone);
+  client.once("close", onGone);
+  const detach = () => {
+    client.removeListener("data", onData);
+    client.removeListener("error", onGone);
+    client.removeListener("close", onGone);
+  };
+  return {
+    get closed() {
+      return closed;
+    },
+    get overflowed() {
+      return overflowed;
+    },
+    feed(upstream) {
+      for (const chunk of chunks)
+        upstream.write(chunk);
+      live = upstream;
+    },
+    stop() {
+      live = null;
+    },
+    commit(upstream) {
+      detach();
+      chunks.length = 0;
+      if (closed) {
+        upstream.destroy();
+        return;
+      }
+      pipeThrough(client, upstream);
+    },
+    fail(err2) {
+      detach();
+      client.destroy(err2 instanceof Error ? err2 : new Error(String(err2)));
+    }
+  };
+}
 function createDockerSshBridge(opts) {
   const clients = new Set;
   let upstreamMode = null;
   let modeDecision = null;
   let dialClient = null;
-  const openDialStdioUpstream = async () => {
-    if (opts.executor?.openDockerDialStdio) {
+  let pooledUnreliable = false;
+  const openDialStdioUpstream = async (forceEphemeral = false) => {
+    if (!forceEphemeral && opts.executor?.openDockerDialStdio) {
       const stream = await opts.executor.openDockerDialStdio();
       stream.once("error", (e) => console.warn(`[docker-ssh] dial-stdio channel error: ${safeErrorMessage(e)}`));
       return stream;
@@ -22061,29 +22150,52 @@ Host: localhost\r
     modeDecision ??= decideMode().then((mode) => upstreamMode = mode);
     return modeDecision;
   };
-  const openUpstream = async () => {
-    const mode = await ensureMode();
-    return mode === "dialstdio" ? openDialStdioUpstream() : openStreamlocalUpstream(opts);
+  const downgradeToDialStdio = async (capture, reason) => {
+    console.warn(`[docker-ssh] streamlocal unusable (${opts.host ?? "?"}): ${reason} — ` + "downgrading this bridge to dial-stdio (fresh connection) and replaying the buffered request.");
+    upstreamMode = "dialstdio";
+    pooledUnreliable = true;
+    const upstream = await openDialStdioUpstream(true);
+    capture.feed(upstream);
+    capture.commit(upstream);
+  };
+  const bridgeClient = async (client) => {
+    const capture = captureClient(client);
+    try {
+      const mode = await ensureMode();
+      if (mode === "dialstdio") {
+        const upstream = await openDialStdioUpstream(pooledUnreliable);
+        capture.feed(upstream);
+        capture.commit(upstream);
+        return;
+      }
+      let channel;
+      try {
+        channel = await withTimeout(openStreamlocalUpstream(opts), STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS, `channel open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1000}s`);
+      } catch (err2) {
+        await downgradeToDialStdio(capture, safeErrorMessage(err2));
+        return;
+      }
+      capture.feed(channel);
+      const firstByte = capture.overflowed ? null : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
+      if (capture.overflowed || firstByte) {
+        if (firstByte)
+          client.write(firstByte);
+        capture.commit(channel);
+        return;
+      }
+      capture.stop();
+      channel.destroy();
+      await downgradeToDialStdio(capture, "channel opened but no data flowed");
+    } catch (err2) {
+      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err2)}`);
+      capture.fail(err2);
+    }
   };
   const server = net2.createServer((client) => {
     clients.add(client);
     client.setNoDelay(true);
     client.once("close", () => clients.delete(client));
-    openUpstream().then((upstream) => {
-      const teardown = () => {
-        client.destroy();
-        upstream.destroy();
-      };
-      client.on("error", teardown);
-      upstream.on("error", teardown);
-      client.once("close", () => upstream.destroy());
-      upstream.once("close", () => client.destroy());
-      client.pipe(upstream);
-      upstream.pipe(client);
-    }).catch((error51) => {
-      console.warn(`[docker-ssh] bridge upstream open failed: ${safeErrorMessage(error51)}`);
-      client.destroy(error51 instanceof Error ? error51 : new Error(String(error51)));
-    });
+    bridgeClient(client);
   });
   return {
     start: () => new Promise((resolve2, reject) => {
@@ -22113,11 +22225,12 @@ Host: localhost\r
     }
   };
 }
-var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock", resolvedDockerSocketPathCache, DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio", STREAMLOCAL_PROBE_TIMEOUT_MS = 8000, DOCKER_SOCKET_DISCOVERY_SCRIPT;
+var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock", resolvedDockerSocketPathCache, DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio", STREAMLOCAL_PROBE_TIMEOUT_MS = 8000, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3000, VERIFY_BUFFER_CAP_BYTES, DOCKER_SOCKET_DISCOVERY_SCRIPT;
 var init_docker_ssh_agent = __esm(() => {
   init_ssh_client();
   init_src();
   resolvedDockerSocketPathCache = new WeakMap;
+  VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
   DOCKER_SOCKET_DISCOVERY_SCRIPT = [
     "set -eu",
     'uid="$(id -u 2>/dev/null || printf 0)"',
@@ -25651,7 +25764,7 @@ __export(exports_executor, {
   SshExecutor: () => SshExecutor,
   LocalExecutor: () => LocalExecutor
 });
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 function createExecutor(ssh) {
   if (ssh) {
     if (ssh.useSystemSsh)
@@ -25663,13 +25776,30 @@ function createExecutor(ssh) {
 function hostControlDisabled() {
   return process.env.OPENSHIP_HOST_CONTROL?.trim().toLowerCase() === "false";
 }
+function runningInContainer() {
+  if (process.env.OPENSHIP_IN_CONTAINER?.trim().toLowerCase() === "true")
+    return true;
+  try {
+    if (existsSync("/.dockerenv"))
+      return true;
+  } catch {}
+  try {
+    return /\b(docker|containerd|podman|kubepods)\b/.test(readFileSync("/proc/1/cgroup", "utf8"));
+  } catch {
+    return false;
+  }
+}
 function createHostExecutor() {
   if (hostControlDisabled()) {
     throw new Error("Host control is disabled on this instance (OPENSHIP_HOST_CONTROL=false). " + "Re-run `openship up` without --no-host-control to allow host operations.");
   }
   const host = process.env.OPENSHIP_HOST_SSH_HOST?.trim();
-  if (!host)
+  if (!host) {
+    if (runningInContainer()) {
+      throw new Error("This operation targets the HOST machine, but no host channel is configured " + "(OPENSHIP_HOST_SSH_HOST is unset) and Openship is running in a container — " + "so it would have run inside the container instead, against the wrong " + "filesystem. Re-run `openship up` to provision the host channel.");
+    }
     return localExecutor;
+  }
   const keyPath = process.env.OPENSHIP_HOST_SSH_KEY?.trim();
   const portRaw = Number(process.env.OPENSHIP_HOST_SSH_PORT || "22");
   const port = Number.isInteger(portRaw) && portRaw > 0 && portRaw < 65536 ? portRaw : 22;
@@ -28968,7 +29098,7 @@ __export(exports_openresty_lua, {
   ACME_CHALLENGE_LOCATION: () => ACME_CHALLENGE_LOCATION
 });
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { dirname as dirname4, join as join10 } from "node:path";
 import { fileURLToPath } from "node:url";
 async function detectOpenRestyPaths(executor) {
@@ -29051,11 +29181,11 @@ http {
 `;
 }
 function luaSourceAvailable() {
-  return VHOST_REFERENCED_LUA.every((f) => EMBEDDED_LUA[f] !== undefined || existsSync(join10(LUA_SRC_DIR, f)));
+  return VHOST_REFERENCED_LUA.every((f) => EMBEDDED_LUA[f] !== undefined || existsSync2(join10(LUA_SRC_DIR, f)));
 }
 function readLua(filename) {
   const onDisk = join10(LUA_SRC_DIR, filename);
-  if (existsSync(onDisk))
+  if (existsSync2(onDisk))
     return readFileSync2(onDisk, "utf-8");
   const embedded = EMBEDDED_LUA[filename];
   if (embedded !== undefined)
@@ -29255,6 +29385,7 @@ var exports_detect = {};
 __export(exports_detect, {
   stopTargetsForStatus: () => stopTargetsForStatus,
   sq: () => sq3,
+  sanitizeEdgeVhosts: () => sanitizeEdgeVhosts,
   resolveOurEdgeContainer: () => resolveOurEdgeContainer,
   probeEdge: () => probeEdge,
   ourLuaOnHost: () => ourLuaOnHost,
@@ -29262,9 +29393,13 @@ __export(exports_detect, {
   isOurEdgeContainer: () => isOurEdgeContainer,
   invalidateEdgeContainer: () => invalidateEdgeContainer,
   freeEdgeTargets: () => freeEdgeTargets,
+  edgeIsBroken: () => edgeIsBroken,
+  edgeFailureReason: () => edgeFailureReason,
+  edgeCrashReason: () => edgeCrashReason,
   classifyProxy: () => classifyProxy,
   EdgeMigrateRequested: () => EdgeMigrateRequested,
-  EdgeConflictError: () => EdgeConflictError
+  EdgeConflictError: () => EdgeConflictError,
+  EDGE_CONTAINER_NAME: () => EDGE_CONTAINER_NAME
 });
 async function tryExec3(executor, command) {
   try {
@@ -29297,6 +29432,49 @@ function sq3(value) {
 function isOurEdgeContainer(name2, image) {
   return /openship-edge/i.test(`${name2 ?? ""} ${image ?? ""}`);
 }
+function vhostLog(message, level = "info") {
+  return { timestamp: new Date().toISOString(), message, level };
+}
+async function sanitizeEdgeVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq3(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" > "$f.osh" && mv "$f.osh" "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out2 = await executor.exec(script).catch(() => "");
+  for (const line of out2.split(`
+`).map((l) => l.trim()).filter(Boolean)) {
+    const [action, file3] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(vhostLog(`Dropped catch-all vhost ${file3} — the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(vhostLog(`Removed default_server from ${file3} — the edge image owns it.`, "warn"));
+    }
+  }
+}
+async function edgeIsBroken(executor) {
+  const status = await tryExec3(executor, `docker inspect -f '{{.State.Status}}' ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null`);
+  const state = (status ?? "").trim();
+  return state === "restarting" || state === "exited" || state === "dead";
+}
+async function edgeCrashReason(executor) {
+  const logs = await tryExec3(executor, `docker logs --tail 40 ${sq3(EDGE_CONTAINER_NAME)} 2>&1`);
+  return logs ? edgeFailureReason(logs) : null;
+}
+function edgeFailureReason(containerLog) {
+  const lines = containerLog.split(`
+`).map((l) => l.trim()).filter(Boolean);
+  const emerg = lines.find((l) => l.includes("[emerg]"));
+  if (emerg)
+    return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
+  return null;
+}
 async function ourEdgeContainerRunning(executor) {
   return Boolean(await resolveOurEdgeContainer(executor));
 }
@@ -29466,7 +29644,7 @@ async function freeEdgeTargets(executor, targets, onLog) {
   }
   await new Promise((r) => setTimeout(r, 1000));
 }
-var EDGE_PORTS, EdgeConflictError, EdgeMigrateRequested, EDGE_CONTAINER_TTL_MS = 20000, edgeContainerMemo, edgeMemoGeneration = 0, WORKER_RE, MASTER_RE;
+var EDGE_PORTS, EdgeConflictError, EdgeMigrateRequested, EDGE_CONTAINER_NAME = "openship-edge", EDGE_CONTAINER_TTL_MS = 20000, edgeContainerMemo, edgeMemoGeneration = 0, WORKER_RE, MASTER_RE;
 var init_detect2 = __esm(() => {
   init_src();
   init_port_conflict();
@@ -31222,6 +31400,8 @@ async function readJournal(executor) {
 }
 async function rollback(executor, journal, onLog) {
   onLog(log("Rolling back — restoring the previous proxy...", "warn"));
+  await tryExec7(executor, `docker update --restart=no ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec7(executor, `docker stop ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
   await tryExec7(executor, "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; " + "systemctl reset-failed openresty 2>/dev/null || true");
   for (const u of journal.units) {
     await tryExec7(executor, u.wasEnabled ? `systemctl enable --now ${sq3(u.unit)} 2>/dev/null || true` : `systemctl start ${sq3(u.unit)} 2>/dev/null || true`);
@@ -31237,6 +31417,16 @@ async function rollback(executor, journal, onLog) {
       onLog(log(`Could not restore process ${p.pid} — no command captured.`, "warn"));
     }
   }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(log("Nothing is listening on :80 after the restore — the box is NOT serving. " + "Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).", "error"));
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex3 = port.toString(16).toUpperCase().padStart(4, "0");
+  const out2 = await tryExec7(executor, `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || ` + `(grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex3}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`);
+  return (out2 ?? "").includes("yes");
 }
 async function beginEdgeTakeover(executor, status, onLog) {
   await writeJournal(executor, await buildJournal(executor, status));
@@ -31246,9 +31436,9 @@ async function rollbackEdgeTakeover(executor, onLog) {
   const journal = await readJournal(executor);
   if (!journal || journal.completed)
     return false;
-  await rollback(executor, journal, onLog);
+  const restored = await rollback(executor, journal, onLog);
   await clearJournal(executor);
-  return true;
+  return restored;
 }
 async function completeEdgeTakeover(executor) {
   const journal = await readJournal(executor);
@@ -32152,8 +32342,7 @@ __export(exports_ensure_container_edge, {
   ensureContainerEdge: () => ensureContainerEdge,
   dockerAvailable: () => dockerAvailable,
   containerEdgeProvider: () => containerEdgeProvider,
-  buildEdgeRunCommand: () => buildEdgeRunCommand,
-  EDGE_CONTAINER_NAME: () => EDGE_CONTAINER_NAME
+  buildEdgeRunCommand: () => buildEdgeRunCommand
 });
 function log2(message, level = "info") {
   return { timestamp: new Date().toISOString(), message, level };
@@ -32190,6 +32379,13 @@ async function localContainerEdgeProvider(container, opts) {
     pinPaths: true
   });
 }
+async function startEdgeContainer(executor, container, image, onLog) {
+  await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {});
+  await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
+  const run2 = await executor.streamExec(buildEdgeRunCommand(container, image), onLog);
+  invalidateEdgeContainer(executor);
+  return run2.code === 0;
+}
 function buildEdgeRunCommand(container, image) {
   const mounts = EDGE_CONTAINER_MOUNTS.map((m) => `-v ${sq2(`${m.host}:${m.container}:z`)}`).join(" ");
   return [
@@ -32210,10 +32406,7 @@ async function swapEdgeImage(executor, container, from, to, opts) {
     return { swapped: false, edgeDown: false };
   }
   const start2 = async (image) => {
-    await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
-    const run2 = await executor.streamExec(buildEdgeRunCommand(container, image), onLog);
-    invalidateEdgeContainer(executor);
-    if (run2.code !== 0)
+    if (!await startEdgeContainer(executor, container, image, onLog))
       return false;
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 30000
@@ -32231,6 +32424,11 @@ async function swapEdgeImage(executor, container, from, to, opts) {
   onLog(log2(`Rollback to ${from} ALSO failed — the edge is down on this server.`, "error"));
   return { swapped: false, edgeDown: true };
 }
+async function listDir(executor, dir) {
+  const out2 = await executor.exec(`ls -1 ${sq2(dir)} 2>/dev/null || true`).catch(() => "");
+  return new Set(out2.split(`
+`).map((l) => l.trim()).filter(Boolean));
+}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -32264,16 +32462,26 @@ async function ensureContainerEdge(executor, opts) {
     await executor.exec(`mkdir -p ${sq2(mount.host)}`).catch(() => {});
   }
   const sitesTarget = EDGE_HOST_PATHS.sitesDir;
+  let beforeCarry = null;
   if (bareWasOurs) {
     const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
     if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
       onLog(log2(`Carrying vhosts from ${barePaths.sitesDir}...`));
+      beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq2(`${barePaths.sitesDir}/.`)} ${sq2(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {});
     }
   }
   const restoreBare = async () => {
     if (!bareWasOurs)
       return;
+    if (beforeCarry) {
+      const now2 = await listDir(executor, sitesTarget);
+      const added = [...now2].filter((name2) => !beforeCarry.has(name2));
+      if (added.length > 0) {
+        await executor.exec(`rm -f ${added.map((n) => sq2(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {});
+        onLog(log2(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
+      }
+    }
     onLog(log2("Restoring the host OpenResty edge...", "warn"));
     await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {});
   };
@@ -32283,12 +32491,10 @@ async function ensureContainerEdge(executor, opts) {
       await executor.exec("systemctl disable --now openresty 2>/dev/null || true").catch(() => {});
       await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {});
     }
-    await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
     onLog(log2("Starting the edge container..."));
-    const run2 = await executor.streamExec(buildEdgeRunCommand(container, image), onLog);
-    invalidateEdgeContainer(executor);
-    if (run2.code !== 0)
+    if (!await startEdgeContainer(executor, container, image, onLog)) {
       throw new Error("the edge container failed to start");
+    }
     await executor.exec(containerCommand(container, "openresty -t"));
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 30000
@@ -32309,10 +32515,11 @@ ${logs}`, "error"));
     await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
     invalidateEdgeContainer(executor);
     await restoreBare();
-    throw new Error(`Edge container setup failed: ${msg}`);
+    const reason = edgeFailureReason(logs);
+    throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
-var EDGE_CONTAINER_NAME = "openship-edge", injectedDefaultImage;
+var injectedDefaultImage;
 var init_ensure_container_edge = __esm(() => {
   init_src();
   init_openresty_lua();
@@ -32417,9 +32624,9 @@ async function runEdgeTakeover(executor, opts, onLog) {
     edgeImage: opts.edgeImage
   });
   if (!install.success) {
-    await rollback(executor, journal, onLog);
+    const rolledBack = await rollback(executor, journal, onLog);
     await clearJournal(executor);
-    return { ok: false, rolledBack: true, registered: [], warnings: [install.error ?? "Edge install failed"] };
+    return { ok: false, rolledBack, registered: [], warnings: [install.error ?? "Edge install failed"] };
   }
   try {
     const container = await resolveOurEdgeContainer(executor, { fresh: true });
@@ -32454,9 +32661,11 @@ async function runEdgeTakeover(executor, opts, onLog) {
     return { ok: true, rolledBack: false, registered, warnings };
   } catch (err2) {
     warnings.push(safeErrorMessage(err2));
-    await rollback(executor, journal, onLog);
+    const rolledBack = await rollback(executor, journal, onLog);
     await clearJournal(executor);
-    return { ok: false, rolledBack: true, registered: [], warnings };
+    if (!rolledBack)
+      warnings.push("The previous proxy did NOT come back — nothing is serving :80.");
+    return { ok: false, rolledBack, registered: [], warnings };
   }
 }
 var DOMAIN_RE2;
@@ -80000,7 +80209,6 @@ __export(exports_src, {
   EdgeConflictError: () => EdgeConflictError,
   EDGE_HOST_STATE_DIR: () => EDGE_HOST_STATE_DIR,
   EDGE_HOST_PATHS: () => EDGE_HOST_PATHS,
-  EDGE_CONTAINER_NAME: () => EDGE_CONTAINER_NAME,
   EDGE_CONTAINER_MOUNTS: () => EDGE_CONTAINER_MOUNTS,
   DockerRuntime: () => DockerRuntime,
   DockerEdgeExecutor: () => DockerEdgeExecutor,
@@ -99322,7 +99530,7 @@ var init_migrator3 = __esm(() => {
 });
 
 // ../../packages/db/src/client.ts
-import { mkdirSync as mkdirSync2, existsSync as existsSync3, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync2, existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve5, dirname as dirname8, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getDriver() {
@@ -99397,7 +99605,7 @@ async function createPgClient(url2) {
 }
 function clearStalePgliteControlFile(dataDir) {
   const controlPath = join18(dataDir, "postmaster.pid");
-  if (!existsSync3(controlPath))
+  if (!existsSync4(controlPath))
     return;
   try {
     unlinkSync2(controlPath);
@@ -99426,7 +99634,7 @@ async function createPgliteClient() {
     return memDb;
   }
   const dataDir = resolvePgliteDataDir();
-  if (!existsSync3(dataDir)) {
+  if (!existsSync4(dataDir)) {
     mkdirSync2(dataDir, { recursive: true });
   }
   await acquirePgliteLock(dataDir, { waitMs: 30000, pollMs: 250 });
@@ -191353,7 +191561,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@repo/api",
-    version: "0.4.6",
+    version: "0.4.8",
     license: "Apache-2.0",
     private: true,
     type: "module",
@@ -246432,7 +246640,7 @@ var init_safe_fetch = __esm(() => {
 
 // ../api/src/lib/release-download.ts
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync, rmSync } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, rmSync } from "node:fs";
 import { readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join20, resolve as resolve8 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
@@ -246446,7 +246654,7 @@ async function fetchAndExtractRelease(input) {
   const external4 = Boolean(input.assetUrl);
   const envOverride = input.envOverride ?? (input.asset ? envOverrideFor(input.asset) : "OPENSHIP_RELEASE_DIST_PATH");
   const targetDir = resolve8(cacheDir, tag2);
-  if (existsSync4(targetDir)) {
+  if (existsSync5(targetDir)) {
     return { path: targetDir, downloaded: false };
   }
   let assetUrl;
@@ -246504,7 +246712,7 @@ async function fetchAndExtractRelease(input) {
     try {
       renameSync(scratchDir, targetDir);
     } catch (err2) {
-      if (existsSync4(targetDir)) {
+      if (existsSync5(targetDir)) {
         rmSync(scratchDir, { recursive: true, force: true });
         return { path: targetDir, downloaded: true };
       }
@@ -246516,7 +246724,7 @@ async function fetchAndExtractRelease(input) {
     }
     return { path: targetDir, downloaded: true };
   } catch (err2) {
-    if (existsSync4(scratchDir)) {
+    if (existsSync5(scratchDir)) {
       rmSync(scratchDir, { recursive: true, force: true });
     }
     throw err2;
@@ -246807,7 +247015,7 @@ var init_release_download = __esm(() => {
 });
 
 // ../api/src/lib/release-resolver.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join21, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -246827,17 +247035,17 @@ async function resolveReleaseDist(spec) {
     const raw2 = process.env[spec.envOverride];
     if (raw2) {
       const dir = spec.envOverrideSubdir ? resolve9(raw2, spec.envOverrideSubdir) : resolve9(raw2);
-      if (existsSync5(dir))
+      if (existsSync6(dir))
         return { dir, version: version5, origin: "env" };
       throw new ReleaseDistMissingError(spec.name, dir);
     }
   }
-  if (spec.repoLocalPath && existsSync5(spec.repoLocalPath)) {
+  if (spec.repoLocalPath && existsSync6(spec.repoLocalPath)) {
     return { dir: spec.repoLocalPath, version: version5, origin: "repo-local" };
   }
   const cacheDir = join21(spec.dataDir ?? computeDataDir(), `${spec.name}-dist`);
   const cachedTarget = join21(cacheDir, tag2);
-  if (existsSync5(cachedTarget))
+  if (existsSync6(cachedTarget))
     return { dir: cachedTarget, version: version5, origin: "cache-hit" };
   const src = spec.source;
   try {
@@ -246872,13 +247080,13 @@ function resolveReleaseDistOrNull(spec) {
     const raw2 = process.env[spec.envOverride];
     if (raw2) {
       const dir = spec.envOverrideSubdir ? resolve9(raw2, spec.envOverrideSubdir) : resolve9(raw2);
-      return existsSync5(dir) ? dir : null;
+      return existsSync6(dir) ? dir : null;
     }
   }
-  if (spec.repoLocalPath && existsSync5(spec.repoLocalPath))
+  if (spec.repoLocalPath && existsSync6(spec.repoLocalPath))
     return spec.repoLocalPath;
   const cached6 = join21(spec.dataDir ?? computeDataDir(), `${spec.name}-dist`, `v${version5}`);
-  return existsSync5(cached6) ? cached6 : null;
+  return existsSync6(cached6) ? cached6 : null;
 }
 function subst(s4, version5, tag2) {
   return s4.replaceAll("{version}", version5).replaceAll("{tag}", tag2);
@@ -278158,7 +278366,7 @@ var require_lib5 = __commonJS((exports) => {
 
 // ../api/src/lib/geo-ip.ts
 import { isIP } from "node:net";
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { mkdir as mkdir2, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
 import { dirname as dirname9, join as join25 } from "node:path";
@@ -278180,7 +278388,7 @@ function candidatePaths() {
 async function resolveDbPath() {
   for (const p4 of candidatePaths()) {
     try {
-      if (existsSync7(p4))
+      if (existsSync8(p4))
         return p4;
     } catch {}
   }
@@ -296920,7 +297128,7 @@ await __promiseAll([
   init_github_access(),
   init_rollback()
 ]);
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
 async function assertGitHubAccessForDeployment(ctx2, deploymentId, organizationId) {
   const dep = await getDeployment(deploymentId, organizationId);
   const project2 = await repos.project.findById(dep.projectId);
@@ -297080,7 +297288,7 @@ async function skipPortCheck(deploymentId, organizationId, target) {
 }
 function readInstanceLog(tail) {
   const path2 = process.env.OPENSHIP_INSTANCE_LOG;
-  if (!path2 || !existsSync6(path2))
+  if (!path2 || !existsSync7(path2))
     return [];
   let text3;
   try {

package/dist/{setup-HQIZLUOJ.js → setup-NU6T2PDU.js}

@@ -4,13 +4,13 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-C5OHTYEF.js";
-import "./chunk-SQ77DZOI.js";
+} from "./chunk-GKHUSZCD.js";
+import "./chunk-SLTYVHU7.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-FQGJZ2HS.js";
+import "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";