openship 0.4.7 → 0.4.8

package/dist/{bare-2HYDXQEH.js → bare-JY5Y5ELU.js}

@@ -9,7 +9,7 @@ import {
 import "./chunk-MZ2WEHHY.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-4Z5QO7N6.js";
-import "./chunk-4TJC4JZQ.js";
+import "./chunk-XPPZ7B2J.js";
 import "./chunk-OXWDY22G.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-TYVME3XD.js";

package/dist/{chunk-R5BHFFAV.js → chunk-2D3I5G6P.js}

@@ -59,21 +59,39 @@ function sq(value) {
 function isOurEdgeContainer(name, image) {
   return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
 }
-async function edgeIsServing(executor, port = 80) {
-  const running = await tryExec(
-    executor,
-    `docker inspect -f '{{.State.Running}}' ${sq(EDGE_CONTAINER_NAME)} 2>/dev/null`
-  );
-  if ((running ?? "").trim() !== "true") return false;
-  const probe = await tryExec(
+function vhostLog(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function sanitizeEdgeVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    // A real server_name is anything that isn't the `_` wildcard.
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" > "$f.osh" && mv "$f.osh" "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out = await executor.exec(script).catch(() => "");
+  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [action, file] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(vhostLog(`Dropped catch-all vhost ${file} \u2014 the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(vhostLog(`Removed default_server from ${file} \u2014 the edge image owns it.`, "warn"));
+    }
+  }
+}
+async function edgeIsBroken(executor) {
+  const status = await tryExec(
     executor,
-    containerShell(`wget -q -O /dev/null -T 3 http://127.0.0.1:${port}/ >/dev/null 2>&1; echo $?`)
+    `docker inspect -f '{{.State.Status}}' ${sq(EDGE_CONTAINER_NAME)} 2>/dev/null`
   );
-  const code = (probe ?? "").trim().split("\n").pop() ?? "1";
-  return code === "0" || code === "8";
-}
-function containerShell(command) {
-  return `docker exec ${sq(EDGE_CONTAINER_NAME)} sh -c ${sq(command)}`;
+  const state = (status ?? "").trim();
+  return state === "restarting" || state === "exited" || state === "dead";
 }
 async function edgeCrashReason(executor) {
   const logs = await tryExec(
@@ -86,7 +104,7 @@ function edgeFailureReason(containerLog) {
   const lines = containerLog.split("\n").map((l) => l.trim()).filter(Boolean);
   const emerg = lines.find((l) => l.includes("[emerg]"));
   if (emerg) return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
-  return lines.at(-1) ?? null;
+  return null;
 }
 var EDGE_CONTAINER_NAME = "openship-edge";
 async function ourEdgeContainerRunning(executor) {
@@ -268,7 +286,8 @@ export {
   classifyProxy,
   sq,
   isOurEdgeContainer,
-  edgeIsServing,
+  sanitizeEdgeVhosts,
+  edgeIsBroken,
   edgeCrashReason,
   edgeFailureReason,
   EDGE_CONTAINER_NAME,

package/dist/{chunk-XFCDYZUQ.js → chunk-5NYUCONN.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-UXWAVM4C.js";
+} from "./chunk-SLTYVHU7.js";
 import {
   createDockerBuildContext,
   normalizeDockerRelativePath,

package/dist/{chunk-IMBD5PZ5.js → chunk-BBHX7T4R.js}

@@ -101,10 +101,10 @@ import {
 } from "./chunk-W73X43R7.js";
 import {
   CloudRuntime
-} from "./chunk-XFCDYZUQ.js";
+} from "./chunk-5NYUCONN.js";
 import {
   systemCatalog
-} from "./chunk-UXWAVM4C.js";
+} from "./chunk-SLTYVHU7.js";
 import {
   AwsCrc32,
   __awaiter,
@@ -149,8 +149,9 @@ import {
 import {
   EDGE_CONTAINER_NAME,
   edgeCrashReason,
-  invalidateEdgeContainer
-} from "./chunk-R5BHFFAV.js";
+  invalidateEdgeContainer,
+  sanitizeEdgeVhosts
+} from "./chunk-2D3I5G6P.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
@@ -13234,7 +13235,7 @@ function renderEnv(opts, host, cfg) {
     // (hides the local row). Written explicitly so the policy is visible in .env.
     `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
     `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.7" : "latest")}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.8" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
     `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
@@ -13307,7 +13308,14 @@ function compose(args, opts) {
   });
   return r2.status ?? 1;
 }
-function composeUp(opts) {
+function composePrefetch(opts) {
+  const { buildDir } = materialize(opts);
+  if (buildDir) {
+    return compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0;
+  }
+  return compose(["pull"]) === 0;
+}
+async function composeUp(opts) {
   const { buildDir, cfg, envChanged } = materialize(opts);
   const apiPort = cfg.apiPort;
   const dashPort = cfg.dashPort;
@@ -13323,12 +13331,20 @@ function composeUp(opts) {
   if (dbVolumeExists(project)) {
     reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
   }
+  await sanitizeEdgeVhosts(
+    new LocalExecutor(),
+    EDGE_SITES_HOST_DIR,
+    (l2) => console.log(`  ${l2.message}`)
+  ).catch(() => {
+  });
   if (buildDir) {
-    if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
-    }
-    if (compose(["build"], { withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
+    if (!opts.alreadyFetched) {
+      if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
+        return { ok: false, apiPort, dashPort };
+      }
+      if (compose(["build"], { withBuildOverride: true }) !== 0) {
+        return { ok: false, apiPort, dashPort };
+      }
     }
     if (up({ withBuildOverride: true }) !== 0) {
       return { ok: false, apiPort, dashPort };
@@ -13337,7 +13353,9 @@ function composeUp(opts) {
     writeInstallMethod("compose");
     return { ok: true, apiPort, dashPort };
   }
-  if (compose(["pull"]) !== 0) return { ok: false, apiPort, dashPort };
+  if (!opts.alreadyFetched && compose(["pull"]) !== 0) {
+    return { ok: false, apiPort, dashPort };
+  }
   if (up() !== 0) return { ok: false, apiPort, dashPort };
   onEdgeContainerChanged();
   writeInstallMethod("compose");
@@ -13366,9 +13384,9 @@ function composeUninstall(opts = {}) {
   }
   return { ok, removedImages };
 }
-function composeUpdate(version) {
+async function composeUpdate(version) {
   if (!existsSync3(COMPOSE_FILE)) return false;
-  return composeUp(version ? { version } : {}).ok;
+  return (await composeUp(version ? { version } : {})).ok;
 }
 function composePs() {
   return compose(["ps"]);
@@ -13488,6 +13506,7 @@ export {
   composeIsViableDefault,
   ensureDocker,
   sourceBuildDir,
+  composePrefetch,
   composeUp,
   composeDown,
   composeUninstall,

package/dist/{chunk-IPYPMI3S.js → chunk-GKHUSZCD.js}

@@ -6,7 +6,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-UXWAVM4C.js";
+} from "./chunk-SLTYVHU7.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";

package/dist/{chunk-UXWAVM4C.js → chunk-SLTYVHU7.js}

@@ -31,9 +31,10 @@ import {
   ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
+  sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-R5BHFFAV.js";
+} from "./chunk-2D3I5G6P.js";
 import {
   waitForPortListening
 } from "./chunk-ILFETZOM.js";
@@ -1842,7 +1843,7 @@ async function runningImage(executor, container) {
   return out.trim() || null;
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
+  const { NginxProvider: Provider } = await import("./nginx-3L4SIBJA.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -1857,7 +1858,7 @@ async function containerEdgeProvider(executor, container, opts) {
 }
 async function localContainerEdgeProvider(container, opts) {
   const { DockerEdgeExecutor } = await import("./docker-edge-executor-VHW3JPJS.js");
-  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
+  const { NginxProvider: Provider } = await import("./nginx-3L4SIBJA.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -1867,6 +1868,18 @@ async function localContainerEdgeProvider(container, opts) {
     pinPaths: true
   });
 }
+async function startEdgeContainer(executor, container, image, onLog) {
+  await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {
+  });
+  await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+  });
+  const run = await executor.streamExec(
+    buildEdgeRunCommand(container, image),
+    onLog
+  );
+  invalidateEdgeContainer(executor);
+  return run.code === 0;
+}
 function buildEdgeRunCommand(container, image) {
   const mounts = EDGE_CONTAINER_MOUNTS.map(
     // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
@@ -1890,14 +1903,7 @@ async function swapEdgeImage(executor, container, from, to, opts) {
     return { swapped: false, edgeDown: false };
   }
   const start = async (image) => {
-    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
-    });
-    const run = await executor.streamExec(
-      buildEdgeRunCommand(container, image),
-      onLog
-    );
-    invalidateEdgeContainer(executor);
-    if (run.code !== 0) return false;
+    if (!await startEdgeContainer(executor, container, image, onLog)) return false;
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
@@ -1920,29 +1926,6 @@ async function listDir(executor, dir) {
     out.split("\n").map((l) => l.trim()).filter(Boolean)
   );
 }
-async function sanitizeCarriedVhosts(executor, sitesDir, onLog) {
-  const script = [
-    `for f in ${sq(sitesDir)}/*.conf; do`,
-    `  [ -f "$f" ] || continue;`,
-    // A real server_name is anything that isn't the `_` wildcard.
-    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
-    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
-    `  fi;`,
-    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
-    `    sed -i -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" && echo "unset-default $f";`,
-    `  fi;`,
-    `done`
-  ].join(" ");
-  const out = await executor.exec(script).catch(() => "");
-  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
-    const [action, file] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
-    if (action === "dropped-catchall") {
-      onLog(log4(`Dropped the bare edge's catch-all ${file} \u2014 the edge image provides it.`, "warn"));
-    } else if (action === "unset-default") {
-      onLog(log4(`Removed default_server from ${file} \u2014 the edge image owns it.`, "warn"));
-    }
-  }
-}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -1989,7 +1972,6 @@ async function ensureContainerEdge(executor, opts) {
       beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
       });
-      await sanitizeCarriedVhosts(executor, sitesTarget, onLog);
     }
   }
   const restoreBare = async () => {
@@ -2015,15 +1997,10 @@ async function ensureContainerEdge(executor, opts) {
       await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {
       });
     }
-    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
-    });
     onLog(log4("Starting the edge container..."));
-    const run = await executor.streamExec(
-      buildEdgeRunCommand(container, image),
-      onLog
-    );
-    invalidateEdgeContainer(executor);
-    if (run.code !== 0) throw new Error("the edge container failed to start");
+    if (!await startEdgeContainer(executor, container, image, onLog)) {
+      throw new Error("the edge container failed to start");
+    }
     await executor.exec(containerCommand(container, "openresty -t"));
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4

package/dist/{chunk-4TJC4JZQ.js → chunk-XPPZ7B2J.js}

@@ -30,7 +30,7 @@ import {
 } from "./chunk-6APULWSU.js";
 
 // ../../packages/adapters/src/system/executor.ts
-import { readFileSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 
 // ../../packages/adapters/src/system/ssh-executor.ts
 import { createReadStream } from "fs";
@@ -1508,6 +1508,18 @@ function createExecutor(ssh) {
 function hostControlDisabled() {
   return process.env.OPENSHIP_HOST_CONTROL?.trim().toLowerCase() === "false";
 }
+function runningInContainer() {
+  if (process.env.OPENSHIP_IN_CONTAINER?.trim().toLowerCase() === "true") return true;
+  try {
+    if (existsSync("/.dockerenv")) return true;
+  } catch {
+  }
+  try {
+    return /\b(docker|containerd|podman|kubepods)\b/.test(readFileSync("/proc/1/cgroup", "utf8"));
+  } catch {
+    return false;
+  }
+}
 function createHostExecutor() {
   if (hostControlDisabled()) {
     throw new Error(
@@ -1515,7 +1527,14 @@ function createHostExecutor() {
     );
   }
   const host = process.env.OPENSHIP_HOST_SSH_HOST?.trim();
-  if (!host) return localExecutor;
+  if (!host) {
+    if (runningInContainer()) {
+      throw new Error(
+        "This operation targets the HOST machine, but no host channel is configured (OPENSHIP_HOST_SSH_HOST is unset) and Openship is running in a container \u2014 so it would have run inside the container instead, against the wrong filesystem. Re-run `openship up` to provision the host channel."
+      );
+    }
+    return localExecutor;
+  }
   const keyPath = process.env.OPENSHIP_HOST_SSH_KEY?.trim();
   const portRaw = Number(process.env.OPENSHIP_HOST_SSH_PORT || "22");
   const port = Number.isInteger(portRaw) && portRaw > 0 && portRaw < 65536 ? portRaw : 22;

package/dist/{cloud-2KXREXMO.js → cloud-KYWY3RP4.js}

@@ -6,19 +6,19 @@ import {
   CloudRuntime,
   PAGE_CONTAINER_PREFIX,
   provisionCloudWorkspace
-} from "./chunk-XFCDYZUQ.js";
-import "./chunk-UXWAVM4C.js";
+} from "./chunk-5NYUCONN.js";
+import "./chunk-SLTYVHU7.js";
 import "./chunk-V6AN6XLZ.js";
 import "./chunk-MZ2WEHHY.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-4Z5QO7N6.js";
-import "./chunk-4TJC4JZQ.js";
+import "./chunk-XPPZ7B2J.js";
 import "./chunk-OXWDY22G.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-TYVME3XD.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-R5BHFFAV.js";
+import "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/{detect-2XSCFFTF.js → detect-AZLOHUFX.js}

@@ -9,7 +9,7 @@ import {
   classifyProxy,
   edgeCrashReason,
   edgeFailureReason,
-  edgeIsServing,
+  edgeIsBroken,
   freeEdgeTargets,
   invalidateEdgeContainer,
   isOurEdgeContainer,
@@ -17,9 +17,10 @@ import {
   ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
+  sanitizeEdgeVhosts,
   sq,
   stopTargetsForStatus
-} from "./chunk-R5BHFFAV.js";
+} from "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";
@@ -31,7 +32,7 @@ export {
   classifyProxy,
   edgeCrashReason,
   edgeFailureReason,
-  edgeIsServing,
+  edgeIsBroken,
   freeEdgeTargets,
   invalidateEdgeContainer,
   isOurEdgeContainer,
@@ -39,6 +40,7 @@ export {
   ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
+  sanitizeEdgeVhosts,
   sq,
   stopTargetsForStatus
 };

package/dist/{edge-import-ZQ4Y5HEA.js → edge-import-ABUDKKJI.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   importMigratedSites,
   waitForApiHealth
-} from "./chunk-IMBD5PZ5.js";
+} from "./chunk-BBHX7T4R.js";
 import "./chunk-FRNAR33O.js";
 import "./chunk-EI575GHN.js";
 import "./chunk-6APIPIJY.js";
@@ -14,12 +14,12 @@ import "./chunk-OWED2GRM.js";
 import "./chunk-VWPEKOH6.js";
 import "./chunk-W73X43R7.js";
 import "./chunk-TGIINPVM.js";
-import "./chunk-XFCDYZUQ.js";
+import "./chunk-5NYUCONN.js";
 import "./chunk-AVIB7CT7.js";
 import "./chunk-5MZ624VX.js";
 import "./chunk-Q2CIRAOK.js";
-import "./chunk-IPYPMI3S.js";
-import "./chunk-UXWAVM4C.js";
+import "./chunk-GKHUSZCD.js";
+import "./chunk-SLTYVHU7.js";
 import "./chunk-O6ZZF52V.js";
 import "./chunk-JYGD5WSN.js";
 import "./chunk-SJIFLLX4.js";
@@ -28,13 +28,13 @@ import "./chunk-VDMQJHPI.js";
 import "./chunk-MZ2WEHHY.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-4Z5QO7N6.js";
-import "./chunk-4TJC4JZQ.js";
+import "./chunk-XPPZ7B2J.js";
 import "./chunk-OXWDY22G.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-TYVME3XD.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-R5BHFFAV.js";
+import "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/{ensure-container-edge-ED25XL3Z.js → ensure-container-edge-SW6HENSG.js}

@@ -10,12 +10,12 @@ import {
   localContainerEdgeProvider,
   resolveEdgeImage,
   setDefaultEdgeImage
-} from "./chunk-UXWAVM4C.js";
+} from "./chunk-SLTYVHU7.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-R5BHFFAV.js";
+import "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/{executor-YPT6RH6O.js → executor-XJ6RP4Q2.js}

@@ -8,7 +8,7 @@ import {
   createExecutor,
   createHostExecutor,
   hostControlDisabled
-} from "./chunk-4TJC4JZQ.js";
+} from "./chunk-XPPZ7B2J.js";
 import "./chunk-OXWDY22G.js";
 import "./chunk-RPHRPFEH.js";
 import {

package/dist/index.js

@@ -8,6 +8,7 @@ import {
   composeDown,
   composeInternalToken,
   composeIsViableDefault,
+  composePrefetch,
   composePs,
   composeRestart,
   composeRunning,
@@ -25,7 +26,7 @@ import {
   remoteSha,
   shortSha,
   sourceBuildDir
-} from "./chunk-IMBD5PZ5.js";
+} from "./chunk-BBHX7T4R.js";
 import "./chunk-FRNAR33O.js";
 import "./chunk-EI575GHN.js";
 import "./chunk-6APIPIJY.js";
@@ -34,11 +35,11 @@ import "./chunk-OWED2GRM.js";
 import "./chunk-VWPEKOH6.js";
 import "./chunk-W73X43R7.js";
 import "./chunk-TGIINPVM.js";
-import "./chunk-XFCDYZUQ.js";
+import "./chunk-5NYUCONN.js";
 import "./chunk-AVIB7CT7.js";
 import "./chunk-5MZ624VX.js";
 import "./chunk-Q2CIRAOK.js";
-import "./chunk-IPYPMI3S.js";
+import "./chunk-GKHUSZCD.js";
 import {
   beginEdgeTakeover,
   collectProxyCerts,
@@ -51,7 +52,7 @@ import {
   recoverInterruptedTakeover,
   rollbackEdgeTakeover,
   scanImportableSites
-} from "./chunk-UXWAVM4C.js";
+} from "./chunk-SLTYVHU7.js";
 import "./chunk-O6ZZF52V.js";
 import "./chunk-JYGD5WSN.js";
 import "./chunk-SJIFLLX4.js";
@@ -60,7 +61,7 @@ import "./chunk-VDMQJHPI.js";
 import "./chunk-MZ2WEHHY.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-4Z5QO7N6.js";
-import "./chunk-4TJC4JZQ.js";
+import "./chunk-XPPZ7B2J.js";
 import "./chunk-OXWDY22G.js";
 import "./chunk-RPHRPFEH.js";
 import {
@@ -70,9 +71,9 @@ import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
 import {
   edgeCrashReason,
-  edgeIsServing,
+  edgeIsBroken,
   ourEdgeContainerRunning
-} from "./chunk-R5BHFFAV.js";
+} from "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import {
@@ -1683,6 +1684,25 @@ async function runCompose(opts) {
     );
     process.exit(1);
   }
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
+  const prefetch = ora(
+    sourceBuildDir() ? "Building images before touching :80/:443\u2026" : "Pulling images before touching :80/:443\u2026"
+  ).start();
+  const fetched = composePrefetch({
+    apiPort: opts.port,
+    dashboardPort: opts.dashboardPort,
+    publicUrl,
+    trustProxy: opts.trustProxy,
+    noHostControl: opts.hostControl === false ? true : void 0
+  });
+  if (!fetched) {
+    prefetch.fail("Couldn't fetch the stack's images \u2014 nothing was changed on this box.");
+    console.error(
+      chalk6.dim("\n  Your current proxy is untouched and still serving. Fix the pull/build error above and re-run.\n")
+    );
+    process.exit(1);
+  }
+  prefetch.succeed("Images ready \u2014 nothing on :80/:443 has changed yet.");
   let edgePlan;
   try {
     edgePlan = await planAndApplyHostEdge({ edge: opts.edge });
@@ -1700,12 +1720,13 @@ async function runCompose(opts) {
     );
     process.exit(1);
   }
-  const publicUrl = effectivePublicUrl(opts.publicUrl);
   const fromSource = sourceBuildDir();
   const spinner5 = ora(
     fromSource ? `Building Openship from ${fromSource} and starting the stack\u2026` : "Starting Openship via Docker Compose\u2026"
   ).start();
-  const res = composeUp({
+  const res = await composeUp({
+    // Prefetched above, before the preflight stopped anything.
+    alreadyFetched: true,
     apiPort: opts.port,
     dashboardPort: opts.dashboardPort,
     publicUrl,
@@ -1724,11 +1745,11 @@ async function runCompose(opts) {
     process.exit(1);
   }
   spinner5.succeed("Openship is running via Docker Compose.");
-  if (edgePlan.action && !await edgeIsServing(new LocalExecutor())) {
+  if (edgePlan.action && await edgeIsBroken(new LocalExecutor())) {
     const reason = await edgeCrashReason(new LocalExecutor());
     console.error(
       chalk6.red(`
-  Openship's edge is not serving :80${reason ? ` \u2014 ${reason}` : "."}`)
+  Openship's edge container is not running${reason ? ` \u2014 ${reason}` : "."}`)
     );
     const restored = await rollbackHostEdge();
     console.error(
@@ -1996,7 +2017,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.4.7"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.4.8"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -6605,7 +6626,7 @@ function detectPackageManager2(override) {
 var updateCommand = new Command26("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").option("--rebuild", "From-source installs: rebuild even if already at the remote tip").action(async (opts) => {
   const source = readSourceInstall();
   if (source) return runSourceUpdate(source, opts);
-  const current = "0.4.7";
+  const current = "0.4.8";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6640,7 +6661,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
     return;
   }
   if (readInstallMethod() === "compose") {
-    const applied = composeUpdate(latest);
+    const applied = await composeUpdate(latest);
     if (isJsonMode()) {
       printJson({ updated: true, from: current, to: latest, via: pm, method: "compose", applied });
     } else if (applied) {
@@ -7172,7 +7193,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.4.7"}`;
+  const uiTag = `v${"0.4.8"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7226,6 +7247,18 @@ async function runWizard() {
     }
   }
   if (method === "compose") {
+    log5.step(
+      sourceBuildDir() ? "Building the Openship images before touching :80/:443 (first run takes a few minutes)\u2026" : "Pulling images before touching :80/:443\u2026"
+    );
+    if (!composePrefetch({
+      publicUrl,
+      trustProxy: behindProxy,
+      version: "0.4.8",
+      noHostControl: !allowHostControl
+    })) {
+      cancel4("Couldn't fetch the Openship images \u2014 nothing on this box was changed.");
+      process.exit(1);
+    }
     const edgePlan = await planAndApplyHostEdge({});
     if (!edgePlan.proceed) {
       cancel4("Left the existing proxy on 80/443 running \u2014 re-run and choose migrate/takeover when ready.");
@@ -7234,13 +7267,13 @@ async function runWizard() {
     edgeAction = edgePlan.action;
     migratedSites = edgePlan.sites;
     migratedCertPems = edgePlan.certPems;
-    log5.step(
-      sourceBuildDir() ? "Building the Openship images from your source checkout (first run takes a few minutes)\u2026" : "Pulling images and starting the Docker Compose stack\u2026"
-    );
-    const up = composeUp({
+    log5.step("Starting the Docker Compose stack\u2026");
+    const up = await composeUp({
+      // Prefetched above, before the preflight stopped anything.
+      alreadyFetched: true,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.4.7",
+      version: "0.4.8",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7577,7 +7610,7 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.7").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.8").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/{nginx-XWJAOGS4.js → nginx-3L4SIBJA.js}

@@ -10,7 +10,7 @@ import {
   summarizeCertbotFailure
 } from "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-R5BHFFAV.js";
+import "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/dist/server/index.js

@@ -25764,7 +25764,7 @@ __export(exports_executor, {
   SshExecutor: () => SshExecutor,
   LocalExecutor: () => LocalExecutor
 });
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 function createExecutor(ssh) {
   if (ssh) {
     if (ssh.useSystemSsh)
@@ -25776,13 +25776,30 @@ function createExecutor(ssh) {
 function hostControlDisabled() {
   return process.env.OPENSHIP_HOST_CONTROL?.trim().toLowerCase() === "false";
 }
+function runningInContainer() {
+  if (process.env.OPENSHIP_IN_CONTAINER?.trim().toLowerCase() === "true")
+    return true;
+  try {
+    if (existsSync("/.dockerenv"))
+      return true;
+  } catch {}
+  try {
+    return /\b(docker|containerd|podman|kubepods)\b/.test(readFileSync("/proc/1/cgroup", "utf8"));
+  } catch {
+    return false;
+  }
+}
 function createHostExecutor() {
   if (hostControlDisabled()) {
     throw new Error("Host control is disabled on this instance (OPENSHIP_HOST_CONTROL=false). " + "Re-run `openship up` without --no-host-control to allow host operations.");
   }
   const host = process.env.OPENSHIP_HOST_SSH_HOST?.trim();
-  if (!host)
+  if (!host) {
+    if (runningInContainer()) {
+      throw new Error("This operation targets the HOST machine, but no host channel is configured " + "(OPENSHIP_HOST_SSH_HOST is unset) and Openship is running in a container — " + "so it would have run inside the container instead, against the wrong " + "filesystem. Re-run `openship up` to provision the host channel.");
+    }
     return localExecutor;
+  }
   const keyPath = process.env.OPENSHIP_HOST_SSH_KEY?.trim();
   const portRaw = Number(process.env.OPENSHIP_HOST_SSH_PORT || "22");
   const port = Number.isInteger(portRaw) && portRaw > 0 && portRaw < 65536 ? portRaw : 22;
@@ -29081,7 +29098,7 @@ __export(exports_openresty_lua, {
   ACME_CHALLENGE_LOCATION: () => ACME_CHALLENGE_LOCATION
 });
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { dirname as dirname4, join as join10 } from "node:path";
 import { fileURLToPath } from "node:url";
 async function detectOpenRestyPaths(executor) {
@@ -29164,11 +29181,11 @@ http {
 `;
 }
 function luaSourceAvailable() {
-  return VHOST_REFERENCED_LUA.every((f) => EMBEDDED_LUA[f] !== undefined || existsSync(join10(LUA_SRC_DIR, f)));
+  return VHOST_REFERENCED_LUA.every((f) => EMBEDDED_LUA[f] !== undefined || existsSync2(join10(LUA_SRC_DIR, f)));
 }
 function readLua(filename) {
   const onDisk = join10(LUA_SRC_DIR, filename);
-  if (existsSync(onDisk))
+  if (existsSync2(onDisk))
     return readFileSync2(onDisk, "utf-8");
   const embedded = EMBEDDED_LUA[filename];
   if (embedded !== undefined)
@@ -29368,6 +29385,7 @@ var exports_detect = {};
 __export(exports_detect, {
   stopTargetsForStatus: () => stopTargetsForStatus,
   sq: () => sq3,
+  sanitizeEdgeVhosts: () => sanitizeEdgeVhosts,
   resolveOurEdgeContainer: () => resolveOurEdgeContainer,
   probeEdge: () => probeEdge,
   ourLuaOnHost: () => ourLuaOnHost,
@@ -29375,7 +29393,7 @@ __export(exports_detect, {
   isOurEdgeContainer: () => isOurEdgeContainer,
   invalidateEdgeContainer: () => invalidateEdgeContainer,
   freeEdgeTargets: () => freeEdgeTargets,
-  edgeIsServing: () => edgeIsServing,
+  edgeIsBroken: () => edgeIsBroken,
   edgeFailureReason: () => edgeFailureReason,
   edgeCrashReason: () => edgeCrashReason,
   classifyProxy: () => classifyProxy,
@@ -29414,17 +29432,36 @@ function sq3(value) {
 function isOurEdgeContainer(name2, image) {
   return /openship-edge/i.test(`${name2 ?? ""} ${image ?? ""}`);
 }
-async function edgeIsServing(executor, port = 80) {
-  const running = await tryExec3(executor, `docker inspect -f '{{.State.Running}}' ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null`);
-  if ((running ?? "").trim() !== "true")
-    return false;
-  const probe = await tryExec3(executor, containerShell(`wget -q -O /dev/null -T 3 http://127.0.0.1:${port}/ >/dev/null 2>&1; echo $?`));
-  const code = (probe ?? "").trim().split(`
-`).pop() ?? "1";
-  return code === "0" || code === "8";
+function vhostLog(message, level = "info") {
+  return { timestamp: new Date().toISOString(), message, level };
 }
-function containerShell(command) {
-  return `docker exec ${sq3(EDGE_CONTAINER_NAME)} sh -c ${sq3(command)}`;
+async function sanitizeEdgeVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq3(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" > "$f.osh" && mv "$f.osh" "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out2 = await executor.exec(script).catch(() => "");
+  for (const line of out2.split(`
+`).map((l) => l.trim()).filter(Boolean)) {
+    const [action, file3] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(vhostLog(`Dropped catch-all vhost ${file3} — the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(vhostLog(`Removed default_server from ${file3} — the edge image owns it.`, "warn"));
+    }
+  }
+}
+async function edgeIsBroken(executor) {
+  const status = await tryExec3(executor, `docker inspect -f '{{.State.Status}}' ${sq3(EDGE_CONTAINER_NAME)} 2>/dev/null`);
+  const state = (status ?? "").trim();
+  return state === "restarting" || state === "exited" || state === "dead";
 }
 async function edgeCrashReason(executor) {
   const logs = await tryExec3(executor, `docker logs --tail 40 ${sq3(EDGE_CONTAINER_NAME)} 2>&1`);
@@ -29436,7 +29473,7 @@ function edgeFailureReason(containerLog) {
   const emerg = lines.find((l) => l.includes("[emerg]"));
   if (emerg)
     return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
-  return lines.at(-1) ?? null;
+  return null;
 }
 async function ourEdgeContainerRunning(executor) {
   return Boolean(await resolveOurEdgeContainer(executor));
@@ -32342,6 +32379,13 @@ async function localContainerEdgeProvider(container, opts) {
     pinPaths: true
   });
 }
+async function startEdgeContainer(executor, container, image, onLog) {
+  await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {});
+  await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
+  const run2 = await executor.streamExec(buildEdgeRunCommand(container, image), onLog);
+  invalidateEdgeContainer(executor);
+  return run2.code === 0;
+}
 function buildEdgeRunCommand(container, image) {
   const mounts = EDGE_CONTAINER_MOUNTS.map((m) => `-v ${sq2(`${m.host}:${m.container}:z`)}`).join(" ");
   return [
@@ -32362,10 +32406,7 @@ async function swapEdgeImage(executor, container, from, to, opts) {
     return { swapped: false, edgeDown: false };
   }
   const start2 = async (image) => {
-    await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
-    const run2 = await executor.streamExec(buildEdgeRunCommand(container, image), onLog);
-    invalidateEdgeContainer(executor);
-    if (run2.code !== 0)
+    if (!await startEdgeContainer(executor, container, image, onLog))
       return false;
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 30000
@@ -32388,29 +32429,6 @@ async function listDir(executor, dir) {
   return new Set(out2.split(`
 `).map((l) => l.trim()).filter(Boolean));
 }
-async function sanitizeCarriedVhosts(executor, sitesDir, onLog) {
-  const script = [
-    `for f in ${sq2(sitesDir)}/*.conf; do`,
-    `  [ -f "$f" ] || continue;`,
-    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
-    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
-    `  fi;`,
-    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
-    `    sed -i -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" && echo "unset-default $f";`,
-    `  fi;`,
-    `done`
-  ].join(" ");
-  const out2 = await executor.exec(script).catch(() => "");
-  for (const line of out2.split(`
-`).map((l) => l.trim()).filter(Boolean)) {
-    const [action, file3] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
-    if (action === "dropped-catchall") {
-      onLog(log2(`Dropped the bare edge's catch-all ${file3} — the edge image provides it.`, "warn"));
-    } else if (action === "unset-default") {
-      onLog(log2(`Removed default_server from ${file3} — the edge image owns it.`, "warn"));
-    }
-  }
-}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -32451,7 +32469,6 @@ async function ensureContainerEdge(executor, opts) {
       onLog(log2(`Carrying vhosts from ${barePaths.sitesDir}...`));
       beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq2(`${barePaths.sitesDir}/.`)} ${sq2(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {});
-      await sanitizeCarriedVhosts(executor, sitesTarget, onLog);
     }
   }
   const restoreBare = async () => {
@@ -32474,12 +32491,10 @@ async function ensureContainerEdge(executor, opts) {
       await executor.exec("systemctl disable --now openresty 2>/dev/null || true").catch(() => {});
       await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {});
     }
-    await executor.exec(`docker rm -f ${sq2(container)} 2>/dev/null || true`).catch(() => {});
     onLog(log2("Starting the edge container..."));
-    const run2 = await executor.streamExec(buildEdgeRunCommand(container, image), onLog);
-    invalidateEdgeContainer(executor);
-    if (run2.code !== 0)
+    if (!await startEdgeContainer(executor, container, image, onLog)) {
       throw new Error("the edge container failed to start");
+    }
     await executor.exec(containerCommand(container, "openresty -t"));
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 30000
@@ -99515,7 +99530,7 @@ var init_migrator3 = __esm(() => {
 });
 
 // ../../packages/db/src/client.ts
-import { mkdirSync as mkdirSync2, existsSync as existsSync3, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync2, existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve5, dirname as dirname8, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getDriver() {
@@ -99590,7 +99605,7 @@ async function createPgClient(url2) {
 }
 function clearStalePgliteControlFile(dataDir) {
   const controlPath = join18(dataDir, "postmaster.pid");
-  if (!existsSync3(controlPath))
+  if (!existsSync4(controlPath))
     return;
   try {
     unlinkSync2(controlPath);
@@ -99619,7 +99634,7 @@ async function createPgliteClient() {
     return memDb;
   }
   const dataDir = resolvePgliteDataDir();
-  if (!existsSync3(dataDir)) {
+  if (!existsSync4(dataDir)) {
     mkdirSync2(dataDir, { recursive: true });
   }
   await acquirePgliteLock(dataDir, { waitMs: 30000, pollMs: 250 });
@@ -191546,7 +191561,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@repo/api",
-    version: "0.4.7",
+    version: "0.4.8",
     license: "Apache-2.0",
     private: true,
     type: "module",
@@ -246625,7 +246640,7 @@ var init_safe_fetch = __esm(() => {
 
 // ../api/src/lib/release-download.ts
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync, rmSync } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, rmSync } from "node:fs";
 import { readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join20, resolve as resolve8 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
@@ -246639,7 +246654,7 @@ async function fetchAndExtractRelease(input) {
   const external4 = Boolean(input.assetUrl);
   const envOverride = input.envOverride ?? (input.asset ? envOverrideFor(input.asset) : "OPENSHIP_RELEASE_DIST_PATH");
   const targetDir = resolve8(cacheDir, tag2);
-  if (existsSync4(targetDir)) {
+  if (existsSync5(targetDir)) {
     return { path: targetDir, downloaded: false };
   }
   let assetUrl;
@@ -246697,7 +246712,7 @@ async function fetchAndExtractRelease(input) {
     try {
       renameSync(scratchDir, targetDir);
     } catch (err2) {
-      if (existsSync4(targetDir)) {
+      if (existsSync5(targetDir)) {
         rmSync(scratchDir, { recursive: true, force: true });
         return { path: targetDir, downloaded: true };
       }
@@ -246709,7 +246724,7 @@ async function fetchAndExtractRelease(input) {
     }
     return { path: targetDir, downloaded: true };
   } catch (err2) {
-    if (existsSync4(scratchDir)) {
+    if (existsSync5(scratchDir)) {
       rmSync(scratchDir, { recursive: true, force: true });
     }
     throw err2;
@@ -247000,7 +247015,7 @@ var init_release_download = __esm(() => {
 });
 
 // ../api/src/lib/release-resolver.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join21, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -247020,17 +247035,17 @@ async function resolveReleaseDist(spec) {
     const raw2 = process.env[spec.envOverride];
     if (raw2) {
       const dir = spec.envOverrideSubdir ? resolve9(raw2, spec.envOverrideSubdir) : resolve9(raw2);
-      if (existsSync5(dir))
+      if (existsSync6(dir))
         return { dir, version: version5, origin: "env" };
       throw new ReleaseDistMissingError(spec.name, dir);
     }
   }
-  if (spec.repoLocalPath && existsSync5(spec.repoLocalPath)) {
+  if (spec.repoLocalPath && existsSync6(spec.repoLocalPath)) {
     return { dir: spec.repoLocalPath, version: version5, origin: "repo-local" };
   }
   const cacheDir = join21(spec.dataDir ?? computeDataDir(), `${spec.name}-dist`);
   const cachedTarget = join21(cacheDir, tag2);
-  if (existsSync5(cachedTarget))
+  if (existsSync6(cachedTarget))
     return { dir: cachedTarget, version: version5, origin: "cache-hit" };
   const src = spec.source;
   try {
@@ -247065,13 +247080,13 @@ function resolveReleaseDistOrNull(spec) {
     const raw2 = process.env[spec.envOverride];
     if (raw2) {
       const dir = spec.envOverrideSubdir ? resolve9(raw2, spec.envOverrideSubdir) : resolve9(raw2);
-      return existsSync5(dir) ? dir : null;
+      return existsSync6(dir) ? dir : null;
     }
   }
-  if (spec.repoLocalPath && existsSync5(spec.repoLocalPath))
+  if (spec.repoLocalPath && existsSync6(spec.repoLocalPath))
     return spec.repoLocalPath;
   const cached6 = join21(spec.dataDir ?? computeDataDir(), `${spec.name}-dist`, `v${version5}`);
-  return existsSync5(cached6) ? cached6 : null;
+  return existsSync6(cached6) ? cached6 : null;
 }
 function subst(s4, version5, tag2) {
   return s4.replaceAll("{version}", version5).replaceAll("{tag}", tag2);
@@ -278351,7 +278366,7 @@ var require_lib5 = __commonJS((exports) => {
 
 // ../api/src/lib/geo-ip.ts
 import { isIP } from "node:net";
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { mkdir as mkdir2, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
 import { dirname as dirname9, join as join25 } from "node:path";
@@ -278373,7 +278388,7 @@ function candidatePaths() {
 async function resolveDbPath() {
   for (const p4 of candidatePaths()) {
     try {
-      if (existsSync7(p4))
+      if (existsSync8(p4))
         return p4;
     } catch {}
   }
@@ -297113,7 +297128,7 @@ await __promiseAll([
   init_github_access(),
   init_rollback()
 ]);
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
 async function assertGitHubAccessForDeployment(ctx2, deploymentId, organizationId) {
   const dep = await getDeployment(deploymentId, organizationId);
   const project2 = await repos.project.findById(dep.projectId);
@@ -297273,7 +297288,7 @@ async function skipPortCheck(deploymentId, organizationId, target) {
 }
 function readInstanceLog(tail) {
   const path2 = process.env.OPENSHIP_INSTANCE_LOG;
-  if (!path2 || !existsSync6(path2))
+  if (!path2 || !existsSync7(path2))
     return [];
   let text3;
   try {

package/dist/{setup-2DMFIA74.js → setup-NU6T2PDU.js}

@@ -4,13 +4,13 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-IPYPMI3S.js";
-import "./chunk-UXWAVM4C.js";
+} from "./chunk-GKHUSZCD.js";
+import "./chunk-SLTYVHU7.js";
 import "./chunk-L2VOGB2X.js";
 import "./chunk-RPHRPFEH.js";
 import "./chunk-FXTBHTWY.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-R5BHFFAV.js";
+import "./chunk-2D3I5G6P.js";
 import "./chunk-ILFETZOM.js";
 import "./chunk-VFINNTUL.js";
 import "./chunk-6APULWSU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {