openship 0.4.7 → 0.5.0

package/dist/index.js

@@ -3,29 +3,42 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  DEFAULT_API_PORT,
+  DEFAULT_DASHBOARD_PORT,
   IS_ALT_HOME,
   OS_DIR,
   composeDown,
   composeInternalToken,
   composeIsViableDefault,
+  composePrefetch,
   composePs,
   composeRestart,
   composeRunning,
   composeStart,
+  composeTrustedOriginUrls,
   composeUninstall,
   composeUp,
   composeUpdate,
+  dockerGap,
   ensureDocker,
   hasDockerCompose,
   importMigratedSites,
+  portMoveNotice,
   prepareFromSource,
   readInstallMethod,
+  readInstanceUrl,
   readSourceInstall,
+  readStoredPorts,
   rebuildFromSource,
   remoteSha,
+  resolveComposePorts,
+  resolvePorts,
+  saveInstanceUrl,
   shortSha,
-  sourceBuildDir
-} from "./chunk-IMBD5PZ5.js";
+  sourceBuildDir,
+  storedApiPort,
+  storedDashboardPort
+} from "./chunk-BS2AXYZX.js";
 import "./chunk-FRNAR33O.js";
 import "./chunk-EI575GHN.js";
 import "./chunk-6APIPIJY.js";
@@ -33,12 +46,12 @@ import "./chunk-IXCHURVK.js";
 import "./chunk-OWED2GRM.js";
 import "./chunk-VWPEKOH6.js";
 import "./chunk-W73X43R7.js";
-import "./chunk-TGIINPVM.js";
-import "./chunk-XFCDYZUQ.js";
+import "./chunk-6LKHXB6T.js";
+import "./chunk-JLKKYUZA.js";
 import "./chunk-AVIB7CT7.js";
 import "./chunk-5MZ624VX.js";
 import "./chunk-Q2CIRAOK.js";
-import "./chunk-IPYPMI3S.js";
+import "./chunk-NNPEG6HM.js";
 import {
   beginEdgeTakeover,
   collectProxyCerts,
@@ -51,39 +64,40 @@ import {
   recoverInterruptedTakeover,
   rollbackEdgeTakeover,
   scanImportableSites
-} from "./chunk-UXWAVM4C.js";
+} from "./chunk-NXFIRK2Z.js";
 import "./chunk-O6ZZF52V.js";
 import "./chunk-JYGD5WSN.js";
-import "./chunk-SJIFLLX4.js";
-import "./chunk-V6AN6XLZ.js";
-import "./chunk-VDMQJHPI.js";
-import "./chunk-MZ2WEHHY.js";
-import "./chunk-L2VOGB2X.js";
-import "./chunk-4Z5QO7N6.js";
-import "./chunk-4TJC4JZQ.js";
-import "./chunk-OXWDY22G.js";
+import "./chunk-CUJXGK7R.js";
+import "./chunk-V7BZMGOT.js";
+import "./chunk-YWMODKWL.js";
+import "./chunk-KNTJ7PSF.js";
+import "./chunk-KZOBYJUW.js";
+import "./chunk-I6PSTQIR.js";
+import "./chunk-K2RPVGPN.js";
+import "./chunk-ZCOQJCZO.js";
 import "./chunk-RPHRPFEH.js";
 import {
   LocalExecutor
 } from "./chunk-TYVME3XD.js";
-import "./chunk-FXTBHTWY.js";
+import "./chunk-RB35YN3J.js";
 import "./chunk-FPRHYBY2.js";
 import {
   edgeCrashReason,
-  edgeIsServing,
+  edgeIsBroken,
   ourEdgeContainerRunning
-} from "./chunk-R5BHFFAV.js";
+} from "./chunk-6PIYRG5I.js";
 import "./chunk-ILFETZOM.js";
-import "./chunk-VFINNTUL.js";
+import "./chunk-EAAGSQXN.js";
 import {
   CLOUD_DASHBOARD_URL,
   LOCAL_API_URL,
   LOCAL_DASHBOARD_URL,
   cliInstallCommand,
+  commandToArgv,
   isValidEmail,
   parseOpenshipConfigJson,
   resolveCliUpdatePlan
-} from "./chunk-6APULWSU.js";
+} from "./chunk-UMQP7SYT.js";
 import "./chunk-KI2EY3WB.js";
 
 // src/index.ts
@@ -486,8 +500,8 @@ import chalk6 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { createWriteStream as createWriteStream2, existsSync as existsSync7, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname2, join as join8 } from "path";
+import { createWriteStream as createWriteStream2, existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname2, join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/dashboard.ts
@@ -657,7 +671,7 @@ async function fetchBundle(tag, onProgress) {
 
 // src/lib/service.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "fs";
 import { homedir } from "os";
 import { join as join4, resolve } from "path";
 var HOME = homedir();
@@ -875,14 +889,9 @@ function serviceStatus() {
 }
 function sweepOrphanPorts() {
   if (process.platform === "win32") return;
-  let ports = [];
-  try {
-    const raw = readFileSync2(join4(HOME, ".openship", "ports.json"), "utf8");
-    const p = JSON.parse(raw);
-    ports = [p.api, p.dashboard].filter((n) => typeof n === "number");
-  } catch {
-    return;
-  }
+  const stored = readStoredPorts();
+  const ports = [stored.api, stored.dashboard].filter((n) => typeof n === "number");
+  if (ports.length === 0) return;
   const self = process.pid;
   for (const port of ports) {
     const q = run("lsof", ["-ti", `tcp:${port}`]);
@@ -923,97 +932,10 @@ function stop() {
   return result;
 }
 
-// src/lib/ports.ts
-import { createServer } from "net";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
-var PORTS_FILE = join5(OS_DIR, "ports.json");
-var INSTANCE_FILE = join5(OS_DIR, "instance.json");
-function saveInstanceUrl(publicUrl) {
-  try {
-    if (!existsSync4(OS_DIR)) mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync4(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
-  } catch {
-  }
-}
-function readInstanceUrl() {
-  try {
-    return JSON.parse(readFileSync3(INSTANCE_FILE, "utf8")).publicUrl ?? null;
-  } catch {
-    return null;
-  }
-}
-var DEFAULT_API = 4e3;
-var DEFAULT_DASHBOARD = 3001;
-function isPortFree(port) {
-  return new Promise((resolve2) => {
-    const srv = createServer();
-    srv.once("error", () => resolve2(false));
-    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(true)));
-  });
-}
-async function waitPortFree(port, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 6e3;
-  const intervalMs = opts.intervalMs ?? 250;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isPortFree(port)) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r) => setTimeout(r, intervalMs));
-  }
-}
-function getFreePort() {
-  return new Promise((resolve2, reject2) => {
-    const srv = createServer();
-    srv.once("error", reject2);
-    srv.listen(0, "127.0.0.1", () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve2(port) : reject2(new Error("no free port")));
-    });
-  });
-}
-function loadStoredPorts() {
-  try {
-    return JSON.parse(readFileSync3(PORTS_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function saveStoredPorts(api, dashboard) {
-  try {
-    if (!existsSync4(OS_DIR)) mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync4(PORTS_FILE, JSON.stringify({ api, dashboard }));
-  } catch {
-  }
-}
-async function resolvePorts(prefs) {
-  const stored = loadStoredPorts();
-  const apiPref = prefs.api ?? stored.api ?? DEFAULT_API;
-  const dashPref = prefs.dashboard ?? stored.dashboard ?? DEFAULT_DASHBOARD;
-  const apiRemembered = prefs.api === void 0 && stored.api === apiPref;
-  const dashRemembered = prefs.dashboard === void 0 && stored.dashboard === dashPref;
-  let api;
-  if (await isPortFree(apiPref)) api = apiPref;
-  else if (apiRemembered && await waitPortFree(apiPref)) api = apiPref;
-  else api = await getFreePort();
-  let dashboard;
-  if (dashPref !== api && await isPortFree(dashPref)) dashboard = dashPref;
-  else if (dashPref !== api && dashRemembered && await waitPortFree(dashPref)) dashboard = dashPref;
-  else dashboard = await getFreePort();
-  if (dashboard === api) dashboard = await getFreePort();
-  saveStoredPorts(api, dashboard);
-  return {
-    api,
-    dashboard,
-    switched: { api: api !== apiPref, dashboard: dashboard !== dashPref }
-  };
-}
-
 // src/lib/edge-preflight.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
 import chalk5 from "chalk";
 import { isCancel, log, note, select } from "@clack/prompts";
 async function planAndApplyHostEdge(opts, overrides = {}) {
@@ -1052,7 +974,7 @@ async function rollbackHostEdge() {
     return false;
   }
 }
-var IMPORTED_MARKER = join6(OS_DIR, "imported-proxy");
+var IMPORTED_MARKER = join5(OS_DIR, "imported-proxy");
 function edgeServedHostnames() {
   const served = /* @__PURE__ */ new Set();
   const r = spawnSync3(
@@ -1076,13 +998,13 @@ function edgeServedHostnames() {
 }
 function markStoppedProxyImported() {
   try {
-    mkdirSync6(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync5(IMPORTED_MARKER, (/* @__PURE__ */ new Date()).toISOString(), { mode: 384 });
+    mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync4(IMPORTED_MARKER, (/* @__PURE__ */ new Date()).toISOString(), { mode: 384 });
   } catch {
   }
 }
 async function offerStoppedProxyImport(executor, deps) {
-  if (!deps.interactive || existsSync5(IMPORTED_MARKER)) return { proceed: true };
+  if (!deps.interactive || existsSync4(IMPORTED_MARKER)) return { proceed: true };
   let proxy = null;
   try {
     proxy = await deps.detectInstalledProxy(executor);
@@ -1227,15 +1149,15 @@ function defaultDeps() {
 }
 
 // src/lib/loopback-api.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
 import { randomBytes } from "crypto";
-import { join as join7 } from "path";
+import { join as join6 } from "path";
 function ensureInternalToken() {
-  const path2 = join7(OS_DIR, "internal-token");
-  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
-  mkdirSync7(OS_DIR, { recursive: true, mode: 448 });
+  const path2 = join6(OS_DIR, "internal-token");
+  if (existsSync5(path2)) return readFileSync3(path2, "utf8").trim();
+  mkdirSync6(OS_DIR, { recursive: true, mode: 448 });
   const token = randomBytes(32).toString("hex");
-  writeFileSync6(path2, token, { mode: 384 });
+  writeFileSync5(path2, token, { mode: 384 });
   return token;
 }
 async function internalGet(port, path2, token) {
@@ -1264,17 +1186,17 @@ async function internalPost(port, path2, body, token) {
     return { ok: false, data: { error: err2.message } };
   }
 }
-async function bootstrapAdmin(apiPort2, admin, token) {
-  const { ok: ok3, data } = await internalPost(apiPort2, "/api/system/bootstrap-admin", admin, token);
+async function bootstrapAdmin(apiPort, admin, token) {
+  const { ok: ok3, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
   if (ok3) return { ok: true };
   if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
   return { ok: false, message: data?.error || "failed" };
 }
-async function waitHealthy(apiPort2, seconds = 90) {
+async function waitHealthy(apiPort, seconds = 90) {
   for (let i = 0; i < seconds; i++) {
     await new Promise((r) => setTimeout(r, 1e3));
     try {
-      await fetch(`http://127.0.0.1:${apiPort2}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
       return true;
     } catch {
     }
@@ -1555,16 +1477,16 @@ function normalizePublicUrl(raw) {
   return url;
 }
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
-var SERVER_DIR = join8(DIST_DIR, "server");
+var SERVER_DIR = join7(DIST_DIR, "server");
 function ensureAuthSecret() {
-  const path2 = join8(OS_DIR, "auth-secret");
-  if (existsSync7(path2)) return readFileSync5(path2, "utf8").trim();
-  mkdirSync8(OS_DIR, { recursive: true, mode: 448 });
+  const path2 = join7(OS_DIR, "auth-secret");
+  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync7(OS_DIR, { recursive: true, mode: 448 });
   const secret = randomBytes2(32).toString("hex");
-  writeFileSync7(path2, secret, { mode: 384 });
+  writeFileSync6(path2, secret, { mode: 384 });
   return secret;
 }
-var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
+var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on (default: 4000, or the next free port if it's taken)").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port (default: 3001, or the next free port if it's taken)").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
   "--public-url <url>",
   "Serve remotely at this public URL (VPS): binds the dashboard to all interfaces, proxies the API same-origin, and requires login"
 ).option(
@@ -1683,6 +1605,32 @@ async function runCompose(opts) {
     );
     process.exit(1);
   }
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
+  const ports = await resolveComposePorts({ api: opts.port, dashboard: opts.dashboardPort });
+  const apiPort = String(ports.api);
+  const dashboardPort = String(ports.dashboard);
+  const portNotice = portMoveNotice(ports, [...composeTrustedOriginUrls(), publicUrl]);
+  if (portNotice.length) {
+    console.log("\n" + portNotice.map((l) => chalk6.yellow(`  ${l}`)).join("\n"));
+  }
+  const prefetch = ora(
+    sourceBuildDir() ? "Building images before touching :80/:443\u2026" : "Pulling images before touching :80/:443\u2026"
+  ).start();
+  const fetched = composePrefetch({
+    apiPort,
+    dashboardPort,
+    publicUrl,
+    trustProxy: opts.trustProxy,
+    noHostControl: opts.hostControl === false ? true : void 0
+  });
+  if (!fetched) {
+    prefetch.fail("Couldn't fetch the stack's images \u2014 nothing was changed on this box.");
+    console.error(
+      chalk6.dim("\n  Your current proxy is untouched and still serving. Fix the pull/build error above and re-run.\n")
+    );
+    process.exit(1);
+  }
+  prefetch.succeed("Images ready \u2014 nothing on :80/:443 has changed yet.");
   let edgePlan;
   try {
     edgePlan = await planAndApplyHostEdge({ edge: opts.edge });
@@ -1700,14 +1648,15 @@ async function runCompose(opts) {
     );
     process.exit(1);
   }
-  const publicUrl = effectivePublicUrl(opts.publicUrl);
   const fromSource = sourceBuildDir();
   const spinner5 = ora(
     fromSource ? `Building Openship from ${fromSource} and starting the stack\u2026` : "Starting Openship via Docker Compose\u2026"
   ).start();
-  const res = composeUp({
-    apiPort: opts.port,
-    dashboardPort: opts.dashboardPort,
+  const res = await composeUp({
+    // Prefetched above, before the preflight stopped anything.
+    alreadyFetched: true,
+    apiPort,
+    dashboardPort,
     publicUrl,
     trustProxy: opts.trustProxy,
     // commander maps `--no-host-control` to hostControl === false. `undefined` when
@@ -1724,11 +1673,11 @@ async function runCompose(opts) {
     process.exit(1);
   }
   spinner5.succeed("Openship is running via Docker Compose.");
-  if (edgePlan.action && !await edgeIsServing(new LocalExecutor())) {
+  if (edgePlan.action && await edgeIsBroken(new LocalExecutor())) {
     const reason = await edgeCrashReason(new LocalExecutor());
     console.error(
       chalk6.red(`
-  Openship's edge is not serving :80${reason ? ` \u2014 ${reason}` : "."}`)
+  Openship's edge container is not running${reason ? ` \u2014 ${reason}` : "."}`)
     );
     const restored = await rollbackHostEdge();
     console.error(
@@ -1804,8 +1753,8 @@ async function startService(opts, runOpts = {}) {
 `) + p.content + "\n"
     );
     return {
-      port: String(opts.port || "4000"),
-      dashPort: String(opts.dashboardPort || "3001"),
+      port: String(opts.port || DEFAULT_API_PORT),
+      dashPort: String(opts.dashboardPort || DEFAULT_DASHBOARD_PORT),
       publicUrl
     };
   }
@@ -1831,11 +1780,9 @@ async function startService(opts, runOpts = {}) {
   try {
     const res = installAndStart(flags);
     if (!runOpts.quiet) {
-      if (resolved.switched.api || resolved.switched.dashboard) {
-        console.log(
-          chalk6.yellow(`
-  A preferred port was busy \u2014 using API ${port}, dashboard ${dashPort}.`)
-        );
+      const portNotice = portMoveNotice(resolved, [publicUrl]);
+      if (portNotice.length) {
+        console.log("\n" + portNotice.map((l) => chalk6.yellow(`  ${l}`)).join("\n"));
       }
       const dashboardLine = publicUrl ? chalk6.dim(`  Dashboard: ${publicUrl}  (login required)
 `) : chalk6.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
@@ -1866,8 +1813,8 @@ async function runForeground(opts, source) {
     apiArgs = ["run", "src/index.ts"];
     apiCwd = source.apiDir;
   } else {
-    const serverEntry = join8(SERVER_DIR, "index.js");
-    if (!existsSync7(serverEntry)) {
+    const serverEntry = join7(SERVER_DIR, "index.js");
+    if (!existsSync6(serverEntry)) {
       console.error(
         chalk6.red("\n  Bundled server not found in this install.") + chalk6.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
       );
@@ -1883,28 +1830,42 @@ async function runForeground(opts, source) {
   const dashPort = String(resolved.dashboard);
   const publicUrl = effectivePublicUrl(opts.publicUrl);
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
-  const dataDir = opts.dataDir || join8(OS_DIR, "data");
-  mkdirSync8(dataDir, { recursive: true });
-  const logDir = join8(OS_DIR, "logs");
-  mkdirSync8(logDir, { recursive: true });
-  const instanceLogPath = join8(logDir, "instance.log");
+  const dataDir = opts.dataDir || join7(OS_DIR, "data");
+  mkdirSync7(dataDir, { recursive: true });
+  const logDir = join7(OS_DIR, "logs");
+  mkdirSync7(logDir, { recursive: true });
+  const instanceLogPath = join7(logDir, "instance.log");
   const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
     ...process.env,
     PORT: port,
     NODE_ENV: "production",
-    // desktop mode → in-process job runner (no Redis).
-    DEPLOY_MODE: "desktop",
+    // BARE, not "desktop". This box is a server-host: openship runs ON it and it
+    // is itself a deploy target. Claiming "desktop" (once done here just to get
+    // the in-process job runner) made the API report `isServerHost: false`
+    // (health.routes.ts), so `registerSelfServerReconcile` — gated on
+    // modes:["selfhosted"] — never ran, "This Server" was never registered, and
+    // the deploy wizard offered Openship Cloud as the only target on a box the
+    // operator had just installed on purpose.
+    //
+    // It also mislabelled the security posture: DEPLOY_MODE=desktop relaxes the
+    // zero-auth gate and makes INTERNAL_TOKEN optional. "desktop" belongs to
+    // Electron alone (apps/desktop/src/main/services.ts:361) — the only launcher
+    // that is genuinely a single-user loopback app.
+    //
+    // The job runner is unaffected: it picks BullMQ vs in-process by REDIS
+    // REACHABILITY (app.ts:238), and OPENSHIP_JOB_RUNNER below already pins it.
+    DEPLOY_MODE: "bare",
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
     PGLITE_DATA_DIR: dataDir,
     BETTER_AUTH_SECRET: ensureAuthSecret()
   };
   if (!source) {
-    env.OPENSHIP_MIGRATIONS_DIR = join8(SERVER_DIR, "migrations");
-    env.OPENSHIP_PGLITE_ASSETS_DIR = join8(SERVER_DIR, "pglite");
-    const engineDir = join8(SERVER_DIR, "engine");
-    if (existsSync7(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
+    env.OPENSHIP_MIGRATIONS_DIR = join7(SERVER_DIR, "migrations");
+    env.OPENSHIP_PGLITE_ASSETS_DIR = join7(SERVER_DIR, "pglite");
+    const engineDir = join7(SERVER_DIR, "engine");
+    if (existsSync6(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
   }
   env.OPENSHIP_REQUIRE_AUTH = "true";
   env.INTERNAL_TOKEN = ensureInternalToken();
@@ -1996,7 +1957,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.4.7"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.5.0"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2126,7 +2087,7 @@ var stopCommand = new Command5("stop").description("Stop Openship (started by `o
 import { Command as Command6 } from "commander";
 import chalk8 from "chalk";
 import { confirm, isCancel as isCancel2 } from "@clack/prompts";
-import { existsSync as existsSync8, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync7, rmSync as rmSync3 } from "fs";
 var uninstallCommand = new Command6("uninstall").description(
   "Remove Openship from this machine: stop it, delete its data (database, certs, edge config), its images, and ~/.openship. Deployed apps are left running."
 ).option("-y, --yes", "Skip the confirmation prompt (for scripts)").option("--keep-data", "Keep the database/certs volumes and ~/.openship \u2014 remove only the running stack").option("--keep-images", "Don't delete the Openship container images").action(async (opts) => {
@@ -2172,7 +2133,7 @@ var uninstallCommand = new Command6("uninstall").description(
       console.log(chalk8.yellow(`  Couldn't remove the service: ${err2.message}`));
     }
   }
-  if (destructive && existsSync8(OS_DIR)) {
+  if (destructive && existsSync7(OS_DIR)) {
     try {
       rmSync3(OS_DIR, { recursive: true, force: true });
       console.log(chalk8.green(`  Removed ${OS_DIR}`));
@@ -2191,15 +2152,15 @@ var uninstallCommand = new Command6("uninstall").description(
 
 // src/commands/init.ts
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync9, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output2 } from "process";
-import { join as join9 } from "path";
+import { join as join8 } from "path";
 var initCommand = new Command7("init").description("Link the current directory to an Openship project (.openship/project.json)").option("--project <id>", "Project id to link (skips the picker)").option("--environment <name>", "Default deploy environment", "production").option("--dir <path>", "Directory to initialize", process.cwd()).option("--force", "Overwrite an existing project link").option("-y, --yes", "Non-interactive: fail instead of prompting").action(async (opts) => {
   const root = opts.dir || process.cwd();
-  const linkDir = join9(root, ".openship");
-  const linkPath = join9(linkDir, "project.json");
-  if (existsSync9(linkPath) && !opts.force) {
+  const linkDir = join8(root, ".openship");
+  const linkPath = join8(linkDir, "project.json");
+  if (existsSync8(linkPath) && !opts.force) {
     err(`Already linked (${linkPath}). Re-run with --force to overwrite.`);
     process.exit(1);
   }
@@ -2252,8 +2213,8 @@ var initCommand = new Command7("init").description("Link the current directory t
     context: getActiveContext(),
     defaults: { environment: opts.environment || "production" }
   };
-  mkdirSync9(linkDir, { recursive: true });
-  writeFileSync8(linkPath, JSON.stringify(link, null, 2) + "\n");
+  mkdirSync8(linkDir, { recursive: true });
+  writeFileSync7(linkPath, JSON.stringify(link, null, 2) + "\n");
   if (isJsonMode()) {
     printJson({ path: linkPath, link });
     return;
@@ -2265,8 +2226,8 @@ var initCommand = new Command7("init").description("Link the current directory t
 
 // src/commands/config.ts
 import { Command as Command8 } from "commander";
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync9 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync5, writeFileSync as writeFileSync8 } from "fs";
+import { join as join9 } from "path";
 var SCHEMA_URL = "https://openship.io/openship.schema.json";
 var CONFIG_FILE = "openship.json";
 function detectHints(dir) {
@@ -2278,15 +2239,15 @@ function detectHints(dir) {
     ["package-lock.json", "npm"]
   ];
   for (const [file, pm] of lock) {
-    if (existsSync10(join10(dir, file))) {
+    if (existsSync9(join9(dir, file))) {
       hints.packageManager = pm;
       break;
     }
   }
-  const pkgPath = join10(dir, "package.json");
-  if (existsSync10(pkgPath)) {
+  const pkgPath = join9(dir, "package.json");
+  if (existsSync9(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
       const runner = hints.packageManager ?? "npm";
       const exec = runner === "npm" ? "npm run" : runner;
       if (pkg.scripts?.build) hints.buildCommand = `${exec} build`;
@@ -2298,15 +2259,15 @@ function detectHints(dir) {
 }
 var initCmd = new Command8("init").description("Scaffold an openship.json in the current directory").option("--dir <path>", "Directory to write into", process.cwd()).option("--force", "Overwrite an existing openship.json").action((opts) => {
   const dir = opts.dir || process.cwd();
-  const path2 = join10(dir, CONFIG_FILE);
-  if (existsSync10(path2) && !opts.force) {
+  const path2 = join9(dir, CONFIG_FILE);
+  if (existsSync9(path2) && !opts.force) {
     err(`${CONFIG_FILE} already exists. Re-run with --force to overwrite.`);
     process.exit(1);
   }
   const hints = detectHints(dir);
   const scaffold = { $schema: SCHEMA_URL, ...hints };
   const text2 = JSON.stringify(scaffold, null, 2) + "\n";
-  writeFileSync9(path2, text2);
+  writeFileSync8(path2, text2);
   if (isJsonMode()) {
     printJson({ path: path2, config: scaffold });
     return;
@@ -2316,13 +2277,13 @@ var initCmd = new Command8("init").description("Scaffold an openship.json in the
   info("  Edit it to declare framework, env, domains, resources, services\u2026 then `openship config validate`.\n");
 });
 var validateCmd = new Command8("validate").description("Validate an openship.json against the deploy schema").argument("[file]", "Path to the config file", CONFIG_FILE).action((file) => {
-  const path2 = file === CONFIG_FILE ? join10(process.cwd(), CONFIG_FILE) : file;
-  if (!existsSync10(path2)) {
+  const path2 = file === CONFIG_FILE ? join9(process.cwd(), CONFIG_FILE) : file;
+  if (!existsSync9(path2)) {
     if (isJsonMode()) printJson({ valid: false, errors: [`${path2} not found`], warnings: [] });
     else err(`Not found: ${path2}`);
     process.exit(1);
   }
-  const { config, errors, warnings } = parseOpenshipConfigJson(readFileSync6(path2, "utf8"));
+  const { config, errors, warnings } = parseOpenshipConfigJson(readFileSync5(path2, "utf8"));
   const valid = errors.length === 0 && config !== null;
   if (isJsonMode()) {
     printJson({ valid, errors, warnings });
@@ -2395,15 +2356,6 @@ var contextCommand = new Command9("context").alias("ctx").description("Manage co
 // src/commands/status.ts
 import { Command as Command10 } from "commander";
 import chalk9 from "chalk";
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join11 } from "path";
-function readPorts() {
-  try {
-    return JSON.parse(readFileSync7(join11(OS_DIR, "ports.json"), "utf8"));
-  } catch {
-    return {};
-  }
-}
 var statusCommand = new Command10("status").description("Show the local Openship service (installed/running, ports) and the active context's API health").action(async () => {
   const context = getActiveContext();
   const apiUrl = getApiUrl2();
@@ -2423,7 +2375,7 @@ var statusCommand = new Command10("status").description("Show the local Openship
     return;
   }
   const svc = serviceStatus();
-  const ports = readPorts();
+  const ports = readStoredPorts();
   let health = null;
   let envInfo = null;
   let reachable = true;
@@ -2455,7 +2407,7 @@ var statusCommand = new Command10("status").description("Show the local Openship
 
 // src/commands/doctor.ts
 import { Command as Command11 } from "commander";
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
 import chalk11 from "chalk";
 import open from "open";
@@ -2463,42 +2415,42 @@ import { intro, outro, note as note2, select as select3, log as log3, spinner as
 
 // src/lib/repair.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync6 } from "fs";
+import { join as join11 } from "path";
 import chalk10 from "chalk";
 import { spinner, log as log2, select as select2, isCancel as isCancel3, cancel } from "@clack/prompts";
 
 // src/lib/heal.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync10,
   readdirSync,
   statSync,
   unlinkSync,
-  mkdirSync as mkdirSync10,
+  mkdirSync as mkdirSync9,
   copyFileSync,
   renameSync
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join12 } from "path";
+import { join as join10 } from "path";
 import { execFileSync } from "child_process";
 function resolveDataDir() {
   const fromEnv = process.env.PGLITE_DATA_DIR?.trim();
   if (fromEnv) {
-    return fromEnv.startsWith("~") ? join12(homedir2(), fromEnv.slice(1).replace(/^[/\\]/, "")) : fromEnv;
+    return fromEnv.startsWith("~") ? join10(homedir2(), fromEnv.slice(1).replace(/^[/\\]/, "")) : fromEnv;
   }
-  return join12(OS_DIR, "data");
+  return join10(OS_DIR, "data");
 }
 function dataDirExists(dataDir = resolveDataDir()) {
-  return existsSync11(dataDir);
+  return existsSync10(dataDir);
 }
 function stamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function copyDirRecursive(src, dest) {
-  if (!existsSync11(dest)) mkdirSync10(dest, { recursive: true });
+  if (!existsSync10(dest)) mkdirSync9(dest, { recursive: true });
   for (const entry of readdirSync(src)) {
-    const s = join12(src, entry);
-    const d = join12(dest, entry);
+    const s = join10(src, entry);
+    const d = join10(dest, entry);
     if (statSync(s).isDirectory()) copyDirRecursive(s, d);
     else copyFileSync(s, d);
   }
@@ -2510,30 +2462,30 @@ function backupDataDir(dataDir = resolveDataDir()) {
 }
 function healDataDir(dataDir = resolveDataDir()) {
   const result = { removedPostmasterPid: false, trimmedWalSegment: null };
-  const pidPath = join12(dataDir, "postmaster.pid");
-  if (existsSync11(pidPath)) {
+  const pidPath = join10(dataDir, "postmaster.pid");
+  if (existsSync10(pidPath)) {
     unlinkSync(pidPath);
     result.removedPostmasterPid = true;
   }
-  const walDir = join12(dataDir, "pg_wal");
-  if (existsSync11(walDir)) {
-    const segments = readdirSync(walDir).filter((name) => /^[0-9A-F]{24}$/.test(name)).map((name) => ({ name, mtime: statSync(join12(walDir, name)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const walDir = join10(dataDir, "pg_wal");
+  if (existsSync10(walDir)) {
+    const segments = readdirSync(walDir).filter((name) => /^[0-9A-F]{24}$/.test(name)).map((name) => ({ name, mtime: statSync(join10(walDir, name)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
     if (segments.length > 0) {
       const newest = segments[0];
-      unlinkSync(join12(walDir, newest.name));
+      unlinkSync(join10(walDir, newest.name));
       result.trimmedWalSegment = newest.name;
     }
   }
   return result;
 }
 function restoreBackup(backupDir, dataDir = resolveDataDir()) {
-  if (!existsSync11(backupDir)) throw new Error(`Backup not found: ${backupDir}`);
-  if (existsSync11(dataDir)) renameSync(dataDir, `${dataDir}.discarded-${stamp()}`);
+  if (!existsSync10(backupDir)) throw new Error(`Backup not found: ${backupDir}`);
+  if (existsSync10(dataDir)) renameSync(dataDir, `${dataDir}.discarded-${stamp()}`);
   copyDirRecursive(backupDir, dataDir);
 }
 function freshStart(dataDir = resolveDataDir()) {
   const aside = `${dataDir}.corrupt-${stamp()}`;
-  if (existsSync11(dataDir)) renameSync(dataDir, aside);
+  if (existsSync10(dataDir)) renameSync(dataDir, aside);
   return aside;
 }
 function findResetwal() {
@@ -2545,7 +2497,7 @@ function findResetwal() {
     "/usr/lib/postgresql/16/bin/pg_resetwal",
     "/usr/bin/pg_resetwal"
   ];
-  for (const c of candidates) if (existsSync11(c)) return c;
+  for (const c of candidates) if (existsSync10(c)) return c;
   try {
     const found = execFileSync("bash", ["-lc", "command -v pg_resetwal"], {
       encoding: "utf8",
@@ -2566,7 +2518,7 @@ function deepHeal(dataDir = resolveDataDir()) {
 }
 
 // src/lib/repair.ts
-var LOG_DIR2 = join13(OS_DIR, "logs");
+var LOG_DIR2 = join11(OS_DIR, "logs");
 function ensure(value) {
   if (isCancel3(value)) {
     cancel("Cancelled.");
@@ -2574,23 +2526,9 @@ function ensure(value) {
   }
   return value;
 }
-function storedPorts() {
-  try {
-    const p = join13(OS_DIR, "ports.json");
-    return existsSync12(p) ? JSON.parse(readFileSync8(p, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
-function apiPort() {
-  return storedPorts().api ?? 4e3;
-}
-function dashboardPort() {
-  return storedPorts().dashboard ?? 3001;
-}
 async function internalGet2(path2, timeoutMs = 8e3) {
   try {
-    const res = await fetch(`http://127.0.0.1:${apiPort()}${path2}`, {
+    const res = await fetch(`http://127.0.0.1:${storedApiPort()}${path2}`, {
       headers: { "X-Internal-Token": ensureInternalToken() },
       signal: AbortSignal.timeout(timeoutMs)
     });
@@ -2602,7 +2540,7 @@ async function internalGet2(path2, timeoutMs = 8e3) {
 }
 async function apiReachable() {
   try {
-    const res = await fetch(`http://127.0.0.1:${apiPort()}/api/health`, {
+    const res = await fetch(`http://127.0.0.1:${storedApiPort()}/api/health`, {
       signal: AbortSignal.timeout(2500)
     });
     return res.ok;
@@ -2626,10 +2564,10 @@ async function waitApiDown(seconds = 20) {
 }
 function lastServiceError() {
   for (const name of ["up.err.log", "up.log", "instance.log"]) {
-    const p = join13(LOG_DIR2, name);
-    if (!existsSync12(p)) continue;
+    const p = join11(LOG_DIR2, name);
+    if (!existsSync11(p)) continue;
     try {
-      const lines = readFileSync8(p, "utf8").trim().split("\n");
+      const lines = readFileSync6(p, "utf8").trim().split("\n");
       const hit = [...lines].reverse().find((l) => /error|locked|aborted|malformed|corrupt|throw|cannot|EADDRINUSE/i.test(l));
       if (hit) return hit.trim().slice(0, 240);
     } catch {
@@ -2687,11 +2625,11 @@ async function componentChecks(apiUp) {
   checks.push({
     name: "API",
     state: apiUp ? "pass" : "fail",
-    detail: apiUp ? `reachable on :${apiPort()}` : `not answering on :${apiPort()}`
+    detail: apiUp ? `reachable on :${storedApiPort()}` : `not answering on :${storedApiPort()}`
   });
   let dashUp = false;
   try {
-    const res = await fetch(`http://127.0.0.1:${dashboardPort()}/`, {
+    const res = await fetch(`http://127.0.0.1:${storedDashboardPort()}/`, {
       redirect: "manual",
       signal: AbortSignal.timeout(2500)
     });
@@ -2701,7 +2639,7 @@ async function componentChecks(apiUp) {
   checks.push({
     name: "Dashboard",
     state: dashUp ? "pass" : "warn",
-    detail: dashUp ? `serving on :${dashboardPort()}` : `not serving on :${dashboardPort()}`
+    detail: dashUp ? `serving on :${storedDashboardPort()}` : `not serving on :${storedDashboardPort()}`
   });
   const edge = dockerNameRunning("openship-edge");
   checks.push(
@@ -2888,7 +2826,7 @@ function bunVersion() {
 }
 async function remotePreflight() {
   const checks = [];
-  const hasConfig = existsSync13(CONFIG_PATH);
+  const hasConfig = existsSync12(CONFIG_PATH);
   checks.push({ name: "config", status: hasConfig ? "pass" : "warn", detail: hasConfig ? CONFIG_PATH : `not found; run \`openship login\`` });
   const context = getActiveContext();
   const apiUrl = getApiUrl();
@@ -3026,7 +2964,7 @@ async function interactiveDoctor() {
     }
     if (action2 === "open") {
       const url = readInstanceUrl();
-      const target = url && !/^https?:\/\/localhost/i.test(url) ? url : `http://localhost:${dashboardPort()}`;
+      const target = url && !/^https?:\/\/localhost/i.test(url) ? url : `http://localhost:${storedDashboardPort()}`;
       await open(target).catch(() => {
       });
       log3.message(chalk11.dim(`Opening ${target}`));
@@ -3056,15 +2994,15 @@ import { execFileSync as execFileSync4 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
-import { join as join14, dirname as dirname3, parse } from "path";
-var LINK_REL = join14(".openship", "project.json");
+import { readFileSync as readFileSync7, existsSync as existsSync13 } from "fs";
+import { join as join12, dirname as dirname3, parse } from "path";
+var LINK_REL = join12(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
   let dir = from;
   const root = parse(dir).root;
   for (; ; ) {
-    const candidate = join14(dir, LINK_REL);
-    if (existsSync14(candidate)) return candidate;
+    const candidate = join12(dir, LINK_REL);
+    if (existsSync13(candidate)) return candidate;
     if (dir === root) return null;
     dir = dirname3(dir);
   }
@@ -3073,7 +3011,7 @@ function readProjectLink(from) {
   const path2 = findProjectLinkPath(from);
   if (!path2) return null;
   try {
-    return JSON.parse(readFileSync9(path2, "utf8"));
+    return JSON.parse(readFileSync7(path2, "utf8"));
   } catch {
     return null;
   }
@@ -3081,21 +3019,21 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { readFileSync as readFileSync10, existsSync as existsSync15, rmSync as rmSync4 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync14, rmSync as rmSync4 } from "fs";
 import { tmpdir } from "os";
-import { join as join15, basename } from "path";
+import { join as join13, basename } from "path";
 function detectPackageManager(dir) {
-  if (existsSync15(join15(dir, "bun.lockb")) || existsSync15(join15(dir, "bun.lock"))) return "bun";
-  if (existsSync15(join15(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync15(join15(dir, "yarn.lock"))) return "yarn";
-  if (existsSync15(join15(dir, "package.json"))) return "npm";
+  if (existsSync14(join13(dir, "bun.lockb")) || existsSync14(join13(dir, "bun.lock"))) return "bun";
+  if (existsSync14(join13(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync14(join13(dir, "yarn.lock"))) return "yarn";
+  if (existsSync14(join13(dir, "package.json"))) return "npm";
   return void 0;
 }
 function detectStack(dir) {
-  if (existsSync15(join15(dir, "go.mod"))) return "go";
-  if (existsSync15(join15(dir, "Cargo.toml"))) return "rust";
-  if (existsSync15(join15(dir, "requirements.txt")) || existsSync15(join15(dir, "pyproject.toml"))) return "python";
-  if (existsSync15(join15(dir, "package.json"))) return "node";
+  if (existsSync14(join13(dir, "go.mod"))) return "go";
+  if (existsSync14(join13(dir, "Cargo.toml"))) return "rust";
+  if (existsSync14(join13(dir, "requirements.txt")) || existsSync14(join13(dir, "pyproject.toml"))) return "python";
+  if (existsSync14(join13(dir, "package.json"))) return "node";
   return void 0;
 }
 async function deployFolder(opts) {
@@ -3112,7 +3050,7 @@ async function deployFolder(opts) {
     throw new Error(session.error || "Failed to open upload session");
   }
   step("Packaging folder");
-  const tarball = join15(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
+  const tarball = join13(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
   execFileSync3(
     "tar",
     [
@@ -3131,7 +3069,7 @@ async function deployFolder(opts) {
   );
   step("Uploading source");
   try {
-    const body = readFileSync10(tarball);
+    const body = readFileSync8(tarball);
     const up = session.upload;
     const method = up.method || "POST";
     const res = /^https?:\/\//i.test(up.url) ? await fetch(up.url, { method, headers: up.headers, body }) : await apiRaw(`/${up.url.replace(/^\/+/, "")}`, { method, headers: up.headers, body });
@@ -3585,12 +3523,19 @@ var sslStatus = new Command13("status").description("Check SSL certificate statu
     printJson(res);
   })
 );
-var sslRenew = new Command13("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
+var sslRenew = new Command13("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also renew the www subdomain (separately \u2014 its own certificate)").action(
   run2(async (domain, opts) => {
     const res = await apiRequest("/deployments/ssl/renew", {
       method: "POST",
       body: JSON.stringify({ domain, includeWww: opts.www === true })
     });
+    if (!isJsonMode() && res.results && res.results.length > 1) {
+      for (const r of res.results) {
+        if (r.success) ok(`${r.domain}: ${r.status}`);
+        else err(`${r.domain}: ${r.message ?? r.status}`);
+      }
+      return;
+    }
     report(res, `SSL renewal requested for ${domain}`);
   })
 );
@@ -4370,8 +4315,10 @@ function mapComposeService(name, def, baseDir) {
   const volumes = mapVolumes(d.volumes);
   if (volumes.length) svc.volumes = volumes;
   const command = d.command;
-  if (typeof command === "string") svc.command = command;
-  else if (Array.isArray(command)) svc.command = command.map(String).join(" ");
+  if (command != null) {
+    svc.commandArgv = commandToArgv(command);
+    svc.command = typeof command === "string" ? command : command.map(String).join(" ");
+  }
   if (typeof d.restart === "string") svc.restart = d.restart;
   return svc;
 }
@@ -5137,7 +5084,7 @@ var serverCommand = server;
 // src/commands/system.ts
 import { Command as Command19 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -5437,7 +5384,7 @@ dataTransferCommand.command("export").description("Export the entire instance to
       );
       spin4?.succeed("Export ready.");
       if (opts.out) {
-        writeFileSync10(opts.out, JSON.stringify(file));
+        writeFileSync9(opts.out, JSON.stringify(file));
         const tables = Object.keys(file.dump?.tables ?? {}).length;
         report2(
           { out: opts.out, tables },
@@ -5463,7 +5410,7 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
     let file;
     try {
-      file = JSON.parse(readFileSync11(opts.file, "utf8"));
+      file = JSON.parse(readFileSync9(opts.file, "utf8"));
     } catch {
       err(`
   Could not read or parse ${opts.file}.
@@ -5814,7 +5761,7 @@ var mailCommand = new Command20("mail").description("Self-hosted mail server (iR
 // src/commands/backup.ts
 import { Command as Command21 } from "commander";
 import ora7 from "ora";
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 async function guard3(fn) {
   try {
     await fn();
@@ -6107,7 +6054,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
     let sftpPrivateKey = opts.sftpPrivateKey;
     if (opts.sftpPrivateKeyFile) {
       try {
-        sftpPrivateKey = readFileSync12(opts.sftpPrivateKeyFile, "utf8");
+        sftpPrivateKey = readFileSync10(opts.sftpPrivateKeyFile, "utf8");
       } catch {
         throw new Error(`Cannot read key file: ${opts.sftpPrivateKeyFile}`);
       }
@@ -6219,13 +6166,28 @@ var createCmd3 = new Command22("create").description("Mint a new personal access
   "Scope the token to a resource (repeatable), e.g. project:abc123:read,write",
   collectGrant,
   []
+).option(
+  "--full-access",
+  "Mint an UNSCOPED token with your own full access (required when no --grant is given)",
+  false
 ).action(async (name, opts) => {
   const grants = opts.grant ?? [];
+  if (grants.length === 0 && !opts.fullAccess) {
+    fail3(
+      new Error(
+        "Refusing to mint an unscoped token by default. Pass --grant <type:id:perms> to scope it, or --full-access to deliberately create one with your own full access."
+      )
+    );
+  }
+  if (grants.length > 0 && opts.fullAccess) {
+    fail3(new Error("--grant and --full-access are mutually exclusive: pick one."));
+  }
   const body = {
     name,
     readOnly: opts.readOnly || void 0,
     expiresInDays: Number.isFinite(opts.expires) ? opts.expires : void 0,
-    grants: grants.length > 0 ? grants : void 0
+    grants: grants.length > 0 ? grants : void 0,
+    fullAccess: grants.length === 0 ? true : void 0
   };
   const sp = spin3(`Creating token "${name}"\u2026`);
   try {
@@ -6299,16 +6261,7 @@ var apiCommand = new Command23("api").description("Make an authenticated request
 import { Command as Command24 } from "commander";
 import chalk19 from "chalk";
 import { intro as intro2, outro as outro2, password as passwordPrompt, isCancel as isCancel4, cancel as cancel3, log as log4 } from "@clack/prompts";
-import { readFileSync as readFileSync13 } from "fs";
-import { join as join16 } from "path";
-function resolvedApiPort() {
-  try {
-    return JSON.parse(readFileSync13(join16(OS_DIR, "ports.json"), "utf8")).api;
-  } catch {
-    return void 0;
-  }
-}
-var resetAdminCommand = new Command24("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the resolved port from ~/.openship/ports.json, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
+var resetAdminCommand = new Command24("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the port this install resolved to, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
   intro2(chalk19.cyan("Reset Openship admin password"));
   let pw = opts.password;
   if (!pw) {
@@ -6334,7 +6287,7 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
     }
     pw = entered;
   }
-  const port = String(opts.port || resolvedApiPort() || 4e3);
+  const port = String(opts.port || storedApiPort());
   let res;
   try {
     res = await fetch(`http://127.0.0.1:${port}/api/system/reset-admin-password`, {
@@ -6357,10 +6310,10 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
 
 // src/commands/install.ts
 import { Command as Command25 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
 import { spawn as spawn2, spawnSync as spawnSync6 } from "child_process";
 import { homedir as homedir3 } from "os";
-import { join as join17 } from "path";
+import { join as join14 } from "path";
 import ora9 from "ora";
 function assetForPlatform() {
   const { platform, arch } = process;
@@ -6374,10 +6327,10 @@ function assetForPlatform() {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 function installDmg(dmg) {
-  const homeApps = join17(homedir3(), "Applications");
+  const homeApps = join14(homedir3(), "Applications");
   let dest = homeApps;
   try {
-    mkdirSync11(homeApps, { recursive: true });
+    mkdirSync10(homeApps, { recursive: true });
   } catch {
     dest = "/Applications";
   }
@@ -6387,14 +6340,14 @@ function installDmg(dmg) {
   if (attach.status !== 0) throw new Error(`hdiutil attach failed: ${attach.stderr?.trim()}`);
   const mount = (attach.stdout.match(/\/Volumes\/[^\n]*/g) ?? []).pop()?.trim();
   if (!mount) throw new Error("Could not determine the mounted volume");
-  let target = join17(dest, "Openship.app");
+  let target = join14(dest, "Openship.app");
   try {
-    const appInDmg = join17(mount, "Openship.app");
-    if (!existsSync16(appInDmg)) throw new Error("Openship.app not found in the disk image");
+    const appInDmg = join14(mount, "Openship.app");
+    if (!existsSync15(appInDmg)) throw new Error("Openship.app not found in the disk image");
     spawnSync6("rm", ["-rf", target]);
     let copy = spawnSync6("ditto", [appInDmg, target], { encoding: "utf8" });
     if (copy.status !== 0 && dest === homeApps) {
-      target = join17("/Applications", "Openship.app");
+      target = join14("/Applications", "Openship.app");
       spawnSync6("rm", ["-rf", target]);
       copy = spawnSync6("ditto", [appInDmg, target], { encoding: "utf8" });
     }
@@ -6409,9 +6362,9 @@ function installAppImage(appImage) {
   return appImage;
 }
 function installZip(zip) {
-  const localAppData = process.env.LOCALAPPDATA || join17(homedir3(), "AppData", "Local");
-  const target = join17(localAppData, "Programs", "Openship");
-  mkdirSync11(target, { recursive: true });
+  const localAppData = process.env.LOCALAPPDATA || join14(homedir3(), "AppData", "Local");
+  const target = join14(localAppData, "Programs", "Openship");
+  mkdirSync10(target, { recursive: true });
   const expand = spawnSync6(
     "powershell",
     [
@@ -6438,8 +6391,8 @@ function launch(kind, target) {
     child.unref();
     return;
   }
-  const exe = join17(target, "Openship.exe");
-  const path2 = existsSync16(exe) ? exe : target;
+  const exe = join14(target, "Openship.exe");
+  const path2 = existsSync15(exe) ? exe : target;
   spawnSync6("cmd", ["/c", "start", "", path2]);
 }
 var installCommand = new Command25("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
@@ -6465,13 +6418,13 @@ var installCommand = new Command25("install").description("Download and install
     process.exit(1);
   }
   const dir = releaseDir(tag);
-  const assetPath = join17(dir, asset.name);
+  const assetPath = join14(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
   const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
-  const cachedUsable = !opts.force && existsSync16(assetPath) && (existsSync16(sidecarPath) || opts.verify === false);
+  const cachedUsable = !opts.force && existsSync15(assetPath) && (existsSync15(sidecarPath) || opts.verify === false);
   if (cachedUsable) {
     info(`  Using cached ${asset.name} (${tag}).`);
   } else {
@@ -6493,8 +6446,8 @@ var installCommand = new Command25("install").description("Download and install
     const s2 = spin4("Verifying checksum\u2026");
     try {
       let sidecarBody;
-      if (existsSync16(sidecarPath) && !downloaded) {
-        sidecarBody = readFileSync14(sidecarPath, "utf8");
+      if (existsSync15(sidecarPath) && !downloaded) {
+        sidecarBody = readFileSync11(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
       }
@@ -6517,8 +6470,8 @@ var installCommand = new Command25("install").description("Download and install
         err(`Expected ${expected}, got ${actual}. The download may be corrupt or tampered with.`);
         process.exit(1);
       }
-      mkdirSync11(dir, { recursive: true });
-      writeFileSync11(sidecarPath, sidecarBody);
+      mkdirSync10(dir, { recursive: true });
+      writeFileSync10(sidecarPath, sidecarBody);
       s2?.succeed("Checksum verified");
     } catch (e) {
       s2?.fail("Verification failed");
@@ -6605,7 +6558,7 @@ function detectPackageManager2(override) {
 var updateCommand = new Command26("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").option("--rebuild", "From-source installs: rebuild even if already at the remote tip").action(async (opts) => {
   const source = readSourceInstall();
   if (source) return runSourceUpdate(source, opts);
-  const current = "0.4.7";
+  const current = "0.5.0";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6640,7 +6593,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
     return;
   }
   if (readInstallMethod() === "compose") {
-    const applied = composeUpdate(latest);
+    const applied = await composeUpdate(latest);
     if (isJsonMode()) {
       printJson({ updated: true, from: current, to: latest, via: pm, method: "compose", applied });
     } else if (applied) {
@@ -6663,17 +6616,17 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
 
 // src/commands/cache.ts
 import { Command as Command27 } from "commander";
-import { existsSync as existsSync17, readdirSync as readdirSync2, readFileSync as readFileSync15, rmSync as rmSync5, statSync as statSync2 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync2, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync2 } from "fs";
+import { join as join15 } from "path";
 function listAssets() {
-  if (!existsSync17(RELEASES_DIR)) return [];
+  if (!existsSync16(RELEASES_DIR)) return [];
   const out = [];
   for (const tag of readdirSync2(RELEASES_DIR)) {
     const dir = releaseDir(tag);
     if (!statSync2(dir).isDirectory()) continue;
     for (const name of readdirSync2(dir)) {
       if (name.endsWith(".sha256")) continue;
-      const path2 = join18(dir, name);
+      const path2 = join15(dir, name);
       const st = statSync2(path2);
       if (!st.isFile()) continue;
       out.push({
@@ -6681,7 +6634,7 @@ function listAssets() {
         name,
         path: path2,
         size: st.size,
-        hasSidecar: existsSync17(`${path2}.sha256`)
+        hasSidecar: existsSync16(`${path2}.sha256`)
       });
     }
   }
@@ -6712,7 +6665,7 @@ var verifyCmd2 = new Command27("verify").description("Re-hash cached assets and
       results.push({ tag: a.tag, asset: a.name, result: "no-sidecar" });
       continue;
     }
-    const expected = parseSha256(readFileSync15(`${a.path}.sha256`, "utf8"));
+    const expected = parseSha256(readFileSync12(`${a.path}.sha256`, "utf8"));
     const actual = await hashFile(a.path);
     const okMatch = expected !== null && expected === actual;
     if (!okMatch) bad += 1;
@@ -6728,7 +6681,7 @@ var verifyCmd2 = new Command27("verify").description("Re-hash cached assets and
 });
 var cleanCmd = new Command27("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
   const target = tag ? releaseDir(tag) : RELEASES_DIR;
-  if (!existsSync17(target)) {
+  if (!existsSync16(target)) {
     if (isJsonMode()) printJson({ removed: false, path: target });
     else info(`  Nothing to clean (${target}).`);
     return;
@@ -6748,8 +6701,8 @@ var cacheCommand = new Command27("cache").description("Manage the local download
 import chalk20 from "chalk";
 import open2 from "open";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync12, readFileSync as readFileSync16, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync11, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "fs";
+import { join as join16 } from "path";
 import {
   intro as intro3,
   outro as outro3,
@@ -6895,13 +6848,13 @@ async function streamProvision(port, sessionId, s) {
   }
   return { ok: ok3, detail };
 }
-var SETUP_LOCK = join19(OS_DIR, "setup-in-progress");
+var SETUP_LOCK = join16(OS_DIR, "setup-in-progress");
 function isSetupInProgress() {
-  return existsSync18(SETUP_LOCK);
+  return existsSync17(SETUP_LOCK);
 }
 function markSetupStarted() {
-  mkdirSync12(OS_DIR, { recursive: true });
-  writeFileSync12(SETUP_LOCK, "1");
+  mkdirSync11(OS_DIR, { recursive: true });
+  writeFileSync11(SETUP_LOCK, "1");
 }
 function markSetupDone() {
   rmSync6(SETUP_LOCK, { force: true });
@@ -7162,17 +7115,22 @@ async function runWizard() {
   }
   let method = "bare";
   if (process.platform === "linux") {
-    if (hasDockerCompose()) {
+    const gap = dockerGap();
+    if (!gap) {
       method = "compose";
+    } else if (!gap.installable) {
+      log5.warn(`${gap.summary} \u2014 using the bare process service instead.`);
+      if (gap.hint) log5.info(gap.hint);
+      method = "bare";
     } else {
-      log5.step("Docker isn't installed \u2014 installing it now (get.docker.com)\u2026");
-      method = await ensureDocker() ? "compose" : "bare";
+      log5.step(`${gap.summary} \u2014 installing via get.docker.com\u2026`);
+      method = await ensureDocker({ onNotice: (line) => log5.info(line) }) ? "compose" : "bare";
       if (method === "bare") {
         log5.warn("Couldn't install Docker automatically \u2014 falling back to the bare process service.");
       }
     }
   }
-  const uiTag = `v${"0.4.7"}`;
+  const uiTag = `v${"0.5.0"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7226,6 +7184,25 @@ async function runWizard() {
     }
   }
   if (method === "compose") {
+    const ports = await resolveComposePorts({});
+    const apiPort = String(ports.api);
+    const dashboardPort = String(ports.dashboard);
+    const moved = portMoveNotice(ports, composeTrustedOriginUrls());
+    if (moved.length) log5.info(moved.join("\n"));
+    log5.step(
+      sourceBuildDir() ? "Building the Openship images before touching :80/:443 (first run takes a few minutes)\u2026" : "Pulling images before touching :80/:443\u2026"
+    );
+    if (!composePrefetch({
+      apiPort,
+      dashboardPort,
+      publicUrl,
+      trustProxy: behindProxy,
+      version: "0.5.0",
+      noHostControl: !allowHostControl
+    })) {
+      cancel4("Couldn't fetch the Openship images \u2014 nothing on this box was changed.");
+      process.exit(1);
+    }
     const edgePlan = await planAndApplyHostEdge({});
     if (!edgePlan.proceed) {
       cancel4("Left the existing proxy on 80/443 running \u2014 re-run and choose migrate/takeover when ready.");
@@ -7234,13 +7211,15 @@ async function runWizard() {
     edgeAction = edgePlan.action;
     migratedSites = edgePlan.sites;
     migratedCertPems = edgePlan.certPems;
-    log5.step(
-      sourceBuildDir() ? "Building the Openship images from your source checkout (first run takes a few minutes)\u2026" : "Pulling images and starting the Docker Compose stack\u2026"
-    );
-    const up = composeUp({
+    log5.step("Starting the Docker Compose stack\u2026");
+    const up = await composeUp({
+      // Prefetched above, before the preflight stopped anything.
+      alreadyFetched: true,
+      apiPort,
+      dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.4.7",
+      version: "0.5.0",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7471,22 +7450,14 @@ async function runWizard() {
     byo: domainPlan.type === "byo"
   });
 }
-function storedPorts2() {
-  const p = join19(OS_DIR, "ports.json");
-  try {
-    return existsSync18(p) ? JSON.parse(readFileSync16(p, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
 async function runControl() {
   const svc = serviceStatus();
   const isCompose = readInstallMethod() === "compose";
   const running = isCompose ? composeRunning() : svc.running;
   const managerLabel = isCompose ? "docker compose" : svc.kind === "unsupported" ? "none" : svc.kind;
-  const ports = storedPorts2();
-  const apiPort2 = String(ports.api ?? 4e3);
-  const dashUrl = `http://localhost:${ports.dashboard ?? 3001}`;
+  const ports = readStoredPorts();
+  const apiPort = String(storedApiPort());
+  const dashUrl = `http://localhost:${storedDashboardPort()}`;
   const publicUrl = readInstanceUrl();
   const primaryUrl = publicUrl && !/^https?:\/\/localhost/i.test(publicUrl) ? publicUrl : dashUrl;
   intro3(`${chalk20.bgCyan(chalk20.black(" Openship "))}${chalk20.dim(" control")}`);
@@ -7561,7 +7532,7 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
       const pw = ensure2(
         await password({ message: "New admin password", validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters" })
       );
-      const rr = await internalPost(apiPort2, "/api/system/reset-admin-password", { password: pw });
+      const rr = await internalPost(apiPort, "/api/system/reset-admin-password", { password: pw });
       outro3(
         rr.ok ? chalk20.green(`Password reset. Sign in at ${dashUrl} with your email + new password.`) : chalk20.red(`Couldn't reset: ${rr.data?.error || "failed"}`)
       );
@@ -7577,7 +7548,7 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.7").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.5.0").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";