openship 0.6.0 → 0.6.5

package/dist/{chunk-IXM5245F.js → chunk-GRTXMUHA.js}

@@ -7,31 +7,38 @@ import {
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-JIMUYEKN.js";
-import {
-  resolveEnvironment
-} from "./chunk-IW2UKBVF.js";
+} from "./chunk-MSZUCNPV.js";
 import {
   BuildCancelledError,
   BuildLogger,
   detectBuildKillHint,
+  killProcessesUnderDir,
   parseLogLevel,
   runBuildPipeline,
   sq,
   transferLocalDirectory
-} from "./chunk-VDDMADOF.js";
-import {
-  formatDuration,
-  isRemoteConnectionError,
-  isRetryableRemoteConnectionError,
-  systemDebug
-} from "./chunk-ZCFVHA25.js";
+} from "./chunk-TM2IQPYU.js";
 import {
   LocalExecutor
 } from "./chunk-6FH4AXVY.js";
 import {
-  probeListeningPort
-} from "./chunk-3LDWWY7U.js";
+  privilegedExecutor
+} from "./chunk-RFWJE7ZN.js";
+import {
+  probeExec,
+  probeListeningPort,
+  withReason
+} from "./chunk-A7EWM2KA.js";
+import {
+  HOST_STATE_DIR,
+  envOps,
+  hostRefusal,
+  opScript
+} from "./chunk-EZPPTWJQ.js";
+import {
+  ensureOwnedDir,
+  resolveEnvironment
+} from "./chunk-WFRXYWK2.js";
 import {
   sq as sq2,
   wrapLocalBuildCommand
@@ -40,23 +47,30 @@ import {
   DeployError,
   LANGUAGES,
   STACKS,
+  answered,
   appVolumeTargets,
   buildOutputTransferExcludes,
+  formatDuration,
+  isRemoteConnectionError,
+  isRetryableRemoteConnectionError,
   missingOutputDirectoryMessage,
   packageManagerEnsureCommand,
-  safeErrorMessage
-} from "./chunk-OTLSJYAC.js";
+  refused,
+  safeErrorMessage,
+  shellQuote,
+  systemDebug
+} from "./chunk-LEYSL46B.js";
 
 // ../../packages/adapters/src/system/remote-journal.ts
 var OPSH_RUN_VERSION = 1;
-var DEFAULT_JOURNAL_BASE = "/root/.openship";
+var DEFAULT_JOURNAL_BASE = HOST_STATE_DIR;
 var REMOTE_ENV_PREFIX = "export DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew && ";
 var OPSH_RUN_SCRIPT = `#!/bin/sh
 # opsh-run \u2014 openship reliable command journal. Managed file; do not edit.
 VERSION=${OPSH_RUN_VERSION}
 
 BASE="$OPSH_BASE"
-[ -z "$BASE" ] && BASE=/root/.openship
+[ -z "$BASE" ] && BASE=${HOST_STATE_DIR}
 OPS="$BASE/ops"
 
 if [ "$1" = "--version" ]; then echo "$VERSION"; exit 0; fi
@@ -139,6 +153,14 @@ ERR="$(openssl base64 -A < "$DIR/stderr" 2>/dev/null)"
 echo "OPSH1 $CODE $OUT $ERR"
 exit 0
 `;
+async function resolveJournalBase(exec) {
+  try {
+    return envOps(await resolveEnvironment(exec)).scratchDir();
+  } catch (err) {
+    if (isRemoteConnectionError(err)) throw err;
+    return DEFAULT_JOURNAL_BASE;
+  }
+}
 async function ensureRemoteJournal(exec, baseDir) {
   const runner = `${baseDir}/bin/opsh-run`;
   let current = -1;
@@ -213,7 +235,7 @@ function sleep(ms) {
   });
 }
 async function runReliable(acquire, opId, command, opts) {
-  const baseDir = opts.baseDir ?? DEFAULT_JOURNAL_BASE;
+  let baseDir = opts.baseDir ?? null;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_RELIABLE_TIMEOUT_MS;
   const deadline = Date.now() + timeoutMs;
   const minMs = opts.reconnectMinMs ?? DEFAULT_RECONNECT_MIN_MS;
@@ -235,6 +257,7 @@ async function runReliable(acquire, opId, command, opts) {
       continue;
     }
     try {
+      baseDir ??= await resolveJournalBase(executor);
       if (!opts.ensured || !opts.ensured.has(executor)) {
         await ensureRemoteJournal(executor, baseDir);
         opts.ensured?.add(executor);
@@ -290,472 +313,475 @@ async function execReliable(executor, opId, command, opts = {}) {
 }
 
 // ../../packages/adapters/src/toolchain/catalog.ts
-function nodeInstallPlan(profile) {
-  if (profile.os === "linux" && ["apt", "dnf", "yum"].includes(profile.packageManager)) {
-    const installCommands = {
-      // NodeSource's `setup_lts.x` pins the apt repo to $(lsb_release -sc), so it
-      // breaks on a new/unpublished Ubuntu codename exactly like the OpenResty
-      // #86 bug (and can leave a poisoned nodesource.list that fails later apt
-      // runs). Their node_XX.x repos use the distro-agnostic `nodistro` suite, so
-      // add it directly (no codename, no `curl | bash` of a remote script) and
-      // heal a stale list first. Pinned to the current LTS major (bump on new LTS).
-      apt: [
-        "set -e",
-        "rm -f /etc/apt/sources.list.d/nodesource.list",
-        "apt-get update -qq && apt-get install -y -qq curl gnupg ca-certificates",
-        "curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /usr/share/keyrings/nodesource.gpg",
-        'echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list',
-        "apt-get update -qq && apt-get install -y -qq nodejs"
-      ].join("\n"),
-      dnf: "curl -fsSL https://rpm.nodesource.com/setup_lts.x | bash - && dnf install -y nodejs",
-      yum: "curl -fsSL https://rpm.nodesource.com/setup_lts.x | bash - && yum install -y nodejs"
-    };
-    return {
-      supported: true,
-      installCommand: installCommands[profile.packageManager],
-      verifyCommand: "node --version"
-    };
-  }
-  const fallbacks = {
-    brew: "brew install node"
-  };
-  const fallback = fallbacks[profile.packageManager];
-  if (!fallback) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Node.js installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand: fallback,
-    verifyCommand: "node --version"
-  };
-}
-function goInstallPlan(profile) {
-  if (profile.os === "linux") {
-    const arch = profile.arch === "arm64" ? "arm64" : "amd64";
-    return {
-      supported: true,
-      installCommand: [
-        `curl -fsSL https://go.dev/dl/go1.22.5.linux-${arch}.tar.gz -o /tmp/go.tar.gz`,
-        "rm -rf /usr/local/go",
-        "tar -C /usr/local -xzf /tmp/go.tar.gz",
-        "rm /tmp/go.tar.gz",
-        "echo 'export PATH=$PATH:/usr/local/go/bin' >> /etc/profile.d/go.sh",
-        "export PATH=$PATH:/usr/local/go/bin"
-      ].join(" && "),
-      verifyCommand: "/usr/local/go/bin/go version || go version"
-    };
-  }
-  if (profile.packageManager === "brew") {
-    return {
-      supported: true,
-      installCommand: "brew install go",
-      verifyCommand: "go version"
-    };
+var CHECKS = {
+  node: {
+    label: "Node.js",
+    versionCommand: "node --version",
+    parseVersion: (output) => output.replace(/^v/, "").trim(),
+    missingMessage: "Node.js is not installed",
+    installable: true
+  },
+  bun: {
+    label: "Bun",
+    versionCommand: "bun --version",
+    parseVersion: (output) => output.trim(),
+    missingMessage: "Bun is not installed",
+    installable: true
+  },
+  npm: {
+    label: "npm",
+    versionCommand: "npm --version",
+    parseVersion: (output) => output.trim(),
+    missingMessage: "npm is not installed",
+    installable: false,
+    providedBy: "node"
+  },
+  go: {
+    label: "Go",
+    versionCommand: "go version",
+    parseVersion: (output) => output.match(/go(\d+\.\d+(?:\.\d+)?)/)?.[1] ?? output.trim(),
+    missingMessage: "Go is not installed",
+    installable: true
+  },
+  rustc: {
+    label: "Rust compiler",
+    versionCommand: "rustc --version",
+    parseVersion: (output) => output.match(/rustc (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Rust compiler is not installed",
+    installable: true
+  },
+  cargo: {
+    label: "Cargo",
+    versionCommand: "cargo --version",
+    parseVersion: (output) => output.match(/cargo (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Cargo is not installed",
+    installable: false,
+    providedBy: "rustc"
+  },
+  python3: {
+    label: "Python 3",
+    versionCommand: "python3 --version",
+    parseVersion: (output) => output.match(/Python (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Python 3 is not installed",
+    installable: true
+  },
+  pip: {
+    label: "pip",
+    versionCommand: "pip3 --version || pip --version",
+    parseVersion: (output) => output.match(/pip (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "pip is not installed",
+    installable: true,
+    providedBy: "python3"
+  },
+  ruby: {
+    label: "Ruby",
+    versionCommand: "ruby --version",
+    parseVersion: (output) => output.match(/ruby (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Ruby is not installed",
+    installable: true
+  },
+  bundler: {
+    label: "Bundler",
+    versionCommand: "bundler --version",
+    parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
+    missingMessage: "Bundler is not installed",
+    installable: true,
+    providedBy: "ruby"
+  },
+  php: {
+    label: "PHP",
+    versionCommand: "php --version",
+    parseVersion: (output) => output.match(/PHP (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "PHP is not installed",
+    installable: true
+  },
+  composer: {
+    label: "Composer",
+    versionCommand: "composer --version",
+    parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
+    missingMessage: "Composer is not installed",
+    installable: true,
+    providedBy: "php"
+  },
+  java: {
+    label: "Java",
+    versionCommand: "java --version 2>&1 || java -version 2>&1",
+    parseVersion: (output) => output.match(/(\d+\.\d+)/)?.[1] ?? output.trim(),
+    missingMessage: "Java is not installed",
+    installable: true
+  },
+  javac: {
+    label: "Java compiler",
+    versionCommand: "javac --version 2>&1 || javac -version 2>&1",
+    parseVersion: (output) => output.match(/javac (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Java compiler (javac) is not installed",
+    installable: false,
+    providedBy: "java"
+  },
+  maven: {
+    label: "Maven",
+    versionCommand: "mvn -version 2>&1",
+    parseVersion: (output) => output.match(/Apache Maven (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Maven is not installed",
+    installable: true
+  },
+  gradle: {
+    label: "Gradle",
+    versionCommand: "gradle --version 2>&1",
+    parseVersion: (output) => output.match(/Gradle (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Gradle is not installed",
+    installable: true
+  },
+  dotnet: {
+    label: ".NET SDK",
+    versionCommand: "dotnet --version",
+    parseVersion: (output) => output.trim(),
+    missingMessage: ".NET SDK is not installed",
+    installable: true
+  },
+  elixir: {
+    label: "Elixir",
+    versionCommand: "elixir --version 2>&1",
+    parseVersion: (output) => output.match(/Elixir (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Elixir is not installed",
+    installable: true
+  },
+  mix: {
+    label: "Mix",
+    versionCommand: "mix --version 2>&1",
+    parseVersion: (output) => output.match(/Mix (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Mix is not installed",
+    installable: false,
+    providedBy: "elixir"
   }
-  return {
-    supported: false,
-    unsupportedReason: "Go installation is only supported on Linux and macOS (brew)"
-  };
-}
-function rustInstallPlan(_profile) {
-  return {
-    supported: true,
-    installCommand: "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && . $HOME/.cargo/env",
-    verifyCommand: ". $HOME/.cargo/env && rustc --version"
-  };
-}
-function pythonInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq python3 python3-pip python3-venv",
-    dnf: "dnf install -y python3 python3-pip",
-    yum: "yum install -y python3 python3-pip",
-    brew: "brew install python3"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Python installation"
-    };
+};
+function label(as, parts) {
+  const steps = [];
+  for (const part of parts) {
+    if (typeof part === "string") {
+      steps.push({ command: part, as });
+      continue;
+    }
+    if (!part.supported) return part;
+    for (const command of part.value) steps.push({ command, as });
   }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "python3 --version"
-  };
+  return answered(steps);
 }
-function rubyInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq ruby-full build-essential",
-    dnf: "dnf install -y ruby ruby-devel",
-    yum: "yum install -y ruby ruby-devel",
-    brew: "brew install ruby"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Ruby installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "ruby --version"
-  };
+function asRoot(...parts) {
+  return label("root", parts);
 }
-function phpInstallPlan(profile) {
-  if (profile.packageManager === "apt") {
-    return {
-      supported: true,
-      installCommand: [
-        "apt-get update -qq",
-        "apt-get install -y -qq php-cli php-mbstring php-xml php-curl unzip",
-        "curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer"
-      ].join(" && "),
-      verifyCommand: "php --version && composer --version"
-    };
-  }
-  const commands = {
-    dnf: "dnf install -y php-cli php-mbstring php-xml php-curl composer",
-    yum: "yum install -y php-cli php-mbstring php-xml php-curl",
-    brew: "brew install php composer"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for PHP installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "php --version"
-  };
+function asLogin(...parts) {
+  return label("login", parts);
 }
-function javaInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq openjdk-21-jdk",
-    dnf: "dnf install -y java-21-openjdk-devel",
-    yum: "yum install -y java-21-openjdk-devel",
-    brew: "brew install openjdk@21"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Java installation"
-    };
+function chain(...parts) {
+  const steps = [];
+  for (const part of parts) {
+    if (!part.supported) return part;
+    steps.push(...part.value);
   }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "java --version 2>&1"
-  };
+  return answered(steps);
 }
-function mavenInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq maven",
-    dnf: "dnf install -y maven",
-    yum: "yum install -y maven",
-    brew: "brew install maven"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Maven installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "mvn -version"
-  };
+function isAmazon(profile) {
+  return profile.distroId?.trim().toLowerCase() === "amzn";
 }
-function gradleInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq gradle",
-    brew: "brew install gradle"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Gradle installation (use the ./gradlew wrapper instead)"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "gradle --version"
-  };
+var NODE_LTS_MAJOR = 22;
+var GO_VERSION = "1.22.5";
+var BUN_VERSION = "1.2.0";
+var DOTNET_CHANNEL = "8.0";
+var COMPOSER_INSTALL = "curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer";
+var NO_EPEL = "and Openship does not enable third-party repositories (EPEL) on a host it did not provision. Install it yourself, or build in a container.";
+var NO_GRADLE_RPM = `The RHEL family ships no gradle package ${NO_EPEL} Most projects include a ./gradlew wrapper, which the build prefers anyway and which needs only a JDK.`;
+var NO_ELIXIR_RPM = `The RHEL family ships no elixir or erlang package ${NO_EPEL}`;
+function ensureUnzip(ops) {
+  if (ops.profile.os === "darwin") return answered([]);
+  const install = ops.pkgInstall(["unzip"]);
+  if (!install.supported) return answered([]);
+  return asRoot(`command -v unzip >/dev/null 2>&1 || { ${opScript(install.value)}; }`);
 }
-function dotnetInstallPlan(profile) {
-  if (profile.os === "linux") {
-    return {
-      supported: true,
-      installCommand: "curl -fsSL https://dot.net/v1/dotnet-install.sh | bash -s -- --channel 8.0 --install-dir /usr/local/share/dotnet && ln -sf /usr/local/share/dotnet/dotnet /usr/local/bin/dotnet",
-      verifyCommand: "dotnet --version"
-    };
-  }
-  if (profile.packageManager === "brew") {
-    return {
-      supported: true,
-      installCommand: "brew install dotnet-sdk",
-      verifyCommand: "dotnet --version"
-    };
-  }
-  return {
-    supported: false,
-    unsupportedReason: ".NET SDK installation is only supported on Linux and macOS (brew)"
-  };
-}
-function elixirInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq erlang elixir",
-    dnf: "dnf install -y erlang elixir",
-    brew: "brew install elixir"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Elixir installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "elixir --version"
-  };
-}
-function bundlerInstallPlan(_profile) {
-  return {
-    supported: true,
-    installCommand: "gem install bundler",
-    verifyCommand: "bundler --version"
-  };
-}
-function composerInstallPlan(profile) {
-  if (profile.packageManager === "brew") {
-    return {
-      supported: true,
-      installCommand: "brew install composer",
-      verifyCommand: "composer --version"
-    };
-  }
-  return {
-    supported: true,
-    installCommand: "curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer",
-    verifyCommand: "composer --version"
-  };
-}
-function bunInstallPlan(_profile) {
-  return {
-    supported: true,
-    installCommand: [
-      "curl -fsSL https://bun.sh/install | bash -s 'bun-v1.2.0'",
-      "ln -sf $HOME/.bun/bin/bun /usr/local/bin/bun"
-    ].join(" && "),
-    verifyCommand: "bun --version"
-  };
-}
-function pipInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq python3-pip",
-    dnf: "dnf install -y python3-pip",
-    yum: "yum install -y python3-pip",
-    brew: "python3 -m ensurepip --upgrade"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for pip installation"
-    };
+var RECIPES = {
+  node: {
+    verify: "node --version",
+    // Total over `SystemPackageManager` with no `default`, so a new manager is a
+    // "function lacks ending return statement" error rather than a silent fallthrough.
+    steps: (ops) => {
+      switch (ops.profile.packageManager) {
+        case "apt":
+          return asRoot(
+            "rm -f /etc/apt/sources.list.d/nodesource.list",
+            ops.pkgInstall(["curl", "gnupg", "ca-certificates"]),
+            "curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /usr/share/keyrings/nodesource.gpg",
+            `echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_LTS_MAJOR}.x nodistro main" > /etc/apt/sources.list.d/nodesource.list`,
+            ops.pkgInstall(["nodejs"])
+          );
+        case "dnf":
+          return asRoot(
+            `curl -fsSL https://rpm.nodesource.com/setup_${NODE_LTS_MAJOR}.x | bash -`,
+            ops.pkgInstall(["nodejs"])
+          );
+        case "yum":
+          return refused(
+            `Node ${NODE_LTS_MAJOR} needs glibc 2.28 or newer and this host's release (${ops.profile.prettyName ?? ops.profile.distroId ?? "unknown"}) ships an older one, so the vendor package would install and then fail to load. Use a newer OS release, or build in a container.`
+          );
+        case "apk":
+          return asRoot(ops.pkgInstall(["nodejs", "npm"]));
+        case "brew":
+          return asRoot(ops.pkgInstall(["node"]));
+        case "none":
+          return asRoot(ops.pkgInstall(["nodejs"]));
+      }
+    }
+  },
+  bun: {
+    verify: "bun --version",
+    steps: (ops) => {
+      if (ops.profile.libc === "musl") {
+        return refused(
+          "Bun's official installer is a bash script and this host is musl-based (Alpine), which ships busybox ash and no bash. Openship will not add a shell to a host to satisfy an installer. Use Node for this project, or build in a container."
+        );
+      }
+      return chain(
+        ensureUnzip(ops),
+        // The download lands in the login user's own home, so it must NOT be elevated:
+        // under sudo, HOME becomes root's and root would own ~/.bun, leaving `bun install`
+        // unable to write its own cache while `verify` still passes because it only reads.
+        //
+        // HOME is pinned to `home()` rather than left to `$HOME` so the install prefix and
+        // the symlink target below are derived from the same value and cannot diverge. The
+        // assignment sits on the `bash`, not the `curl` — it prefixes exactly one command,
+        // and it is the interpreter that chooses the prefix.
+        asLogin(
+          `curl -fsSL https://bun.sh/install | HOME=${shellQuote(ops.home())} bash -s 'bun-v${BUN_VERSION}'`
+        ),
+        // /usr/local/bin is root-owned, and this is what puts bun on PATH for a build.
+        asRoot(`ln -sf ${shellQuote(`${ops.home()}/.bun/bin/bun`)} /usr/local/bin/bun`)
+      );
+    }
+  },
+  go: {
+    verify: "go version",
+    steps: (ops) => {
+      if (ops.profile.libc === "musl") return asRoot(ops.pkgInstall(["go"]));
+      if (ops.profile.os === "darwin") return asRoot(ops.pkgInstall(["go"]));
+      const arch = ops.releaseArch();
+      if (!arch.supported) return arch;
+      return asRoot(
+        `curl -fsSL https://go.dev/dl/go${GO_VERSION}.linux-${arch.value}.tar.gz -o /tmp/go.tar.gz`,
+        "rm -rf /usr/local/go",
+        "tar -C /usr/local -xzf /tmp/go.tar.gz",
+        "rm -f /tmp/go.tar.gz",
+        // The profile.d line is for an operator's interactive login only. A build runs
+        // through a NON-login `ssh host 'go build'`, which sources nothing, so this was
+        // the only recipe of the fifteen whose payload never reached a build's PATH: the
+        // install went green and `go build` then exited 127. The symlink is what actually
+        // puts it there — Go resolves GOROOT from /proc/self/exe, so a link is transparent.
+        "ln -sf /usr/local/go/bin/go /usr/local/bin/go",
+        "ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt",
+        "echo 'export PATH=$PATH:/usr/local/go/bin' > /etc/profile.d/go.sh"
+      );
+    }
+  },
+  rustc: {
+    verify: ". $HOME/.cargo/env 2>/dev/null; rustc --version",
+    steps: (ops) => (
+      // rustup's default host triple is gnu, so on musl it fetches a toolchain that
+      // cannot run. Alpine's rust package is built for the box it's on.
+      ops.profile.libc === "musl" ? asRoot(ops.pkgInstall(["rust", "cargo"])) : chain(
+        // Unelevated for the same reason as bun, and doubly so here: rustup owns BOTH
+        // ~/.cargo and ~/.rustup, and `cargo build` writes into the registry cache
+        // under ~/.cargo on every build. Pinned HOME also makes `verify`
+        // (`. $HOME/.cargo/env`, run unelevated) look where the toolchain landed.
+        asLogin(
+          `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | HOME=${shellQuote(ops.home())} sh -s -- -y --no-modify-path`
+        ),
+        asRoot(
+          `ln -sf ${shellQuote(`${ops.home()}/.cargo/bin/cargo`)} ${shellQuote(`${ops.home()}/.cargo/bin/rustc`)} /usr/local/bin/`
+        )
+      )
+    )
+  },
+  python3: {
+    verify: "python3 --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["python3", "python3-pip", "python3-venv"]),
+        // No `python3-venv` on the RPM side — venv lives in `python3-libs` there.
+        dnf: answered(["python3", "python3-pip"]),
+        yum: answered(["python3", "python3-pip"]),
+        apk: answered(["python3", "py3-pip"]),
+        brew: answered(["python3"])
+      })
+    )
+  },
+  pip: {
+    verify: "pip3 --version || pip --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["python3-pip"]),
+        dnf: answered(["python3-pip"]),
+        yum: answered(["python3-pip"]),
+        apk: answered(["py3-pip"]),
+        // Homebrew has no `pip` formula; pip arrives with its python.
+        brew: refused(
+          "Homebrew installs pip as part of Python \u2014 install the python3 tool instead."
+        )
+      })
+    )
+  },
+  ruby: {
+    verify: "ruby --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["ruby-full", "build-essential"]),
+        // AL2023 has no unversioned `ruby`; Rocky/Alma/RHEL/Fedora do. Both are dnf,
+        // which is exactly the split a package-manager-keyed table cannot express.
+        dnf: answered(
+          isAmazon(ops.profile) ? ["ruby3.2", "ruby3.2-devel"] : ["ruby", "ruby-devel"]
+        ),
+        yum: answered(["ruby", "ruby-devel"]),
+        // `build-base` because musl has no prebuilt native gems to fall back on.
+        apk: answered(["ruby", "ruby-dev", "build-base"]),
+        brew: answered(["ruby"])
+      })
+    )
+  },
+  bundler: {
+    verify: "bundler --version",
+    // Ships with every supported Ruby as a default gem; `gem install` only upgrades it.
+    // No distro package is worth preferring here.
+    steps: () => asRoot("gem install bundler")
+  },
+  php: {
+    verify: "php --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["php-cli", "php-mbstring", "php-xml", "php-curl", "unzip"]),
+        // There is no `php-curl` anywhere on the RPM side — curl support ships in
+        // `php-common`, which the cli package pulls in. AL2023 versions every name.
+        dnf: answered(
+          isAmazon(ops.profile) ? ["php8.2-cli", "php8.2-mbstring", "php8.2-xml"] : ["php-cli", "php-mbstring", "php-xml"]
+        ),
+        yum: answered(["php-cli", "php-mbstring", "php-xml"]),
+        // Alpine versions the package and symlinks /usr/bin/php → php83, so `verify`
+        // holds without the recipe naming a version.
+        apk: answered(["php83"]),
+        brew: answered(["php"])
+      })
+    )
+  },
+  composer: {
+    verify: "composer --version",
+    steps: (ops) => {
+      if (ops.profile.packageManager === "brew") return asRoot(ops.pkgInstall(["composer"]));
+      if (ops.profile.libc === "musl") {
+        return refused(
+          "Composer needs PHP's phar and openssl extensions, and on musl hosts (Alpine) those ship as separate packages that Openship does not install. Add php-phar and php-openssl for your PHP version yourself, or build in a container."
+        );
+      }
+      return asRoot(COMPOSER_INSTALL);
+    }
+  },
+  java: {
+    verify: "java --version 2>&1",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["openjdk-21-jdk"]),
+        // Amazon ships Corretto in place of OpenJDK — `java-21-openjdk-devel` does not
+        // exist on AL2023, so a Java build there installed nothing and then failed on a
+        // missing `javac`.
+        dnf: answered(
+          isAmazon(ops.profile) ? ["java-21-amazon-corretto-devel"] : ["java-21-openjdk-devel"]
+        ),
+        // AL2 and CentOS 7 top out far below 21 (AL2's newest is
+        // `java-1.8.0-openjdk-devel`). Installing Java 8 for a recipe that promises 21 is
+        // the silent wrong answer, so name the release as the problem instead.
+        yum: refused(
+          "This host's release carries no OpenJDK 21 package \u2014 the newest it has is Java 8/11, and Openship will not install a JDK older than the toolchain asks for. Use a newer OS release, or build in a container."
+        ),
+        apk: answered(["openjdk21-jdk"]),
+        brew: answered(["openjdk@21"])
+      })
+    )
+  },
+  maven: {
+    verify: "mvn -version",
+    steps: (ops) => asRoot(ops.pkgInstall(["maven"]))
+  },
+  gradle: {
+    verify: "gradle --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["gradle"]),
+        dnf: refused(NO_GRADLE_RPM),
+        yum: refused(NO_GRADLE_RPM),
+        apk: answered(["gradle"]),
+        brew: answered(["gradle"])
+      })
+    )
+  },
+  dotnet: {
+    verify: "dotnet --version",
+    steps: (ops) => {
+      if (ops.profile.libc === "musl") return asRoot(ops.pkgInstall(["dotnet8-sdk"]));
+      if (ops.profile.packageManager === "brew") return asRoot(ops.pkgInstall(["dotnet"]));
+      if (ops.profile.os !== "linux") {
+        return refused(
+          `Openship installs the .NET SDK on Linux, and on macOS through Homebrew. This host reports os=${ops.profile.os}.`
+        );
+      }
+      return asRoot(
+        "curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh",
+        `bash /tmp/dotnet-install.sh --channel ${DOTNET_CHANNEL} --install-dir /usr/local/share/dotnet`,
+        "rm -f /tmp/dotnet-install.sh",
+        "ln -sf /usr/local/share/dotnet/dotnet /usr/local/bin/dotnet"
+      );
+    }
+  },
+  elixir: {
+    verify: "elixir --version 2>&1",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["erlang", "elixir"]),
+        // Keyed on the distro, not the package manager, because the two disagree here:
+        // Fedora carries elixir and erlang in its own repos, while AL2023 and Rocky 9
+        // — same `dnf` — carry neither. Refusing all of dnf told a Fedora operator to go
+        // enable EPEL for a package Fedora already has, and EPEL does not target Fedora
+        // at all, so the advice was not just unnecessary but impossible to follow.
+        //
+        // This is the first production reader of `profile.distro`.
+        dnf: ops.profile.distro === "fedora" ? answered(["erlang", "elixir"]) : refused(NO_ELIXIR_RPM),
+        yum: refused(NO_ELIXIR_RPM),
+        apk: answered(["elixir", "erlang"]),
+        brew: answered(["elixir"])
+      })
+    )
   }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "pip3 --version || pip --version"
-  };
-}
+};
+var INSTALLS = Object.fromEntries(
+  Object.entries(RECIPES).map(([tool, recipe]) => [
+    tool,
+    (profile) => {
+      const gate = hostRefusal(profile);
+      if (gate !== null) return refused(gate);
+      const ops = envOps(profile);
+      const steps = recipe.steps(ops);
+      return steps.supported ? answered({ steps: steps.value, verifyCommand: recipe.verify }) : steps;
+    }
+  ])
+);
 var toolchainCatalog = {
   /**
-   * Check recipes - how to detect each tool and parse its version.
+   * Check recipes — how to detect each tool and parse its version.
    *
-   * Every tool in LANGUAGES[lang].requiredTools must have an entry here.
+   * Every tool named in `LANGUAGES[lang].requiredTools` must have an entry here.
    */
-  checks: {
-    node: {
-      label: "Node.js",
-      versionCommand: "node --version",
-      parseVersion: (output) => output.replace(/^v/, "").trim(),
-      missingMessage: "Node.js is not installed",
-      installable: true
-    },
-    bun: {
-      label: "Bun",
-      versionCommand: "bun --version",
-      parseVersion: (output) => output.trim(),
-      missingMessage: "Bun is not installed",
-      installable: true
-    },
-    npm: {
-      label: "npm",
-      versionCommand: "npm --version",
-      parseVersion: (output) => output.trim(),
-      missingMessage: "npm is not installed",
-      installable: false,
-      providedBy: "node"
-    },
-    go: {
-      label: "Go",
-      versionCommand: "go version",
-      parseVersion: (output) => output.match(/go(\d+\.\d+(\.\d+)?)/)?.[1] ?? output.trim(),
-      missingMessage: "Go is not installed",
-      installable: true
-    },
-    rustc: {
-      label: "Rust compiler",
-      versionCommand: "rustc --version",
-      parseVersion: (output) => output.match(/rustc (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Rust compiler is not installed",
-      installable: true
-    },
-    cargo: {
-      label: "Cargo",
-      versionCommand: "cargo --version",
-      parseVersion: (output) => output.match(/cargo (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Cargo is not installed",
-      installable: false,
-      providedBy: "rustc"
-    },
-    python3: {
-      label: "Python 3",
-      versionCommand: "python3 --version",
-      parseVersion: (output) => output.match(/Python (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Python 3 is not installed",
-      installable: true
-    },
-    pip: {
-      label: "pip",
-      versionCommand: "pip3 --version || pip --version",
-      parseVersion: (output) => output.match(/pip (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "pip is not installed",
-      installable: true,
-      providedBy: "python3"
-    },
-    ruby: {
-      label: "Ruby",
-      versionCommand: "ruby --version",
-      parseVersion: (output) => output.match(/ruby (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Ruby is not installed",
-      installable: true
-    },
-    bundler: {
-      label: "Bundler",
-      versionCommand: "bundler --version",
-      parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
-      missingMessage: "Bundler is not installed",
-      installable: true,
-      providedBy: "ruby"
-    },
-    php: {
-      label: "PHP",
-      versionCommand: "php --version",
-      parseVersion: (output) => output.match(/PHP (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "PHP is not installed",
-      installable: true
-    },
-    composer: {
-      label: "Composer",
-      versionCommand: "composer --version",
-      parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
-      missingMessage: "Composer is not installed",
-      installable: true,
-      providedBy: "php"
-    },
-    java: {
-      label: "Java",
-      versionCommand: "java --version 2>&1 || java -version 2>&1",
-      parseVersion: (output) => output.match(/(\d+\.\d+)/)?.[1] ?? output.trim(),
-      missingMessage: "Java is not installed",
-      installable: true
-    },
-    javac: {
-      label: "Java compiler",
-      versionCommand: "javac --version 2>&1 || javac -version 2>&1",
-      parseVersion: (output) => output.match(/javac (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Java compiler (javac) is not installed",
-      installable: false,
-      providedBy: "java"
-    },
-    maven: {
-      label: "Maven",
-      versionCommand: "mvn -version 2>&1",
-      parseVersion: (output) => output.match(/Apache Maven (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Maven is not installed",
-      installable: true
-    },
-    gradle: {
-      label: "Gradle",
-      versionCommand: "gradle --version 2>&1",
-      parseVersion: (output) => output.match(/Gradle (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Gradle is not installed",
-      installable: true
-    },
-    dotnet: {
-      label: ".NET SDK",
-      versionCommand: "dotnet --version",
-      parseVersion: (output) => output.trim(),
-      missingMessage: ".NET SDK is not installed",
-      installable: true
-    },
-    elixir: {
-      label: "Elixir",
-      versionCommand: "elixir --version 2>&1",
-      parseVersion: (output) => output.match(/Elixir (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Elixir is not installed",
-      installable: true
-    },
-    mix: {
-      label: "Mix",
-      versionCommand: "mix --version 2>&1",
-      parseVersion: (output) => output.match(/Mix (\S+)/)?.[1] ?? output.trim(),
-      missingMessage: "Mix is not installed",
-      installable: false,
-      providedBy: "elixir"
-    }
-  },
+  checks: CHECKS,
   /**
-   * Install plan factories - how to install each tool on a given OS.
+   * Install plan factories — how to install each tool on a given host.
    *
-   * Only tools with `installable: true` (and no `providedBy`) need an entry.
-   * Tools like npm, cargo, mix are installed as part of their parent.
+   * Only `installable` tools have one. npm, cargo, javac and mix arrive with their
+   * parent and say so through `providedBy`.
    */
-  installs: {
-    node: nodeInstallPlan,
-    bun: bunInstallPlan,
-    go: goInstallPlan,
-    rustc: rustInstallPlan,
-    python3: pythonInstallPlan,
-    pip: pipInstallPlan,
-    ruby: rubyInstallPlan,
-    bundler: bundlerInstallPlan,
-    php: phpInstallPlan,
-    composer: composerInstallPlan,
-    java: javaInstallPlan,
-    maven: mavenInstallPlan,
-    gradle: gradleInstallPlan,
-    dotnet: dotnetInstallPlan,
-    elixir: elixirInstallPlan
-  }
+  installs: INSTALLS
 };
 
 // ../../packages/adapters/src/toolchain/checks.ts
@@ -775,31 +801,8 @@ function compareVersions(actual, minimum) {
   }
   return 0;
 }
-async function tryExec(executor, command) {
-  const startedAt = Date.now();
-  systemDebug("toolchain", `exec:start ${command}`);
-  try {
-    const result = await executor.exec(command, { timeout: 1e4 });
-    systemDebug(
-      "toolchain",
-      `exec:ok ${command} (${formatDuration(startedAt)})`
-    );
-    return result;
-  } catch (err) {
-    if (isRemoteConnectionError(err)) {
-      systemDebug(
-        "toolchain",
-        `exec:abort ${command} (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
-      );
-      throw err;
-    }
-    const msg = safeErrorMessage(err);
-    systemDebug(
-      "toolchain",
-      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
-    );
-    return null;
-  }
+function meetsMinVersion(actual, minimum) {
+  return compareVersions(actual, minimum) >= 0;
 }
 async function checkTool(executor, name, opts) {
   const recipe = toolchainCatalog.checks[name];
@@ -812,18 +815,21 @@ async function checkTool(executor, name, opts) {
       message: `Unknown tool: ${name}`
     };
   }
-  const output = await tryExec(executor, recipe.versionCommand);
-  if (!output) {
-    systemDebug("toolchain", `${name}:missing`);
+  const probe = await probeExec(executor, recipe.versionCommand, "toolchain");
+  if (!probe.output) {
+    systemDebug("toolchain", `${name}:missing ${probe.error ?? "exited 0 with no version"}`);
     return {
       name,
       label: recipe.label,
       installed: false,
       healthy: false,
-      message: recipe.missingMessage
+      // A tool that isn't there and a tool whose `--version` was refused ("permission
+      // denied", "Command timed out") both land here, and only the second can say why —
+      // #408, the same conflation `system/checks.ts` reports its way out of.
+      message: withReason(recipe.missingMessage, probe.error)
     };
   }
-  const version = recipe.parseVersion(output);
+  const version = recipe.parseVersion(probe.output);
   if (opts?.minVersion && compareVersions(version, opts.minVersion) < 0) {
     systemDebug("toolchain", `${name}:outdated v${version} < ${opts.minVersion}`);
     return {
@@ -883,6 +889,16 @@ async function checkToolchainForStack(executor, stackId) {
 }
 
 // ../../packages/adapters/src/toolchain/installer.ts
+function groupStepsByAuthority(steps, hostNeedsRoot) {
+  const groups = [];
+  for (const step of steps) {
+    const as = step.as === "root" && hostNeedsRoot ? "root" : "login";
+    const open = groups.at(-1);
+    if (open && open.as === as) open.commands.push(step.command);
+    else groups.push({ as, commands: [step.command] });
+  }
+  return groups;
+}
 async function installTool(executor, name, onLog, requiredVersion) {
   const startedAt = Date.now();
   const recipe = toolchainCatalog.checks[name];
@@ -907,13 +923,26 @@ async function installTool(executor, name, onLog, requiredVersion) {
   const profile = await resolveEnvironment(executor);
   const plan = factory(profile);
   if (!plan.supported) {
-    const msg = plan.unsupportedReason ?? `${recipe.label} installation not supported on this system`;
     onLog?.({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      message: msg,
+      message: `Cannot install ${recipe.label} on ${envOps(profile).describe()}: ${plan.reason}`,
       level: "error"
     });
-    return { tool: name, success: false, error: msg };
+    return { tool: name, success: false, error: plan.reason };
+  }
+  const groups = groupStepsByAuthority(plan.value.steps, envOps(profile).installsNeedRoot());
+  let elevated = null;
+  if (groups.some((group) => group.as === "root")) {
+    const grant = await privilegedExecutor(executor, `Installing ${recipe.label}`);
+    if (!grant.supported) {
+      onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: grant.reason,
+        level: "error"
+      });
+      return { tool: name, success: false, error: grant.reason };
+    }
+    elevated = grant.value.executor;
   }
   systemDebug("toolchain", `install:start ${name}`);
   onLog?.({
@@ -922,33 +951,25 @@ async function installTool(executor, name, onLog, requiredVersion) {
     level: "info"
   });
   try {
-    const { code } = await executor.streamExec(plan.installCommand, (entry) => {
-      onLog?.(entry);
-    });
-    if (code !== 0) {
-      if (plan.fallbackInstallCommands?.length) {
-        for (const fallback of plan.fallbackInstallCommands) {
-          onLog?.({
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            message: `Primary install failed, trying fallback...`,
-            level: "warn"
-          });
-          const fb = await executor.streamExec(fallback, (entry) => onLog?.(entry));
-          if (fb.code === 0) break;
-        }
-      } else {
+    for (const group of groups) {
+      const runner = group.as === "root" ? elevated : executor;
+      const { code } = await runner.streamExec(opScript(group.commands), (entry) => {
+        onLog?.(entry);
+      });
+      if (code !== 0) {
         throw new Error(`Install command failed with exit code ${code}`);
       }
     }
-    if (plan.startCommand) {
-      await executor.streamExec(plan.startCommand, (entry) => onLog?.(entry));
-    }
-    const verifyCmd = plan.verifyCommand ?? recipe.versionCommand;
-    const verifyResult = await executor.exec(verifyCmd, { timeout: 1e4 }).catch(() => null);
+    const verifyResult = await executor.exec(plan.value.verifyCommand, { timeout: 1e4 }).catch(() => null);
     if (!verifyResult) {
       throw new Error(`${recipe.label} installed but verification failed`);
     }
     const version = recipe.parseVersion(verifyResult);
+    if (requiredVersion && !meetsMinVersion(version, requiredVersion)) {
+      throw new Error(
+        `${recipe.label} ${version} was installed but this project needs ${requiredVersion} or newer, and this host has no newer package. Use a newer OS release, or build in a container.`
+      );
+    }
     systemDebug("toolchain", `install:done ${name} v${version} (${formatDuration(startedAt)})`);
     onLog?.({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1503,21 +1524,18 @@ ${hint}` : "Process exited immediately after spawn (no output captured)";
 
 // ../../packages/adapters/src/runtime/supervisor/detect.ts
 async function detectSupervisor(executor, workDir) {
-  const hasSystemd = await probeSystemd(executor);
-  if (hasSystemd) {
-    return new SystemdSupervisor(executor, workDir);
-  }
-  return new NohupSupervisor(executor, workDir);
-}
-async function probeSystemd(executor) {
-  try {
-    const result = await executor.exec(
-      `[ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1 && echo y || echo n`
+  const profile = await resolveEnvironment(executor).catch((err) => {
+    systemDebug("supervisor", `detect: host unreachable, using nohup \u2014 ${safeErrorMessage(err)}`);
+    return null;
+  });
+  if (profile?.serviceManager === "systemd") return new SystemdSupervisor(executor, workDir);
+  const unmeasured = profile?.probeError ?? (profile?.supported === false ? profile.unsupportedReason : null);
+  if (unmeasured) {
+    console.warn(
+      `[supervisor] could not confirm this host's init system, so the service will run under nohup and will NOT restart after a reboot: ${unmeasured}`
     );
-    return result.trim() === "y";
-  } catch {
-    return false;
   }
+  return new NohupSupervisor(executor, workDir);
 }
 
 // ../../packages/adapters/src/runtime/bare.ts
@@ -1672,7 +1690,7 @@ var BareRuntime = class {
   async promoteBuildArtifact(artifactPath, deploymentId, previousDeploymentId) {
     const releaseDir = this.releaseDir(deploymentId);
     if (artifactPath === releaseDir) return releaseDir;
-    await this.executor.mkdir(`${this.workDir}/releases`);
+    await ensureOwnedDir(this.executor, `${this.workDir}/releases`);
     await this.executor.rm(releaseDir);
     const previousReleaseDir = previousDeploymentId ? this.releaseDir(previousDeploymentId) : void 0;
     if (previousReleaseDir && await this.executor.exists(previousReleaseDir)) {
@@ -1898,10 +1916,7 @@ var BareRuntime = class {
       abort.abort();
       this.activeBuilds.delete(sessionId);
     }
-    const dir = sq(this.buildDir(sessionId));
-    const scan = (sig) => `for p in /proc/[0-9]*; do c=$(readlink "$p/cwd" 2>/dev/null); case "$c" in ${dir}|${dir}/*) kill -${sig} "\${p##*/}" 2>/dev/null || true;; esac; done`;
-    await this.executor.exec(`${scan("TERM")}; sleep 2; ${scan("KILL")}`).catch(() => {
-    });
+    await killProcessesUnderDir(this.executor, this.buildDir(sessionId));
   }
   async getBuildLogs(sessionId) {
     void sessionId;