openship 0.6.1 → 0.6.5

package/README.md

@@ -77,10 +77,13 @@ From the desktop app you connect a server (SSH) or Openship Cloud and deploy to
 Install the CLI (it bundles the API + dashboard), then run **`openship`** — an interactive wizard creates the first admin, wires your domain, and installs Openship as a boot service. Run it again anytime to manage the instance.
 
 ```bash
-curl -fsSL https://get.openship.io | sh          # install  (or: npm i -g openship)
+curl -fsSL https://get.openship.io | sh          # install  (or: npm i -g openship — needs Node 22+)
 openship                                          # guided setup, then control panel
 ```
 
+The install script brings its own Node when your system one is older than 22; a package-manager
+install runs on the Node you already have.
+
 For CI / headless boxes, skip the wizard and drive `openship up` directly:
 
 ```bash
@@ -154,7 +157,9 @@ docker compose --env-file .env -f docker/docker-compose.yml up -d
 
 The stack is **postgres + redis + api + dashboard + edge**. The `edge` is OpenResty on **:80/:443** as a container (`network_mode: host`) — routing + Let's Encrypt, no bare host install. **Linux only** (host networking); on mac/win use `openship up` (bare). The `api` container mounts the host Docker socket so the control plane can build + run your apps as host containers — it's host-privileged through the socket, so run it only on a trusted host.
 
-**Upgrade:** pin `OPENSHIP_VERSION` in `.env` for reproducible pulls, then `docker compose --env-file .env -f docker/docker-compose.yml pull && … up -d` (or just `openship update`). **Build from source instead:** add `-f docker/docker-compose.build.yml … up -d --build`.
+**Upgrade:** pin `OPENSHIP_VERSION` in `.env` for reproducible pulls, then `docker compose --env-file .env -f docker/docker-compose.yml pull && … up -d`. `openship update` only reconciles a stack the CLI installed, and `openship up` would *adopt* this one — don't reach for either here. **Build from source instead:** add `-f docker/docker-compose.build.yml … up -d --build`.
+
+**Host operations** (`:80`/`:443` takeover, the mail engine, host terminal/port scans) need the container→host SSH channel, which `openship up` provisions and this path does not — the five manual steps are in `.env.example` under *Host operations from the container*, and the failure it produces is [Troubleshooting → Host control channel](https://openship.io/docs/troubleshooting/host-channel). Everything else, including deploys, works without it.
 
 > The **root** `docker-compose.yml` is a different file: it's the SaaS / from-source **control plane** (builds from source, ships the marketing site, no edge/socket). It does **not** self-host your apps — use `docker/docker-compose.yml` above or `openship up`.
 

package/dist/{bare-IWS2QHJ3.js → bare-XQIPDO4R.js}

@@ -5,17 +5,18 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   BareRuntime,
   STATIC_RELEASE_BASE
-} from "./chunk-IXM5245F.js";
-import "./chunk-JIMUYEKN.js";
-import "./chunk-IW2UKBVF.js";
-import "./chunk-VDDMADOF.js";
-import "./chunk-UC7YIEHT.js";
-import "./chunk-6ODUBKUB.js";
-import "./chunk-ZCFVHA25.js";
+} from "./chunk-GRTXMUHA.js";
+import "./chunk-MSZUCNPV.js";
+import "./chunk-TM2IQPYU.js";
+import "./chunk-VHMOQL5Y.js";
+import "./chunk-5OUWIPOB.js";
 import "./chunk-6FH4AXVY.js";
-import "./chunk-3LDWWY7U.js";
+import "./chunk-RFWJE7ZN.js";
+import "./chunk-A7EWM2KA.js";
+import "./chunk-EZPPTWJQ.js";
+import "./chunk-WFRXYWK2.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-OTLSJYAC.js";
+import "./chunk-LEYSL46B.js";
 import "./chunk-PXKCZB2I.js";
 export {
   BareRuntime,

package/dist/{chunk-RRJJGVKE.js → chunk-3ZAGC5NT.js}

@@ -5,42 +5,41 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-IOT5ZX23.js";
+} from "./chunk-7334NSJL.js";
 import {
   createDockerBuildContext,
   normalizeDockerRelativePath,
-  resolveDockerfileCandidates
-} from "./chunk-EMXI4UCU.js";
+  resolveDockerfileCandidates,
+  resolveWithinDirectory
+} from "./chunk-LFCSC4IU.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-JIMUYEKN.js";
+} from "./chunk-MSZUCNPV.js";
 import {
   BuildLogger,
   injectGitToken,
   runBuildPipeline,
   sq,
   transferLocalDirectory
-} from "./chunk-VDDMADOF.js";
-import {
-  isRuntimeNotFoundError
-} from "./chunk-ZCFVHA25.js";
+} from "./chunk-TM2IQPYU.js";
 import {
   STACKS,
   SYSTEM,
   TRANSFER_EXCLUDES,
   buildOutputTransferExcludes,
+  isRuntimeNotFoundError,
   missingOutputDirectoryMessage,
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-LEYSL46B.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";
-import { join, posix } from "path";
+import { posix } from "path";
 
 // ../../packages/adapters/src/types.ts
 var DEFAULT_RESOURCE_CONFIG = {
@@ -1367,6 +1366,16 @@ async function provisionCloudWorkspace(client, config, logger) {
     throw err;
   }
 }
+var HostBuildForbiddenError = class extends Error {
+  code = "HOST_BUILD_FORBIDDEN";
+  constructor(message) {
+    super(message);
+    this.name = "HostBuildForbiddenError";
+  }
+};
+function isHostBuildForbiddenError(err) {
+  return err instanceof HostBuildForbiddenError || err instanceof Error && err.name === "HostBuildForbiddenError";
+}
 var CloudRuntime = class {
   name = "cloud";
   capabilities = /* @__PURE__ */ new Set([
@@ -1387,7 +1396,10 @@ var CloudRuntime = class {
     // disk is still there to start back up (see makeActive).
     "unitRestore",
     "serviceShell",
-    "inContainerExec"
+    "inContainerExec",
+    // Runs in the REMOTE workspace over the Oblien API, so it never touches the
+    // control-plane host.
+    "isolatedExec"
   ]);
   /**
    * Services map to Oblien workspaces, not Docker containers, so host-level
@@ -1396,7 +1408,13 @@ var CloudRuntime = class {
    * logging/dns — join this set as they're added in later phases.
    */
   unsupportedComposeKeys = /* @__PURE__ */ new Set([
-    "healthcheck"
+    "healthcheck",
+    // Namespace sharing has no Oblien equivalent — a workspace is not a container
+    // whose netns/pidns a peer can join. Declared here so the deploy warns once
+    // per service and continues, rather than the workload coming up on its own
+    // network with nothing having said so (#533).
+    "networkMode",
+    "pidMode"
   ]);
   client;
   // Optional admin-scoped proxy. Set when this runtime is constructed
@@ -1409,9 +1427,20 @@ var CloudRuntime = class {
   builtArtifacts = /* @__PURE__ */ new Map();
   activeBuilds = /* @__PURE__ */ new Map();
   compose;
+  /**
+   * May this runtime do work on the machine the API process runs on?
+   *
+   * DEFAULT DENY, unlike every other optional knob on PlatformConfig. The permissive
+   * default is what the two host arms below relied on, and the cost of forgetting to
+   * set it is a tenant's build commands running on a multi-tenant control plane —
+   * while the cost of a missed opt-IN is a self-hosted local-orchestrated cloud deploy
+   * failing loudly with the message below. Loud beats silent here.
+   */
+  allowHostBuild;
   constructor(client, opts) {
     this.client = client;
     this.adminProxy = opts?.adminProxy;
+    this.allowHostBuild = opts?.allowHostBuild ?? false;
     this.compose = new CloudComposeSupport({
       client,
       builtArtifacts: this.builtArtifacts,
@@ -1420,6 +1449,16 @@ var CloudRuntime = class {
       execAndStream: (runtime, command, onLog, timeoutSeconds) => this.execAndStream(runtime, command, onLog, timeoutSeconds)
     });
   }
+  /**
+   * Refuse work on the API's own machine unless this runtime was explicitly built to
+   * allow it. `what` completes the sentence "… is not allowed to <what>".
+   */
+  assertHostWorkAllowed(what) {
+    if (this.allowHostBuild) return;
+    throw new HostBuildForbiddenError(
+      `This deployment asked to ${what}, which is not permitted on this instance. Cloud builds run inside your Oblien workspace. If this project was moved here from a self-hosted install, redeploy it so its build settings are re-resolved for the cloud (its stored settings still say "build locally").`
+    );
+  }
   supports(cap) {
     return this.capabilities.has(cap);
   }
@@ -1496,6 +1535,11 @@ var CloudRuntime = class {
         return activeBuild.abort.signal.aborted ? { ...result2, status: "cancelled", errorMessage: void 0 } : result2;
       }
       const buildLocally = config.buildStrategy === "local";
+      if (buildLocally) {
+        this.assertHostWorkAllowed(
+          "run this project's install and build commands on the machine this API runs on"
+        );
+      }
       let wsId;
       let rt;
       try {
@@ -1629,6 +1673,9 @@ var CloudRuntime = class {
             await this.ensureWorkspaceGit(rt, plog, "build workspace");
             return;
           }
+          this.assertHostWorkAllowed(
+            "package a source directory from the machine this API runs on"
+          );
           await transferLocalDirectory(
             cfg.localPath,
             {
@@ -1743,17 +1790,15 @@ var CloudRuntime = class {
     if (!config.localPath) {
       return this.resolveRemoteDockerfileBuildSource(config, logger);
     }
+    this.assertHostWorkAllowed("read and package a source tree from the machine this API runs on");
     logger.log("Preparing local Dockerfile source...\n");
     const context = await createDockerBuildContext(config, {
       requireRepositoryDockerfile: true,
       onLog: logger.callback
     });
-    const dockerfilePath = join(context.contextDir, ...context.dockerfileName.split("/"));
+    const dockerfilePath = resolveWithinDirectory(context.contextDir, context.dockerfileName);
     const dockerfile = await readFile(dockerfilePath, "utf-8");
-    const contextRoot = join(
-      context.contextDir,
-      ...normalizeDockerRelativePath(context.rootDirectory).split("/").filter(Boolean)
-    );
+    const contextRoot = resolveWithinDirectory(context.contextDir, context.rootDirectory);
     return {
       kind: "local",
       contextRoot,
@@ -3129,5 +3174,7 @@ function clampShellWindow(value, fallback, min, max) {
 export {
   PAGE_CONTAINER_PREFIX,
   provisionCloudWorkspace,
+  HostBuildForbiddenError,
+  isHostBuildForbiddenError,
   CloudRuntime
 };

package/dist/{chunk-6ODUBKUB.js → chunk-5OUWIPOB.js}

@@ -3,12 +3,12 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  PACKAGE_ROOT_ONLY_EXCLUDES,
+  hostFirewallRule,
   isSshAuthError,
+  safeErrorMessage,
   systemDebug
-} from "./chunk-ZCFVHA25.js";
-import {
-  PACKAGE_ROOT_ONLY_EXCLUDES
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-LEYSL46B.js";
 
 // ../../packages/adapters/src/archive.ts
 import { execFile } from "child_process";
@@ -107,6 +107,16 @@ function describeSshAuthFailure(config, originalMessage) {
   }
   return `SSH authentication failed for ${target}. (${originalMessage})`;
 }
+function describeSshConnectFailure(config, originalMessage) {
+  const target = formatSshTarget(config);
+  const port = config.port ?? 22;
+  if (config.hostChannel) {
+    return `Cannot reach the host SSH endpoint ${target} from inside the Openship API container. Host control is configured, but the connection never completed. The usual cause is a host firewall dropping traffic from the Docker bridge to the host's SSH port \u2014 allow it with:
+${hostFirewallRule("unknown", [], port)}
+Or re-run \`openship up\`, which probes this and offers the exact rule. (${originalMessage})`;
+  }
+  return `Cannot reach ${target} over SSH. Check that the host is up, that port ${port} is open, and that no firewall or security group is dropping the connection. (${originalMessage})`;
+}
 function execFileText(command, args, timeout = 5e3) {
   return new Promise((resolve, reject) => {
     execFile2(command, args, { timeout }, (err, stdout, stderr) => {
@@ -205,6 +215,10 @@ function toConnectConfig(config) {
     passphrase: config.privateKeyPassphrase,
     agent: config.sshAgent,
     tryKeyboard: false,
+    // Explicit rather than relying on ssh2's implicit 20s so callers can shorten it.
+    // The container→host channel does (8s): a filtered SYN there would otherwise
+    // stall every host operation for 20s apiece with no output.
+    readyTimeout: config.readyTimeoutMs ?? 2e4,
     keepaliveInterval: 15e3,
     // 10 (~150s) rather than 3 (45s): a small server pegged by a heavy
     // `docker build` / `bun install` can briefly starve sshd of keepalive
@@ -230,12 +244,12 @@ async function connectSshClient(config) {
         reject(new Error(describeSshAuthFailure(config, err.message)));
         return;
       }
-      reject(err);
+      reject(new Error(describeSshConnectFailure(config, err.message)));
     });
     client.on("close", () => {
       if (settled) return;
       settled = true;
-      reject(new Error("SSH connection closed before ready"));
+      reject(new Error(describeSshConnectFailure(config, "SSH connection closed before ready")));
     });
     client.connect(toConnectConfig(config));
   });
@@ -263,6 +277,7 @@ async function openSshUnixSocket(client, socketPath) {
     });
   });
 }
+var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
 async function openSshExecChannel(client, command) {
   return new Promise((resolve, reject) => {
     client.exec(command, (err, stream) => {
@@ -274,6 +289,50 @@ async function openSshExecChannel(client, command) {
     });
   });
 }
+var DIAL_STDIO_DIAGNOSTICS = /* @__PURE__ */ Symbol("openship.dialStdioDiagnostics");
+var DIAL_STDIO_STDERR_CAP = 4096;
+function attachDialStdioDiagnostics(stream) {
+  const channel = stream;
+  if (channel[DIAL_STDIO_DIAGNOSTICS]) return stream;
+  const diagnostics = {
+    stderr: "",
+    exitCode: null,
+    signal: null,
+    error: null
+  };
+  channel[DIAL_STDIO_DIAGNOSTICS] = diagnostics;
+  const stderr = stream.stderr;
+  stderr?.on("data", (chunk) => {
+    if (diagnostics.stderr.length >= DIAL_STDIO_STDERR_CAP) return;
+    diagnostics.stderr = (diagnostics.stderr + chunk.toString("utf8")).slice(
+      0,
+      DIAL_STDIO_STDERR_CAP
+    );
+  });
+  stream.on("exit", (code, signal) => {
+    diagnostics.exitCode = typeof code === "number" ? code : null;
+    diagnostics.signal = typeof signal === "string" ? signal : null;
+  });
+  stream.on("error", (err) => {
+    diagnostics.error ??= safeErrorMessage(err);
+  });
+  return stream;
+}
+function dialStdioDiagnostics(stream) {
+  const diagnostics = stream?.[DIAL_STDIO_DIAGNOSTICS];
+  if (!diagnostics) return "";
+  const parts = [];
+  const stderr = diagnostics.stderr.trim();
+  if (stderr) parts.push(stderr.replace(/\s+/g, " "));
+  if (diagnostics.error) parts.push(diagnostics.error);
+  if (diagnostics.signal) parts.push(`killed by ${diagnostics.signal}`);
+  else if (diagnostics.exitCode) parts.push(`exit code ${diagnostics.exitCode}`);
+  if (parts.length === 0) return "";
+  return `\`${DOCKER_DIAL_STDIO_COMMAND}\` reported: ${parts.join(" \u2014 ")}`;
+}
+async function openDockerDialStdioChannel(client) {
+  return attachDialStdioDiagnostics(await openSshExecChannel(client, DOCKER_DIAL_STDIO_COMMAND));
+}
 async function execSshCommand(client, command, timeout = 1e4) {
   return new Promise((resolve, reject) => {
     let stdout = "";
@@ -325,6 +384,9 @@ export {
   connectSshClient,
   openSftp,
   openSshUnixSocket,
-  openSshExecChannel,
+  DOCKER_DIAL_STDIO_COMMAND,
+  attachDialStdioDiagnostics,
+  dialStdioDiagnostics,
+  openDockerDialStdioChannel,
   execSshCommand
 };

package/dist/chunk-6HOA5JT7.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  composeInternalToken,
+  startUnitHint
+} from "./chunk-QLX7NBEA.js";
+import {
+  LocalExecutor
+} from "./chunk-6FH4AXVY.js";
+import {
+  EDGE_CONTAINER_NAME,
+  edgeCrashReason
+} from "./chunk-WE7BXW6L.js";
+
+// src/lib/edge-import.ts
+import chalk from "chalk";
+import ora from "ora";
+async function waitForApiHealth(port, tries) {
+  for (let i = 0; i < tries; i++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${port}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      if (r.ok) return true;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
+async function waitForEdgeRunning(tries) {
+  const exec = new LocalExecutor();
+  for (let i = 0; i < tries; i++) {
+    const out = await exec.exec(`docker inspect -f '{{.State.Running}}' ${EDGE_CONTAINER_NAME}`).catch(() => "");
+    if (out.trim() === "true") return true;
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
+async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
+  const token = composeInternalToken();
+  if (!token) {
+    const error = "couldn't read the stack's internal token";
+    console.log(chalk.yellow(`  Skipping site import \u2014 ${error}. Re-run to retry.
+`));
+    return { ok: false, registered: [], error };
+  }
+  const spinner = ora(
+    `Importing ${sites.length} migrated site${sites.length === 1 ? "" : "s"} into the edge\u2026`
+  ).start();
+  if (!await waitForApiHealth(apiPort, 60)) {
+    const error = "API didn't become healthy in time";
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
+  if (!await waitForEdgeRunning(60)) {
+    const error = `the ${EDGE_CONTAINER_NAME} container isn't running yet`;
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
+  try {
+    const r = await fetch(`http://127.0.0.1:${apiPort}/api/system/edge/import-sites`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": token },
+      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    const data = await r.json().catch(() => ({}));
+    if (!r.ok) {
+      const error = data.error ?? `HTTP ${r.status}`;
+      spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
+      return { ok: false, registered: [], error };
+    }
+    const registered = data.registered ?? [];
+    const warnings = data.warnings ?? [];
+    const missed = sites.length - registered.length;
+    if (sites.length > 0 && registered.length === 0) {
+      spinner.fail(
+        `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
+      );
+      for (const w of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w}`));
+      const edgeLog = await edgeCrashReason(new LocalExecutor());
+      if (edgeLog) {
+        console.log(chalk.red(`
+  The edge container is not running. Its log says:`));
+        console.log(chalk.red(`    ${edgeLog}`));
+      }
+      const back = startUnitHint("nginx");
+      console.log(
+        chalk.yellow(
+          `
+  Retry the import with \`openship up\` once the cause above is fixed, or put your
+` + (back ? `  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && ${back}
+` : `  previous proxy back by stopping ${EDGE_CONTAINER_NAME} and starting it the way
+  this host starts services.
+`)
+        )
+      );
+      return { ok: false, registered, error: warnings[0] ?? "no sites were registered" };
+    }
+    if (missed > 0) {
+      spinner.warn(
+        `Migrated ${registered.length}/${sites.length} sites \u2014 ${missed} not served (see below).`
+      );
+      for (const w of warnings.slice(0, 8)) console.log(chalk.yellow(`    \u2022 ${w}`));
+      return { ok: false, registered, error: `${missed} site(s) not registered` };
+    }
+    spinner.succeed(
+      `Migrated ${registered.length} site${registered.length === 1 ? "" : "s"} into Openship's edge.`
+    );
+    for (const w of warnings.slice(0, 8)) console.log(chalk.dim(`    \u2022 ${w}`));
+    return { ok: true, registered };
+  } catch (e) {
+    const error = e.message;
+    spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
+    return { ok: false, registered: [], error };
+  }
+}
+
+export {
+  waitForApiHealth,
+  waitForEdgeRunning,
+  importMigratedSites
+};

package/dist/{chunk-TWJCLD4W.js → chunk-6JELW75A.js}

@@ -2,16 +2,16 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  LocalExecutor
-} from "./chunk-6FH4AXVY.js";
 import {
   explainEdgeDown,
   isEdgeDownFailure
 } from "./chunk-I3DPMTSF.js";
+import {
+  LocalExecutor
+} from "./chunk-6FH4AXVY.js";
 import {
   edgeFailureReason
-} from "./chunk-VZ2ZHPS2.js";
+} from "./chunk-WE7BXW6L.js";
 import {
   logEntry,
   sq