openship 0.6.1 → 0.6.6

package/dist/{chunk-IOT5ZX23.js → chunk-A4GXYE4L.js}

@@ -2,14 +2,6 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  resolveEnvironment
-} from "./chunk-IW2UKBVF.js";
-import {
-  formatDuration,
-  isRemoteConnectionError,
-  systemDebug
-} from "./chunk-ZCFVHA25.js";
 import {
   containerCommand,
   edgeContainerExecutor,
@@ -17,7 +9,28 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-EW6KB2J7.js";
+} from "./chunk-QVW76WDL.js";
+import {
+  EDGE_CHALLENGE_HOST_DIR,
+  EDGE_CONTAINER_MOUNTS,
+  EDGE_HOST_PATHS,
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-RSR7PFIQ.js";
+import {
+  privilegedExecutor,
+  rootChecked,
+  rootOrDegrade
+} from "./chunk-4I2BM2DT.js";
+import {
+  envOps,
+  opScript
+} from "./chunk-YMMQRE5J.js";
+import {
+  resolveEnvironment
+} from "./chunk-UVNMQM7W.js";
+import {
+  sq
+} from "./chunk-ZFJXPCQP.js";
 import {
   EDGE_CONTAINER_NAME,
   EdgeConflictError,
@@ -32,28 +45,25 @@ import {
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-VZ2ZHPS2.js";
+} from "./chunk-2YM3NI2E.js";
 import {
-  waitForPortListening
-} from "./chunk-3LDWWY7U.js";
-import {
-  EDGE_CHALLENGE_HOST_DIR,
-  EDGE_CONTAINER_MOUNTS,
-  EDGE_HOST_PATHS,
-  OPENRESTY_DEFAULT_PATHS
-} from "./chunk-YIPMDGG6.js";
-import {
-  sq
-} from "./chunk-ZFJXPCQP.js";
+  probeExec,
+  tryExec,
+  waitForPortListening,
+  withReason
+} from "./chunk-SM26HDS2.js";
 import {
   AppError,
   PROXY_DIRECTIVES,
+  answered,
   buildEdgeImageRef,
   compareSemver,
+  formatDuration,
   parseProxyValue,
   safeErrorMessage,
-  sanitizeProxySettings
-} from "./chunk-OTLSJYAC.js";
+  sanitizeProxySettings,
+  systemDebug
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/system/managed-image.ts
 import { posix } from "path";
@@ -120,14 +130,7 @@ var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
 function log2(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
-async function tryExec(executor, cmd) {
-  try {
-    return await executor.exec(cmd);
-  } catch {
-    return null;
-  }
-}
-async function buildJournal(executor, status) {
+async function buildJournal(executor, status, onLog) {
   const units = /* @__PURE__ */ new Map();
   const containers = /* @__PURE__ */ new Map();
   const processes = /* @__PURE__ */ new Map();
@@ -137,7 +140,17 @@ async function buildJournal(executor, status) {
         executor,
         `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
       );
-      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
+      if (r === null) {
+        onLog?.(
+          log2(
+            `Could not read ${o.containerName}'s restart policy. If this takeover is rolled back it will be started again, but its policy left untouched \u2014 check it with \`docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${o.containerName}\`.`,
+            "warn"
+          )
+        );
+        containers.set(o.containerName, { name: o.containerName });
+      } else {
+        containers.set(o.containerName, { name: o.containerName, restart: r.trim() || "no" });
+      }
     } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
       const en = await tryExec(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
       units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
@@ -152,19 +165,44 @@ async function buildJournal(executor, status) {
     processes: [...processes.values()]
   };
 }
+function journalFileExecutor(executor) {
+  return rootOrDegrade(executor, {
+    purpose: "Writing the edge-takeover rollback journal",
+    consequence: "An interrupted takeover won't be repaired automatically on the next boot.",
+    report: () => {
+    }
+  });
+}
 async function writeJournal(executor, journal) {
   try {
-    await executor.mkdir(JOURNAL_DIR);
-    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
+    const privileged = await journalFileExecutor(executor);
+    await privileged.mkdir(JOURNAL_DIR);
+    await privileged.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
   } catch {
   }
 }
 async function clearJournal(executor) {
-  await tryExec(executor, `rm -f ${JOURNAL_PATH}`);
-}
-async function readJournal(executor) {
-  const raw = await tryExec(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
-  if (!raw?.trim()) return null;
+  await tryExec(await journalFileExecutor(executor), `rm -f ${JOURNAL_PATH}`);
+}
+async function readJournal(executor, onLog) {
+  const privileged = await journalFileExecutor(executor);
+  const raw = await tryExec(privileged, `cat ${JOURNAL_PATH} 2>/dev/null`);
+  if (raw === null) {
+    const listed = await tryExec(privileged, `ls ${JOURNAL_PATH} 2>/dev/null`);
+    if (listed?.trim()) {
+      onLog?.(
+        log2(
+          `An unfinished edge takeover is recorded at ${JOURNAL_PATH}, but Openship could not read it as this user \u2014 the previous proxy will NOT be restored automatically. Re-run as root, or restore it by hand.`,
+          "error"
+        )
+      );
+    }
+    return null;
+  }
+  if (!raw.trim()) {
+    await clearJournal(executor);
+    return null;
+  }
   try {
     return JSON.parse(raw);
   } catch {
@@ -174,26 +212,43 @@ async function readJournal(executor) {
 }
 async function rollback(executor, journal, onLog) {
   onLog(log2("Rolling back \u2014 restoring the previous proxy...", "warn"));
-  await tryExec(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
-  await tryExec(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  const restore = await rootOrDegrade(executor, {
+    purpose: "Restarting the proxy that was holding ports 80/443",
+    consequence: "Restarting and re-enabling it will likely be refused \u2014 so if :80 is served after this, it is because nothing was ever stopped, not because Openship put it back.",
+    report: (message) => onLog(log2(message, "warn"))
+  });
+  await tryExec(restore, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec(restore, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
   await tryExec(
-    executor,
+    restore,
     "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
   );
   for (const u of journal.units) {
     await tryExec(
-      executor,
+      restore,
       u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
     );
   }
   for (const c of journal.containers) {
-    await tryExec(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
-    await tryExec(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
+    if (c.restart) {
+      await tryExec(
+        restore,
+        `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`
+      );
+    } else {
+      onLog(
+        log2(
+          `Starting ${c.name} without setting a restart policy \u2014 Openship never managed to read the one it had. Confirm it still comes back on reboot.`,
+          "warn"
+        )
+      );
+    }
+    await tryExec(restore, `docker start ${sq2(c.name)} 2>/dev/null || true`);
   }
   for (const p of journal.processes ?? []) {
     if (p.command) {
       await tryExec(
-        executor,
+        restore,
         `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
       );
     } else {
@@ -219,16 +274,29 @@ async function portIsServed(executor, port) {
   );
   return (out ?? "").includes("yes");
 }
+var EDGE_STOP_ELEVATION = {
+  purpose: "Stopping the proxy that holds ports 80/443",
+  consequence: "Stopping and disabling it will likely be refused, leaving the ports bound."
+};
 async function beginEdgeTakeover(executor, status, onLog, targets) {
-  await writeJournal(executor, await buildJournal(executor, status));
-  return freeEdgeTargets(
-    executor,
+  await writeJournal(executor, await buildJournal(executor, status, onLog));
+  let privilegeDegraded = false;
+  const stopExecutor = await rootOrDegrade(executor, {
+    ...EDGE_STOP_ELEVATION,
+    report: (message) => {
+      privilegeDegraded = true;
+      onLog(log2(message, "warn"));
+    }
+  });
+  const freed = await freeEdgeTargets(
+    stopExecutor,
     targets?.length ? targets : stopTargetsForStatus(status),
     (m, l) => onLog(log2(m, l))
   );
+  return { ...freed, privilegeDegraded };
 }
 async function rollbackEdgeTakeover(executor, onLog) {
-  const journal = await readJournal(executor);
+  const journal = await readJournal(executor, onLog);
   if (!journal || journal.completed) return false;
   const restored = await rollback(executor, journal, onLog);
   await clearJournal(executor);
@@ -243,7 +311,7 @@ async function completeEdgeTakeover(executor) {
   await clearJournal(executor);
 }
 async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
-  const journal = await readJournal(executor);
+  const journal = await readJournal(executor, onLog);
   if (!journal) return;
   if (journal.completed) {
     await clearJournal(executor);
@@ -260,13 +328,6 @@ async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
 }
 
 // ../../packages/adapters/src/system/proxy/import/parse-utils.ts
-async function tryExec2(executor, command) {
-  try {
-    return await executor.exec(command);
-  } catch {
-    return null;
-  }
-}
 function stripComments(text) {
   return text.split("\n").map((line) => {
     let quote;
@@ -330,15 +391,23 @@ function sq3(value) {
 // ../../packages/adapters/src/system/proxy/import/nginx.ts
 async function dumpResolvedConfig(executor, bins) {
   for (const bin of bins) {
-    const dumped = await tryExec2(executor, `${bin} -T 2>/dev/null`);
+    const dumped = await tryExec(executor, `${bin} -T 2>/dev/null`);
     if (dumped && /server\s*\{/.test(dumped)) return dumped;
   }
   return null;
 }
+async function nginxPrefix(executor, bins) {
+  for (const bin of bins) {
+    const out = await tryExec(executor, `${bin} -V 2>&1`);
+    const prefix = out?.match(/--prefix=(\S+)/)?.[1];
+    if (prefix) return prefix;
+  }
+  return null;
+}
 async function loadNginxConfig(executor) {
   const dumped = await dumpResolvedConfig(executor, ["nginx", "openresty"]);
   if (dumped) return dumped;
-  const cat = await tryExec2(
+  const cat = await tryExec(
     executor,
     "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
   );
@@ -450,9 +519,24 @@ function parseProxyDirectives(body) {
     ...Object.keys(raw).length > 0 ? { raw } : {}
   };
 }
-function parseServer(body, source, upstreams) {
+var LOOPBACK_SERVER_NAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "localhost.localdomain",
+  "ip6-localhost",
+  "ip6-loopback"
+]);
+function resolveStaticRoot(root, prefix) {
+  if (root.startsWith("/")) return { root };
+  if (!prefix) {
+    return {
+      reason: `static root "${root}" is relative to nginx's compiled prefix, which this host didn't report`
+    };
+  }
+  return { root: `${prefix.replace(/\/+$/, "")}/${root}` };
+}
+function parseServer(body, source, upstreams, prefix) {
   const warnings = [];
-  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~")) ?? [];
+  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~") && !LOOPBACK_SERVER_NAMES.has(n.toLowerCase())) ?? [];
   const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map((m) => m[1]);
   const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
   const root = firstDirective(body, "root");
@@ -479,7 +563,12 @@ function parseServer(body, source, upstreams) {
   } else if (isHttpsUpgradeForSelf(body, names)) {
     return { warnings: [] };
   } else if (root && !isAcmeWebrootOnly(body)) {
-    target = { kind: "static", root: root.replace(/;$/, "") };
+    const resolved2 = resolveStaticRoot(root.replace(/;$/, ""), prefix);
+    if ("reason" in resolved2) {
+      warnings.push(`nginx: ${names[0]} \u2014 ${resolved2.reason} (skipped)`);
+      return { warnings };
+    }
+    target = { kind: "static", root: resolved2.root };
   } else if (root) {
     return { warnings: [] };
   } else {
@@ -494,7 +583,7 @@ function parseServer(body, source, upstreams) {
   if (tunables.raw) site.proxyRaw = tunables.raw;
   return { site, warnings };
 }
-function parseNginxConfig(raw) {
+function parseNginxConfig(raw, prefix) {
   const warnings = [];
   const sites = [];
   if (!raw.trim()) {
@@ -507,7 +596,7 @@ function parseNginxConfig(raw) {
     warnings.push("nginx: no server blocks found");
   }
   for (const body of blocks) {
-    const { site, warnings: blockWarnings } = parseServer(body, "nginx", upstreams);
+    const { site, warnings: blockWarnings } = parseServer(body, "nginx", upstreams, prefix);
     warnings.push(...blockWarnings);
     if (site) sites.push(site);
   }
@@ -519,7 +608,10 @@ function parseNginxConfig(raw) {
   return { proxy: "nginx", sites: kept, warnings };
 }
 async function scanNginx(executor) {
-  return parseNginxConfig(await loadNginxConfig(executor));
+  const raw = await loadNginxConfig(executor);
+  const relativeRoot = /(?:^|[;{\s])root\s+[^/;\s]/.test(raw);
+  const prefix = relativeRoot ? await nginxPrefix(executor, ["nginx", "openresty"]) : null;
+  return parseNginxConfig(raw, prefix ?? void 0);
 }
 var OUR_EDGE_SITE_GLOBS = [
   `${EDGE_HOST_PATHS.sitesDir}/*.conf`,
@@ -533,11 +625,11 @@ async function scanForeignOpenResty(executor) {
 }
 async function scanOpenshipEdge(executor) {
   const cat = `cat ${OUR_EDGE_SITE_GLOBS.join(" ")} 2>/dev/null`;
-  const raw = await tryExec2(executor, cat);
+  const raw = await tryExec(executor, cat);
   if (raw?.trim()) return parseNginxConfig(raw);
   const container = await resolveOurEdgeContainer(executor);
   if (!container) return parseNginxConfig("");
-  const fromContainer = await tryExec2(executor, containerCommand(container, cat));
+  const fromContainer = await tryExec(executor, containerCommand(container, cat));
   return parseNginxConfig(fromContainer ?? "");
 }
 
@@ -545,12 +637,12 @@ async function scanOpenshipEdge(executor) {
 var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
 async function loadCaddyAdminConfig(executor) {
   const endpoint = "http://localhost:2019/config/";
-  const out = await tryExec2(executor, `curl -fsS ${endpoint} 2>/dev/null`) || await tryExec2(executor, `wget -qO- ${endpoint} 2>/dev/null`);
+  const out = await tryExec(executor, `curl -fsS ${endpoint} 2>/dev/null`) || await tryExec(executor, `wget -qO- ${endpoint} 2>/dev/null`);
   return out && out.trim().startsWith("{") ? out : null;
 }
 async function loadCaddyJson(executor) {
   for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec2(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
+    const out = await tryExec(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
     if (out && out.trim().startsWith("{")) return out;
   }
   return null;
@@ -665,7 +757,7 @@ function parseCaddyJson(raw) {
 }
 async function loadCaddyfile(executor) {
   for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec2(executor, `cat ${p} 2>/dev/null`);
+    const out = await tryExec(executor, `cat ${p} 2>/dev/null`);
     if (out && out.trim()) return out;
   }
   return "";
@@ -800,7 +892,7 @@ async function scanCaddyText(executor) {
 
 // ../../packages/adapters/src/system/proxy/import/apache.ts
 async function vhostFilesFromDump(executor) {
-  const dump = await tryExec2(
+  const dump = await tryExec(
     executor,
     "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
   );
@@ -815,10 +907,10 @@ async function vhostFilesFromDump(executor) {
 async function loadApacheConfig(executor) {
   const files = await vhostFilesFromDump(executor);
   if (files.length > 0) {
-    const cat2 = await tryExec2(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
+    const cat2 = await tryExec(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
     if (cat2 && cat2.trim()) return cat2;
   }
-  const cat = await tryExec2(
+  const cat = await tryExec(
     executor,
     "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
   );
@@ -1145,7 +1237,7 @@ function parseTraefikLabels(containers) {
   };
 }
 async function scanTraefik(executor) {
-  const out = await tryExec2(
+  const out = await tryExec(
     executor,
     `docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range $n, $v := .NetworkSettings.Networks}}{{$n}}={{$v.IPAddress}} {{end}}	{{range $p, $v := .Config.ExposedPorts}}{{$p}} {{end}}	{{if .Config.Cmd}}{{join .Config.Cmd " "}}{{end}}' 2>/dev/null`
   );
@@ -1277,10 +1369,10 @@ function candidateNames(host) {
 async function findPairIn(exec, root, host, container) {
   for (const name of candidateNames(host)) {
     const glob = `${root}/certificates/*/${name}/${name}.crt`;
-    let certPath = firstCrt(await tryExec2(exec, `ls -1 ${glob} 2>/dev/null`));
+    let certPath = firstCrt(await tryExec(exec, `ls -1 ${glob} 2>/dev/null`));
     if (!certPath && container) {
       certPath = firstCrt(
-        await tryExec2(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
+        await tryExec(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
       );
     }
     if (certPath) return { certPath, keyPath: certPath.replace(/\.crt$/, ".key") };
@@ -1326,7 +1418,7 @@ async function candidateStoragePaths(exec, container) {
   };
   if (container) {
     collect(
-      await tryExec2(
+      await tryExec(
         exec,
         `docker inspect ${sq2(container)} --format '{{json .Config.Cmd}} {{json .Args}} {{json .Config.Env}}' 2>/dev/null`
       )
@@ -1558,61 +1650,21 @@ function makeApi(exec, kind, ours, container) {
 }
 
 // ../../packages/adapters/src/system/catalog.ts
+var MIN_DOCKER_VERSION = "20.10";
 function dockerInstallPlan(profile) {
-  if (profile.os !== "linux") {
-    return {
-      supported: false,
-      unsupportedReason: "Docker installation is only supported on Linux servers"
-    };
-  }
-  return {
-    supported: true,
-    installCommand: "curl -fsSL https://get.docker.com | sh",
-    startCommand: profile.serviceManager === "systemd" ? "systemctl enable docker && systemctl start docker" : void 0,
+  const ops = envOps(profile);
+  const install = ops.dockerInstall();
+  if (!install.supported) return install;
+  const start = ops.dockerStart();
+  return answered({
+    installCommand: opScript(install.value),
+    service: start.supported ? answered(opScript(start.value)) : start,
     verifyCommand: "docker --version"
-  };
-}
-function gitInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq git",
-    dnf: "dnf install -y git",
-    yum: "yum install -y git",
-    apk: "apk add --no-cache git",
-    brew: "brew install git"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Git installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "git --version"
-  };
+  });
 }
-function rsyncInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq rsync",
-    dnf: "dnf install -y rsync",
-    yum: "yum install -y rsync",
-    apk: "apk add --no-cache rsync",
-    brew: "brew install rsync"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for rsync installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "rsync --version | head -n 1"
-  };
+function packagePlan(profile, pkg, verifyCommand) {
+  const install = envOps(profile).pkgInstall([pkg]);
+  return install.supported ? answered({ installCommand: opScript(install.value), verifyCommand }) : install;
 }
 var systemCatalog = {
   checks: {
@@ -1626,7 +1678,11 @@ var systemCatalog = {
       daemonCommand: "docker info --format '{{.ServerVersion}}'",
       parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
       missingMessage: "Docker is not installed",
-      notRunningMessage: "Docker is installed but the daemon is not running"
+      notRunningMessage: "Docker is installed but the daemon is not running",
+      // Deliberately does NOT claim the daemon is up or down: the socket's permission
+      // is checked before the daemon is asked, so this arm proves only that we may not
+      // ask. What it can state is the fix, which is the part "not running" got wrong.
+      deniedMessage: "Docker is installed but this connection is not allowed to use its socket \u2014 add the login user to the `docker` group, or connect as root"
     },
     openresty: {
       versionCommand: "openresty -v 2>&1 || /usr/local/openresty/bin/openresty -v 2>&1",
@@ -1660,185 +1716,9 @@ var systemCatalog = {
   // CONTAINER. See installer.ts `installContainerEdge`.
   installs: {
     docker: dockerInstallPlan,
-    git: gitInstallPlan,
-    rsync: rsyncInstallPlan
-  }
-};
-
-// ../../packages/adapters/src/system/elevated-executor.ts
-var INSTALL_ENV = "DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew";
-function elevateCommand(command) {
-  return `sudo -n sh -c ${sq(`export ${INSTALL_ENV}; ${command}`)}`;
-}
-function dirOf(path) {
-  const idx = path.lastIndexOf("/");
-  if (idx < 0) return ".";
-  return idx === 0 ? "/" : path.slice(0, idx);
-}
-function elevatedExecutor(inner) {
-  const writeFileElevated = async (path, content) => {
-    const tmp = `/tmp/.openship-elev-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
-    await inner.writeFile(tmp, content);
-    await inner.exec(
-      elevateCommand(`mkdir -p ${sq(dirOf(path))} && mv -f ${sq(tmp)} ${sq(path)}`)
-    );
-  };
-  const overrides = {
-    exec: (command, opts) => inner.exec(elevateCommand(command), opts),
-    streamExec: (command, onLog, opts) => inner.streamExec(elevateCommand(command), onLog, opts),
-    writeFile: writeFileElevated,
-    // Elevated for the same reason as writeFile: the vhost/conf dirs are root-owned,
-    // and the Proxy would otherwise forward this to the inner executor unelevated —
-    // EACCES immediately after an elevated write succeeded.
-    rename: async (from, to) => {
-      await inner.exec(elevateCommand(`mv -f ${sq(from)} ${sq(to)}`));
-    },
-    mkdir: async (path) => {
-      await inner.exec(elevateCommand(`mkdir -p ${sq(path)}`));
-    },
-    rm: async (path) => {
-      await inner.exec(elevateCommand(`rm -rf ${sq(path)}`));
-    }
-  };
-  return new Proxy(inner, {
-    get(target, prop2) {
-      if (Object.prototype.hasOwnProperty.call(overrides, prop2)) {
-        return overrides[prop2];
-      }
-      const value = Reflect.get(target, prop2, target);
-      return typeof value === "function" ? value.bind(target) : value;
-    }
-  });
-}
-
-// ../../packages/adapters/src/system/installer.ts
-function log3(message, level = "info") {
-  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
-}
-async function prepareExecutor(executor, component) {
-  const profile = await resolveEnvironment(executor);
-  if (profile.isRoot) return { ok: true, executor, profile };
-  if (profile.canSudo) return { ok: true, executor: elevatedExecutor(executor), profile };
-  return {
-    ok: false,
-    result: {
-      component,
-      success: false,
-      error: `Installing ${component} needs root. Connect this server as root, or as a user with passwordless sudo.`
-    }
-  };
-}
-async function installDocker(executor, onLog) {
-  const prep = await prepareExecutor(executor, "docker");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.docker(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "docker", success: false, error: plan.unsupportedReason ?? "Docker install not supported" };
-  }
-  onLog(log3("Installing Docker Engine..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "docker", success: false, error: "Docker install failed" };
-    if (plan.startCommand) {
-      onLog(log3("Starting Docker service..."));
-      await executor.streamExec(plan.startCommand, onLog);
-    }
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.docker.parseVersion(version);
-    onLog(log3(`Docker ${parsed} installed`));
-    return { component: "docker", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`Docker installation failed: ${msg}`, "error"));
-    return { component: "docker", success: false, error: msg };
-  }
-}
-async function installGit(executor, onLog, opts) {
-  const prep = await prepareExecutor(executor, "git");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.git(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "git", success: false, error: plan.unsupportedReason ?? "Git install not supported" };
-  }
-  onLog(log3(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "git", success: false, error: "Git installation failed" };
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.git.parseVersion(version);
-    onLog(log3(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
-    return { component: "git", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`Git installation failed: ${msg}`, "error"));
-    return { component: "git", success: false, error: msg };
-  }
-}
-async function installRsync(executor, onLog) {
-  const prep = await prepareExecutor(executor, "rsync");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.rsync(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "rsync", success: false, error: plan.unsupportedReason ?? "rsync install not supported" };
-  }
-  onLog(log3("Installing rsync..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "rsync", success: false, error: "rsync installation failed" };
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.rsync.parseVersion(version);
-    onLog(log3(`rsync ${parsed} installed`));
-    return { component: "rsync", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`rsync installation failed: ${msg}`, "error"));
-    return { component: "rsync", success: false, error: msg };
-  }
-}
-async function installContainerEdge(executor, onLog, config) {
-  const prep = await prepareExecutor(executor, "edge");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  if (!await dockerAvailable(executor)) {
-    const error = "The edge is a container image and needs Docker on this server. Install the Docker component first, then install the edge.";
-    onLog(log3(error, "error"));
-    return { component: "edge", success: false, error };
+    git: (profile) => packagePlan(profile, "git", "git --version"),
+    rsync: (profile) => packagePlan(profile, "rsync", "rsync --version | head -n 1")
   }
-  try {
-    const result = await ensureContainerEdge(executor, {
-      onLog,
-      config,
-      image: config?.edgeImage
-    });
-    if (result.converted) {
-      onLog(log3("Edge moved from host OpenResty to the container edge", "warn"));
-    }
-    const version = await executor.exec(containerCommand(result.container, "openresty -v 2>&1")).catch(() => "");
-    return {
-      component: "edge",
-      success: true,
-      version: version ? systemCatalog.checks.openresty.parseVersion(version) : void 0
-    };
-  } catch (err) {
-    if (err instanceof EdgeMigrateRequested) throw err;
-    const msg = safeErrorMessage(err);
-    onLog(log3(`Edge setup failed: ${msg}`, "error"));
-    return { component: "edge", success: false, error: msg };
-  }
-}
-var COMPONENT_INSTALLERS = {
-  docker: (exec, log6) => installDocker(exec, log6),
-  // The edge is ONE component and it is a container image — there is no
-  // host-OpenResty or host-certbot installer to reach for any more.
-  edge: (exec, log6, config) => installContainerEdge(exec, log6, config),
-  git: (exec, log6) => installGit(exec, log6),
-  rsync: (exec, log6) => installRsync(exec, log6)
 };
 
 // ../../packages/adapters/src/system/available-version.ts
@@ -1858,32 +1738,30 @@ function normalizePkgVersion(raw) {
   if (dash !== -1) v = v.slice(0, dash);
   return v.trim();
 }
-async function tryExec3(executor, cmd) {
-  try {
-    return await executor.exec(cmd);
-  } catch {
-    return null;
-  }
-}
-async function probeCandidate(executor, pm, pkg) {
-  const q = `'${pkg.replace(/'/g, "'\\''")}'`;
-  if (pm === "apt") {
-    const out = await tryExec3(executor, `apt-cache policy ${q} 2>/dev/null`);
-    return out?.match(/Candidate:\s*(\S+)/)?.[1]?.trim() ?? null;
-  }
-  if (pm === "dnf" || pm === "yum") {
-    const out = await tryExec3(
-      executor,
-      `${pm} -q --cacheonly list available ${q} 2>/dev/null | tail -n1`
-    );
-    return out?.trim().split(/\s+/)[1]?.trim() ?? null;
-  }
-  if (pm === "apk") {
-    const out = await tryExec3(executor, `apk policy ${q} 2>/dev/null`);
-    const versions = [...out?.matchAll(/^\s+([\w.+~-]+):\s*$/gm) ?? []].map((m) => m[1]);
+var READ_CANDIDATE = {
+  // `apt-cache policy` prints "  Candidate: <version>".
+  apt: (out) => out.match(/Candidate:\s*(\S+)/)?.[1]?.trim() ?? null,
+  // Cached list; the last "pkg.arch  version  repo" row carries the newest avail.
+  dnf: (out) => out.trim().split(/\s+/)[1]?.trim() ?? null,
+  yum: (out) => out.trim().split(/\s+/)[1]?.trim() ?? null,
+  // `apk policy` prints one `  <version>:` line per available version (colon at end
+  // of line), each followed by indented source lines (installed marker, repo URLs);
+  // the last version line is newest.
+  apk: (out) => {
+    const versions = [...out.matchAll(/^\s+([\w.+~-]+):\s*$/gm)].map((m) => m[1]);
     return versions.length ? versions[versions.length - 1] : null;
-  }
-  return null;
+  },
+  // Both refuse the probe itself, so there is no output to read. Stated rather than
+  // omitted — `null` here is paired with a refusal, not with a missing branch.
+  brew: null,
+  none: null
+};
+async function probeCandidate(executor, profile, pkg) {
+  const read = READ_CANDIDATE[profile.packageManager];
+  const probe = envOps(profile).pkgAvailableVersion(pkg);
+  if (!read || !probe.supported) return null;
+  const out = await tryExec(executor, opScript(probe.value));
+  return out ? read(out) : null;
 }
 async function enrichAvailableVersions(executor, profile, statuses) {
   const targets = statuses.filter(
@@ -1893,7 +1771,7 @@ async function enrichAvailableVersions(executor, profile, statuses) {
     targets.map(async (s) => {
       try {
         const pkg = PACKAGE_NAMES[s.name];
-        const candidate = await probeCandidate(executor, profile.packageManager, pkg);
+        const candidate = await probeCandidate(executor, profile, pkg);
         if (!candidate) return;
         const avail = normalizePkgVersion(candidate);
         const installed = normalizePkgVersion(s.version);
@@ -1957,37 +1835,8 @@ function getSystemComponentDefinition(name) {
 }
 
 // ../../packages/adapters/src/system/checks.ts
-async function tryExec4(executor, command) {
-  const startedAt = Date.now();
-  systemDebug("checks", `exec:start ${command}`);
-  try {
-    const result = await executor.exec(command, { timeout: 1e4 });
-    systemDebug(
-      "checks",
-      `exec:ok ${command} (${formatDuration(startedAt)})`
-    );
-    return { output: result.trim(), error: null };
-  } catch (err) {
-    if (isRemoteConnectionError(err)) {
-      systemDebug(
-        "checks",
-        `exec:abort ${command} (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
-      );
-      throw err;
-    }
-    const msg = safeErrorMessage(err);
-    systemDebug(
-      "checks",
-      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
-    );
-    return { output: "", error: msg || `\`${command}\` failed` };
-  }
-}
-function withReason(message, error) {
-  if (!error) return message;
-  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
-  if (!first) return message;
-  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+function isSocketDenied(error) {
+  return error != null && /permission denied|eacces/i.test(error);
 }
 function healthy(name, version, running) {
   const component = getSystemComponentDefinition(name);
@@ -2020,22 +1869,31 @@ function unhealthy(name, message, opts) {
 async function checkDocker(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.docker;
-  const version = await tryExec4(executor, recipe.versionCommand);
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
   if (!version.output) {
     systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
     return unhealthy("docker", withReason(recipe.missingMessage, version.error));
   }
   const parsed = recipe.parseVersion(version.output);
-  const info = await tryExec4(executor, recipe.daemonCommand);
+  const info = await probeExec(executor, recipe.daemonCommand, "checks");
   if (!info.output) {
+    const denied = isSocketDenied(info.error);
     systemDebug(
       "checks",
-      `docker:not-running (${formatDuration(startedAt)}) ${info.error ?? "probe exited 0 with no server version"}`
+      `docker:${denied ? "denied" : "not-running"} (${formatDuration(startedAt)}) ${info.error ?? "probe exited 0 with no server version"}`
+    );
+    return unhealthy(
+      "docker",
+      withReason(denied && recipe.deniedMessage || recipe.notRunningMessage, info.error),
+      {
+        version: parsed,
+        // Left UNSET when denied: `running: false` would be a fact we don't have. The
+        // permission check happens before the daemon is consulted, so a refusal is
+        // equally consistent with a healthy daemon, and asserting it is stopped is the
+        // same class of guess the message above stopped making.
+        ...denied ? {} : { running: false }
+      }
     );
-    return unhealthy("docker", withReason(recipe.notRunningMessage, info.error), {
-      version: parsed,
-      running: false
-    });
   }
   systemDebug("checks", `docker:healthy (${formatDuration(startedAt)})`);
   return healthy("docker", parsed, true);
@@ -2043,7 +1901,7 @@ async function checkDocker(executor) {
 async function checkGit(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.git;
-  const version = await tryExec4(executor, recipe.versionCommand);
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
   if (!version.output) {
     systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
     return unhealthy("git", withReason(recipe.missingMessage, version.error));
@@ -2055,7 +1913,7 @@ async function checkGit(executor) {
 async function checkRsync(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.rsync;
-  const version = await tryExec4(executor, recipe.versionCommand);
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
   if (!version.output) {
     systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
     return unhealthy("rsync", withReason(recipe.missingMessage, version.error));
@@ -2083,7 +1941,7 @@ async function checkEdge(executor) {
       { running: false }
     );
   }
-  const version = await tryExec4(executor, containerCommand(container, "openresty -v 2>&1"));
+  const version = await probeExec(executor, containerCommand(container, "openresty -v 2>&1"), "checks");
   if (!version.output) {
     systemDebug("checks", `edge:container-unresponsive (${formatDuration(startedAt)})`);
     return unhealthy(
@@ -2159,6 +2017,182 @@ async function checkComponents(executor, names) {
   return results;
 }
 
+// ../../packages/adapters/src/system/installer.ts
+function log3(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function prepareExecutor(executor, component) {
+  const grant = await privilegedExecutor(executor, `Installing ${component}`);
+  if (!grant.supported) {
+    return { ok: false, result: { component, success: false, error: grant.reason } };
+  }
+  return { ok: true, executor: grant.value.executor, profile: grant.value.profile };
+}
+function describeInstallFailure(label, code, output) {
+  const lines = output.split("\n").map((line) => line.replace(/\r/g, "").trim()).filter(Boolean);
+  const flagged = lines.filter((line) => /^(e:|err:|error:|dpkg:|fatal:)/i.test(line));
+  const picked = (flagged.length ? flagged : lines).slice(-3).join(" \xB7 ");
+  const detail = picked.length > 400 ? `${picked.slice(0, 399)}\u2026` : picked;
+  const held = /held packages?|--allow-change-held-packages/i.test(output) ? " Packages are held on this host (`apt-mark hold`) and Openship does not override a hold \u2014 unhold them first if you do want this install." : "";
+  return `${label} install failed (exit ${code})${detail ? `: ${detail}` : ""}.${held}`;
+}
+async function probeDocker(executor) {
+  const status = await checkDocker(executor);
+  const version = status.version;
+  if (!status.installed) return { verdict: "missing", message: status.message };
+  if (!status.healthy) return { verdict: "stopped", version, message: status.message };
+  if (version && compareSemver(version, MIN_DOCKER_VERSION) < 0) {
+    return { verdict: "outdated", version, message: status.message };
+  }
+  return { verdict: "ok", version, message: status.message };
+}
+function dockerAlreadyThere(present, onLog) {
+  const named = present.version ? `Docker ${present.version}` : "Docker";
+  onLog(log3(`${named} is installed and its daemon is answering \u2014 nothing to install`));
+  return { component: "docker", success: true, version: present.version };
+}
+async function installDocker(executor, onLog, config) {
+  const forced = config?.reinstall === true;
+  let present = forced ? null : await probeDocker(executor);
+  if (present?.verdict === "ok") return dockerAlreadyThere(present, onLog);
+  const prep = await prepareExecutor(executor, "docker");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  if (present && present.verdict !== "missing" && !profile.isRoot) {
+    present = await probeDocker(executor);
+    if (present.verdict === "ok") return dockerAlreadyThere(present, onLog);
+  }
+  const plan = systemCatalog.installs.docker(profile);
+  const service = plan.supported ? plan.value.service : plan;
+  if (present?.verdict === "stopped" && service?.supported) {
+    onLog(log3(`${present.message} \u2014 starting the Docker service`, "warn"));
+    await executor.streamExec(service.value, onLog).catch(() => void 0);
+    present = await probeDocker(executor);
+    if (present.verdict === "ok") {
+      onLog(log3(`Docker ${present.version} is running`));
+      return { component: "docker", success: true, version: present.version };
+    }
+  }
+  if (present && present.verdict !== "missing") {
+    const cannotStart = present.verdict === "stopped" && service && !service.supported ? ` Openship could not start it for you: ${service.reason}` : "";
+    const error = (present.verdict === "outdated" ? `Docker ${present.version} is installed but Openship needs ${MIN_DOCKER_VERSION} or newer. Upgrading Docker restarts the daemon and every container on this server, so it is never done as part of another step \u2014 upgrade it on the host, or use Reinstall on the Docker component to run the official installer.` : `${present.message}. Start Docker on this server and retry. Openship will not reinstall Docker over a daemon that is merely unreachable: the installer would also upgrade the engine and restart every container on this host. Use Reinstall on the Docker component if that is what you want.`) + cannotStart;
+    onLog(log3(error, "error"));
+    return { component: "docker", success: false, version: present.version, error };
+  }
+  if (!plan.supported) {
+    onLog(log3(plan.reason, "error"));
+    return { component: "docker", success: false, error: plan.reason };
+  }
+  onLog(
+    forced ? log3(
+      "Running the Docker installer \u2014 it may upgrade the engine, which restarts the daemon and every container on this host...",
+      "warn"
+    ) : log3("Installing Docker Engine...")
+  );
+  try {
+    const { code, output } = await executor.streamExec(
+      plan.value.installCommand,
+      onLog
+    );
+    if (code !== 0) {
+      const error = describeInstallFailure("Docker", code, output);
+      onLog(log3(error, "error"));
+      return { component: "docker", success: false, error };
+    }
+    if (service?.supported) {
+      onLog(log3("Starting Docker service..."));
+      await executor.streamExec(service.value, onLog);
+    } else if (service) {
+      onLog(log3(`Docker is installed but Openship cannot start it here: ${service.reason}`, "warn"));
+    }
+    const version = await executor.exec(plan.value.verifyCommand);
+    const parsed = systemCatalog.checks.docker.parseVersion(version);
+    onLog(log3(`Docker ${parsed} installed`));
+    return { component: "docker", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Docker installation failed: ${msg}`, "error"));
+    return { component: "docker", success: false, error: msg };
+  }
+}
+async function installPackaged(executor, onLog, component, label, where) {
+  const prep = await prepareExecutor(executor, component);
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const plan = systemCatalog.installs[component](prep.profile);
+  if (!plan.supported) {
+    onLog(log3(plan.reason, "error"));
+    return { component, success: false, error: plan.reason };
+  }
+  const inside = where ? ` in ${where}` : "";
+  onLog(log3(`Installing ${label}${inside}...`));
+  try {
+    const { code, output } = await executor.streamExec(
+      plan.value.installCommand,
+      onLog
+    );
+    if (code !== 0) {
+      const error = describeInstallFailure(label, code, output);
+      onLog(log3(error, "error"));
+      return { component, success: false, error };
+    }
+    const version = await executor.exec(plan.value.verifyCommand);
+    const parsed = systemCatalog.checks[component].parseVersion(version);
+    onLog(log3(`${label} ${parsed} installed${inside}`));
+    return { component, success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`${label} installation failed: ${msg}`, "error"));
+    return { component, success: false, error: msg };
+  }
+}
+function installGit(executor, onLog, opts) {
+  return installPackaged(executor, onLog, "git", "Git", opts?.label);
+}
+function installRsync(executor, onLog) {
+  return installPackaged(executor, onLog, "rsync", "rsync");
+}
+async function installContainerEdge(executor, onLog, config) {
+  const prep = await prepareExecutor(executor, "edge");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  if (!await dockerAvailable(executor)) {
+    const error = "The edge is a container image and needs Docker on this server. Install the Docker component first, then install the edge.";
+    onLog(log3(error, "error"));
+    return { component: "edge", success: false, error };
+  }
+  try {
+    const result = await ensureContainerEdge(executor, {
+      onLog,
+      config,
+      image: config?.edgeImage
+    });
+    if (result.converted) {
+      onLog(log3("Edge moved from host OpenResty to the container edge", "warn"));
+    }
+    const version = await executor.exec(containerCommand(result.container, "openresty -v 2>&1")).catch(() => "");
+    return {
+      component: "edge",
+      success: true,
+      version: version ? systemCatalog.checks.openresty.parseVersion(version) : void 0
+    };
+  } catch (err) {
+    if (err instanceof EdgeMigrateRequested) throw err;
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Edge setup failed: ${msg}`, "error"));
+    return { component: "edge", success: false, error: msg };
+  }
+}
+var COMPONENT_INSTALLERS = {
+  docker: (exec, log6, config) => installDocker(exec, log6, config),
+  // The edge is ONE component and it is a container image — there is no
+  // host-OpenResty or host-certbot installer to reach for any more.
+  edge: (exec, log6, config) => installContainerEdge(exec, log6, config),
+  git: (exec, log6) => installGit(exec, log6),
+  rsync: (exec, log6) => installRsync(exec, log6)
+};
+
 // ../../packages/adapters/src/system/proxy/index.ts
 async function importSites(executor, status) {
   const proxy = status.occupants.find((o) => o.proxy)?.proxy;
@@ -2206,8 +2240,12 @@ async function ensureEdgeClear(executor, config, onLog) {
     if (!freed.freed) {
       await rollbackEdgeTakeover(executor, onLog);
       const plural = freed.stillBound.length > 1;
+      const ports = `port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use, so the edge can't bind. Nothing was installed`;
       throw new AppError(
-        `Stopped the existing proxy, but port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use, so the edge can't bind. Nothing was installed and the previous proxy has been restored \u2014 find what else is holding the port and retry.`,
+        // The advice has to match the actual cause. Told to hunt for another holder, an
+        // operator retries the same unprivileged takeover forever — and "stopped the
+        // existing proxy" is untrue on this arm, since the stop is what was refused.
+        freed.privilegeDegraded ? `The ${ports} \u2014 and Openship could not run the stop as root on this host (see the privilege warning above), so stopping the existing proxy was almost certainly refused. Retrying as this user will fail the same way: reconnect as root, or as a user with passwordless sudo.` : `Stopped the existing proxy, but ${ports} and the previous proxy has been restored \u2014 find what else is holding the port and retry.`,
         409,
         "EDGE_PORTS_STILL_BOUND"
       );
@@ -2262,15 +2300,22 @@ function setDefaultEdgeImage(image) {
 function resolveEdgeImage(explicit) {
   return buildEdgeImageRef({ explicit, injectedDefault: injectedDefaultImage });
 }
+function edgeHostExecutor(executor) {
+  return rootOrDegrade(executor, {
+    purpose: "Configuring routing and TLS",
+    consequence: "Vhosts and certificates may not be writable, and routing will be incomplete \u2014 the deploy continues and the app still runs on its port.",
+    report: (message) => console.error(`[edge] ${message}`)
+  });
+}
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-YOEEFBTE.js");
+  const { NginxProvider: Provider } = await import("./nginx-KUFMLMAC.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
     // migrate proxy scan, cert reuse, the mail cert symlinks — keeps working),
     // while reload/certbot run inside the container.
     paths: EDGE_HOST_PATHS,
-    executor: edgeContainerExecutor(executor, container),
+    executor: edgeContainerExecutor(await edgeHostExecutor(executor), container),
     // Challenge tokens go to the HOST side of the ACME mount, for the same reason
     // vhosts do. This is the ONE mount whose two sides differ
     // (/var/lib/openship/edge/acme → /var/www/acme), so the write path and the
@@ -2287,12 +2332,21 @@ async function containerEdgeProvider(executor, container, opts) {
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-62N64MGS.js");
-  const { NginxProvider: Provider } = await import("./nginx-YOEEFBTE.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-22IBXNYJ.js");
+  const { NginxProvider: Provider } = await import("./nginx-KUFMLMAC.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
-    executor: new DockerEdgeExecutor({ containerName: container }),
+    // The one place the privilege gate is the WRONG instrument, so the reason is stated
+    // instead: this executor's commands run inside the EDGE container, so probing
+    // through it would measure that container's interior and brand the result with a
+    // verdict about the wrong machine. Privilege here comes from the deployment shape —
+    // the api process is root in its own container, the vhost dir is a bind mount it
+    // owns, and the daemon socket is mounted in. There is no login to elevate.
+    executor: rootChecked(
+      new DockerEdgeExecutor({ containerName: container }),
+      "compose: api is root in its own container, writing shared mounts over a mounted socket"
+    ),
     // nginx.conf + the Lua are BAKED into the image — nothing to detect, install
     // or patch, and detection would answer from inside the container anyway.
     pinPaths: true,
@@ -2411,8 +2465,19 @@ async function ensureContainerEdge(executor, opts) {
       );
     }
   }
+  const hostState = await rootOrDegrade(executor, {
+    purpose: "Creating the edge's state directories",
+    consequence: "Docker will create them empty, so vhosts and certificates may not persist.",
+    report: (message) => onLog(log5(message, "warn"))
+  });
   for (const mount of EDGE_CONTAINER_MOUNTS) {
-    await executor.exec(`mkdir -p ${sq(mount.host)}`).catch(() => {
+    await hostState.exec(`mkdir -p ${sq(mount.host)}`).catch((err) => {
+      onLog(
+        log5(
+          `Could not create the edge state directory ${mount.host}: ${safeErrorMessage(err)}. Docker will create it empty, so vhosts and certificates may not persist.`,
+          "warn"
+        )
+      );
     });
   }
   const clear = await ensureEdgeClear(executor, opts.config, onLog);
@@ -2472,6 +2537,7 @@ export {
   verifyEdgeServing,
   ensureContainerEdge,
   checkGit,
+  COMPONENT_CHECKS,
   checkAll,
   checkComponents
 };