openship 0.6.5 → 0.6.6

package/dist/{chunk-VHMOQL5Y.js → chunk-MLYSEZQB.js}

@@ -3,14 +3,16 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  connectSshClient,
   getTarCreateEnv,
+  prepareSourceTarArgs
+} from "./chunk-Q7WGTQQ5.js";
+import {
+  connectSshClient,
   openDockerDialStdioChannel,
   openSftp,
   openSshUnixSocket,
-  prepareSourceTarArgs,
   reconcileKnownHosts
-} from "./chunk-5OUWIPOB.js";
+} from "./chunk-PCPVTH6M.js";
 import {
   LocalExecutor
 } from "./chunk-6FH4AXVY.js";
@@ -22,6 +24,7 @@ import {
   sq
 } from "./chunk-ZFJXPCQP.js";
 import {
+  HOST_CHANNEL_AUTH_REJECTED,
   HOST_CHANNEL_NOT_PROVISIONED,
   HOST_CHANNEL_UNPROVISIONED,
   HostChannelUnavailableError,
@@ -30,9 +33,11 @@ import {
   commandForError,
   explainHostChannelCause,
   formatBytes,
+  hostChannelAccount,
   hostFirewallRule,
+  isSshAuthError,
   safeErrorMessage
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/system/executor.ts
 import { existsSync, readFileSync } from "fs";
@@ -1625,7 +1630,7 @@ function hostChannelPort() {
   return Number.isInteger(raw) && raw > 0 && raw < 65536 ? raw : 22;
 }
 function hostChannelUser() {
-  return process.env.OPENSHIP_HOST_SSH_USER?.trim() || "root";
+  return hostChannelAccount(process.env);
 }
 function readHostChannelKey(keyPath) {
   let contents;
@@ -1670,6 +1675,80 @@ function explainDialFailure(probe, host, port, target) {
   const cidr = containerBridgeCidr();
   return { hint, rule: hostFirewallRule("unknown", cidr ? [cidr] : [], port) };
 }
+var AUTH_MEMO_OK_MS = 3e4;
+var AUTH_MEMO_FAIL_MS = 5e3;
+var authMemo = null;
+function invalidateHostChannelAuth() {
+  authMemo = null;
+}
+function probeForwarding(client, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (verdict) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(verdict);
+    };
+    const timer = setTimeout(() => finish("unknown"), timeoutMs);
+    timer.unref?.();
+    try {
+      client.forwardOut("127.0.0.1", 0, "127.0.0.1", 1, (err, stream) => {
+        if (stream) {
+          stream.destroy();
+          finish("ok");
+          return;
+        }
+        const reason = err?.reason;
+        const message = err?.message;
+        if (reason === 1 || reason === 3) return finish("blocked");
+        if (typeof message === "string" && /administratively prohibited/i.test(message)) {
+          return finish("blocked");
+        }
+        finish("ok");
+      });
+    } catch {
+      finish("unknown");
+    }
+  });
+}
+async function verifyHostChannelAuth(config) {
+  const memoKey = `${config.username}@${config.host}:${config.port}#${config.privateKey.length}`;
+  if (authMemo?.key === memoKey && authMemo.expires > Date.now()) {
+    return authMemo.hint ? { hint: authMemo.hint, forwarding: authMemo.forwarding } : { forwarding: authMemo.forwarding };
+  }
+  let hint = null;
+  let forwarding = "unknown";
+  try {
+    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-JBMA7SN4.js");
+    const client = await connectSshClient2({
+      host: config.host,
+      port: config.port,
+      username: config.username,
+      privateKey: config.privateKey,
+      readyTimeoutMs: config.timeoutMs,
+      // Load-bearing: it selects describeSshAuthFailure's host-channel wording, so the
+      // hint an operator reads here is the same sentence the deploy log gives them.
+      hostChannel: true
+    });
+    forwarding = await probeForwarding(
+      client,
+      config.timeoutMs
+    );
+    client.end();
+  } catch (err) {
+    if (isSshAuthError(err)) {
+      hint = err instanceof Error ? err.message : HOST_CHANNEL_AUTH_REJECTED;
+    }
+  }
+  authMemo = {
+    key: memoKey,
+    hint,
+    forwarding,
+    expires: Date.now() + (hint ? AUTH_MEMO_FAIL_MS : AUTH_MEMO_OK_MS)
+  };
+  return hint ? { hint, forwarding } : { forwarding };
+}
 async function hostChannelHealth(timeoutMs = 2500) {
   if (hostControlDisabled()) {
     return {
@@ -1692,32 +1771,48 @@ async function hostChannelHealth(timeoutMs = 2500) {
   const port = hostChannelPort();
   const target = `${hostChannelUser()}@${host}:${port}`;
   const keyPath = process.env.OPENSHIP_HOST_SSH_KEY?.trim();
+  let privateKey;
   if (keyPath) {
-    const { reason } = readHostChannelKey(keyPath);
-    if (reason) {
+    const read = readHostChannelKey(keyPath);
+    if (read.reason) {
       return {
         ok: false,
         code: "key_unreadable",
         host,
         port,
         target,
-        hint: `${reason} ${HOST_CHANNEL_NOT_PROVISIONED}`
+        hint: `${read.reason} ${HOST_CHANNEL_NOT_PROVISIONED}`
       };
     }
+    privateKey = read.key;
   }
   const probe = await probeTcpDetailed(host, port, timeoutMs);
-  if (probe.ok) {
-    return { ok: true, code: "ok", host, port, target };
+  if (!probe.ok) {
+    return {
+      ok: false,
+      code: "unreachable",
+      host,
+      port,
+      target,
+      cause: probe.reason,
+      ...explainDialFailure(probe, host, port, target)
+    };
   }
-  return {
-    ok: false,
-    code: "unreachable",
-    host,
-    port,
-    target,
-    cause: probe.reason,
-    ...explainDialFailure(probe, host, port, target)
-  };
+  let forwarding = "unknown";
+  if (privateKey) {
+    const verdict = await verifyHostChannelAuth({
+      host,
+      port,
+      username: hostChannelUser(),
+      privateKey,
+      timeoutMs
+    });
+    if (verdict.hint) {
+      return { ok: false, code: "auth_rejected", host, port, target, hint: verdict.hint };
+    }
+    forwarding = verdict.forwarding;
+  }
+  return { ok: true, code: "ok", host, port, target, forwarding };
 }
 function unavailableExecutor(reason, code = "not_configured") {
   const refuse = async () => {
@@ -1787,6 +1882,7 @@ export {
   setHostControlOverride,
   hostControlDisabled,
   containerBridgeCidr,
+  invalidateHostChannelAuth,
   hostChannelHealth,
   unavailableExecutor,
   createHostExecutor

package/dist/{chunk-7S4USQYF.js → chunk-NK5N5LXN.js}

@@ -2,19 +2,6 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  importMigratedSites
-} from "./chunk-6HOA5JT7.js";
-import {
-  completeHostEdge,
-  markStoppedProxyImported,
-  planAndApplyHostEdge,
-  previewHostEdge,
-  rollbackHostEdge
-} from "./chunk-HPXP6LXZ.js";
-import {
-  verifyHostChannel
-} from "./chunk-XRNRT37W.js";
 import {
   DEFAULT_REPO,
   PORTS_FILE,
@@ -40,9 +27,27 @@ import {
   resolveComposePorts,
   resolvePorts,
   sourceBuildDir,
+  verifyHostChannel
+} from "./chunk-WVAML4H6.js";
+import {
+  bootstrapAdmin,
+  importMigratedSites,
+  internalFetch,
+  internalPost,
+  mintBareInternalToken,
+  waitHealthy
+} from "./chunk-VTGPEC6B.js";
+import {
   startUnitHint,
   thisHost
-} from "./chunk-QLX7NBEA.js";
+} from "./chunk-5DMWSTOM.js";
+import {
+  completeHostEdge,
+  markStoppedProxyImported,
+  planAndApplyHostEdge,
+  previewHostEdge,
+  rollbackHostEdge
+} from "./chunk-CBLD2HS5.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,18 +63,18 @@ import {
   EDGE_CONTAINER_NAME,
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-WE7BXW6L.js";
+} from "./chunk-2YM3NI2E.js";
 import {
   isValidEmail
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
 import chalk2 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
-import { createWriteStream as createWriteStream2, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { randomBytes } from "crypto";
+import { createWriteStream as createWriteStream2, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
@@ -615,9 +620,16 @@ async function planUp(opts) {
       ...stack.buildFile ? [stack.buildFile] : [],
       ...stack.hostChannel ? [
         stack.hostChannel.keyPath,
-        `${stack.hostChannel.authKeysPath}${stack.hostChannel.viaSudo ? "  (via sudo)" : ""}  (authorizes that key for ${stack.hostChannel.user}'s host ops; --no-host-control skips it)`,
+        `${stack.hostChannel.authKeysPath}  (authorizes that key for ${stack.hostChannel.user}'s host ops; --no-host-control skips it)`,
+        // Say which route to root this channel will take, rather than repeating a root
+        // warning at a box that reaches root perfectly well via sudo. `sudo` is a
+        // supported shape now, not a degradation, and the preview is where an operator
+        // decides whether that is what they wanted.
+        ...stack.hostChannel.elevation === "sudo" ? [
+          `logs in as ${stack.hostChannel.user} and elevates with sudo for root host ops (no root login is created)`
+        ] : [],
         ...stack.hostChannel.rootUnavailable ? [
-          "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root to fix)"
+          "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root, or enable passwordless sudo, to fix)"
         ] : []
       ] : [],
       ...stack.mountDirs.map((d) => `${d}/  (edge routing state + certs)`),
@@ -768,87 +780,6 @@ function serviceWord(kind) {
   }
 }
 
-// src/lib/loopback-api.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { randomBytes } from "crypto";
-function ensureInternalToken() {
-  const path = INTERNAL_TOKEN_FILE;
-  if (existsSync4(path)) return readFileSync3(path, "utf8").trim();
-  mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
-  const token = randomBytes(32).toString("hex");
-  writeFileSync4(path, token, { mode: 384 });
-  return token;
-}
-async function internalGet(port, path, token) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
-      headers: { "X-Internal-Token": token ?? ensureInternalToken() },
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
-  }
-}
-async function internalPost(port, path, body, token) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Internal-Token": token ?? ensureInternalToken() },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(3e4)
-    });
-    const data = await res.json().catch(() => ({}));
-    return { ok: res.ok, data };
-  } catch (err) {
-    return { ok: false, data: { error: err.message } };
-  }
-}
-async function bootstrapAdmin(apiPort, admin, token) {
-  const { ok, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
-  if (ok) return { ok: true };
-  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
-  return { ok: false, message: data?.error || "failed" };
-}
-async function waitHealthy(apiPort, seconds = 90) {
-  for (let i = 0; i < seconds; i++) {
-    await new Promise((r) => setTimeout(r, 1e3));
-    try {
-      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
-      return true;
-    } catch {
-    }
-  }
-  return false;
-}
-async function waitDashboard(dashPort, seconds = 45) {
-  for (let i = 0; i < seconds; i++) {
-    await new Promise((r) => setTimeout(r, 1e3));
-    try {
-      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
-        redirect: "manual",
-        signal: AbortSignal.timeout(2e3)
-      });
-      if (res.status > 0) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-async function detectPublicIp() {
-  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
-    try {
-      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
-      if (!res.ok) continue;
-      const ip = (await res.text()).trim();
-      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
-    } catch {
-    }
-  }
-  return null;
-}
-
 // src/lib/instance-provision.ts
 var HeadlessInputError = class extends Error {
   code = "HEADLESS_INPUT";
@@ -927,10 +858,14 @@ async function bootstrapOrReset(port, admin, token) {
 async function drainProvisionStream(port, sessionId, token, onLog) {
   let detail;
   try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
-      headers: { "X-Internal-Token": token ?? ensureInternalToken() },
-      signal: AbortSignal.timeout(18e4)
-    });
+    const call = await internalFetch(
+      port,
+      `/api/system/self-register/stream?id=${sessionId}`,
+      { signal: AbortSignal.timeout(18e4) },
+      token
+    );
+    if (call.kind !== "response") return { completed: false, detail: call.detail };
+    const res = call.res;
     if (!res.body) return { completed: false };
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
@@ -1100,10 +1035,10 @@ var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
 var SERVER_DIR = join5(DIST_DIR, "server");
 function ensureAuthSecret() {
   const path = AUTH_SECRET_FILE;
-  if (existsSync5(path)) return readFileSync4(path, "utf8").trim();
-  mkdirSync6(OS_DIR, { recursive: true, mode: 448 });
-  const secret = randomBytes2(32).toString("hex");
-  writeFileSync5(path, secret, { mode: 384 });
+  if (existsSync4(path)) return readFileSync3(path, "utf8").trim();
+  mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
+  const secret = randomBytes(32).toString("hex");
+  writeFileSync4(path, secret, { mode: 384 });
   return secret;
 }
 var upCommand = new Command("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on (default: 4000, or the next free port if it's taken)").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port (default: 3001, or the next free port if it's taken)").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option(
@@ -1471,7 +1406,7 @@ async function runForeground(opts, source) {
     apiCwd = source.apiDir;
   } else {
     const serverEntry = join5(SERVER_DIR, "index.js");
-    if (!existsSync5(serverEntry)) {
+    if (!existsSync4(serverEntry)) {
       console.error(
         chalk2.red("\n  Bundled server not found in this install.") + chalk2.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
       );
@@ -1488,8 +1423,8 @@ async function runForeground(opts, source) {
   const publicUrl = effectivePublicUrl(opts.publicUrl);
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
   const dataDir = opts.dataDir || DATA_DIR;
-  mkdirSync6(dataDir, { recursive: true });
-  mkdirSync6(LOG_DIR, { recursive: true });
+  mkdirSync5(dataDir, { recursive: true });
+  mkdirSync5(LOG_DIR, { recursive: true });
   const instanceLogPath = join5(LOG_DIR, "instance.log");
   const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
@@ -1521,10 +1456,10 @@ async function runForeground(opts, source) {
     env.OPENSHIP_MIGRATIONS_DIR = join5(SERVER_DIR, "migrations");
     env.OPENSHIP_PGLITE_ASSETS_DIR = join5(SERVER_DIR, "pglite");
     const engineDir = join5(SERVER_DIR, "engine");
-    if (existsSync5(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
+    if (existsSync4(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
   }
   env.OPENSHIP_REQUIRE_AUTH = "true";
-  env.INTERNAL_TOKEN = ensureInternalToken();
+  env.INTERNAL_TOKEN = mintBareInternalToken();
   if (opts.mail) env.OPENSHIP_PRODUCT = "mail";
   if (!env.OPENSHIP_AUTH_MODE) env.OPENSHIP_AUTH_MODE = "local";
   env.OPENSHIP_API_HOST = "127.0.0.1";
@@ -1614,7 +1549,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.5"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.6"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -1738,13 +1673,6 @@ export {
   restart,
   serviceStatus,
   stop,
-  ensureInternalToken,
-  internalGet,
-  internalPost,
-  bootstrapAdmin,
-  waitHealthy,
-  waitDashboard,
-  detectPublicIp,
   headlessProvision,
   normalizeUrl,
   upCommand,

package/dist/{chunk-3ZAGC5NT.js → chunk-OBPKYXQL.js}

@@ -5,27 +5,28 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-7334NSJL.js";
+} from "./chunk-A4GXYE4L.js";
 import {
   createDockerBuildContext,
   normalizeDockerRelativePath,
   resolveDockerfileCandidates,
   resolveWithinDirectory
-} from "./chunk-LFCSC4IU.js";
+} from "./chunk-LUKYPVJ4.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-MSZUCNPV.js";
+} from "./chunk-YIMOCZBZ.js";
 import {
   BuildLogger,
   injectGitToken,
   runBuildPipeline,
   sq,
   transferLocalDirectory
-} from "./chunk-TM2IQPYU.js";
+} from "./chunk-LH2PLRQO.js";
 import {
+  PRICING,
   STACKS,
   SYSTEM,
   TRANSFER_EXCLUDES,
@@ -35,7 +36,7 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";
@@ -47,6 +48,11 @@ var DEFAULT_RESOURCE_CONFIG = {
   memoryMb: 512,
   diskMb: 5120
 };
+var DEFAULT_BUILD_RESOURCE_CONFIG = {
+  cpuCores: PRICING.oblien.buildResources.cpuCores,
+  memoryMb: PRICING.oblien.buildResources.memoryMb,
+  diskMb: PRICING.oblien.buildResources.diskGb * 1024
+};
 function cloudCpus(cpuCores) {
   return Math.max(0.25, cpuCores);
 }
@@ -1414,7 +1420,12 @@ var CloudRuntime = class {
     // per service and continues, rather than the workload coming up on its own
     // network with nothing having said so (#533).
     "networkMode",
-    "pidMode"
+    "pidMode",
+    // A workspace is not a container whose ENTRYPOINT we compose: Oblien resolves its
+    // own workload command, so an override (or a clearing `[]`) has nowhere to land
+    // here. Declared so the deploy says so once per service and continues, rather
+    // than the image's own launcher running with nothing having mentioned it (#575).
+    "entrypoint"
   ]);
   client;
   // Optional admin-scoped proxy. Set when this runtime is constructed

package/dist/{chunk-5OUWIPOB.js → chunk-PCPVTH6M.js}

@@ -3,102 +3,31 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  PACKAGE_ROOT_ONLY_EXCLUDES,
+  HOST_CHANNEL_AUTH_REJECTED,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
   hostFirewallRule,
   isSshAuthError,
   safeErrorMessage,
   systemDebug
-} from "./chunk-LEYSL46B.js";
-
-// ../../packages/adapters/src/archive.ts
-import { execFile } from "child_process";
-import { mkdtemp, rm, stat, writeFile } from "fs/promises";
-import { tmpdir } from "os";
-import { join } from "path";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var ROOT_ONLY_EXCLUDES = new Set(PACKAGE_ROOT_ONLY_EXCLUDES);
-var NOOP_CLEANUP = async () => {
-};
-function getTarCreateEnv() {
-  return {
-    ...process.env,
-    COPYFILE_DISABLE: "1",
-    COPY_EXTENDED_ATTRIBUTES_DISABLE: "1"
-  };
-}
-function tarCreateBaseArgs(localPath) {
-  const darwinFlags = process.platform === "darwin" ? ["--no-mac-metadata", "--no-xattrs", "--no-acls", "--no-fflags"] : [];
-  return [...darwinFlags, "-czf", "-", "-C", localPath];
-}
-async function gitTrackedFiles(localPath) {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["-C", localPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
-      { maxBuffer: 256 * 1024 * 1024 }
-    );
-    const files = stdout.split("\0").filter(Boolean);
-    return files.length > 0 ? files : null;
-  } catch {
-    return null;
-  }
-}
-async function existingRelativePaths(root, paths) {
-  if (!paths?.length) return [];
-  const found = [];
-  for (const p of paths) {
-    try {
-      await stat(join(root, p));
-      found.push(p);
-    } catch {
-    }
-  }
-  return found;
-}
-async function prepareSourceTarArgs(localPath, options) {
-  if (options?.includes?.length) {
-    return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
-  }
-  const files = await gitTrackedFiles(localPath);
-  if (files) {
-    const extra = await existingRelativePaths(localPath, options?.alsoInclude);
-    const entries = extra.length ? [...files, ...extra] : files;
-    const tmpDir = await mkdtemp(join(tmpdir(), "openship-tarlist-"));
-    const listFile = join(tmpDir, "files.null");
-    await writeFile(listFile, entries.join("\0"));
-    const args = [...tarCreateBaseArgs(localPath), "--null", "-T", listFile];
-    return { args, cleanup: () => rm(tmpDir, { recursive: true, force: true }) };
-  }
-  return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
-}
-function getTarCreateArgs(localPath, options) {
-  const args = tarCreateBaseArgs(localPath);
-  if (options?.includes?.length) {
-    args.push(...options.includes);
-    return args;
-  }
-  for (const exclude of options?.excludes ?? []) {
-    const pattern = ROOT_ONLY_EXCLUDES.has(exclude) ? `./${exclude}` : exclude;
-    args.push(`--exclude=${pattern}`);
-  }
-  args.push(".");
-  return args;
-}
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";
 
 // ../../packages/adapters/src/system/ssh-support.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 import { access } from "fs/promises";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
 function formatSshTarget(config) {
   return `${config.username ?? "root"}@${config.host}:${config.port ?? 22}`;
 }
 function describeSshAuthFailure(config, originalMessage) {
   const target = formatSshTarget(config);
+  if (config.hostChannel) {
+    return `${HOST_CHANNEL_AUTH_REJECTED} Dialed ${target} from inside the Openship API container. ${HOST_CHANNEL_ROW_CREDENTIALS_UNUSED} ${HOST_CHANNEL_NOT_PROVISIONED} (${originalMessage})`;
+  }
   if (config.password) {
     return `SSH password authentication failed for ${target}. Check the username/password, or verify that the server allows password login. (${originalMessage})`;
   }
@@ -119,7 +48,7 @@ Or re-run \`openship up\`, which probes this and offers the exact rule. (${origi
 }
 function execFileText(command, args, timeout = 5e3) {
   return new Promise((resolve, reject) => {
-    execFile2(command, args, { timeout }, (err, stdout, stderr) => {
+    execFile(command, args, { timeout }, (err, stdout, stderr) => {
       if (err) {
         reject(new Error(stderr.trim() || stdout.trim() || err.message));
         return;
@@ -141,7 +70,7 @@ function parseKnownHostsEntries(text) {
   return entries;
 }
 async function reconcileKnownHosts(config) {
-  const knownHostsPath = join2(homedir(), ".ssh", "known_hosts");
+  const knownHostsPath = join(homedir(), ".ssh", "known_hosts");
   try {
     await access(knownHostsPath);
   } catch {
@@ -378,13 +307,12 @@ async function execSshCommand(client, command, timeout = 1e4) {
 }
 
 export {
-  getTarCreateEnv,
-  prepareSourceTarArgs,
   reconcileKnownHosts,
   connectSshClient,
   openSftp,
   openSshUnixSocket,
   DOCKER_DIAL_STDIO_COMMAND,
+  openSshExecChannel,
   attachDialStdioDiagnostics,
   dialStdioDiagnostics,
   openDockerDialStdioChannel,