openship 0.6.6 → 0.6.7

package/dist/{chunk-PCPVTH6M.js → chunk-5T4UVOM3.js}

@@ -2,15 +2,17 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  isSshAuthError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
 import {
   HOST_CHANNEL_AUTH_REJECTED,
   HOST_CHANNEL_NOT_PROVISIONED,
   HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
   hostFirewallRule,
-  isSshAuthError,
-  safeErrorMessage,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
+  safeErrorMessage
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";

package/dist/{chunk-YMMQRE5J.js → chunk-BLEXTYRK.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-OBPKYXQL.js → chunk-CIJV43LH.js}

@@ -5,38 +5,45 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-A4GXYE4L.js";
+} from "./chunk-ZPJ74LXE.js";
 import {
-  createDockerBuildContext,
-  normalizeDockerRelativePath,
-  resolveDockerfileCandidates,
-  resolveWithinDirectory
-} from "./chunk-LUKYPVJ4.js";
+  createDockerBuildContext
+} from "./chunk-XWHWTHEL.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-YIMOCZBZ.js";
+} from "./chunk-MEE6OZFP.js";
 import {
   BuildLogger,
+  dockerBuildContextDirectory,
+  droppedRuntimeEnvMessage,
   injectGitToken,
+  normalizeDockerRelativePath,
+  resolveContextDockerfileCandidates,
+  resolveDockerfileCandidates,
+  resolveWithinDirectory,
   runBuildPipeline,
+  splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-LH2PLRQO.js";
+} from "./chunk-H4FS5BED.js";
+import {
+  isRuntimeNotFoundError
+} from "./chunk-N5YZMO33.js";
 import {
   PRICING,
   STACKS,
   SYSTEM,
   TRANSFER_EXCLUDES,
   buildOutputTransferExcludes,
-  isRuntimeNotFoundError,
   missingOutputDirectoryMessage,
+  nodeBinPathExport,
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";
@@ -719,9 +726,11 @@ function restartPolicyForWorkload(policy) {
   return "always";
 }
 function resolveCloudWorkloadCmd(opts) {
-  const { commandArgv, startCommand, workdir } = opts;
+  const { commandArgv, startCommand, workdir, binPathExport } = opts;
   if (commandArgv != null) return commandArgv.length > 0 ? commandArgv : void 0;
-  return startCommand ? ["sh", "-c", `cd ${sq(workdir)} && ${startCommand}`] : void 0;
+  if (!startCommand) return void 0;
+  const body = `cd ${sq(workdir)} && ${startCommand}`;
+  return ["sh", "-c", binPathExport ? `${binPathExport} && ${body}` : body];
 }
 function exposeTarget(port, serviceName, slug, domain = SYSTEM.DOMAINS.CLOUD_DOMAIN) {
   const service = `service "${serviceName}" on port ${port}`;
@@ -1320,6 +1329,9 @@ function resolveCopyDestinationPath(copy, sourcePath, destination, destinationIs
   const basename = posix.basename(sourcePath.replace(/\/+$/g, "")) || ".";
   return posix.normalize(posix.join(destination, basename));
 }
+function cloudBuildContextPath(config) {
+  return dockerBuildContextDirectory(config) || normalizeDockerRelativePath(config.rootDirectory);
+}
 var PAGE_CONTAINER_PREFIX = "page:";
 async function provisionCloudWorkspace(client, config, logger) {
   logger?.log(`Creating workspace from image "${config.image}"...
@@ -1792,7 +1804,7 @@ var CloudRuntime = class {
       logger.log("Using Dockerfile content from source metadata.\n");
       return {
         kind: "remote",
-        contextRelativePath: normalizeDockerRelativePath(config.rootDirectory),
+        contextRelativePath: cloudBuildContextPath(config),
         dockerfile: config.dockerfileContent,
         cleanup: async () => {
         }
@@ -1807,9 +1819,12 @@ var CloudRuntime = class {
       requireRepositoryDockerfile: true,
       onLog: logger.callback
     });
-    const dockerfilePath = resolveWithinDirectory(context.contextDir, context.dockerfileName);
+    const dockerfilePath = resolveWithinDirectory(
+      context.buildContextDir,
+      context.dockerfileName
+    );
     const dockerfile = await readFile(dockerfilePath, "utf-8");
-    const contextRoot = resolveWithinDirectory(context.contextDir, context.rootDirectory);
+    const contextRoot = context.contextSubdir ? context.buildContextDir : resolveWithinDirectory(context.contextDir, context.rootDirectory);
     return {
       kind: "local",
       contextRoot,
@@ -1818,7 +1833,10 @@ var CloudRuntime = class {
     };
   }
   async resolveRemoteDockerfileBuildSource(config, logger) {
-    const candidates = resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
+    const contextSubdir = dockerBuildContextDirectory(config);
+    const candidates = contextSubdir ? resolveContextDockerfileCandidates(contextSubdir, config.dockerfilePath).map(
+      (candidate) => `${contextSubdir}/${candidate}`
+    ) : resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
     const sourceLabel = config.commitSha ? `${config.branch}@${config.commitSha.slice(0, 7)}` : config.branch;
     const checkoutRef = config.commitSha ?? "FETCH_HEAD";
     const sourceDir = "/openship/dockerfile-source";
@@ -1881,7 +1899,7 @@ var CloudRuntime = class {
           sourceWorkspaceId = void 0;
           return {
             kind: "remote",
-            contextRelativePath: normalizeDockerRelativePath(config.rootDirectory),
+            contextRelativePath: cloudBuildContextPath(config),
             dockerfile,
             cleanup: async () => {
               await this.ws(workspaceId).delete().catch(() => {
@@ -2063,6 +2081,25 @@ var CloudRuntime = class {
     const contextSource = contextRelativePath ? joinWorkspacePath(repoRoot, contextRelativePath) : contextRoot;
     const prepareContextCommands = contextRelativePath ? [
       `echo "Copying Dockerfile context ${contextRelativePath}..."`,
+      // `cp -a` FOLLOWS a symlinked source directory, so a repo that tracks
+      // `svc -> /` and declares `build: ./svc` would copy the workspace's root
+      // filesystem into its own build context. The lexical `..` refusal above
+      // cannot see that; only a resolved path can. Same class as
+      // GHSA-443m-7g52-94w8, reachable through the build context rather than
+      // rootDirectory, and asserted here for the same reason the docker paths
+      // assert it: at the sink.
+      // `pwd -P` rather than `readlink -f`: it is a POSIX shell builtin, so it
+      // exists in every workspace image, and it answers both questions at once —
+      // the `cd` fails when the context is not a directory, and the resolved path
+      // reveals a symlink that left the checkout.
+      // BOTH sides resolved, and an unresolvable either side is fatal: an empty
+      // `__root` would turn the prefix test into `"/"*`, which every absolute path
+      // matches — a containment check that passes vacuously is worse than none.
+      // `|| __x=""` keeps `set -e` from killing the script before the message.
+      `__root="$(cd ${sq(repoRoot)} && pwd -P)" || __root=""`,
+      `__ctx="$(cd ${sq(contextSource)} 2>/dev/null && pwd -P)" || __ctx=""`,
+      `if [ -z "$__root" ] || [ -z "$__ctx" ]; then echo "Build context ${contextRelativePath} is not a directory in this repository." >&2; exit 1; fi`,
+      `case "$__ctx/" in "$__root/"*) ;; *) echo "Build context ${contextRelativePath} resolves outside this repository." >&2; exit 1 ;; esac`,
       `mkdir -p ${sq(contextRoot)}`,
       `cp -a ${sq(`${contextSource}/.`)} ${sq(contextRoot)}/`
     ] : ['echo "Using repository root as Dockerfile context."'];
@@ -2385,15 +2422,28 @@ fi`;
       }
     }
     const startCommand = builtArtifact?.runtime.startCommand || config.startCommand || "npm start";
+    const projectEnv = splitRuntimeEnv(config.envVars);
+    if (projectEnv.dropped.length > 0) {
+      onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: droppedRuntimeEnvMessage(projectEnv.dropped)
+      });
+    }
     const envArray = toEnvArray2({
       ...builtArtifact?.runtime.env ?? {},
-      ...config.envVars
+      ...Object.fromEntries(projectEnv.entries)
     });
     const restartPolicy = config.restartPolicy === "no" ? "never" : config.restartPolicy ?? "always";
+    const workloadCmd = resolveCloudWorkloadCmd({
+      startCommand,
+      workdir: workDir,
+      binPathExport: builtArtifact ? "" : nodeBinPathExport(config.packageManager, [workDir, "/app"])
+    });
     try {
       await ws.workloads.create({
         name: "app",
-        cmd: ["sh", "-c", `cd ${workDir} && ${startCommand}`],
+        cmd: workloadCmd,
         working_dir: workDir,
         env: [...envArray, `PORT=${config.port}`],
         restart_policy: restartPolicy,
@@ -2695,15 +2745,7 @@ fi`;
   }
   async purge(deployment) {
     if (deployment.containerId?.startsWith(PAGE_CONTAINER_PREFIX)) {
-      const slug = deployment.containerId.slice(5);
-      try {
-        if (this.adminProxy?.deletePage) {
-          await this.adminProxy.deletePage(slug);
-        } else {
-          await this.client.pages.delete(slug);
-        }
-      } catch {
-      }
+      await this.destroy(deployment.containerId);
       return;
     }
     if (!deployment.containerId) return;
@@ -2717,10 +2759,7 @@ fi`;
         err instanceof Error ? err.message : err
       );
     }
-    try {
-      await this.destroy(deployment.containerId);
-    } catch {
-    }
+    await this.destroy(deployment.containerId);
   }
   // ── Observability ──────────────────────────────────────────────────────
   async getContainerInfo(containerId) {

package/dist/{chunk-NK5N5LXN.js → chunk-DDFUESPJ.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-WVAML4H6.js";
+} from "./chunk-PPEBIY5F.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -36,18 +36,18 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-VTGPEC6B.js";
+} from "./chunk-RDXT4BQB.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-5DMWSTOM.js";
+} from "./chunk-VQM6JHJB.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-CBLD2HS5.js";
+} from "./chunk-J2XM3QSP.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,15 +58,17 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
-  EDGE_CONTAINER_NAME,
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-GIPJNNI5.js";
+import {
+  EDGE_CONTAINER_NAME
+} from "./chunk-UWEV6XTS.js";
 import {
   isValidEmail
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -609,6 +611,7 @@ async function planUp(opts) {
       ...opts.hostControl === false ? { noHostControl: true } : {},
       ...opts.hostSshHost ? { hostSshHost: opts.hostSshHost } : {},
       ...opts.hostSshPort ? { hostSshPort: opts.hostSshPort } : {},
+      ...opts.hostSshUser ? { hostSshUser: opts.hostSshUser } : {},
       ...opts.resetSecrets ? { resetSecrets: true } : {},
       ...opts.mail ? { mail: true } : {}
     });
@@ -630,6 +633,13 @@ async function planUp(opts) {
         ] : [],
         ...stack.hostChannel.rootUnavailable ? [
           "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root, or enable passwordless sudo, to fix)"
+        ] : [],
+        // A plan that named one account and then settled on another would read as the
+        // plan being wrong, and this run genuinely cannot know which: only a dial can
+        // establish whether sshd accepts the first account, and dialing means writing
+        // the key a dry run exists not to write (#527, previewHostChannel).
+        ...stack.hostChannel.fallbacks?.length ? [
+          `if this host's sshd refuses that account, falls back to ${stack.hostChannel.fallbacks.join(", ")} (pin one with --host-ssh-user)`
         ] : []
       ] : [],
       ...stack.mountDirs.map((d) => `${d}/  (edge routing state + certs)`),
@@ -1071,6 +1081,9 @@ var upCommand = new Command("up").description("Start Openship as a persistent se
 ).option(
   "--host-ssh-port <port>",
   "Compose mode: port the host's sshd listens on for host operations (default 22). Preserved across re-runs."
+).option(
+  "--host-ssh-user <name>",
+  "Compose mode: the host account the api container logs in as for host operations. Normally left unset \u2014 provisioning authorizes a key and DIALS to find an account this host's sshd actually accepts (root when invoked as root, otherwise the invoking user, falling back to $SUDO_USER when a root login is refused). Set this when neither is the account you want, or when sshd's rules mean neither works: the named account is used as-is and never falls back, so it must be able to log in over SSH and should have passwordless sudo (host operations elevate per command). Preserved across re-runs."
 ).option(
   "--open-host-firewall",
   "Compose mode: if the api container can't reach this machine's SSH port, add the host firewall rule that allows it (scoped to the container subnet, ufw/firewalld only). Without this the blocked channel is reported and left alone. Not implied by --yes."
@@ -1213,6 +1226,7 @@ async function runCompose(opts) {
     // so the containers would keep an environment the file no longer shows.
     hostSshHost: opts.hostSshHost,
     hostSshPort: opts.hostSshPort,
+    hostSshUser: opts.hostSshUser,
     resetSecrets: opts.resetSecrets,
     mail: opts.mail
   });
@@ -1267,6 +1281,7 @@ async function runCompose(opts) {
     // configured with rather than resetting it to host.docker.internal:22.
     hostSshHost: opts.hostSshHost,
     hostSshPort: opts.hostSshPort,
+    hostSshUser: opts.hostSshUser,
     resetSecrets: opts.resetSecrets,
     // Absent on a re-run keeps the install's mode (resolveEnvConfig), so this
     // never flips a mail box back to the platform shell.
@@ -1549,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.6"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.7"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-6FH4AXVY.js → chunk-E2X26PXR.js}

@@ -8,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";

package/dist/{chunk-HKRQXPTI.js → chunk-FYPFEDPZ.js}

@@ -7,7 +7,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-A4GXYE4L.js";
+} from "./chunk-ZPJ74LXE.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";

package/dist/{chunk-UVNMQM7W.js → chunk-FZ6QCF6B.js}

@@ -4,18 +4,20 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 import {
-  assessHostSupport,
-  classifyDistro,
   formatDuration,
   isRemoteConnectionError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
+import {
+  assessHostSupport,
+  classifyDistro,
   parseOsRelease,
   parseSystemArch,
   parseSystemOs,
-  safeErrorMessage,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
+  safeErrorMessage
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-MLYSEZQB.js → chunk-GGIAIGUL.js}

@@ -2,103 +2,52 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  probeTcpDetailed
+} from "./chunk-R4VDPFLS.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-Q7WGTQQ5.js";
+} from "./chunk-2ANV5ZQ5.js";
 import {
   connectSshClient,
   openDockerDialStdioChannel,
   openSftp,
   openSshUnixSocket,
   reconcileKnownHosts
-} from "./chunk-PCPVTH6M.js";
+} from "./chunk-5T4UVOM3.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
   emitBufferedLines,
   flushBufferedLines,
   hasLocalCommand,
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
+import {
+  HostChannelUnavailableError,
+  SshDisconnectedError,
+  commandForError,
+  isSshAuthError
+} from "./chunk-N5YZMO33.js";
 import {
   HOST_CHANNEL_AUTH_REJECTED,
   HOST_CHANNEL_NOT_PROVISIONED,
   HOST_CHANNEL_UNPROVISIONED,
-  HostChannelUnavailableError,
-  SshDisconnectedError,
   TRANSFER_EXCLUDES,
-  commandForError,
   explainHostChannelCause,
   formatBytes,
   hostChannelAccount,
   hostFirewallRule,
-  isSshAuthError,
   safeErrorMessage
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/executor.ts
 import { existsSync, readFileSync } from "fs";
 import { networkInterfaces } from "os";
 
-// ../../packages/adapters/src/system/reachability.ts
-import { connect } from "net";
-import { request } from "http";
-function classifyDialError(code) {
-  switch (code) {
-    case "ECONNREFUSED":
-    case "ECONNRESET":
-      return "refused";
-    case "ENOTFOUND":
-    case "EAI_AGAIN":
-      return "unresolved";
-    case "EHOSTUNREACH":
-    case "ENETUNREACH":
-    case "ENETDOWN":
-      return "no_route";
-    // The kernel's own connect timeout, i.e. our `timeout` reported for us.
-    case "ETIMEDOUT":
-      return "timeout";
-    default:
-      return "error";
-  }
-}
-function probeTcpDetailed(host, port, timeoutMs = 2500) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (result, socket2) => {
-      if (settled) return;
-      settled = true;
-      try {
-        socket2?.destroy();
-      } catch {
-      }
-      resolve(result);
-    };
-    const socket = connect({ host, port });
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => done({ ok: true }, socket));
-    socket.once(
-      "timeout",
-      () => done({ ok: false, reason: "timeout", message: `no response within ${timeoutMs}ms` }, socket)
-    );
-    socket.once("error", (err) => {
-      const errno = err;
-      done(
-        {
-          ok: false,
-          reason: classifyDialError(errno.code),
-          ...errno.code ? { code: errno.code } : {},
-          ...errno.message ? { message: errno.message } : {}
-        },
-        socket
-      );
-    });
-  });
-}
-
 // ../../packages/adapters/src/system/ssh-executor.ts
 import { createReadStream } from "fs";
 import { mkdtemp as mkdtemp2, rm as fsRm2, stat } from "fs/promises";
@@ -1720,7 +1669,7 @@ async function verifyHostChannelAuth(config) {
   let hint = null;
   let forwarding = "unknown";
   try {
-    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-JBMA7SN4.js");
+    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-625VWGKP.js");
     const client = await connectSshClient2({
       host: config.host,
       port: config.port,