openship 0.6.6 → 0.6.7

package/dist/{chunk-WVAML4H6.js → chunk-PPEBIY5F.js}

@@ -10,28 +10,28 @@ import {
   readComposeEnvFile,
   resolveLocalEnvironmentSync,
   thisHost
-} from "./chunk-5DMWSTOM.js";
+} from "./chunk-VQM6JHJB.js";
 import {
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   systemCatalog
-} from "./chunk-A4GXYE4L.js";
+} from "./chunk-ZPJ74LXE.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
-} from "./chunk-RSR7PFIQ.js";
+} from "./chunk-QHMDCYZ3.js";
 import {
   DEFAULT_DOCKER_SOCKET_PATH,
   resolveLocalDockerSocketPath
-} from "./chunk-77QDF6UD.js";
+} from "./chunk-LHFXSC36.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-GIPJNNI5.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_BLOCKED,
@@ -51,7 +51,7 @@ import {
   hostFirewallRule,
   hostFirewallRuleRemoval,
   wrapText
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // src/lib/host-channel-preflight.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -775,32 +775,66 @@ function stripHostAuthorizedKeys(existing) {
 }
 var ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
 function chooseHostChannelUser(input) {
+  const keysFor = (home) => join4(home, ".ssh", "authorized_keys");
+  if (input.pinned) {
+    return [
+      {
+        user: input.pinned.user,
+        authKeysPath: input.pinned.user === "root" ? ROOT_AUTHORIZED_KEYS : keysFor(input.pinned.home),
+        // Unknowable for an arbitrary account; the dial measures it (see provisionHostSshChannel).
+        elevation: input.pinned.user === "root" ? "login" : "sudo",
+        source: "pin"
+      }
+    ];
+  }
+  const candidates = [];
   if (input.invokerUid === 0) {
-    return {
+    candidates.push({
       user: "root",
       authKeysPath: ROOT_AUTHORIZED_KEYS,
-      rootUnavailable: false,
-      elevation: "login"
-    };
-  }
-  const invoker = {
-    user: input.invokerName,
-    authKeysPath: join4(input.invokerHome, ".ssh", "authorized_keys")
-  };
-  if (input.hasPasswordlessSudo) {
-    return { ...invoker, rootUnavailable: false, elevation: "sudo" };
+      elevation: "login",
+      source: "root"
+    });
+    if (input.sudoUser && input.sudoUser.user !== "root") {
+      candidates.push({
+        user: input.sudoUser.user,
+        authKeysPath: keysFor(input.sudoUser.home),
+        elevation: "sudo",
+        source: "sudo-user"
+      });
+    }
+  } else {
+    candidates.push({
+      user: input.invokerName,
+      authKeysPath: keysFor(input.invokerHome),
+      // Reaches root through sudo at run time, so this is NOT `rootUnavailable` — the
+      // caller must not warn that mail and edge will fail, because they won't.
+      elevation: input.hasPasswordlessSudo ? "sudo" : "none",
+      source: "invoker"
+    });
   }
-  return { ...invoker, rootUnavailable: true, elevation: "none" };
+  const carried = input.carried?.trim();
+  if (!carried) return candidates;
+  const already = candidates.findIndex((c) => c.user === carried);
+  if (already <= 0) return candidates;
+  const [promoted] = candidates.splice(already, 1);
+  return [{ ...promoted, source: "carried" }, ...candidates];
 }
 function hasPasswordlessSudo() {
   try {
-    return spawnSync3("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
+    return spawnSync3("sudo", ["-n", "-k", "true"], { stdio: "ignore" }).status === 0;
   } catch {
     return false;
   }
 }
-function plannedHostChannel(hostControl) {
-  if (!hostControl || process.platform !== "linux") return null;
+function sudoInvoker() {
+  const user = process.env.SUDO_USER?.trim();
+  if (!user || user === "root") return null;
+  const home = passwdHome(user);
+  return home ? { user, home } : null;
+}
+function plannedHostChannel(cfg) {
+  if (!cfg.hostControl || process.platform !== "linux") return null;
   let invoker;
   try {
     const info = userInfo();
@@ -808,14 +842,43 @@ function plannedHostChannel(hostControl) {
   } catch {
     invoker = { uid: -1, username: process.env.USER || process.env.LOGNAME || "root", home: homedir() };
   }
-  const decision = chooseHostChannelUser({
+  const pin = cfg.hostSshUser?.trim();
+  const candidates = chooseHostChannelUser({
     invokerUid: invoker.uid,
     invokerName: invoker.username,
     invokerHome: invoker.home,
     // Only probe sudo when it could change the outcome — a root invoker never needs it.
-    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo()
+    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo(),
+    // A pinned account is dialed, never written to on our guess about its home: root's
+    // file is fixed, and any other account's comes from the passwd database.
+    pinned: pin ? { user: pin, home: passwdHome(pin) ?? join4("/home", pin) } : null,
+    sudoUser: invoker.uid === 0 ? sudoInvoker() : null,
+    carried: cfg.hostSshUserCarried ?? null
   });
-  return { ...decision, keyPath: join4(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+  return { candidates, keyPath: join4(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+}
+function passwdHome(user) {
+  try {
+    const r = spawnSync3("getent", ["passwd", user], { encoding: "utf8" });
+    if (r.status !== 0) return null;
+    return (r.stdout ?? "").split("\n")[0]?.split(":")[5]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function previewHostChannel(cfg) {
+  const plan = plannedHostChannel(cfg);
+  if (!plan) return null;
+  const [first, ...rest] = plan.candidates;
+  if (!first) return null;
+  return {
+    user: first.user,
+    keyPath: plan.keyPath,
+    authKeysPath: first.authKeysPath,
+    rootUnavailable: first.elevation === "none",
+    elevation: first.elevation,
+    fallbacks: rest.map((c) => c.user)
+  };
 }
 function authorizeKeyAt(authKeysPath, pub) {
   mkdirSync3(dirname(authKeysPath), { recursive: true, mode: 448 });
@@ -855,15 +918,20 @@ function retireHostSshChannel(prev) {
   const keyDir = join4(COMPOSE_DIR, "host-ssh");
   if (!existsSync4(keyDir) && !prev.OPENSHIP_HOST_SSH_HOST) return;
   const invokerKeys = join4(homedir(), ".ssh", "authorized_keys");
-  const asRoot = hostChannelAccount(prev) === HOST_CHANNEL_DEFAULT_ACCOUNT;
+  const account = hostChannelAccount(prev);
+  const asRoot = account === HOST_CHANNEL_DEFAULT_ACCOUNT;
+  const accountKeys = asRoot ? ROOT_AUTHORIZED_KEYS : (() => {
+    const home = passwdHome(account);
+    return home ? join4(home, ".ssh", "authorized_keys") : invokerKeys;
+  })();
   const weAreRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(invokerKeys);
-  const alsoInvoker = asRoot ? revokeKeyAt(invokerKeys) : true;
+  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(accountKeys);
+  const alsoInvoker = accountKeys === invokerKeys ? true : revokeKeyAt(invokerKeys);
   try {
     rmSync(keyDir, { recursive: true, force: true });
   } catch {
   }
-  const stuck = asRoot ? ROOT_AUTHORIZED_KEYS : invokerKeys;
+  const stuck = accountKeys;
   console.log(
     revoked && alsoInvoker ? "  Host control off: dropped OPENSHIP_HOST_SSH_* from .env, deleted the host key and\n  revoked its authorized_keys line." : `  Host control off: dropped OPENSHIP_HOST_SSH_* from .env and deleted the host key (it
   can no longer be used). Removing its line needs root \u2014 run:
@@ -871,17 +939,10 @@ function retireHostSshChannel(prev) {
   );
 }
 function provisionHostSshChannel(cfg) {
-  const target = plannedHostChannel(cfg.hostControl);
-  if (!target) return { channel: null };
-  const { user, keyPath, authKeysPath, elevation, rootUnavailable } = target;
-  const provisioned = (channel) => {
-    const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
-    if (probeHostSshd(port) === "absent") {
-      return { channel, issue: { code: "no-sshd", detail: `port ${port}` } };
-    }
-    const auth = verifyChannelAuth(channel.user, channel.keyPath, port);
-    return auth.state === "refused" ? { channel, issue: { code: "auth-refused", detail: auth.detail, account: channel.user } } : { channel };
-  };
+  const plan = plannedHostChannel(cfg);
+  if (!plan) return { channel: null };
+  const { candidates, keyPath } = plan;
+  const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
   try {
     mkdirSync3(join4(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
     if (!existsSync4(keyPath)) {
@@ -896,24 +957,98 @@ function provisionHostSshChannel(cfg) {
     }
     const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
     if (!pub) return { channel: null, issue: { code: "empty-key" } };
-    if (rootUnavailable) {
-      console.warn(
-        "  \u26A0 Host control needs root, but this user isn't root and passwordless sudo isn't\n    available. Mail and edge host operations will fail. Re-run `openship up` as root\n    (or enable passwordless sudo) to fix. Continuing with a limited host channel."
-      );
-      authorizeKeyAt(authKeysPath, pub);
-      return provisioned({ user, keyPath });
+    const tried = [];
+    const losers = [];
+    let lastFailure = null;
+    for (const candidate of candidates) {
+      tried.push(candidate.user);
+      authorizeKeyAt(candidate.authKeysPath, pub);
+      if (probeHostSshd(port) === "absent") {
+        return { channel: { user: candidate.user, keyPath }, issue: { code: "no-sshd", detail: `port ${port}` } };
+      }
+      const auth = verifyChannelAuth(candidate.user, keyPath, port);
+      if (auth.state === "unreachable") {
+        return {
+          channel: { user: candidate.user, keyPath },
+          issue: { code: "unreachable", detail: auth.detail }
+        };
+      }
+      if (auth.state === "refused" || auth.state === "forced-command") {
+        lastFailure = { state: auth.state, detail: auth.detail };
+        losers.push(candidate);
+        continue;
+      }
+      const elevation = candidate.user === "root" ? "login" : auth.state === "ok" && auth.elevation === "refused" ? (
+        // MEASURED, over the session shape the api will use. This is the arm
+        // `hasPasswordlessSudo` used to get wrong from a cached ticket, which is what
+        // suppressed the warning below on boxes that genuinely could not reach root.
+        "none"
+      ) : candidate.elevation;
+      for (const loser of losers) revokeKeyAt(loser.authKeysPath);
+      if (elevation === "sudo") {
+        revokeRootKeyViaSudo();
+      }
+      if (elevation === "none") {
+        console.warn(
+          `  \u26A0 Host control needs root, and this channel has no route to it: it logs in as
+    \`${candidate.user}\`, and \`sudo -n\` was refused over that session. Mail and edge
+    host operations will fail. Grant that account passwordless sudo, or re-run
+    \`openship up\` as root, to fix. Continuing with a limited host channel.`
+        );
+      }
+      if (candidate.source === "sudo-user") {
+        console.log(
+          `  \u2192 Host channel settled on \`${candidate.user}\` rather than root: this host refused a
+    root login, and that account's key was accepted. It elevates per operation with
+    sudo, so no standing root credential is created. Pin one with
+    \`openship up --host-ssh-user <name>\`.`
+        );
+      }
+      return { channel: { user: candidate.user, keyPath }, issue: void 0 };
+    }
+    const carried = cfg.hostSshUserCarried?.trim();
+    for (const loser of losers) {
+      if (loser.user !== carried) revokeKeyAt(loser.authKeysPath);
     }
-    authorizeKeyAt(authKeysPath, pub);
-    if (elevation === "sudo") revokeRootKeyViaSudo();
-    return provisioned({ user, keyPath });
+    return {
+      channel: null,
+      issue: {
+        code: lastFailure?.state === "forced-command" ? "forced-command" : "auth-refused",
+        ...lastFailure?.detail ? { detail: lastFailure.detail } : {},
+        account: tried[tried.length - 1] ?? "",
+        tried,
+        ...tried.includes("root") ? (() => {
+          const setting = permitRootLoginSetting(port);
+          return setting ? { permitRootLogin: setting } : {};
+        })() : {}
+      }
+    };
   } catch (err) {
     return { channel: null, issue: { code: "error", detail: err?.message } };
   }
 }
+function permitRootLoginSetting(port) {
+  try {
+    const r = spawnSync3(
+      "sudo",
+      ["-n", "sshd", "-T", "-C", `user=root,host=localhost,addr=127.0.0.1,laddr=127.0.0.1,lport=${port}`],
+      { encoding: "utf8" }
+    );
+    if (r.status !== 0) return null;
+    return /^permitrootlogin\s+(\S+)/m.exec(r.stdout ?? "")?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sshdRefusesRootLogin(value) {
+  const v = value?.trim().toLowerCase();
+  return v === "no" || v === "forced-commands-only";
+}
 function verifyChannelAuth(user, keyPath, port) {
   const r = spawnSync3(
     "ssh",
     [
+      "-v",
       "-i",
       keyPath,
       "-p",
@@ -931,16 +1066,34 @@ function verifyChannelAuth(user, keyPath, port) {
       "-o",
       "IdentitiesOnly=yes",
       `${user}@127.0.0.1`,
-      "true"
+      CHANNEL_PROBE_COMMAND
     ],
-    { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"], timeout: 15e3 }
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 }
   );
-  if (r.status === 0) return { state: "ok" };
   if (r.error?.code === "ENOENT" || r.status === null) {
     return { state: "unknown" };
   }
-  const detail = (r.stderr || "").split("\n").map((l) => l.trim()).filter((l) => l && !/^Warning: Permanently added/.test(l)).join(" ");
-  return { state: "refused", detail: detail || `ssh exited ${r.status}` };
+  const stderr = r.stderr || "";
+  const stdout = r.stdout || "";
+  const sudo = /openship-sudo=(ok|refused)/.exec(stdout)?.[1];
+  if (r.status === 0 && sudo) {
+    return { state: "ok", elevation: sudo === "ok" ? "ok" : "refused" };
+  }
+  if (/Authenticated to |debug1: Authentication succeeded/.test(stderr)) {
+    return r.status === 0 ? { state: "ok", elevation: "unknown" } : { state: "forced-command", detail: sshProbeDetail(stderr, r.status) };
+  }
+  if (/^ssh: connect to host/m.test(stderr)) {
+    return { state: "unreachable", detail: sshProbeDetail(stderr, r.status) };
+  }
+  if (r.status === 0) return { state: "ok", elevation: "unknown" };
+  return { state: "refused", detail: sshProbeDetail(stderr, r.status) };
+}
+var CHANNEL_PROBE_COMMAND = "if sudo -n -k true 2>/dev/null; then echo openship-sudo=ok; else echo openship-sudo=refused; fi; exit 0";
+function sshProbeDetail(stderr, status) {
+  const detail = stderr.split("\n").map((l) => l.trim()).filter(
+    (l) => l && !/^debug\d*:/.test(l) && !/^OpenSSH_/.test(l) && !/^Warning: Permanently added/.test(l)
+  ).join(" ");
+  return detail || `ssh exited ${status}`;
 }
 function keygenWhy(r) {
   if (r.error?.code === "ENOENT") {
@@ -977,7 +1130,16 @@ function hostIssueNote(text) {
 }
 function renderHostChannelIssue(issue, ctx) {
   const detail = issue.detail ? ` (${issue.detail})` : "";
-  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : issue.code === "auth-refused" ? `  \u26A0 Host control is provisioned, but this host REFUSED the channel's key.` : `  \u26A0 Host control could NOT be provisioned on this box.`;
+  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : issue.code === "unreachable" ? `  \u26A0 Host control is provisioned, but nothing answered at the SSH address we dialed${detail}.` : issue.code === "forced-command" ? (
+    // Like `auth-refused` and unlike `no-sshd`: a key that can't run a command is
+    // not a channel, so nothing was written and the headline must not imply it was.
+    `  \u26A0 Host control could NOT be provisioned: this host's sshd allows the channel no commands.`
+  ) : issue.code === "auth-refused" ? (
+    // NOT "is provisioned, but": a refusal no longer leaves a channel behind. The
+    // run tried every account it could authorize and none of them were let in, so
+    // there is nothing provisioned to describe.
+    `  \u26A0 Host control could NOT be provisioned: this host REFUSED the channel's key.`
+  ) : `  \u26A0 Host control could NOT be provisioned on this box.`;
   let cause;
   switch (issue.code) {
     case "keygen":
@@ -996,14 +1158,27 @@ function renderHostChannelIssue(issue, ctx) {
         sshdEnableHint: thisHost().sshdEnableHint()
       }).body;
       break;
-    case "auth-refused":
-      cause = `The key was authorized for \`${issue.account ?? "the channel account"}\` and sshd is listening, but the dial was refused${detail}. Either that account's \`authorized_keys\` is not the file we wrote to, or sshd permits it no login \u2014 \`sshd -T | grep -i permitrootlogin\` shows the second. Until it is fixed the api container will be refused every time it dials ${ctx.target}.`;
+    case "unreachable":
+      cause = `sshd is listening on this host, but the verification dial to 127.0.0.1 was not answered${detail}. That is an ADDRESS problem, not a key problem: a \`ListenAddress\` that excludes loopback, or a local firewall rule. The api container dials ${ctx.target}, so check that sshd accepts connections there \u2014 \`sudo sshd -T | grep -i listenaddress\` shows what it binds.`;
       break;
+    case "forced-command":
+      cause = `sshd ACCEPTED the channel's key for \`${issue.account ?? "the channel account"}\` and then closed the session without running anything${detail}. That is what \`PermitRootLogin forced-commands-only\` does to a key with no \`command=\` of its own, and it is indistinguishable from a working channel until a host operation runs. Either permit this account a normal login, or use an account that has one: \`openship up --host-ssh-user <name>\`.`;
+      break;
+    case "auth-refused": {
+      const accounts = issue.tried?.length ? issue.tried.map((a) => `\`${a}\``).join(" then ") : `\`${issue.account ?? "the channel account"}\``;
+      const rootNote = issue.permitRootLogin ? ` This host's sshd reports \`PermitRootLogin ${issue.permitRootLogin}\`${sshdRefusesRootLogin(issue.permitRootLogin) ? ", which refuses a root login outright" : ""}.` : "";
+      cause = `The key was authorized for ${accounts} and sshd is listening, but every dial was refused${detail}.${rootNote} sshd is not telling us which of several causes it is \u2014 \`Permission denied (publickey)\` is the same message for an account that may not log in, an \`authorized_keys\` sshd doesn't read for it, and a home directory whose permissions it rejects. Three things fix it:
+  \u2022 name an account that CAN log in: \`openship up --host-ssh-user <name>\`
+  \u2022 permit root a key login: \`PermitRootLogin prohibit-password\` (still refuses passwords), or scope it to the container with a \`Match Address\` block
+  \u2022 or leave host control off: \`openship up --no-host-control\`
+Until one of them is done the api container will be refused every time it dials ${ctx.target}.`;
+      break;
+    }
     case "error":
       cause = `Setting up the channel's key failed${detail}.`;
       break;
   }
-  const continuity = issue.code === "no-sshd" || issue.code === "auth-refused" ? "" : ctx.kept ? hostIssueNote(
+  const continuity = issue.code === "no-sshd" || issue.code === "unreachable" ? "" : ctx.kept ? hostIssueNote(
     "Kept the host channel this install already had in `.env` rather than dropping it: its key is still authorized, so the api container keeps the access it had instead of losing it to this failure."
   ) : hostIssueNote(
     "OPENSHIP_HOST_SSH_HOST is therefore unset, and host operations refuse rather than run against the api container's own filesystem."
@@ -1345,7 +1520,14 @@ function resolveEnvConfig(prev, opts) {
     // so, and every `openship up` overwrote a hand-edited `.env` back to the
     // value that didn't work (#490/#482).
     hostSshHost: keepConfig(prev, "OPENSHIP_HOST_SSH_HOST", opts.hostSshHost) ?? HOST_CHANNEL_DEFAULT_HOST,
-    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT)
+    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT),
+    // Sticky like its siblings, but kept in its OWN key rather than reusing
+    // OPENSHIP_HOST_SSH_USER. That key records what provisioning SETTLED on, and the two
+    // must not be conflated: reading a settled value back as a pin would freeze the account
+    // a box happens to have — including the refused `root` on every install #527 broke — and
+    // the fallback that repairs them could never run.
+    ...keepConfig(prev, "OPENSHIP_HOST_SSH_USER_PIN", opts.hostSshUser) ? { hostSshUser: keepConfig(prev, "OPENSHIP_HOST_SSH_USER_PIN", opts.hostSshUser) } : {},
+    ...prev.OPENSHIP_HOST_SSH_USER?.trim() ? { hostSshUserCarried: prev.OPENSHIP_HOST_SSH_USER.trim() } : {}
   };
 }
 function toPort(value) {
@@ -1409,6 +1591,7 @@ async function resolveComposePorts(prefs, opts = {}) {
 var OMITTABLE_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "OPENSHIP_HOST_SSH_HOST",
   "OPENSHIP_HOST_SSH_USER",
+  "OPENSHIP_HOST_SSH_USER_PIN",
   "OPENSHIP_HOST_SSH_PORT",
   "OPENSHIP_HOST_SSH_KEY",
   "OPENSHIP_HOST_KEY_PATH",
@@ -1421,7 +1604,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.6" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.7" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [
@@ -1470,6 +1653,8 @@ function managedEnvLines(opts, host, cfg, prev) {
   if (host) {
     lines.push(
       `OPENSHIP_HOST_SSH_HOST=${cfg.hostSshHost}`,
+      // What provisioning SETTLED on this run — a fact about the box, not a setting. The
+      // operator's pin, when there is one, is written OUTSIDE this block (see below).
       `OPENSHIP_HOST_SSH_USER=${host.user}`,
       `OPENSHIP_HOST_SSH_PORT=${cfg.hostSshPort}`,
       "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
@@ -1477,6 +1662,7 @@ function managedEnvLines(opts, host, cfg, prev) {
       ...hostGatewayEnv(prev)
     );
   }
+  if (cfg.hostSshUser) lines.push(`OPENSHIP_HOST_SSH_USER_PIN=${cfg.hostSshUser}`);
   return lines;
 }
 function renderEnvAndCarried(opts, host, cfg, prev) {
@@ -1561,7 +1747,7 @@ function composePlan(opts) {
   const prev = readEnvFile();
   const cfg = resolveEnvConfig(prev, opts);
   const buildDir = opts.build === false ? null : sourceBuildDir();
-  const hostChannel = plannedHostChannel(cfg.hostControl);
+  const hostChannel = previewHostChannel(cfg);
   const settings = [];
   const newSecrets = [];
   for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {

package/dist/{chunk-4I2BM2DT.js → chunk-PVP4RGWT.js}

@@ -4,15 +4,15 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   hostRefusal
-} from "./chunk-YMMQRE5J.js";
+} from "./chunk-BLEXTYRK.js";
 import {
   elevatedExecutor,
   resolveEnvironment
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-FZ6QCF6B.js";
 import {
   answered,
   refused
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/privilege.ts
 function rootChecked(executor, why) {

package/dist/{chunk-RSR7PFIQ.js → chunk-QHMDCYZ3.js}

@@ -5,19 +5,19 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   envOps,
   opScript
-} from "./chunk-YMMQRE5J.js";
+} from "./chunk-BLEXTYRK.js";
 import {
   resolveEnvironment
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-FZ6QCF6B.js";
 import {
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 import {
   SYSTEM,
   answered,
   refused,
   safeErrorMessage
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";

package/dist/chunk-R4VDPFLS.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+
+// ../../packages/adapters/src/system/reachability.ts
+import { connect } from "net";
+import { request } from "http";
+function classifyDialError(code) {
+  switch (code) {
+    case "ECONNREFUSED":
+    case "ECONNRESET":
+      return "refused";
+    case "ENOTFOUND":
+    case "EAI_AGAIN":
+      return "unresolved";
+    case "EHOSTUNREACH":
+    case "ENETUNREACH":
+    case "ENETDOWN":
+      return "no_route";
+    // The kernel's own connect timeout, i.e. our `timeout` reported for us.
+    case "ETIMEDOUT":
+      return "timeout";
+    default:
+      return "error";
+  }
+}
+function probeTcpDetailed(host, port, timeoutMs = 2500) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (result, socket2) => {
+      if (settled) return;
+      settled = true;
+      try {
+        socket2?.destroy();
+      } catch {
+      }
+      resolve(result);
+    };
+    const socket = connect({ host, port });
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => done({ ok: true }, socket));
+    socket.once(
+      "timeout",
+      () => done({ ok: false, reason: "timeout", message: `no response within ${timeoutMs}ms` }, socket)
+    );
+    socket.once("error", (err) => {
+      const errno = err;
+      done(
+        {
+          ok: false,
+          reason: classifyDialError(errno.code),
+          ...errno.code ? { code: errno.code } : {},
+          ...errno.message ? { message: errno.message } : {}
+        },
+        socket
+      );
+    });
+  });
+}
+function probeHostedHttp(opts) {
+  const { hostname, path = "/", port = 80, timeoutMs = 3e3 } = opts;
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
+    const req = request(
+      {
+        host: "127.0.0.1",
+        port,
+        path,
+        method: "GET",
+        timeout: timeoutMs,
+        // Claim https so the :80 block SERVES instead of answering our own
+        // HTTP→HTTPS redirect before the doc root is consulted — see the curl twin in
+        // output-exists.ts for why a 301 here read as a healthy site.
+        headers: { Host: hostname, "X-Forwarded-Proto": "https" }
+      },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        res.resume();
+        done(
+          status > 0 ? { status, served: status >= 200 && status < 400 || status === 401 || status === 403 } : null
+        );
+      }
+    );
+    const fail = () => {
+      try {
+        req.destroy();
+      } catch {
+      }
+      done(null);
+    };
+    req.once("timeout", fail);
+    req.once("error", fail);
+    req.end();
+  });
+}
+
+export {
+  probeTcpDetailed,
+  probeHostedHttp
+};

package/dist/{chunk-VTGPEC6B.js → chunk-RDXT4BQB.js}

@@ -7,18 +7,20 @@ import {
   composeInstallExists,
   readComposeEnvFile,
   startUnitHint
-} from "./chunk-5DMWSTOM.js";
+} from "./chunk-VQM6JHJB.js";
 import {
   INTERNAL_TOKEN_FILE,
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
-  EDGE_CONTAINER_NAME,
   edgeCrashReason
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-GIPJNNI5.js";
+import {
+  EDGE_CONTAINER_NAME
+} from "./chunk-UWEV6XTS.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";