openship 0.6.6 → 0.6.8

package/dist/{chunk-NK5N5LXN.js → chunk-RCMERVBL.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-WVAML4H6.js";
+} from "./chunk-5I3COAFH.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -36,18 +36,18 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-VTGPEC6B.js";
+} from "./chunk-7YBWXEM6.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-5DMWSTOM.js";
+} from "./chunk-5UXHT6ED.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-CBLD2HS5.js";
+} from "./chunk-NUT6HKK6.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,15 +58,17 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-T6DVUX4F.js";
 import {
-  EDGE_CONTAINER_NAME,
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-X53JXRS4.js";
+import {
+  EDGE_CONTAINER_NAME
+} from "./chunk-D6HU4VUZ.js";
 import {
   isValidEmail
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -609,6 +611,7 @@ async function planUp(opts) {
       ...opts.hostControl === false ? { noHostControl: true } : {},
       ...opts.hostSshHost ? { hostSshHost: opts.hostSshHost } : {},
       ...opts.hostSshPort ? { hostSshPort: opts.hostSshPort } : {},
+      ...opts.hostSshUser ? { hostSshUser: opts.hostSshUser } : {},
       ...opts.resetSecrets ? { resetSecrets: true } : {},
       ...opts.mail ? { mail: true } : {}
     });
@@ -630,6 +633,13 @@ async function planUp(opts) {
         ] : [],
         ...stack.hostChannel.rootUnavailable ? [
           "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root, or enable passwordless sudo, to fix)"
+        ] : [],
+        // A plan that named one account and then settled on another would read as the
+        // plan being wrong, and this run genuinely cannot know which: only a dial can
+        // establish whether sshd accepts the first account, and dialing means writing
+        // the key a dry run exists not to write (#527, previewHostChannel).
+        ...stack.hostChannel.fallbacks?.length ? [
+          `if this host's sshd refuses that account, falls back to ${stack.hostChannel.fallbacks.join(", ")} (pin one with --host-ssh-user)`
         ] : []
       ] : [],
       ...stack.mountDirs.map((d) => `${d}/  (edge routing state + certs)`),
@@ -1071,6 +1081,9 @@ var upCommand = new Command("up").description("Start Openship as a persistent se
 ).option(
   "--host-ssh-port <port>",
   "Compose mode: port the host's sshd listens on for host operations (default 22). Preserved across re-runs."
+).option(
+  "--host-ssh-user <name>",
+  "Compose mode: the host account the api container logs in as for host operations. Normally left unset \u2014 provisioning authorizes a key and DIALS to find an account this host's sshd actually accepts (root when invoked as root, otherwise the invoking user, falling back to $SUDO_USER when a root login is refused). Set this when neither is the account you want, or when sshd's rules mean neither works: the named account is used as-is and never falls back, so it must be able to log in over SSH and should have passwordless sudo (host operations elevate per command). Preserved across re-runs."
 ).option(
   "--open-host-firewall",
   "Compose mode: if the api container can't reach this machine's SSH port, add the host firewall rule that allows it (scoped to the container subnet, ufw/firewalld only). Without this the blocked channel is reported and left alone. Not implied by --yes."
@@ -1213,6 +1226,7 @@ async function runCompose(opts) {
     // so the containers would keep an environment the file no longer shows.
     hostSshHost: opts.hostSshHost,
     hostSshPort: opts.hostSshPort,
+    hostSshUser: opts.hostSshUser,
     resetSecrets: opts.resetSecrets,
     mail: opts.mail
   });
@@ -1267,6 +1281,7 @@ async function runCompose(opts) {
     // configured with rather than resetting it to host.docker.internal:22.
     hostSshHost: opts.hostSshHost,
     hostSshPort: opts.hostSshPort,
+    hostSshUser: opts.hostSshUser,
     resetSecrets: opts.resetSecrets,
     // Absent on a re-run keeps the install's mode (resolveEnvConfig), so this
     // never flips a mail box back to the platform shell.
@@ -1549,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.6"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.8"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-RXQBD4ZY.js → chunk-RHLNVZMS.js}

@@ -7,9 +7,9 @@ const require = __ospCreateRequire(import.meta.url);
 var NoopInfraProvider = class {
   async registerRoute(_route) {
   }
-  async removeRoute(_domain) {
+  async removeRoute(_domain, _opts) {
   }
-  async provisionCert(domain) {
+  async provisionCert(domain, _opts) {
     return { domain, expiresAt: "", issuer: "none", verified: false };
   }
   async renewCert(domain) {

package/dist/chunk-SK4FFCFR.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  sq
+} from "./chunk-P7RCYELG.js";
+
+// ../../packages/adapters/src/runtime/managed-artifact.ts
+var MANAGED_ARTIFACT_BASE = "/opt/openship";
+var PROTECTED_ROOTS = /* @__PURE__ */ new Set([
+  MANAGED_ARTIFACT_BASE,
+  // BareRuntime's own layout (workDir = MANAGED_ARTIFACT_BASE): releases/<depId>,
+  // .builds/<sessionId>. The parents hold every project's releases at once.
+  `${MANAGED_ARTIFACT_BASE}/releases`,
+  `${MANAGED_ARTIFACT_BASE}/.builds`,
+  // The static tree, whose parent is ALSO the one directory bind-mounted into the
+  // edge container — removing it stops the box serving every static site it hosts.
+  `${MANAGED_ARTIFACT_BASE}/static`,
+  `${MANAGED_ARTIFACT_BASE}/static/releases`,
+  `${MANAGED_ARTIFACT_BASE}/static/.builds`
+]);
+function canonical(ref) {
+  const trimmed = ref.trim();
+  return trimmed.length > 1 ? trimmed.replace(/\/+$/, "") : trimmed;
+}
+function assertManagedArtifactPath(ref) {
+  const target = canonical(ref);
+  if (!target.startsWith("/") || target.includes("..")) {
+    throw new Error(
+      `Refusing to remove "${ref}": an artifact path must be absolute and free of "..".`
+    );
+  }
+  if (PROTECTED_ROOTS.has(target)) {
+    throw new Error(
+      `Refusing to remove "${ref}": that is a shared parent directory, not one deployment's output.`
+    );
+  }
+  if (target !== MANAGED_ARTIFACT_BASE && !target.startsWith(`${MANAGED_ARTIFACT_BASE}/`)) {
+    throw new Error(
+      `Refusing to remove "${ref}": outside ${MANAGED_ARTIFACT_BASE}. Openship removes only directories it created (release dirs, static doc-roots, build dirs).`
+    );
+  }
+}
+async function removeManagedArtifact(executor, ref) {
+  assertManagedArtifactPath(ref);
+  const target = canonical(ref);
+  if (executor) {
+    await executor.exec(`rm -rf ${sq(target)}`);
+    if (await executor.exists(target)) {
+      throw new Error(`Failed to remove ${target}: still present after rm -rf.`);
+    }
+    return;
+  }
+  const { rm, access } = await import("fs/promises");
+  await rm(target, { recursive: true, force: true });
+  const stillThere = await access(target).then(
+    () => true,
+    () => false
+  );
+  if (stillThere) throw new Error(`Failed to remove ${target}: still present after rm.`);
+}
+function isArtifactPathRef(ref) {
+  return ref.startsWith("/");
+}
+
+export {
+  removeManagedArtifact,
+  isArtifactPathRef
+};

package/dist/{chunk-4I2BM2DT.js → chunk-T46BQOLY.js}

@@ -4,15 +4,15 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   hostRefusal
-} from "./chunk-YMMQRE5J.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   elevatedExecutor,
   resolveEnvironment
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   answered,
   refused
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/privilege.ts
 function rootChecked(executor, why) {

package/dist/{chunk-6FH4AXVY.js → chunk-T6DVUX4F.js}

@@ -8,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";

package/dist/{chunk-PCPVTH6M.js → chunk-TAZZZKYO.js}

@@ -2,15 +2,17 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  isSshAuthError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
 import {
   HOST_CHANNEL_AUTH_REJECTED,
   HOST_CHANNEL_NOT_PROVISIONED,
   HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
   hostFirewallRule,
-  isSshAuthError,
-  safeErrorMessage,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
+  safeErrorMessage
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";

package/dist/{chunk-MLYSEZQB.js → chunk-UAWY6X7V.js}

@@ -2,103 +2,52 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  probeTcpDetailed
+} from "./chunk-R4VDPFLS.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-Q7WGTQQ5.js";
+} from "./chunk-VAI5VOOI.js";
 import {
   connectSshClient,
   openDockerDialStdioChannel,
   openSftp,
   openSshUnixSocket,
   reconcileKnownHosts
-} from "./chunk-PCPVTH6M.js";
+} from "./chunk-TAZZZKYO.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   emitBufferedLines,
   flushBufferedLines,
   hasLocalCommand,
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
+import {
+  HostChannelUnavailableError,
+  SshDisconnectedError,
+  commandForError,
+  isSshAuthError
+} from "./chunk-N5YZMO33.js";
 import {
   HOST_CHANNEL_AUTH_REJECTED,
   HOST_CHANNEL_NOT_PROVISIONED,
   HOST_CHANNEL_UNPROVISIONED,
-  HostChannelUnavailableError,
-  SshDisconnectedError,
   TRANSFER_EXCLUDES,
-  commandForError,
   explainHostChannelCause,
   formatBytes,
   hostChannelAccount,
   hostFirewallRule,
-  isSshAuthError,
   safeErrorMessage
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/executor.ts
 import { existsSync, readFileSync } from "fs";
 import { networkInterfaces } from "os";
 
-// ../../packages/adapters/src/system/reachability.ts
-import { connect } from "net";
-import { request } from "http";
-function classifyDialError(code) {
-  switch (code) {
-    case "ECONNREFUSED":
-    case "ECONNRESET":
-      return "refused";
-    case "ENOTFOUND":
-    case "EAI_AGAIN":
-      return "unresolved";
-    case "EHOSTUNREACH":
-    case "ENETUNREACH":
-    case "ENETDOWN":
-      return "no_route";
-    // The kernel's own connect timeout, i.e. our `timeout` reported for us.
-    case "ETIMEDOUT":
-      return "timeout";
-    default:
-      return "error";
-  }
-}
-function probeTcpDetailed(host, port, timeoutMs = 2500) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (result, socket2) => {
-      if (settled) return;
-      settled = true;
-      try {
-        socket2?.destroy();
-      } catch {
-      }
-      resolve(result);
-    };
-    const socket = connect({ host, port });
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => done({ ok: true }, socket));
-    socket.once(
-      "timeout",
-      () => done({ ok: false, reason: "timeout", message: `no response within ${timeoutMs}ms` }, socket)
-    );
-    socket.once("error", (err) => {
-      const errno = err;
-      done(
-        {
-          ok: false,
-          reason: classifyDialError(errno.code),
-          ...errno.code ? { code: errno.code } : {},
-          ...errno.message ? { message: errno.message } : {}
-        },
-        socket
-      );
-    });
-  });
-}
-
 // ../../packages/adapters/src/system/ssh-executor.ts
 import { createReadStream } from "fs";
 import { mkdtemp as mkdtemp2, rm as fsRm2, stat } from "fs/promises";
@@ -113,7 +62,10 @@ import { tmpdir } from "os";
 import { join } from "path";
 function packLocalArchive(tarArgs, outFile) {
   return new Promise((resolve, reject) => {
-    const tar = spawn("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: getTarCreateEnv() });
+    const tar = spawn("tar", tarArgs, {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: getTarCreateEnv()
+    });
     const out = createWriteStream(outFile);
     let stderr = "";
     let tarCode = null;
@@ -122,7 +74,12 @@ function packLocalArchive(tarArgs, outFile) {
     const settle = () => {
       if (!tarClosed || !outClosed) return;
       if (tarCode === 0) resolve();
-      else reject(new Error(`tar failed (exit ${tarCode})${stderr.trim() ? `: ${stderr.trim().slice(-300)}` : ""}`));
+      else
+        reject(
+          new Error(
+            `tar failed (exit ${tarCode})${stderr.trim() ? `: ${stderr.trim().slice(-300)}` : ""}`
+          )
+        );
     };
     tar.stderr.on("data", (d) => {
       stderr += d.toString();
@@ -153,9 +110,17 @@ async function extractRemoteArchive(exec, remoteArchive, remotePath, expectedByt
   );
   onLog?.(logEntry(`Transferred ${formatBytes(expectedBytes)} and extracted on the server.`));
 }
+function formatPrivateKeyForOpenSsh(privateKey) {
+  const normalized = privateKey.replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
+  return normalized.endsWith("\n") ? normalized : `${normalized}
+`;
+}
 async function canUseRemoteRsync(deps) {
   if (deps.config.privateKey && deps.config.privateKeyPassphrase && !deps.config.sshAgent) {
-    return { ok: false, reason: "encrypted SSH keys without an agent are not supported by non-interactive rsync" };
+    return {
+      ok: false,
+      reason: "encrypted SSH keys without an agent are not supported by non-interactive rsync"
+    };
   }
   const [localRsync, localSsh, localSshpass, remoteRsync] = await Promise.all([
     hasLocalCommand("rsync"),
@@ -165,7 +130,8 @@ async function canUseRemoteRsync(deps) {
   ]);
   if (!localRsync) return { ok: false, reason: "local rsync is not installed" };
   if (!localSsh) return { ok: false, reason: "local ssh is not installed" };
-  if (!localSshpass) return { ok: false, reason: "local sshpass is not installed for password-based rsync" };
+  if (!localSshpass)
+    return { ok: false, reason: "local sshpass is not installed for password-based rsync" };
   if (!remoteRsync) return { ok: false, reason: "remote rsync is not installed" };
   return { ok: true };
 }
@@ -208,7 +174,7 @@ async function withTemporaryPrivateKey(config, fn) {
   const tempDir = await mkdtemp(join(tmpdir(), "openship-rsync-key-"));
   const keyPath = join(tempDir, "id_rsa");
   try {
-    await fsWriteFile(keyPath, config.privateKey);
+    await fsWriteFile(keyPath, formatPrivateKeyForOpenSsh(config.privateKey), { mode: 384 });
     await chmod(keyPath, 384);
     return await fn(keyPath);
   } finally {
@@ -254,7 +220,12 @@ async function uploadFileWithRsync(localFile, remoteFile, deps, onLog, opts) {
     let lastCode = 1;
     for (let attempt = 1; attempt <= retries; attempt++) {
       if (attempt > 1) {
-        onLog?.(logEntry(`Connection dropped \u2014 resuming upload (attempt ${attempt}/${retries})...`, "warn"));
+        onLog?.(
+          logEntry(
+            `Connection dropped \u2014 resuming upload (attempt ${attempt}/${retries})...`,
+            "warn"
+          )
+        );
       }
       const args = [
         "-a",
@@ -1720,7 +1691,7 @@ async function verifyHostChannelAuth(config) {
   let hint = null;
   let forwarding = "unknown";
   try {
-    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-JBMA7SN4.js");
+    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-2XWZCMGI.js");
     const client = await connectSshClient2({
       host: config.host,
       port: config.port,

package/dist/{chunk-Q7WGTQQ5.js → chunk-VAI5VOOI.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   PACKAGE_ROOT_ONLY_EXCLUDES
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/archive.ts
 import { execFile } from "child_process";