openship 0.6.6 → 0.6.8

package/dist/{chunk-YIMOCZBZ.js → chunk-5DJOB7IX.js}

@@ -6,13 +6,13 @@ import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-LH2PLRQO.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   wrapLocalBuildCommand
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
 
 // ../../packages/adapters/src/runtime/local-build.ts
 var LOCAL_BUILD_DIR = "/tmp/openship/.builds";

package/dist/{chunk-WVAML4H6.js → chunk-5I3COAFH.js}

@@ -10,28 +10,28 @@ import {
   readComposeEnvFile,
   resolveLocalEnvironmentSync,
   thisHost
-} from "./chunk-5DMWSTOM.js";
+} from "./chunk-5UXHT6ED.js";
 import {
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   systemCatalog
-} from "./chunk-A4GXYE4L.js";
+} from "./chunk-NIYD7MD2.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
-} from "./chunk-RSR7PFIQ.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   DEFAULT_DOCKER_SOCKET_PATH,
   resolveLocalDockerSocketPath
-} from "./chunk-77QDF6UD.js";
+} from "./chunk-3MP6ACKM.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-X53JXRS4.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_BLOCKED,
@@ -51,7 +51,7 @@ import {
   hostFirewallRule,
   hostFirewallRuleRemoval,
   wrapText
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // src/lib/host-channel-preflight.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -66,13 +66,14 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
+  realpathSync,
   renameSync,
   rmSync,
   statSync,
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir, userInfo } from "os";
-import { dirname, join as join4, resolve as resolve2 } from "path";
+import { dirname, join as join4, relative, resolve as resolve2 } from "path";
 
 // src/lib/ports.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -400,8 +401,30 @@ async function rebuildFromSource(info) {
 // src/lib/compose.ts
 var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
 var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
+function canonicalComposeHostPath(target, platform = process.platform, resolvePath = realpathSync) {
+  if (platform !== "darwin") return target;
+  try {
+    return resolvePath(target);
+  } catch {
+    let parent = target;
+    while (parent !== dirname(parent)) {
+      parent = dirname(parent);
+      try {
+        return join4(resolvePath(parent), relative(parent, target));
+      } catch {
+      }
+    }
+    throw new Error(`Could not resolve edge bind-mount source ${target} on this Mac.`);
+  }
+}
+function composeEdgeMounts() {
+  return EDGE_CONTAINER_MOUNTS.map((mount) => ({
+    ...mount,
+    host: canonicalComposeHostPath(mount.host)
+  }));
+}
 function edgeVolumeYaml(indent) {
-  return EDGE_CONTAINER_MOUNTS.map((m) => `${indent}- ${m.host}:${m.container}:z`).join("\n");
+  return composeEdgeMounts().map((m) => `${indent}- ${m.host}:${m.container}:z`).join("\n");
 }
 var DOCKER_CONFIG_MOUNT_MARKER = "__OPENSHIP_DOCKER_CONFIG_MOUNT__";
 function dockerConfigMountYaml(indent) {
@@ -775,32 +798,66 @@ function stripHostAuthorizedKeys(existing) {
 }
 var ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
 function chooseHostChannelUser(input) {
+  const keysFor = (home) => join4(home, ".ssh", "authorized_keys");
+  if (input.pinned) {
+    return [
+      {
+        user: input.pinned.user,
+        authKeysPath: input.pinned.user === "root" ? ROOT_AUTHORIZED_KEYS : keysFor(input.pinned.home),
+        // Unknowable for an arbitrary account; the dial measures it (see provisionHostSshChannel).
+        elevation: input.pinned.user === "root" ? "login" : "sudo",
+        source: "pin"
+      }
+    ];
+  }
+  const candidates = [];
   if (input.invokerUid === 0) {
-    return {
+    candidates.push({
       user: "root",
       authKeysPath: ROOT_AUTHORIZED_KEYS,
-      rootUnavailable: false,
-      elevation: "login"
-    };
-  }
-  const invoker = {
-    user: input.invokerName,
-    authKeysPath: join4(input.invokerHome, ".ssh", "authorized_keys")
-  };
-  if (input.hasPasswordlessSudo) {
-    return { ...invoker, rootUnavailable: false, elevation: "sudo" };
+      elevation: "login",
+      source: "root"
+    });
+    if (input.sudoUser && input.sudoUser.user !== "root") {
+      candidates.push({
+        user: input.sudoUser.user,
+        authKeysPath: keysFor(input.sudoUser.home),
+        elevation: "sudo",
+        source: "sudo-user"
+      });
+    }
+  } else {
+    candidates.push({
+      user: input.invokerName,
+      authKeysPath: keysFor(input.invokerHome),
+      // Reaches root through sudo at run time, so this is NOT `rootUnavailable` — the
+      // caller must not warn that mail and edge will fail, because they won't.
+      elevation: input.hasPasswordlessSudo ? "sudo" : "none",
+      source: "invoker"
+    });
   }
-  return { ...invoker, rootUnavailable: true, elevation: "none" };
+  const carried = input.carried?.trim();
+  if (!carried) return candidates;
+  const already = candidates.findIndex((c) => c.user === carried);
+  if (already <= 0) return candidates;
+  const [promoted] = candidates.splice(already, 1);
+  return [{ ...promoted, source: "carried" }, ...candidates];
 }
 function hasPasswordlessSudo() {
   try {
-    return spawnSync3("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
+    return spawnSync3("sudo", ["-n", "-k", "true"], { stdio: "ignore" }).status === 0;
   } catch {
     return false;
   }
 }
-function plannedHostChannel(hostControl) {
-  if (!hostControl || process.platform !== "linux") return null;
+function sudoInvoker() {
+  const user = process.env.SUDO_USER?.trim();
+  if (!user || user === "root") return null;
+  const home = passwdHome(user);
+  return home ? { user, home } : null;
+}
+function plannedHostChannel(cfg) {
+  if (!cfg.hostControl || process.platform !== "linux") return null;
   let invoker;
   try {
     const info = userInfo();
@@ -808,14 +865,43 @@ function plannedHostChannel(hostControl) {
   } catch {
     invoker = { uid: -1, username: process.env.USER || process.env.LOGNAME || "root", home: homedir() };
   }
-  const decision = chooseHostChannelUser({
+  const pin = cfg.hostSshUser?.trim();
+  const candidates = chooseHostChannelUser({
     invokerUid: invoker.uid,
     invokerName: invoker.username,
     invokerHome: invoker.home,
     // Only probe sudo when it could change the outcome — a root invoker never needs it.
-    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo()
+    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo(),
+    // A pinned account is dialed, never written to on our guess about its home: root's
+    // file is fixed, and any other account's comes from the passwd database.
+    pinned: pin ? { user: pin, home: passwdHome(pin) ?? join4("/home", pin) } : null,
+    sudoUser: invoker.uid === 0 ? sudoInvoker() : null,
+    carried: cfg.hostSshUserCarried ?? null
   });
-  return { ...decision, keyPath: join4(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+  return { candidates, keyPath: join4(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+}
+function passwdHome(user) {
+  try {
+    const r = spawnSync3("getent", ["passwd", user], { encoding: "utf8" });
+    if (r.status !== 0) return null;
+    return (r.stdout ?? "").split("\n")[0]?.split(":")[5]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function previewHostChannel(cfg) {
+  const plan = plannedHostChannel(cfg);
+  if (!plan) return null;
+  const [first, ...rest] = plan.candidates;
+  if (!first) return null;
+  return {
+    user: first.user,
+    keyPath: plan.keyPath,
+    authKeysPath: first.authKeysPath,
+    rootUnavailable: first.elevation === "none",
+    elevation: first.elevation,
+    fallbacks: rest.map((c) => c.user)
+  };
 }
 function authorizeKeyAt(authKeysPath, pub) {
   mkdirSync3(dirname(authKeysPath), { recursive: true, mode: 448 });
@@ -855,15 +941,20 @@ function retireHostSshChannel(prev) {
   const keyDir = join4(COMPOSE_DIR, "host-ssh");
   if (!existsSync4(keyDir) && !prev.OPENSHIP_HOST_SSH_HOST) return;
   const invokerKeys = join4(homedir(), ".ssh", "authorized_keys");
-  const asRoot = hostChannelAccount(prev) === HOST_CHANNEL_DEFAULT_ACCOUNT;
+  const account = hostChannelAccount(prev);
+  const asRoot = account === HOST_CHANNEL_DEFAULT_ACCOUNT;
+  const accountKeys = asRoot ? ROOT_AUTHORIZED_KEYS : (() => {
+    const home = passwdHome(account);
+    return home ? join4(home, ".ssh", "authorized_keys") : invokerKeys;
+  })();
   const weAreRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(invokerKeys);
-  const alsoInvoker = asRoot ? revokeKeyAt(invokerKeys) : true;
+  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(accountKeys);
+  const alsoInvoker = accountKeys === invokerKeys ? true : revokeKeyAt(invokerKeys);
   try {
     rmSync(keyDir, { recursive: true, force: true });
   } catch {
   }
-  const stuck = asRoot ? ROOT_AUTHORIZED_KEYS : invokerKeys;
+  const stuck = accountKeys;
   console.log(
     revoked && alsoInvoker ? "  Host control off: dropped OPENSHIP_HOST_SSH_* from .env, deleted the host key and\n  revoked its authorized_keys line." : `  Host control off: dropped OPENSHIP_HOST_SSH_* from .env and deleted the host key (it
   can no longer be used). Removing its line needs root \u2014 run:
@@ -871,17 +962,10 @@ function retireHostSshChannel(prev) {
   );
 }
 function provisionHostSshChannel(cfg) {
-  const target = plannedHostChannel(cfg.hostControl);
-  if (!target) return { channel: null };
-  const { user, keyPath, authKeysPath, elevation, rootUnavailable } = target;
-  const provisioned = (channel) => {
-    const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
-    if (probeHostSshd(port) === "absent") {
-      return { channel, issue: { code: "no-sshd", detail: `port ${port}` } };
-    }
-    const auth = verifyChannelAuth(channel.user, channel.keyPath, port);
-    return auth.state === "refused" ? { channel, issue: { code: "auth-refused", detail: auth.detail, account: channel.user } } : { channel };
-  };
+  const plan = plannedHostChannel(cfg);
+  if (!plan) return { channel: null };
+  const { candidates, keyPath } = plan;
+  const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
   try {
     mkdirSync3(join4(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
     if (!existsSync4(keyPath)) {
@@ -896,24 +980,98 @@ function provisionHostSshChannel(cfg) {
     }
     const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
     if (!pub) return { channel: null, issue: { code: "empty-key" } };
-    if (rootUnavailable) {
-      console.warn(
-        "  \u26A0 Host control needs root, but this user isn't root and passwordless sudo isn't\n    available. Mail and edge host operations will fail. Re-run `openship up` as root\n    (or enable passwordless sudo) to fix. Continuing with a limited host channel."
-      );
-      authorizeKeyAt(authKeysPath, pub);
-      return provisioned({ user, keyPath });
+    const tried = [];
+    const losers = [];
+    let lastFailure = null;
+    for (const candidate of candidates) {
+      tried.push(candidate.user);
+      authorizeKeyAt(candidate.authKeysPath, pub);
+      if (probeHostSshd(port) === "absent") {
+        return { channel: { user: candidate.user, keyPath }, issue: { code: "no-sshd", detail: `port ${port}` } };
+      }
+      const auth = verifyChannelAuth(candidate.user, keyPath, port);
+      if (auth.state === "unreachable") {
+        return {
+          channel: { user: candidate.user, keyPath },
+          issue: { code: "unreachable", detail: auth.detail }
+        };
+      }
+      if (auth.state === "refused" || auth.state === "forced-command") {
+        lastFailure = { state: auth.state, detail: auth.detail };
+        losers.push(candidate);
+        continue;
+      }
+      const elevation = candidate.user === "root" ? "login" : auth.state === "ok" && auth.elevation === "refused" ? (
+        // MEASURED, over the session shape the api will use. This is the arm
+        // `hasPasswordlessSudo` used to get wrong from a cached ticket, which is what
+        // suppressed the warning below on boxes that genuinely could not reach root.
+        "none"
+      ) : candidate.elevation;
+      for (const loser of losers) revokeKeyAt(loser.authKeysPath);
+      if (elevation === "sudo") {
+        revokeRootKeyViaSudo();
+      }
+      if (elevation === "none") {
+        console.warn(
+          `  \u26A0 Host control needs root, and this channel has no route to it: it logs in as
+    \`${candidate.user}\`, and \`sudo -n\` was refused over that session. Mail and edge
+    host operations will fail. Grant that account passwordless sudo, or re-run
+    \`openship up\` as root, to fix. Continuing with a limited host channel.`
+        );
+      }
+      if (candidate.source === "sudo-user") {
+        console.log(
+          `  \u2192 Host channel settled on \`${candidate.user}\` rather than root: this host refused a
+    root login, and that account's key was accepted. It elevates per operation with
+    sudo, so no standing root credential is created. Pin one with
+    \`openship up --host-ssh-user <name>\`.`
+        );
+      }
+      return { channel: { user: candidate.user, keyPath }, issue: void 0 };
+    }
+    const carried = cfg.hostSshUserCarried?.trim();
+    for (const loser of losers) {
+      if (loser.user !== carried) revokeKeyAt(loser.authKeysPath);
     }
-    authorizeKeyAt(authKeysPath, pub);
-    if (elevation === "sudo") revokeRootKeyViaSudo();
-    return provisioned({ user, keyPath });
+    return {
+      channel: null,
+      issue: {
+        code: lastFailure?.state === "forced-command" ? "forced-command" : "auth-refused",
+        ...lastFailure?.detail ? { detail: lastFailure.detail } : {},
+        account: tried[tried.length - 1] ?? "",
+        tried,
+        ...tried.includes("root") ? (() => {
+          const setting = permitRootLoginSetting(port);
+          return setting ? { permitRootLogin: setting } : {};
+        })() : {}
+      }
+    };
   } catch (err) {
     return { channel: null, issue: { code: "error", detail: err?.message } };
   }
 }
+function permitRootLoginSetting(port) {
+  try {
+    const r = spawnSync3(
+      "sudo",
+      ["-n", "sshd", "-T", "-C", `user=root,host=localhost,addr=127.0.0.1,laddr=127.0.0.1,lport=${port}`],
+      { encoding: "utf8" }
+    );
+    if (r.status !== 0) return null;
+    return /^permitrootlogin\s+(\S+)/m.exec(r.stdout ?? "")?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sshdRefusesRootLogin(value) {
+  const v = value?.trim().toLowerCase();
+  return v === "no" || v === "forced-commands-only";
+}
 function verifyChannelAuth(user, keyPath, port) {
   const r = spawnSync3(
     "ssh",
     [
+      "-v",
       "-i",
       keyPath,
       "-p",
@@ -931,16 +1089,34 @@ function verifyChannelAuth(user, keyPath, port) {
       "-o",
       "IdentitiesOnly=yes",
       `${user}@127.0.0.1`,
-      "true"
+      CHANNEL_PROBE_COMMAND
     ],
-    { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"], timeout: 15e3 }
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 }
   );
-  if (r.status === 0) return { state: "ok" };
   if (r.error?.code === "ENOENT" || r.status === null) {
     return { state: "unknown" };
   }
-  const detail = (r.stderr || "").split("\n").map((l) => l.trim()).filter((l) => l && !/^Warning: Permanently added/.test(l)).join(" ");
-  return { state: "refused", detail: detail || `ssh exited ${r.status}` };
+  const stderr = r.stderr || "";
+  const stdout = r.stdout || "";
+  const sudo = /openship-sudo=(ok|refused)/.exec(stdout)?.[1];
+  if (r.status === 0 && sudo) {
+    return { state: "ok", elevation: sudo === "ok" ? "ok" : "refused" };
+  }
+  if (/Authenticated to |debug1: Authentication succeeded/.test(stderr)) {
+    return r.status === 0 ? { state: "ok", elevation: "unknown" } : { state: "forced-command", detail: sshProbeDetail(stderr, r.status) };
+  }
+  if (/^ssh: connect to host/m.test(stderr)) {
+    return { state: "unreachable", detail: sshProbeDetail(stderr, r.status) };
+  }
+  if (r.status === 0) return { state: "ok", elevation: "unknown" };
+  return { state: "refused", detail: sshProbeDetail(stderr, r.status) };
+}
+var CHANNEL_PROBE_COMMAND = "if sudo -n -k true 2>/dev/null; then echo openship-sudo=ok; else echo openship-sudo=refused; fi; exit 0";
+function sshProbeDetail(stderr, status) {
+  const detail = stderr.split("\n").map((l) => l.trim()).filter(
+    (l) => l && !/^debug\d*:/.test(l) && !/^OpenSSH_/.test(l) && !/^Warning: Permanently added/.test(l)
+  ).join(" ");
+  return detail || `ssh exited ${status}`;
 }
 function keygenWhy(r) {
   if (r.error?.code === "ENOENT") {
@@ -977,7 +1153,16 @@ function hostIssueNote(text) {
 }
 function renderHostChannelIssue(issue, ctx) {
   const detail = issue.detail ? ` (${issue.detail})` : "";
-  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : issue.code === "auth-refused" ? `  \u26A0 Host control is provisioned, but this host REFUSED the channel's key.` : `  \u26A0 Host control could NOT be provisioned on this box.`;
+  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : issue.code === "unreachable" ? `  \u26A0 Host control is provisioned, but nothing answered at the SSH address we dialed${detail}.` : issue.code === "forced-command" ? (
+    // Like `auth-refused` and unlike `no-sshd`: a key that can't run a command is
+    // not a channel, so nothing was written and the headline must not imply it was.
+    `  \u26A0 Host control could NOT be provisioned: this host's sshd allows the channel no commands.`
+  ) : issue.code === "auth-refused" ? (
+    // NOT "is provisioned, but": a refusal no longer leaves a channel behind. The
+    // run tried every account it could authorize and none of them were let in, so
+    // there is nothing provisioned to describe.
+    `  \u26A0 Host control could NOT be provisioned: this host REFUSED the channel's key.`
+  ) : `  \u26A0 Host control could NOT be provisioned on this box.`;
   let cause;
   switch (issue.code) {
     case "keygen":
@@ -996,14 +1181,27 @@ function renderHostChannelIssue(issue, ctx) {
         sshdEnableHint: thisHost().sshdEnableHint()
       }).body;
       break;
-    case "auth-refused":
-      cause = `The key was authorized for \`${issue.account ?? "the channel account"}\` and sshd is listening, but the dial was refused${detail}. Either that account's \`authorized_keys\` is not the file we wrote to, or sshd permits it no login \u2014 \`sshd -T | grep -i permitrootlogin\` shows the second. Until it is fixed the api container will be refused every time it dials ${ctx.target}.`;
+    case "unreachable":
+      cause = `sshd is listening on this host, but the verification dial to 127.0.0.1 was not answered${detail}. That is an ADDRESS problem, not a key problem: a \`ListenAddress\` that excludes loopback, or a local firewall rule. The api container dials ${ctx.target}, so check that sshd accepts connections there \u2014 \`sudo sshd -T | grep -i listenaddress\` shows what it binds.`;
       break;
+    case "forced-command":
+      cause = `sshd ACCEPTED the channel's key for \`${issue.account ?? "the channel account"}\` and then closed the session without running anything${detail}. That is what \`PermitRootLogin forced-commands-only\` does to a key with no \`command=\` of its own, and it is indistinguishable from a working channel until a host operation runs. Either permit this account a normal login, or use an account that has one: \`openship up --host-ssh-user <name>\`.`;
+      break;
+    case "auth-refused": {
+      const accounts = issue.tried?.length ? issue.tried.map((a) => `\`${a}\``).join(" then ") : `\`${issue.account ?? "the channel account"}\``;
+      const rootNote = issue.permitRootLogin ? ` This host's sshd reports \`PermitRootLogin ${issue.permitRootLogin}\`${sshdRefusesRootLogin(issue.permitRootLogin) ? ", which refuses a root login outright" : ""}.` : "";
+      cause = `The key was authorized for ${accounts} and sshd is listening, but every dial was refused${detail}.${rootNote} sshd is not telling us which of several causes it is \u2014 \`Permission denied (publickey)\` is the same message for an account that may not log in, an \`authorized_keys\` sshd doesn't read for it, and a home directory whose permissions it rejects. Three things fix it:
+  \u2022 name an account that CAN log in: \`openship up --host-ssh-user <name>\`
+  \u2022 permit root a key login: \`PermitRootLogin prohibit-password\` (still refuses passwords), or scope it to the container with a \`Match Address\` block
+  \u2022 or leave host control off: \`openship up --no-host-control\`
+Until one of them is done the api container will be refused every time it dials ${ctx.target}.`;
+      break;
+    }
     case "error":
       cause = `Setting up the channel's key failed${detail}.`;
       break;
   }
-  const continuity = issue.code === "no-sshd" || issue.code === "auth-refused" ? "" : ctx.kept ? hostIssueNote(
+  const continuity = issue.code === "no-sshd" || issue.code === "unreachable" ? "" : ctx.kept ? hostIssueNote(
     "Kept the host channel this install already had in `.env` rather than dropping it: its key is still authorized, so the api container keeps the access it had instead of losing it to this failure."
   ) : hostIssueNote(
     "OPENSHIP_HOST_SSH_HOST is therefore unset, and host operations refuse rather than run against the api container's own filesystem."
@@ -1345,7 +1543,14 @@ function resolveEnvConfig(prev, opts) {
     // so, and every `openship up` overwrote a hand-edited `.env` back to the
     // value that didn't work (#490/#482).
     hostSshHost: keepConfig(prev, "OPENSHIP_HOST_SSH_HOST", opts.hostSshHost) ?? HOST_CHANNEL_DEFAULT_HOST,
-    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT)
+    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT),
+    // Sticky like its siblings, but kept in its OWN key rather than reusing
+    // OPENSHIP_HOST_SSH_USER. That key records what provisioning SETTLED on, and the two
+    // must not be conflated: reading a settled value back as a pin would freeze the account
+    // a box happens to have — including the refused `root` on every install #527 broke — and
+    // the fallback that repairs them could never run.
+    ...keepConfig(prev, "OPENSHIP_HOST_SSH_USER_PIN", opts.hostSshUser) ? { hostSshUser: keepConfig(prev, "OPENSHIP_HOST_SSH_USER_PIN", opts.hostSshUser) } : {},
+    ...prev.OPENSHIP_HOST_SSH_USER?.trim() ? { hostSshUserCarried: prev.OPENSHIP_HOST_SSH_USER.trim() } : {}
   };
 }
 function toPort(value) {
@@ -1409,6 +1614,7 @@ async function resolveComposePorts(prefs, opts = {}) {
 var OMITTABLE_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "OPENSHIP_HOST_SSH_HOST",
   "OPENSHIP_HOST_SSH_USER",
+  "OPENSHIP_HOST_SSH_USER_PIN",
   "OPENSHIP_HOST_SSH_PORT",
   "OPENSHIP_HOST_SSH_KEY",
   "OPENSHIP_HOST_KEY_PATH",
@@ -1421,7 +1627,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.6" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.8" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [
@@ -1470,6 +1676,8 @@ function managedEnvLines(opts, host, cfg, prev) {
   if (host) {
     lines.push(
       `OPENSHIP_HOST_SSH_HOST=${cfg.hostSshHost}`,
+      // What provisioning SETTLED on this run — a fact about the box, not a setting. The
+      // operator's pin, when there is one, is written OUTSIDE this block (see below).
       `OPENSHIP_HOST_SSH_USER=${host.user}`,
       `OPENSHIP_HOST_SSH_PORT=${cfg.hostSshPort}`,
       "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
@@ -1477,6 +1685,7 @@ function managedEnvLines(opts, host, cfg, prev) {
       ...hostGatewayEnv(prev)
     );
   }
+  if (cfg.hostSshUser) lines.push(`OPENSHIP_HOST_SSH_USER_PIN=${cfg.hostSshUser}`);
   return lines;
 }
 function renderEnvAndCarried(opts, host, cfg, prev) {
@@ -1561,7 +1770,7 @@ function composePlan(opts) {
   const prev = readEnvFile();
   const cfg = resolveEnvConfig(prev, opts);
   const buildDir = opts.build === false ? null : sourceBuildDir();
-  const hostChannel = plannedHostChannel(cfg.hostControl);
+  const hostChannel = previewHostChannel(cfg);
   const settings = [];
   const newSecrets = [];
   for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
@@ -1588,7 +1797,7 @@ function composePlan(opts) {
     secretRotation: opts.resetSecrets ? null : secretRotationRisk(prev),
     pgDataRisk: pgDataDetectionRisk(prev),
     existing: Object.keys(prev).length > 0,
-    mountDirs: EDGE_CONTAINER_MOUNTS.map((m) => m.host),
+    mountDirs: composeEdgeMounts().map((m) => m.host),
     buildDir,
     hostChannel
   };
@@ -1668,7 +1877,7 @@ function composePrefetch(opts) {
 }
 function ensureEdgeMountDirs() {
   const failed = [];
-  for (const { host } of EDGE_CONTAINER_MOUNTS) {
+  for (const { host } of composeEdgeMounts()) {
     try {
       mkdirSync3(host, { recursive: true });
     } catch (err) {