openship 0.6.7 → 0.6.9

package/dist/bare-FA66N7GC.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  BareRuntime,
+  STATIC_RELEASE_BASE
+} from "./chunk-ENKJ7XIF.js";
+import "./chunk-5DJOB7IX.js";
+import "./chunk-SK4FFCFR.js";
+import "./chunk-AHJYP7DG.js";
+import "./chunk-UAWY6X7V.js";
+import "./chunk-R4VDPFLS.js";
+import "./chunk-VAI5VOOI.js";
+import "./chunk-TAZZZKYO.js";
+import "./chunk-T6DVUX4F.js";
+import "./chunk-T46BQOLY.js";
+import "./chunk-GNOMEMNI.js";
+import "./chunk-NPSRGIHV.js";
+import "./chunk-P7RCYELG.js";
+import "./chunk-BO6CY4V2.js";
+import "./chunk-D6HU4VUZ.js";
+import "./chunk-N5YZMO33.js";
+import "./chunk-WEZFTL4V.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  BareRuntime,
+  STATIC_RELEASE_BASE
+};

package/dist/{chunk-LHFXSC36.js → chunk-3MP6ACKM.js}

@@ -7,12 +7,13 @@ import {
   createDockerBuildContext,
   missingContextDockerfileMessage,
   prepareSourceTree,
+  resolveDockerBuildArgs,
   resolveServiceDockerfile
-} from "./chunk-XWHWTHEL.js";
+} from "./chunk-6GU6JSK6.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-WU54BXFE.js";
+} from "./chunk-SK4FFCFR.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -33,7 +34,7 @@ import {
   sq,
   staticBuilderOutputPath,
   transferLocalDirectory
-} from "./chunk-H4FS5BED.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   DOCKER_DIAL_STDIO_COMMAND,
   attachDialStdioDiagnostics,
@@ -42,14 +43,14 @@ import {
   execSshCommand,
   openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-5T4UVOM3.js";
+} from "./chunk-TAZZZKYO.js";
 import {
   dirOf,
   ensureOwnedDir
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   OPENSHIP_LABEL
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   isRuntimeNotFoundError
 } from "./chunk-N5YZMO33.js";
@@ -63,7 +64,7 @@ import {
   registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 import {
   __commonJS,
   __require,
@@ -4954,7 +4955,6 @@ import { join as join2 } from "path";
 import net2 from "net";
 var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var resolvedDockerSocketPathCache = /* @__PURE__ */ new WeakMap();
-var STREAMLOCAL_PROBE_TIMEOUT_MS = 8e3;
 var STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3e3;
 var DIAL_STDIO_ANSWER_TIMEOUT_MS = 3e3;
 var VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
@@ -5280,12 +5280,12 @@ function createDockerSshBridge(opts) {
     try {
       probe = await withTimeout(
         openStreamlocalUpstream(opts),
-        STREAMLOCAL_PROBE_TIMEOUT_MS,
-        `streamlocal open timed out after ${STREAMLOCAL_PROBE_TIMEOUT_MS / 1e3}s`
+        STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS,
+        `streamlocal open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1e3}s`
       );
       const stream = probe;
       const flowed = await new Promise((resolve) => {
-        const timer = setTimeout(() => resolve(false), STREAMLOCAL_PROBE_TIMEOUT_MS);
+        const timer = setTimeout(() => resolve(false), STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
         const settle = (ok) => {
           clearTimeout(timer);
           resolve(ok);
@@ -5535,7 +5535,7 @@ function resolveDockerTransport(opts) {
 // ../../packages/adapters/src/runtime/docker.ts
 var isDockerNotFoundError = isRuntimeNotFoundError;
 function ownsBuiltImage(imageRef) {
-  return imageRef.startsWith("openship/");
+  return /^openship\/[a-z0-9][a-z0-9._-]*:bld_[A-Za-z0-9_-]+$/.test(imageRef);
 }
 function clampShellWindow(value, fallback, min, max) {
   const n = Number.isFinite(value) ? Number(value) : fallback;
@@ -5603,14 +5603,7 @@ var IN_CONTAINER_EXEC_WATCHDOG = [
 ].join("\n");
 function buildInContainerExecCmd(command, timeoutMs) {
   const seconds = Math.max(1, Math.ceil(timeoutMs / 1e3));
-  return [
-    "sh",
-    "-c",
-    IN_CONTAINER_EXEC_WATCHDOG,
-    "openship-exec",
-    command,
-    String(seconds)
-  ];
+  return ["sh", "-c", IN_CONTAINER_EXEC_WATCHDOG, "openship-exec", command, String(seconds)];
 }
 async function resolveExecExitCode(exec, label) {
   let info = await exec.inspect();
@@ -5745,7 +5738,7 @@ function packBuildContext(contextDir, entries, cancelSignal, ignoreContextPath)
 var DURATION_UNITS_NS = {
   ns: 1,
   us: 1e3,
-  "\xB5s": 1e3,
+  \u00B5s: 1e3,
   ms: 1e6,
   s: 1e9,
   m: 6e10,
@@ -5853,7 +5846,7 @@ function firstNetworkIp(networks) {
 }
 function extractNetworkInfo(data) {
   let ip;
-  for (const net3 of Object.values(data.NetworkSettings.Networks ?? {})) {
+  for (const net3 of Object.values(data.NetworkSettings?.Networks ?? {})) {
     if (net3.IPAddress) {
       ip = net3.IPAddress;
       break;
@@ -5861,14 +5854,31 @@ function extractNetworkInfo(data) {
   }
   const hostPortByContainerPort = {};
   let hostPort;
-  for (const [key, bindings] of Object.entries(data.NetworkSettings.Ports ?? {})) {
-    const bound = bindings?.[0]?.HostPort;
-    if (!bound) continue;
-    const parsed = parseInt(bound, 10);
-    if (!Number.isFinite(parsed)) continue;
-    const containerPort = parseInt(key.split("/")[0] ?? "", 10);
-    if (Number.isFinite(containerPort)) hostPortByContainerPort[containerPort] = parsed;
-    hostPort ??= parsed;
+  const liveBindings = data.NetworkSettings?.Ports ?? {};
+  const configuredBindings = data.HostConfig?.PortBindings ?? {};
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(liveBindings), ...Object.keys(configuredBindings)])) {
+    const [containerRaw, protocol = "tcp"] = key.split("/");
+    if (protocol.toLowerCase() !== "tcp") continue;
+    const containerPort = Number(containerRaw);
+    if (!Number.isSafeInteger(containerPort) || containerPort < 1 || containerPort > 65535) {
+      continue;
+    }
+    const live = liveBindings[key];
+    const bindings = live && live.some((binding) => binding?.HostPort) ? live : configuredBindings[key];
+    const candidates = (bindings ?? []).map((binding, index) => {
+      const port = Number(binding?.HostPort);
+      if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return null;
+      const ip2 = binding?.HostIp?.trim().replace(/^\[|\]$/g, "") ?? "";
+      const priority = ip2 === "127.0.0.1" || ip2 === "::1" ? 3 : /^127(?:\.\d{1,3}){3}$/.test(ip2) ? 2 : ip2 && ip2 !== "0.0.0.0" && ip2 !== "::" ? 1 : 0;
+      return { index, port, priority };
+    }).filter(
+      (candidate) => Boolean(candidate)
+    ).sort((left, right) => right.priority - left.priority || left.index - right.index);
+    const selected = candidates[0]?.port;
+    if (selected !== void 0) {
+      hostPortByContainerPort[containerPort] = selected;
+      hostPort ??= selected;
+    }
   }
   return {
     ip,
@@ -5923,6 +5933,7 @@ var DockerRuntime = class _DockerRuntime {
   name = "docker";
   capabilities = /* @__PURE__ */ new Set([
     "build",
+    "prebuiltImage",
     "deploy",
     "multiServiceDeploy",
     "stop",
@@ -6235,10 +6246,8 @@ var DockerRuntime = class _DockerRuntime {
     const signal = opts?.signal;
     const executor = this.connectionOptions?.executor;
     if (!executor) throw new Error("SSH build path requires an executor on connectionOptions");
-    const buildArgs = Object.entries({
-      ...config.envVars,
-      NODE_ENV: "production"
-    }).filter(([k]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k)).map(([k, v]) => `--build-arg ${sq(`${k}=${v}`)}`).join(" ");
+    const resolvedBuildArgs = resolveDockerBuildArgs(config);
+    const buildArgs = Object.entries(resolvedBuildArgs).map(([k, v]) => `--build-arg ${sq(`${k}=${v}`)}`).join(" ");
     const labelArgs = Object.entries(
       this.labels({ projectId: config.projectId, sessionId: config.sessionId })
     ).map(([k, v]) => `--label ${sq(`${k}=${v}`)}`).join(" ");
@@ -6259,9 +6268,16 @@ var DockerRuntime = class _DockerRuntime {
       );
     }
     const buildCmd = `cd ${sq(remoteBuildDir)} && ${builderEnv}docker build${builderFlags} -t ${sq(tag)}${dockerfileFlag} ${labelArgs} ${buildArgs} .`;
-    log.log(`Running on remote: ${buildCmd}`);
+    log.log(
+      `Running Docker build on remote (${Object.keys(resolvedBuildArgs).length} build argument${Object.keys(resolvedBuildArgs).length === 1 ? "" : "s"}; values hidden).`
+    );
     log.log("\u2500\u2500\u2500 docker build output \u2500\u2500\u2500");
-    this.emitDockerStep(log, "install", "running", "Running install inside container (docker build)");
+    this.emitDockerStep(
+      log,
+      "install",
+      "running",
+      "Running install inside container (docker build)"
+    );
     const { code } = await executor.streamExec(
       buildCmd,
       (entry) => {
@@ -6322,7 +6338,11 @@ var DockerRuntime = class _DockerRuntime {
         config.gitSsh
       );
     }
-    const { cloneUrl, gitEnv: GIT_ENV, credFlag: CRED } = assembleGitClone({
+    const {
+      cloneUrl,
+      gitEnv: GIT_ENV,
+      credFlag: CRED
+    } = assembleGitClone({
       repoUrl: config.repoUrl,
       gitToken: config.gitToken,
       gitCredentialHelperPath: config.gitCredentialHelperPath,
@@ -6348,8 +6368,11 @@ var DockerRuntime = class _DockerRuntime {
             `${GIT_ENV} git ${CRED} clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir} && cd ${dir} && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
           );
         } catch {
-          log.log(`Commit ${config.commitSha} not in the shallow clone; unshallowing and retrying.
-`, "warn");
+          log.log(
+            `Commit ${config.commitSha} not in the shallow clone; unshallowing and retrying.
+`,
+            "warn"
+          );
           await run(
             `cd ${dir} && ${GIT_ENV} git ${CRED} fetch --progress --unshallow && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
           );
@@ -6500,10 +6523,7 @@ var DockerRuntime = class _DockerRuntime {
         t: tag,
         dockerfile: buildContext.dockerfileName,
         labels: this.labels({ projectId: config.projectId, sessionId: config.sessionId }),
-        buildargs: {
-          ...config.envVars,
-          NODE_ENV: "production"
-        },
+        buildargs: resolveDockerBuildArgs(config),
         // Omitted entirely unless the project set a build cap — a self-hosted
         // build should be free to use the machine (a production build often
         // needs several GB). Opt-in only; see dockerBuildResourceLimits.
@@ -6517,7 +6537,9 @@ var DockerRuntime = class _DockerRuntime {
       log.log("Docker daemon finished streaming build output. Finalizing image...\n");
     } catch (err) {
       const contextErr = takeError();
-      throw contextErr ? new Error(`Failed to read Docker build context: ${safeErrorMessage(contextErr)}`, { cause: contextErr }) : err;
+      throw contextErr ? new Error(`Failed to read Docker build context: ${safeErrorMessage(contextErr)}`, {
+        cause: contextErr
+      }) : err;
     } finally {
       await buildContext.cleanup();
     }
@@ -6566,9 +6588,11 @@ var DockerRuntime = class _DockerRuntime {
         }, 6e4);
         if (keepaliveTimer.unref) keepaliveTimer.unref();
         idleTimer = setTimeout(() => {
-          fail(new Error(
-            "Docker build produced no output for 30 minutes. This usually means the remote server cannot reach the package registry, has broken DNS, or the Docker daemon stalled during the build."
-          ));
+          fail(
+            new Error(
+              "Docker build produced no output for 30 minutes. This usually means the remote server cannot reach the package registry, has broken DNS, or the Docker daemon stalled during the build."
+            )
+          );
         }, DOCKER_BUILD_IDLE_TIMEOUT_MS);
         if (idleTimer.unref) idleTimer.unref();
       };
@@ -6672,7 +6696,12 @@ var DockerRuntime = class _DockerRuntime {
         log.log(`Image ${tag} is ready.
 `);
         log.step("build", "completed", `Finalizing image ${tag}`);
-        return { sessionId: config.sessionId, status: "deploying", imageRef: tag, durationMs: Date.now() - startTime };
+        return {
+          sessionId: config.sessionId,
+          status: "deploying",
+          imageRef: tag,
+          durationMs: Date.now() - startTime
+        };
       }
       this.emitDockerStep(log, "clone", "running", "Preparing Docker build context...");
       const buildContext = await createDockerBuildContext(config, {
@@ -6683,12 +6712,7 @@ var DockerRuntime = class _DockerRuntime {
       try {
         const sizeBytes = await this.estimateContextSize(buildContext.contextDir);
         const sizeMB = (sizeBytes / 1024 / 1024).toFixed(1);
-        this.emitDockerStep(
-          log,
-          "clone",
-          "completed",
-          `Docker build context ready (${sizeMB} MB)`
-        );
+        this.emitDockerStep(log, "clone", "completed", `Docker build context ready (${sizeMB} MB)`);
       } catch {
         this.emitDockerStep(log, "clone", "completed", "Docker build context ready");
       }
@@ -6734,7 +6758,75 @@ var DockerRuntime = class _DockerRuntime {
       if (abort.signal.aborted || err instanceof BuildCancelledError) return cancelled();
       const msg = safeErrorMessage(err);
       log.step("build", "failed", `Docker build failed: ${msg}`);
-      return { sessionId: config.sessionId, status: "failed", durationMs: Date.now() - startTime, errorMessage: `Docker build failed: ${msg}` };
+      return {
+        sessionId: config.sessionId,
+        status: "failed",
+        durationMs: Date.now() - startTime,
+        errorMessage: `Docker build failed: ${msg}`
+      };
+    } finally {
+      releaseDockerBuild(config.sessionId, abort);
+    }
+  }
+  /**
+   * Acquire a registry image without ever treating it as a Dockerfile builder.
+   *
+   * The returned digest is preferred over the requested tag so a later deploy
+   * runs exactly the bytes acquired here even if a mutable tag moves between
+   * prepare and deploy. The image is deliberately non-owned: it came from a
+   * registry and may be shared by unrelated containers on the target daemon, so
+   * deployment cleanup must never remove it as if Openship had built it.
+   */
+  async prepareImage(config, logger) {
+    const log = logger ?? new BuildLogger();
+    const startTime = Date.now();
+    const abort = registerDockerBuild(config.sessionId);
+    const cancelled = () => {
+      log.step("build", "failed", "Image pull cancelled");
+      return {
+        sessionId: config.sessionId,
+        status: "cancelled",
+        durationMs: Date.now() - startTime,
+        artifactOwned: false
+      };
+    };
+    try {
+      if (abort.signal.aborted) return cancelled();
+      const requestedRef = config.imageRef.trim();
+      if (!requestedRef) throw new Error("Prebuilt image reference is required");
+      log.step("build", "running", `Pulling prebuilt image ${requestedRef}`);
+      try {
+        await this.ensureDockerFeature(log);
+      } catch (featureErr) {
+        throw new Error(this.formatDockerConnectivityError(featureErr));
+      }
+      await this.pullImage(requestedRef, { force: config.forcePull });
+      if (abort.signal.aborted) return cancelled();
+      const deployRef = await this.resolveImageDigest(requestedRef).catch(() => void 0) ?? requestedRef;
+      log.log(
+        deployRef === requestedRef ? `Image ${requestedRef} is ready.
+` : `Image ${requestedRef} is ready as ${deployRef}.
+`
+      );
+      log.step("build", "completed", `Prebuilt image ${deployRef} is ready`);
+      return {
+        sessionId: config.sessionId,
+        status: "deploying",
+        imageRef: deployRef,
+        durationMs: Date.now() - startTime,
+        artifactOwned: false
+      };
+    } catch (err) {
+      if (abort.signal.aborted) return cancelled();
+      const message = safeErrorMessage(err);
+      log.step("build", "failed", `Image pull failed: ${message}`);
+      return {
+        sessionId: config.sessionId,
+        status: "failed",
+        durationMs: Date.now() - startTime,
+        errorMessage: `Image pull failed: ${message}`,
+        artifactOwned: false
+      };
     } finally {
       releaseDockerBuild(config.sessionId, abort);
     }
@@ -6883,9 +6975,9 @@ var DockerRuntime = class _DockerRuntime {
   async pruneBuildFilesFromDocRoot(config, hostOutDir, sshExecutor, log) {
     if (staticBuilderOutputPath(config) !== builderContextRoot(config)) return;
     if (sshExecutor) {
-      const globs = _DockerRuntime.DOC_ROOT_EXCLUDED.map(
-        (name) => `${sq(hostOutDir)}/${name}`
-      ).join(" ");
+      const globs = _DockerRuntime.DOC_ROOT_EXCLUDED.map((name) => `${sq(hostOutDir)}/${name}`).join(
+        " "
+      );
       await sshExecutor.exec(`rm -rf ${globs}`).catch(() => {
       });
       log.log(`Excluded build files from the published output (${hostOutDir}).
@@ -7007,7 +7099,9 @@ var DockerRuntime = class _DockerRuntime {
           `static extract failed copying ${docRoot} out of the build container (exit ${status.StatusCode})${logs ? `: ${logs.slice(-500)}` : ""}`
         );
       }
-      const entries = (await readdir(hostOutDir).catch(() => [])).filter((e) => e !== probe);
+      const entries = (await readdir(hostOutDir).catch(() => [])).filter(
+        (e) => e !== probe
+      );
       this.assertDocRootFilled(entries.length === 0, docRoot);
       return true;
     } finally {
@@ -7250,11 +7344,7 @@ var DockerRuntime = class _DockerRuntime {
               signal,
               ignoreContextPath
             );
-            const builder = this.selectDockerodeBuilder(
-              spec.config,
-              requiresBuildKit,
-              spec.logger
-            );
+            const builder = this.selectDockerodeBuilder(spec.config, requiresBuildKit, spec.logger);
             try {
               const stream = await this.docker.buildImage(body, {
                 t: tag,
@@ -7263,7 +7353,7 @@ var DockerRuntime = class _DockerRuntime {
                   projectId: spec.config.projectId,
                   sessionId: spec.config.sessionId
                 }),
-                buildargs: { ...spec.config.envVars, NODE_ENV: "production" },
+                buildargs: resolveDockerBuildArgs(spec.config),
                 ...dockerBuildResourceLimits(spec.config.resources),
                 forcerm: true,
                 ...builder.options,
@@ -7272,7 +7362,10 @@ var DockerRuntime = class _DockerRuntime {
               await this.streamDockerodeBuild(stream, spec.logger, builder.trace);
             } catch (err) {
               const contextErr = takeError();
-              throw contextErr ? new Error(`Failed to read Docker build context: ${safeErrorMessage(contextErr)}`, { cause: contextErr }) : err;
+              throw contextErr ? new Error(
+                `Failed to read Docker build context: ${safeErrorMessage(contextErr)}`,
+                { cause: contextErr }
+              ) : err;
             }
           }
           if (isCancelled(spec.config.sessionId)) {
@@ -7666,7 +7759,9 @@ var DockerRuntime = class _DockerRuntime {
    * the ones that survive `container.remove()` and would otherwise leak.
    * Anonymous volumes are auto-removed with `{ v: true }` and don't need to
    * be enumerated. Bind mounts and tmpfs are skipped (the user manages them
-   * outside our control). Returns [] if the container is already gone.
+   * outside our control). Returns [] only if the container is already gone;
+   * transport and permission failures propagate so an explicit volume wipe
+   * never destroys the last copy of its mount inventory.
    */
   async inspectNamedVolumes(containerId) {
     try {
@@ -7674,16 +7769,18 @@ var DockerRuntime = class _DockerRuntime {
       const data = await container.inspect();
       const mounts = data.Mounts ?? [];
       return mounts.filter((m) => m.Type === "volume" && typeof m.Name === "string" && m.Name.length > 0).map((m) => m.Name);
-    } catch {
-      return [];
+    } catch (err) {
+      if (isDockerNotFoundError(err)) return [];
+      throw err;
     }
   }
-  /** Remove a named volume by name. Best-effort - already-gone is fine. */
+  /** Remove a named volume by name. Already-gone is idempotent success. */
   async removeVolume(name) {
     try {
       const volume = this.docker.getVolume(name);
       await volume.remove({ force: true });
-    } catch {
+    } catch (err) {
+      if (!isDockerNotFoundError(err)) throw err;
     }
   }
   // ── Docker discovery (label-agnostic) ────────────────────────────────────
@@ -7897,7 +7994,8 @@ var DockerRuntime = class _DockerRuntime {
     const executor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
     if (executor?.execWithInput) {
       const { code, stderr, stdout } = await executor.execWithInput(`docker load`, body);
-      if (code !== 0) throw new Error(`docker load exited ${code}${stderr ? `: ${stderr.slice(0, 500)}` : ""}`);
+      if (code !== 0)
+        throw new Error(`docker load exited ${code}${stderr ? `: ${stderr.slice(0, 500)}` : ""}`);
       return parseLoadedImageRef(stdout);
     }
     const stream = await this.docker.loadImage(body);
@@ -8155,7 +8253,11 @@ var DockerRuntime = class _DockerRuntime {
     });
     stream.on("end", () => {
       if (buffer && !destroyed) {
-        onLog({ timestamp: (/* @__PURE__ */ new Date()).toISOString(), message: buffer, level: parseLogLevel(buffer) });
+        onLog({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: buffer,
+          level: parseLogLevel(buffer)
+        });
         buffer = "";
       }
     });
@@ -8370,15 +8472,9 @@ var DockerRuntime = class _DockerRuntime {
   async inContainerExecutor(containerId) {
     return {
       exec: async (command, opts) => {
-        const { exitCode, stdout, stderr } = await this.execInContainer(
-          containerId,
-          command,
-          opts
-        );
+        const { exitCode, stdout, stderr } = await this.execInContainer(containerId, command, opts);
         if (exitCode !== 0) {
-          throw new Error(
-            stdout.trim() || stderr.trim() || `exec exited with code ${exitCode}`
-          );
+          throw new Error(stdout.trim() || stderr.trim() || `exec exited with code ${exitCode}`);
         }
         return stdout;
       }
@@ -8482,7 +8578,8 @@ var DockerRuntime = class _DockerRuntime {
       for (const m of c.Mounts ?? []) {
         if (m.Type !== "volume" || !m.Name || !named.has(m.Name)) continue;
         if (owner === config.projectId) ownNames.add(m.Name);
-        else if (!foreign.has(m.Name)) foreign.set(m.Name, c.Names?.[0]?.replace(/^\//, "") ?? owner);
+        else if (!foreign.has(m.Name))
+          foreign.set(m.Name, c.Names?.[0]?.replace(/^\//, "") ?? owner);
       }
     }
     for (const [name, other] of foreign) {
@@ -8602,21 +8699,20 @@ var DockerRuntime = class _DockerRuntime {
         } catch (err) {
           const msg = err?.message ?? "";
           if (!/already exists|already connected/i.test(msg)) {
-            console.warn(
-              `[docker] link-connect failed for ${c.Id.slice(0, 12)} \u2192 ${name}: ${msg}`
-            );
+            console.warn(`[docker] link-connect failed for ${c.Id.slice(0, 12)} \u2192 ${name}: ${msg}`);
           }
         }
       }
     }
   }
-  /** Remove a project network (best-effort). */
+  /** Remove a project network. Already-gone is idempotent success. */
   async removeNetwork(slug) {
     const networkName = `openship-${slug}`;
     try {
       const network = this.docker.getNetwork(networkName);
       await network.remove();
-    } catch {
+    } catch (err) {
+      if (!isDockerNotFoundError(err)) throw err;
     }
   }
   /**

package/dist/{chunk-MEE6OZFP.js → chunk-5DJOB7IX.js}

@@ -6,13 +6,13 @@ import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-H4FS5BED.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   wrapLocalBuildCommand
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 
 // ../../packages/adapters/src/runtime/local-build.ts
 var LOCAL_BUILD_DIR = "/tmp/openship/.builds";

package/dist/{chunk-VQM6JHJB.js → chunk-5UXHT6ED.js}

@@ -134,10 +134,10 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-CIJV43LH.js";
+} from "./chunk-MUWVC5R4.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-QHMDCYZ3.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
@@ -146,26 +146,26 @@ import {
   resolveExecExitCode,
   startAttachStream,
   startExecStream
-} from "./chunk-LHFXSC36.js";
+} from "./chunk-3MP6ACKM.js";
 import {
   BareRuntime
-} from "./chunk-S6B2Z3OO.js";
+} from "./chunk-ENKJ7XIF.js";
 import {
   createExecutor
-} from "./chunk-GGIAIGUL.js";
+} from "./chunk-UAWY6X7V.js";
 import {
   envOps
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   MAIL_HOST_STATE_DIR
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
@@ -177,7 +177,7 @@ import {
   validateBackupPath,
   validateClearPath,
   withTimeout
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";