openship 0.6.7 → 0.6.9

package/dist/{chunk-VSTFHUCV.js → chunk-BO6CY4V2.js}

@@ -7,13 +7,13 @@ import {
   isContainerPortForwarder,
   managedDeploymentIdFromUnit,
   tryExec
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/port-listen.ts
-var PROC_NET_TCP_CMD = "cat /proc/net/tcp 2>/dev/null; cat /proc/net/tcp6 2>/dev/null; true";
+var PROC_NET_TCP_FILES = ["/proc/net/tcp", "/proc/net/tcp6"];
 var TCP_LISTEN = "0A";
 function parseListeningPorts(procText) {
   const ports = /* @__PURE__ */ new Set();
@@ -34,12 +34,15 @@ function parseListeningPorts(procText) {
   return ports;
 }
 async function probePortListeningOnce(executor, port) {
-  try {
-    const out = await executor.exec(PROC_NET_TCP_CMD, { timeout: 5e3 });
-    return parseListeningPorts(out).has(port);
-  } catch {
-    return null;
+  const readable = [];
+  for (const file of PROC_NET_TCP_FILES) {
+    try {
+      readable.push(await executor.exec(`cat ${file} 2>/dev/null`, { timeout: 5e3 }));
+    } catch {
+    }
   }
+  if (readable.length === 0) return null;
+  return parseListeningPorts(readable.join("\n")).has(port);
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -85,12 +88,14 @@ async function waitForPortFree(executor, port, opts = {}) {
 
 // ../../packages/adapters/src/runtime/port-conflict.ts
 async function resolveListenerOwner(executor, pid) {
-  const cgroup = await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null || true`);
+  const cgroup = (await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null`))?.trim();
+  if (!cgroup) return { cgroupVerified: false };
+  const evidence = { cgroupVerified: true, processCgroup: cgroup };
   const containerId = containerIdFromCgroup(cgroup);
-  if (containerId) return { containerId };
+  if (containerId) return { ...evidence, containerId };
   const systemdUnit = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m)?.[1]?.trim();
   if (!systemdUnit || !/^[A-Za-z0-9@._:-]+\.service$/.test(systemdUnit)) {
-    return {};
+    return evidence;
   }
   const description = await tryExec(
     executor,
@@ -98,6 +103,7 @@ async function resolveListenerOwner(executor, pid) {
   );
   const deploymentId = managedDeploymentIdFromUnit(systemdUnit);
   return {
+    ...evidence,
     systemdUnit,
     systemdDescription: description?.trim() || void 0,
     ...deploymentId ? { deploymentId, isManagedDeployment: true } : { isManagedDeployment: false }
@@ -108,25 +114,104 @@ async function resolveListener(executor, port) {
     executor,
     `ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`
   );
-  if (out) {
-    const ssMatch = out.match(/pid=(\d+)/);
-    const lsofMatch = !ssMatch ? out.match(/^\s*(\d+)\s*$/m) : null;
-    const pid = ssMatch ? parseInt(ssMatch[1], 10) : lsofMatch ? parseInt(lsofMatch[1], 10) : null;
-    if (pid) return { pid, occupied: true };
+  const listenerPid = (output) => {
+    if (!output) return null;
+    const ssMatch = output.match(/pid=(\d+)/);
+    const lsofMatch = !ssMatch ? output.match(/^\s*(\d+)\s*$/m) : null;
+    const parsed = ssMatch?.[1] ?? lsofMatch?.[1];
+    if (!parsed) return null;
+    const pid2 = Number.parseInt(parsed, 10);
+    return Number.isSafeInteger(pid2) && pid2 > 0 ? pid2 : null;
+  };
+  const pid = listenerPid(out);
+  if (pid) return { pid, occupied: true, checked: true };
+  const observedListener = Boolean(out?.trim());
+  if (observedListener) {
+    const privilegedOut = await tryExec(
+      executor,
+      `sudo -n ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || sudo -n lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`,
+      { timeout: 5e3 }
+    );
+    const privilegedPid = listenerPid(privilegedOut);
+    if (privilegedPid) return { pid: privilegedPid, occupied: true, checked: true };
   }
   const listening = await probePortListeningOnce(executor, port);
-  return { pid: null, occupied: listening === true };
+  return {
+    pid: null,
+    occupied: observedListener || listening === true,
+    checked: observedListener || listening !== null
+  };
 }
-async function probeListeningPort(executor, port) {
+function parseListenerPids(output) {
+  const lines = (output ?? "").split("\n").map((line) => line.trim()).filter(Boolean);
+  if (lines.length === 0) return { observed: false, complete: true, pids: [] };
+  const pids = /* @__PURE__ */ new Set();
+  let complete = true;
+  for (const line of lines) {
+    const matches = [...line.matchAll(/pid=(\d+)/g)].map((match) => match[1]);
+    const bare = matches.length === 0 ? line.match(/^(\d+)$/)?.[1] : void 0;
+    const values = bare ? [bare] : matches;
+    if (values.length === 0) complete = false;
+    for (const value of values) {
+      const pid = Number.parseInt(value, 10);
+      if (Number.isSafeInteger(pid) && pid > 0) pids.add(pid);
+      else complete = false;
+    }
+  }
+  return { observed: true, complete, pids: [...pids] };
+}
+async function probeListeningPortOwners(executor, port) {
+  const command = `ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`;
+  const ordinary = parseListenerPids(await tryExec(executor, command));
+  let evidence = ordinary;
+  if (ordinary.observed && !ordinary.complete) {
+    const privileged = parseListenerPids(
+      await tryExec(
+        executor,
+        `sudo -n ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || sudo -n lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null`,
+        { timeout: 5e3 }
+      )
+    );
+    if (privileged.observed && privileged.complete) evidence = privileged;
+    else {
+      evidence = {
+        observed: true,
+        complete: false,
+        pids: [.../* @__PURE__ */ new Set([...ordinary.pids, ...privileged.pids])]
+      };
+    }
+  }
+  if (!evidence.observed) {
+    const listening = await probePortListeningOnce(executor, port);
+    if (listening === null) return { occupants: [], checked: false, ownershipComplete: false };
+    if (!listening) return { occupants: [], checked: true, ownershipComplete: true };
+    return { occupants: [], checked: true, ownershipComplete: false };
+  }
+  const described = await Promise.all(
+    evidence.pids.map((pid) => describeProcess(executor, pid).catch(() => null))
+  );
+  const occupants = described.filter((row) => row !== null);
+  return {
+    occupants,
+    checked: true,
+    ownershipComplete: evidence.complete && occupants.length === evidence.pids.length
+  };
+}
+async function probeListeningPortState(executor, port) {
   try {
-    const { pid, occupied } = await resolveListener(executor, port);
-    if (!occupied) return null;
-    if (pid === null) return { pid: null, command: "unknown listener" };
-    return await describeProcess(executor, pid);
+    const { pid, occupied, checked } = await resolveListener(executor, port);
+    if (!checked || !occupied) return { occupant: null, checked };
+    if (pid === null) {
+      return { occupant: { pid: null, command: "unknown listener" }, checked: true };
+    }
+    return { occupant: await describeProcess(executor, pid), checked: true };
   } catch {
-    return null;
+    return { occupant: null, checked: false };
   }
 }
+async function probeListeningPort(executor, port) {
+  return (await probeListeningPortState(executor, port)).occupant;
+}
 async function describeProcess(executor, pid) {
   let command = `PID ${pid}`;
   let rawCommand;
@@ -173,6 +258,7 @@ function portOccupantDetails(port, occupant, stopTarget) {
 export {
   waitForPortListening,
   waitForPortFree,
+  probeListeningPortOwners,
   probeListeningPort,
   describeProcess,
   portOccupantDetails

package/dist/{chunk-J3K6XABC.js → chunk-D3OEMXYP.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-I3DPMTSF.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   logEntry,
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   edgeFailureReason
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 
 // ../../packages/adapters/src/system/docker-edge-executor.ts
 import Dockerode from "dockerode";

package/dist/{chunk-UWEV6XTS.js → chunk-D6HU4VUZ.js}

@@ -10,7 +10,7 @@ import {
 import {
   safeErrorMessage,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/probe-exec.ts
 async function tryExec(executor, command, opts) {

package/dist/{chunk-S6B2Z3OO.js → chunk-ENKJ7XIF.js}

@@ -7,11 +7,11 @@ import {
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-MEE6OZFP.js";
+} from "./chunk-5DJOB7IX.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-WU54BXFE.js";
+} from "./chunk-SK4FFCFR.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -24,36 +24,36 @@ import {
   splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-H4FS5BED.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   privilegedExecutor
-} from "./chunk-PVP4RGWT.js";
+} from "./chunk-T46BQOLY.js";
 import {
   HOST_STATE_DIR,
   envOps,
   hostRefusal,
   opScript
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   ensureOwnedDir,
   resolveEnvironment
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   sq as sq2,
   wrapLocalBuildCommand
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   portOccupantDetails,
   probeListeningPort
-} from "./chunk-VSTFHUCV.js";
+} from "./chunk-BO6CY4V2.js";
 import {
   managedDeploymentUnitName,
   probeExec,
   withReason
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   formatDuration,
   isRemoteConnectionError,
@@ -73,7 +73,7 @@ import {
   refused,
   safeErrorMessage,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/remote-journal.ts
 var OPSH_RUN_VERSION = 1;
@@ -1608,6 +1608,16 @@ var BareRuntime = class {
   async inContainerExecutor() {
     return this.executor;
   }
+  /**
+   * Resolve a retained application release for an env-only refresh.
+   * Deployment ids originate in our database, but reject path-shaped input at
+   * this boundary so an imported/corrupt row cannot escape releases/.
+   */
+  async retainedReleaseArtifact(deploymentId) {
+    if (!deploymentId || deploymentId.includes("/") || deploymentId.includes("\\")) return null;
+    const path = this.releaseDir(deploymentId);
+    return await this.executor.exists(path).catch(() => false) ? path : null;
+  }
   /** Get or lazily initialise the process supervisor. */
   async supervisor() {
     if (this._supervisor) return this._supervisor;

package/dist/{chunk-DDFUESPJ.js → chunk-FCGJN5Q5.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-PPEBIY5F.js";
+} from "./chunk-634DDFT5.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -36,18 +36,18 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-RDXT4BQB.js";
+} from "./chunk-7YBWXEM6.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-VQM6JHJB.js";
+} from "./chunk-5UXHT6ED.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-J2XM3QSP.js";
+} from "./chunk-NUT6HKK6.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,17 +58,17 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   isValidEmail
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -1564,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.7"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.9"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-BLEXTYRK.js → chunk-GNOMEMNI.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {