openship 0.6.9 → 0.7.0

package/dist/{chunk-AHJYP7DG.js → chunk-SYQ3FOLE.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-VAI5VOOI.js";
+} from "./chunk-JAKVPLHT.js";
 import {
   TRANSFER_EXCLUDES,
   nodeBinDirs,
@@ -13,7 +13,7 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/runtime/git-clone.ts
 var sq = shellQuote;
@@ -75,18 +75,48 @@ function assembleGitClone(auth) {
     );
   }
   if (auth.gitCredentialHelperPath) {
-    return invocation(
+    const base = invocation(
       auth.repoUrl,
       [
         TERMINAL_PROMPT,
-        ["GIT_CONFIG_COUNT", "2", false],
+        // An empty helper value resets helpers inherited from the host before
+        // adding the deployment-scoped relay. Without the reset, a server's
+        // stale/global helper can answer first and silently override the
+        // forwarded identity named in the deployment log.
+        ["GIT_CONFIG_COUNT", "3", false],
         ["GIT_CONFIG_KEY_0", "credential.helper", false],
-        ["GIT_CONFIG_VALUE_0", auth.gitCredentialHelperPath, true],
-        ["GIT_CONFIG_KEY_1", "credential.useHttpPath", false],
-        ["GIT_CONFIG_VALUE_1", "true", false]
+        ["GIT_CONFIG_VALUE_0", "", true],
+        ["GIT_CONFIG_KEY_1", "credential.helper", false],
+        ["GIT_CONFIG_VALUE_1", auth.gitCredentialHelperPath, true],
+        ["GIT_CONFIG_KEY_2", "credential.useHttpPath", false],
+        ["GIT_CONFIG_VALUE_2", "true", false]
       ],
       false
     );
+    let url;
+    try {
+      url = new URL(auth.repoUrl);
+    } catch {
+      throw new Error("Git credential forwarding requires an absolute HTTPS repository URL");
+    }
+    if (url.protocol !== "https:") {
+      throw new Error("Git credential forwarding requires an HTTPS repository URL");
+    }
+    const protocol = url.protocol.slice(0, -1);
+    const path = url.pathname.replace(/^\/+/, "");
+    const headerVar = "OPENSHIP_GIT_AUTH_HEADER";
+    const headerCommand = `${sq(auth.gitCredentialHelperPath)} auth-header ${sq(protocol)} ${sq(url.hostname)} ${sq(path)}`;
+    return {
+      ...base,
+      // `auth-header` returns only the Basic header, never prints it to the
+      // build log, and keeps the token out of the command text and filesystem.
+      // The value exists only in the remote shell/git process for this command.
+      shellPrelude: `${headerVar}="$(${headerCommand})" && test -n "$${headerVar}"`,
+      // The argv representation above remains a valid challenge-based helper
+      // invocation for local spawn users. Remote shell users call
+      // gitShellCommand(), which adds the preemptive header as config slot 3.
+      gitEnv: `${base.gitEnv.replace("GIT_CONFIG_COUNT=3", "GIT_CONFIG_COUNT=4")} GIT_CONFIG_KEY_3=http.extraHeader GIT_CONFIG_VALUE_3="$${headerVar}"`
+    };
   }
   if (auth.ambient) {
     if (auth.ambient.via === "ssh") {
@@ -112,6 +142,12 @@ function assembleGitClone(auth) {
     true
   );
 }
+function gitShellCommand(invocation2, args) {
+  const env = invocation2.gitEnv ? `${invocation2.gitEnv} ` : "";
+  const flags = invocation2.credFlag ? `${invocation2.credFlag} ` : "";
+  const command = `${env}git ${flags}${args}`;
+  return invocation2.shellPrelude ? `${invocation2.shellPrelude} && ${command}` : command;
+}
 
 // ../../packages/adapters/src/runtime/git-ssh-material.ts
 import { mkdir, rm, writeFile } from "fs/promises";
@@ -253,31 +289,49 @@ async function runBuildPipeline(env, config, logger) {
               config.gitSsh
             );
           }
-          const { cloneUrl, gitEnv: GIT_ENV, credFlag: CRED } = assembleGitClone({
+          const gitInvocation = assembleGitClone({
             repoUrl: config.repoUrl,
             gitToken: config.gitToken,
             gitCredentialHelperPath: config.gitCredentialHelperPath,
             ssh: sshMaterial,
             ambient: config.gitAmbient
           });
+          const { cloneUrl, credFlag: CRED } = gitInvocation;
           try {
             if (config.commitSha) {
-              try {
-                await exec(
-                  `${GIT_ENV} git ${CRED} clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)} && cd ${sq(env.projectDir)} && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
-                );
-              } catch {
+              await exec(
+                gitShellCommand(
+                  gitInvocation,
+                  `clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)}`
+                )
+              );
+              const commitPresent = await exec(
+                `cd ${sq(env.projectDir)} && git ${CRED} cat-file -e ${sq(`${config.commitSha}^{commit}`)}`
+              ).then(
+                () => true,
+                () => false
+              );
+              if (!commitPresent) {
                 logger.log(
-                  `Checkout of ${config.commitSha} failed inside the depth-50 clone; running git fetch --unshallow and retrying.`,
+                  `Commit ${config.commitSha} is not in the depth-50 clone; fetching full history before checkout.`,
                   "warn"
                 );
                 await exec(
-                  `cd ${sq(env.projectDir)} && ${GIT_ENV} git ${CRED} fetch --progress --unshallow && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+                  `cd ${sq(env.projectDir)} && ${gitShellCommand(gitInvocation, "fetch --progress --unshallow")}`
                 );
               }
+              await exec(
+                `cd ${sq(env.projectDir)} && ${gitShellCommand(
+                  gitInvocation,
+                  `-c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+                )}`
+              );
             } else {
               await exec(
-                `${GIT_ENV} git ${CRED} clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)}`
+                gitShellCommand(
+                  gitInvocation,
+                  `clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)}`
+                )
               );
             }
           } finally {
@@ -342,7 +396,9 @@ function parseLogLevel(message) {
 function detectBuildKillHint(output) {
   if (!output) return null;
   const tail = output.slice(-4096);
-  if (/\bsigkill\b|\bKilled\b|out of memory|JavaScript heap out of memory|Allocation failed/i.test(tail)) {
+  if (/\bsigkill\b|\bKilled\b|out of memory|JavaScript heap out of memory|Allocation failed/i.test(
+    tail
+  )) {
     return "Build process was killed - typically because the target ran out of memory during the build. Increase RAM on the target, add swap, or build locally and ship the dist.";
   }
   return null;
@@ -913,6 +969,7 @@ export {
   sq,
   injectGitToken,
   assembleGitClone,
+  gitShellCommand,
   materializeGitSsh,
   shellGitSshWriter,
   localGitSshWriter,

package/dist/{chunk-3MP6ACKM.js → chunk-TPGBT5UR.js}

@@ -9,11 +9,11 @@ import {
   prepareSourceTree,
   resolveDockerBuildArgs,
   resolveServiceDockerfile
-} from "./chunk-6GU6JSK6.js";
+} from "./chunk-QNQFS37A.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-SK4FFCFR.js";
+} from "./chunk-MZYD3LFP.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -22,6 +22,7 @@ import {
   dockerBuildContextDirectory,
   droppedRuntimeEnvMessage,
   generateDockerfile,
+  gitShellCommand,
   isExcludedDocRootEntry,
   killProcessesUnderDir,
   materializeGitSsh,
@@ -34,7 +35,7 @@ import {
   sq,
   staticBuilderOutputPath,
   transferLocalDirectory
-} from "./chunk-AHJYP7DG.js";
+} from "./chunk-SYQ3FOLE.js";
 import {
   DOCKER_DIAL_STDIO_COMMAND,
   attachDialStdioDiagnostics,
@@ -43,14 +44,14 @@ import {
   execSshCommand,
   openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-TAZZZKYO.js";
+} from "./chunk-HBQWOJRP.js";
 import {
   dirOf,
   ensureOwnedDir
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-JWW5YAFL.js";
 import {
   OPENSHIP_LABEL
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 import {
   isRuntimeNotFoundError
 } from "./chunk-N5YZMO33.js";
@@ -64,7 +65,7 @@ import {
   registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 import {
   __commonJS,
   __require,
@@ -4630,6 +4631,41 @@ import { createGzip } from "zlib";
 import { PassThrough, Writable } from "stream";
 import { relative, sep } from "path";
 
+// ../../packages/adapters/src/runtime/docker-container-info.ts
+function bindingPriority(ip) {
+  const normalized = ip?.trim().replace(/^\[|\]$/g, "") ?? "";
+  if (normalized === "127.0.0.1" || normalized === "::1") return 3;
+  if (/^127(?:\.\d{1,3}){3}$/.test(normalized)) return 2;
+  if (normalized && normalized !== "0.0.0.0" && normalized !== "::") return 1;
+  return 0;
+}
+function dockerPublishedPortInfo(ports) {
+  const selected = /* @__PURE__ */ new Map();
+  for (const binding of ports) {
+    if ((binding.type || "tcp").toLowerCase() !== "tcp") continue;
+    if (!Number.isSafeInteger(binding.privatePort) || binding.privatePort < 1 || binding.privatePort > 65535) {
+      continue;
+    }
+    const hostPort2 = binding.publicPort;
+    if (typeof hostPort2 !== "number" || !Number.isSafeInteger(hostPort2) || hostPort2 < 1 || hostPort2 > 65535) {
+      continue;
+    }
+    const priority = bindingPriority(binding.ip);
+    const previous = selected.get(binding.privatePort);
+    if (!previous || priority > previous.priority) {
+      selected.set(binding.privatePort, { hostPort: hostPort2, priority });
+    }
+  }
+  const hostPortByContainerPort = Object.fromEntries(
+    [...selected].map(([containerPort, binding]) => [containerPort, binding.hostPort])
+  );
+  const hostPort = selected.values().next().value?.hostPort;
+  return {
+    ...hostPort !== void 0 ? { hostPort } : {},
+    ...selected.size > 0 ? { hostPortByContainerPort } : {}
+  };
+}
+
 // ../../packages/adapters/src/runtime/docker-auth.ts
 import { readFile } from "fs/promises";
 import { homedir } from "os";
@@ -4805,11 +4841,13 @@ function bridgeSocket(socket, leftover) {
   });
   return out;
 }
-function upgradeRequest(conn, path, body) {
+function upgradeRequest(conn, path, body, opts = {}) {
   return new Promise((resolve, reject) => {
     const socket = connect(conn);
     let settled = false;
     let head = Buffer.alloc(0);
+    const protocol = opts.protocol ?? "tcp";
+    const timeoutLabel = opts.timeoutLabel ?? "docker exec";
     const fail = (err) => {
       if (settled) return;
       settled = true;
@@ -4818,7 +4856,7 @@ function upgradeRequest(conn, path, body) {
       reject(err);
     };
     const timer = setTimeout(
-      () => fail(new Error(`docker exec upgrade timed out after ${UPGRADE_TIMEOUT_MS}ms`)),
+      () => fail(new Error(`${timeoutLabel} upgrade timed out after ${UPGRADE_TIMEOUT_MS}ms`)),
       UPGRADE_TIMEOUT_MS
     );
     const onData = (chunk) => {
@@ -4827,7 +4865,8 @@ function upgradeRequest(conn, path, body) {
       const text = head.toString("latin1");
       const end = text.indexOf(HEADER_END);
       if (end === -1) {
-        if (head.length > 64 * 1024) fail(new Error("docker exec upgrade: response head too large"));
+        if (head.length > 64 * 1024)
+          fail(new Error(`${timeoutLabel} upgrade: response head too large`));
         return;
       }
       const statusLine = text.slice(0, text.indexOf("\r\n"));
@@ -4848,14 +4887,17 @@ function upgradeRequest(conn, path, body) {
     socket.on("data", onData);
     socket.on("error", fail);
     socket.on("close", onEarlyClose);
+    const extraHeaders = Object.entries(opts.headers ?? {}).map(([name, value]) => `${name}: ${value}\r
+`).join("");
+    const contentType = opts.contentType ? `Content-Type: ${opts.contentType}\r
+` : "";
     socket.write(
       `POST ${path} HTTP/1.1\r
 Host: ${conn.socketPath ? "localhost" : conn.host ?? "localhost"}\r
-Content-Type: application/json\r
-Content-Length: ${Buffer.byteLength(body)}\r
+` + contentType + `Content-Length: ${Buffer.byteLength(body)}\r
 Connection: Upgrade\r
-Upgrade: tcp\r
-\r
+Upgrade: ${protocol}\r
+` + extraHeaders + `\r
 ` + body
     );
   });
@@ -4864,7 +4906,8 @@ function startExecStream(conn, execId, opts) {
   return upgradeRequest(
     conn,
     `/exec/${execId}/start`,
-    JSON.stringify({ Detach: false, Tty: opts.tty })
+    JSON.stringify({ Detach: false, Tty: opts.tty }),
+    { contentType: "application/json" }
   );
 }
 function startAttachStream(conn, containerId, opts) {
@@ -4874,7 +4917,55 @@ function startAttachStream(conn, containerId, opts) {
     stdout: opts.stdout ? "1" : "0",
     stderr: opts.stderr ? "1" : "0"
   });
-  return upgradeRequest(conn, `/containers/${containerId}/attach?${q.toString()}`, "");
+  return upgradeRequest(conn, `/containers/${containerId}/attach?${q.toString()}`, "", {
+    contentType: "application/json"
+  });
+}
+function startBuildKitSessionStream(conn, sessionId, sessionName) {
+  if (!sessionId || /[\r\n]/.test(sessionId) || /[\r\n]/.test(sessionName)) {
+    return Promise.reject(new Error("Invalid Docker BuildKit session identity"));
+  }
+  return upgradeRequest(conn, "/session", "", {
+    protocol: "h2c",
+    headers: {
+      "X-Docker-Expose-Session-Uuid": sessionId,
+      "X-Docker-Expose-Session-Name": sessionName
+    },
+    timeoutLabel: "Docker BuildKit session"
+  });
+}
+var patchedBuildKitModems = /* @__PURE__ */ new WeakSet();
+function headerValue(headers, name) {
+  if (!headers || typeof headers !== "object") return "";
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== name.toLowerCase()) continue;
+    if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : "";
+    return value == null ? "" : String(value);
+  }
+  return "";
+}
+function installDockerodeBuildKitSessionWorkaround(docker) {
+  if (!docker.modem || typeof docker.modem !== "object") return;
+  const modem = docker.modem;
+  if (typeof modem.dial !== "function" || patchedBuildKitModems.has(modem)) return;
+  const originalDial = modem.dial.bind(modem);
+  modem.dial = (options, callback) => {
+    const upgrade = headerValue(options.headers, "upgrade");
+    if (options.path !== "/session" || options.hijack !== true || upgrade.toLowerCase() !== "h2c" || !callback) {
+      return originalDial(options, callback);
+    }
+    const sessionId = headerValue(options.headers, "x-docker-expose-session-uuid");
+    const sessionName = headerValue(options.headers, "x-docker-expose-session-name");
+    void startBuildKitSessionStream(
+      daemonConnectionFrom(docker),
+      sessionId,
+      sessionName || "openship"
+    ).then(
+      (socket) => callback(null, socket),
+      (error) => callback(error instanceof Error ? error : new Error(String(error)), null)
+    );
+  };
+  patchedBuildKitModems.add(modem);
 }
 function daemonConnectionFrom(docker) {
   const m = docker.modem ?? {};
@@ -5113,7 +5204,10 @@ function awaitFirstByte(upstream, ms) {
       upstream.removeListener("close", onFail);
       resolve(outcome);
     };
-    const onData = (chunk) => finish({ kind: "data", chunk });
+    const onData = (chunk) => {
+      upstream.pause();
+      finish({ kind: "data", chunk });
+    };
     const onFail = () => finish({ kind: "closed" });
     const timer = setTimeout(() => finish({ kind: "silent" }), ms);
     upstream.on("data", onData);
@@ -5373,7 +5467,9 @@ function createDockerSshBridge(opts) {
         firstByte.kind === "closed" ? "channel closed before answering" : "channel opened but no data flowed"
       );
     } catch (err) {
-      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+      console.warn(
+        `[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`
+      );
       capture.fail(bridgeFailureReason(opts, safeErrorMessage(err)));
     }
   };
@@ -5386,7 +5482,9 @@ function createDockerSshBridge(opts) {
     void bridgeClient(client);
   });
   server.on("error", (err) => {
-    console.warn(`[docker-ssh] bridge listener error (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+    console.warn(
+      `[docker-ssh] bridge listener error (${opts.host ?? "?"}): ${safeErrorMessage(err)}`
+    );
   });
   return {
     start: () => new Promise((resolve, reject) => {
@@ -5852,38 +5950,28 @@ function extractNetworkInfo(data) {
       break;
     }
   }
-  const hostPortByContainerPort = {};
-  let hostPort;
   const liveBindings = data.NetworkSettings?.Ports ?? {};
   const configuredBindings = data.HostConfig?.PortBindings ?? {};
+  const publishedPorts = [];
   for (const key of /* @__PURE__ */ new Set([...Object.keys(liveBindings), ...Object.keys(configuredBindings)])) {
     const [containerRaw, protocol = "tcp"] = key.split("/");
-    if (protocol.toLowerCase() !== "tcp") continue;
     const containerPort = Number(containerRaw);
-    if (!Number.isSafeInteger(containerPort) || containerPort < 1 || containerPort > 65535) {
-      continue;
-    }
     const live = liveBindings[key];
     const bindings = live && live.some((binding) => binding?.HostPort) ? live : configuredBindings[key];
-    const candidates = (bindings ?? []).map((binding, index) => {
-      const port = Number(binding?.HostPort);
-      if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return null;
-      const ip2 = binding?.HostIp?.trim().replace(/^\[|\]$/g, "") ?? "";
-      const priority = ip2 === "127.0.0.1" || ip2 === "::1" ? 3 : /^127(?:\.\d{1,3}){3}$/.test(ip2) ? 2 : ip2 && ip2 !== "0.0.0.0" && ip2 !== "::" ? 1 : 0;
-      return { index, port, priority };
-    }).filter(
-      (candidate) => Boolean(candidate)
-    ).sort((left, right) => right.priority - left.priority || left.index - right.index);
-    const selected = candidates[0]?.port;
-    if (selected !== void 0) {
-      hostPortByContainerPort[containerPort] = selected;
-      hostPort ??= selected;
+    for (const binding of bindings ?? []) {
+      publishedPorts.push({
+        privatePort: containerPort,
+        publicPort: Number(binding?.HostPort),
+        type: protocol,
+        ...binding?.HostIp ? { ip: binding.HostIp } : {}
+      });
     }
   }
+  const { hostPort, hostPortByContainerPort } = dockerPublishedPortInfo(publishedPorts);
   return {
     ip,
     hostPort,
-    ...Object.keys(hostPortByContainerPort).length ? { hostPortByContainerPort } : {}
+    ...hostPortByContainerPort ? { hostPortByContainerPort } : {}
   };
 }
 function parseLoadedImageRef(output) {
@@ -5988,6 +6076,9 @@ var DockerRuntime = class _DockerRuntime {
   static async create(opts, systemManager, provisionLock) {
     const runtime = new _DockerRuntime(opts, systemManager, provisionLock);
     runtime._docker = new Dockerode(await runtime.transport.establish());
+    if (process.versions.bun) {
+      installDockerodeBuildKitSessionWorkaround(runtime._docker);
+    }
     return runtime;
   }
   supports(cap) {
@@ -6338,48 +6429,64 @@ var DockerRuntime = class _DockerRuntime {
         config.gitSsh
       );
     }
-    const {
-      cloneUrl,
-      gitEnv: GIT_ENV,
-      credFlag: CRED
-    } = assembleGitClone({
+    const gitInvocation = assembleGitClone({
       repoUrl: config.repoUrl,
       gitToken: config.gitToken,
       gitCredentialHelperPath: config.gitCredentialHelperPath,
       ssh: sshMaterial,
       ambient: config.gitAmbient
     });
+    const { cloneUrl, credFlag: CRED } = gitInvocation;
     const dir = sq(remoteContextDir);
     const authLabel = config.gitSsh ? "ssh key" : useHelper ? "forwarded credentials" : config.gitAmbient ? `the server's own git credentials (${config.gitAmbient.via})` : "token";
     log.log(`Cloning ${config.repoUrl} on the server \u2192 ${remoteContextDir} (${authLabel})...
 `);
     await executor.exec(`rm -rf ${dir} && mkdir -p ${dir}`);
-    const run = async (cmd) => {
+    const run = async (operation, cmd) => {
       const { code } = await executor.streamExec(
         cmd,
         (entry) => log.log(entry.message, parseLogLevel(entry.message))
       );
-      if (code !== 0) throw new Error(`git clone on server exited with code ${code}`);
+      if (code !== 0) throw new Error(`git ${operation} on server exited with code ${code}`);
     };
     try {
       if (config.commitSha) {
-        try {
-          await run(
-            `${GIT_ENV} git ${CRED} clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir} && cd ${dir} && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
-          );
-        } catch {
+        await run(
+          "clone",
+          gitShellCommand(
+            gitInvocation,
+            `clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir}`
+          )
+        );
+        const commitPresent = await executor.exec(`cd ${dir} && git ${CRED} cat-file -e ${sq(`${config.commitSha}^{commit}`)}`).then(
+          () => true,
+          () => false
+        );
+        if (!commitPresent) {
           log.log(
             `Commit ${config.commitSha} not in the shallow clone; unshallowing and retrying.
 `,
             "warn"
           );
           await run(
-            `cd ${dir} && ${GIT_ENV} git ${CRED} fetch --progress --unshallow && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+            "fetch",
+            `cd ${dir} && ${gitShellCommand(gitInvocation, "fetch --progress --unshallow")}`
           );
         }
+        await run(
+          "checkout",
+          `cd ${dir} && ${gitShellCommand(
+            gitInvocation,
+            `-c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+          )}`
+        );
       } else {
         await run(
-          `${GIT_ENV} git ${CRED} clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir}`
+          "clone",
+          gitShellCommand(
+            gitInvocation,
+            `clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir}`
+          )
         );
       }
       await executor.exec(`rm -rf ${sq(`${remoteContextDir}/.git`)}`).catch(() => {
@@ -8725,12 +8832,6 @@ var DockerRuntime = class _DockerRuntime {
     const log = onLog ?? (() => {
     });
     const containerName = `openship-${config.slug}-${config.serviceName}`;
-    try {
-      const existing = this.docker.getContainer(containerName);
-      await gracefulStopForGrace(existing);
-      await existing.remove({ force: true });
-    } catch {
-    }
     const serviceEnv = splitRuntimeEnv(config.environment);
     if (serviceEnv.dropped.length > 0) {
       log({
@@ -8758,6 +8859,31 @@ var DockerRuntime = class _DockerRuntime {
     const restartPolicy = resolveRestartPolicy(config.restart);
     const healthcheck = toDockerHealthcheck(config.advanced?.healthcheck);
     const stopConfig = toStopConfig(config.advanced);
+    if (!config.imageAlreadyPrepared) {
+      try {
+        log({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Pulling image ${config.image}...
+`,
+          level: "info"
+        });
+        await this.pullImage(config.image, { force: config.forcePull });
+      } catch (err) {
+        log({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Failed to pull ${config.image}: ${err}
+`,
+          level: "error"
+        });
+        throw err;
+      }
+    }
+    try {
+      const existing = this.docker.getContainer(containerName);
+      await gracefulStopForGrace(existing);
+      await existing.remove({ force: true });
+    } catch {
+    }
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message: `Creating service container ${containerName} from ${config.image}...
@@ -8787,25 +8913,6 @@ var DockerRuntime = class _DockerRuntime {
         level: "info"
       });
     }
-    if (!config.image.startsWith("openship/")) {
-      try {
-        log({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          message: `Pulling image ${config.image}...
-`,
-          level: "info"
-        });
-        await this.pullImage(config.image, { force: config.forcePull });
-      } catch (err) {
-        log({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          message: `Failed to pull ${config.image}: ${err}
-`,
-          level: "error"
-        });
-        throw err;
-      }
-    }
     const container = await this.docker.createContainer({
       name: containerName,
       Image: config.image,

package/dist/{chunk-634DDFT5.js → chunk-TT7P5ZZ3.js}

@@ -10,28 +10,28 @@ import {
   readComposeEnvFile,
   resolveLocalEnvironmentSync,
   thisHost
-} from "./chunk-5UXHT6ED.js";
+} from "./chunk-SPR7N2EK.js";
 import {
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   systemCatalog
-} from "./chunk-NIYD7MD2.js";
+} from "./chunk-7MKZP4TW.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
-} from "./chunk-7PEXM2UI.js";
+} from "./chunk-BOD2IQ3P.js";
 import {
   DEFAULT_DOCKER_SOCKET_PATH,
   resolveLocalDockerSocketPath
-} from "./chunk-3MP6ACKM.js";
+} from "./chunk-TPGBT5UR.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-J4SYG2LC.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-YGA52DHX.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_BLOCKED,
@@ -51,7 +51,7 @@ import {
   hostFirewallRule,
   hostFirewallRuleRemoval,
   wrapText
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // src/lib/host-channel-preflight.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -1627,7 +1627,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.9" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.7.0" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [