openship 0.6.9 → 0.7.1

package/dist/{chunk-634DDFT5.js → chunk-H36ASAYI.js}

@@ -10,28 +10,28 @@ import {
   readComposeEnvFile,
   resolveLocalEnvironmentSync,
   thisHost
-} from "./chunk-5UXHT6ED.js";
+} from "./chunk-IXBOV7BE.js";
 import {
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   systemCatalog
-} from "./chunk-NIYD7MD2.js";
+} from "./chunk-XJSLJLNY.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
-} from "./chunk-7PEXM2UI.js";
+} from "./chunk-DQR5TPFB.js";
 import {
   DEFAULT_DOCKER_SOCKET_PATH,
   resolveLocalDockerSocketPath
-} from "./chunk-3MP6ACKM.js";
+} from "./chunk-7MCPDYKP.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-37XZTLBJ.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_BLOCKED,
@@ -51,7 +51,7 @@ import {
   hostFirewallRule,
   hostFirewallRuleRemoval,
   wrapText
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 
 // src/lib/host-channel-preflight.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -1627,7 +1627,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.9" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.7.1" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [

package/dist/{chunk-AHJYP7DG.js → chunk-IVMPA6RC.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-VAI5VOOI.js";
+} from "./chunk-2YAY5XHK.js";
 import {
   TRANSFER_EXCLUDES,
   nodeBinDirs,
@@ -13,7 +13,7 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/runtime/git-clone.ts
 var sq = shellQuote;
@@ -75,18 +75,48 @@ function assembleGitClone(auth) {
     );
   }
   if (auth.gitCredentialHelperPath) {
-    return invocation(
+    const base = invocation(
       auth.repoUrl,
       [
         TERMINAL_PROMPT,
-        ["GIT_CONFIG_COUNT", "2", false],
+        // An empty helper value resets helpers inherited from the host before
+        // adding the deployment-scoped relay. Without the reset, a server's
+        // stale/global helper can answer first and silently override the
+        // forwarded identity named in the deployment log.
+        ["GIT_CONFIG_COUNT", "3", false],
         ["GIT_CONFIG_KEY_0", "credential.helper", false],
-        ["GIT_CONFIG_VALUE_0", auth.gitCredentialHelperPath, true],
-        ["GIT_CONFIG_KEY_1", "credential.useHttpPath", false],
-        ["GIT_CONFIG_VALUE_1", "true", false]
+        ["GIT_CONFIG_VALUE_0", "", true],
+        ["GIT_CONFIG_KEY_1", "credential.helper", false],
+        ["GIT_CONFIG_VALUE_1", auth.gitCredentialHelperPath, true],
+        ["GIT_CONFIG_KEY_2", "credential.useHttpPath", false],
+        ["GIT_CONFIG_VALUE_2", "true", false]
       ],
       false
     );
+    let url;
+    try {
+      url = new URL(auth.repoUrl);
+    } catch {
+      throw new Error("Git credential forwarding requires an absolute HTTPS repository URL");
+    }
+    if (url.protocol !== "https:") {
+      throw new Error("Git credential forwarding requires an HTTPS repository URL");
+    }
+    const protocol = url.protocol.slice(0, -1);
+    const path = url.pathname.replace(/^\/+/, "");
+    const headerVar = "OPENSHIP_GIT_AUTH_HEADER";
+    const headerCommand = `${sq(auth.gitCredentialHelperPath)} auth-header ${sq(protocol)} ${sq(url.hostname)} ${sq(path)}`;
+    return {
+      ...base,
+      // `auth-header` returns only the Basic header, never prints it to the
+      // build log, and keeps the token out of the command text and filesystem.
+      // The value exists only in the remote shell/git process for this command.
+      shellPrelude: `${headerVar}="$(${headerCommand})" && test -n "$${headerVar}"`,
+      // The argv representation above remains a valid challenge-based helper
+      // invocation for local spawn users. Remote shell users call
+      // gitShellCommand(), which adds the preemptive header as config slot 3.
+      gitEnv: `${base.gitEnv.replace("GIT_CONFIG_COUNT=3", "GIT_CONFIG_COUNT=4")} GIT_CONFIG_KEY_3=http.extraHeader GIT_CONFIG_VALUE_3="$${headerVar}"`
+    };
   }
   if (auth.ambient) {
     if (auth.ambient.via === "ssh") {
@@ -112,6 +142,12 @@ function assembleGitClone(auth) {
     true
   );
 }
+function gitShellCommand(invocation2, args) {
+  const env = invocation2.gitEnv ? `${invocation2.gitEnv} ` : "";
+  const flags = invocation2.credFlag ? `${invocation2.credFlag} ` : "";
+  const command = `${env}git ${flags}${args}`;
+  return invocation2.shellPrelude ? `${invocation2.shellPrelude} && ${command}` : command;
+}
 
 // ../../packages/adapters/src/runtime/git-ssh-material.ts
 import { mkdir, rm, writeFile } from "fs/promises";
@@ -253,31 +289,49 @@ async function runBuildPipeline(env, config, logger) {
               config.gitSsh
             );
           }
-          const { cloneUrl, gitEnv: GIT_ENV, credFlag: CRED } = assembleGitClone({
+          const gitInvocation = assembleGitClone({
             repoUrl: config.repoUrl,
             gitToken: config.gitToken,
             gitCredentialHelperPath: config.gitCredentialHelperPath,
             ssh: sshMaterial,
             ambient: config.gitAmbient
           });
+          const { cloneUrl, credFlag: CRED } = gitInvocation;
           try {
             if (config.commitSha) {
-              try {
-                await exec(
-                  `${GIT_ENV} git ${CRED} clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)} && cd ${sq(env.projectDir)} && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
-                );
-              } catch {
+              await exec(
+                gitShellCommand(
+                  gitInvocation,
+                  `clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)}`
+                )
+              );
+              const commitPresent = await exec(
+                `cd ${sq(env.projectDir)} && git ${CRED} cat-file -e ${sq(`${config.commitSha}^{commit}`)}`
+              ).then(
+                () => true,
+                () => false
+              );
+              if (!commitPresent) {
                 logger.log(
-                  `Checkout of ${config.commitSha} failed inside the depth-50 clone; running git fetch --unshallow and retrying.`,
+                  `Commit ${config.commitSha} is not in the depth-50 clone; fetching full history before checkout.`,
                   "warn"
                 );
                 await exec(
-                  `cd ${sq(env.projectDir)} && ${GIT_ENV} git ${CRED} fetch --progress --unshallow && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+                  `cd ${sq(env.projectDir)} && ${gitShellCommand(gitInvocation, "fetch --progress --unshallow")}`
                 );
               }
+              await exec(
+                `cd ${sq(env.projectDir)} && ${gitShellCommand(
+                  gitInvocation,
+                  `-c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+                )}`
+              );
             } else {
               await exec(
-                `${GIT_ENV} git ${CRED} clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)}`
+                gitShellCommand(
+                  gitInvocation,
+                  `clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(env.projectDir)}`
+                )
               );
             }
           } finally {
@@ -342,7 +396,9 @@ function parseLogLevel(message) {
 function detectBuildKillHint(output) {
   if (!output) return null;
   const tail = output.slice(-4096);
-  if (/\bsigkill\b|\bKilled\b|out of memory|JavaScript heap out of memory|Allocation failed/i.test(tail)) {
+  if (/\bsigkill\b|\bKilled\b|out of memory|JavaScript heap out of memory|Allocation failed/i.test(
+    tail
+  )) {
     return "Build process was killed - typically because the target ran out of memory during the build. Increase RAM on the target, add swap, or build locally and ship the dist.";
   }
   return null;
@@ -913,6 +969,7 @@ export {
   sq,
   injectGitToken,
   assembleGitClone,
+  gitShellCommand,
   materializeGitSsh,
   shellGitSshWriter,
   localGitSshWriter,

package/dist/{chunk-5UXHT6ED.js → chunk-IXBOV7BE.js}

@@ -134,10 +134,10 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-MUWVC5R4.js";
+} from "./chunk-BBPKAQ54.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-7PEXM2UI.js";
+} from "./chunk-DQR5TPFB.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
@@ -146,26 +146,26 @@ import {
   resolveExecExitCode,
   startAttachStream,
   startExecStream
-} from "./chunk-3MP6ACKM.js";
+} from "./chunk-7MCPDYKP.js";
 import {
   BareRuntime
-} from "./chunk-ENKJ7XIF.js";
+} from "./chunk-3YSSXSC2.js";
 import {
   createExecutor
-} from "./chunk-UAWY6X7V.js";
+} from "./chunk-GPTBEPUE.js";
 import {
   envOps
-} from "./chunk-GNOMEMNI.js";
+} from "./chunk-KATXZ5AB.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   MAIL_HOST_STATE_DIR
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-7TQP6723.js";
 import {
   FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
@@ -177,7 +177,7 @@ import {
   validateBackupPath,
   validateClearPath,
   withTimeout
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -1141,6 +1141,8 @@ function demuxDockerStream(source, stdout, stderr, onError) {
 
 // ../../packages/adapters/src/backup/executors/docker.ts
 var HELPER_IMAGE = "alpine:3";
+var BIND_PROBE_TARGET = "/__openship_bind_source";
+var DOCKER_MODE_DIRECTORY = 2 ** 31;
 var ARTIFACT_BUFFER_BYTES = 4 * 1024 * 1024;
 var DEFAULT_HELPER_IDLE_MS = 10 * 60 * 1e3;
 var DEFAULT_HELPER_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
@@ -1216,6 +1218,29 @@ function parseVolumeSpec(spec) {
   const type = isHostPathSource(source) ? "bind" : "volume";
   return { source, target, type };
 }
+function archivePathIsDirectory(response, path) {
+  const rawHeader = response.headers?.["x-docker-container-path-stat"];
+  const encoded = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+  if (!encoded) {
+    throw new Error(`Docker returned no path-stat header while inspecting ${path}`);
+  }
+  let stat;
+  try {
+    stat = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+  } catch (err) {
+    throw new Error(`Docker returned an invalid path-stat header while inspecting ${path}`, {
+      cause: err
+    });
+  }
+  const mode = stat?.mode;
+  if (typeof mode !== "number" || !Number.isSafeInteger(mode)) {
+    throw new Error(`Docker returned no valid path mode while inspecting ${path}`);
+  }
+  return mode >= DOCKER_MODE_DIRECTORY;
+}
+function isMissingBindSourceError(err) {
+  return err?.statusCode === 400 && /bind source path does not exist/i.test(safeErrorMessage(err));
+}
 var DockerBackupExecutor = class {
   constructor(runtime) {
     this.runtime = runtime;
@@ -1244,23 +1269,82 @@ var DockerBackupExecutor = class {
       );
     }
   }
+  /**
+   * Ask the Docker daemon about a path in a container's mount namespace.
+   *
+   * The API may itself run in a container or connect to Docker over SSH/TLS, so
+   * `node:fs` would inspect the wrong filesystem. Docker's archive-info endpoint
+   * returns the daemon-side path's Go FileMode without copying any archive bytes.
+   */
+  async containerPathIsDirectory(container, path) {
+    let response;
+    try {
+      response = await container.infoArchive({ path });
+      return archivePathIsDirectory(response, path);
+    } finally {
+      response?.resume?.();
+    }
+  }
+  /**
+   * Classify a recorded bind source when there is no service container to inspect.
+   * A never-started helper gives Docker a mount namespace, and archive-info reports
+   * the source type from the daemon host. `Mounts` (rather than legacy `Binds`) is
+   * deliberate: a missing source is rejected instead of being created as a directory.
+   */
+  async declaredBindIsDirectory(sourcePath) {
+    try {
+      return await this.withHelper(
+        {
+          Image: HELPER_IMAGE,
+          NetworkDisabled: true,
+          HostConfig: {
+            Mounts: [
+              {
+                Type: "bind",
+                Source: sourcePath,
+                Target: BIND_PROBE_TARGET,
+                ReadOnly: true
+              }
+            ]
+          }
+        },
+        (helper) => this.containerPathIsDirectory(helper, BIND_PROBE_TARGET)
+      );
+    } catch (err) {
+      if (isMissingBindSourceError(err)) return true;
+      throw new Error(
+        `Could not inspect bind mount source "${sourcePath}" on the Docker host: ` + safeErrorMessage(err),
+        { cause: err }
+      );
+    }
+  }
   async listSources(service) {
     if (service.containerId) {
+      const container = this.dockerode.getContainer(service.containerId);
+      let data = null;
       try {
-        const data = await this.dockerode.getContainer(service.containerId).inspect();
-        const mounts = data.Mounts ?? [];
-        return mounts.filter((m2) => m2.Type === "volume" || m2.Type === "bind").map(
-          (m2, i2) => ({
-            id: m2.Name ?? m2.Source ?? `mount-${i2}`,
-            target: m2.Destination ?? "",
-            source: m2.Name ?? m2.Source ?? "",
-            type: m2.Type ?? "volume"
-          })
-        );
+        data = await container.inspect();
       } catch {
       }
+      if (data) {
+        const mounts = data.Mounts ?? [];
+        const sources2 = [];
+        for (const [i2, mount] of mounts.entries()) {
+          if (mount.Type !== "volume" && mount.Type !== "bind") continue;
+          if (mount.Type === "bind" && (!mount.Destination || !await this.containerPathIsDirectory(container, mount.Destination))) {
+            continue;
+          }
+          sources2.push({
+            id: mount.Name ?? mount.Source ?? `mount-${i2}`,
+            target: mount.Destination ?? "",
+            source: mount.Name ?? mount.Source ?? "",
+            type: mount.Type
+          });
+        }
+        return sources2;
+      }
     }
-    return service.volumes.map((spec, i2) => {
+    const sources = service.volumes.map((spec, i2) => {
       const parsed = parseVolumeSpec(spec);
       if (!parsed || !parsed.source) return null;
       const source = parsed.type === "volume" && service.namespaceVolumes ? ensureScopedVolumeName(service.projectSlug, parsed.source) : parsed.source;
@@ -1271,6 +1355,15 @@ var DockerBackupExecutor = class {
         type: parsed.type
       };
     }).filter((x2) => x2 !== null);
+    if (!sources.some((source) => source.type === "bind")) return sources;
+    await this.ensureImage(HELPER_IMAGE);
+    const backupable = [];
+    for (const source of sources) {
+      if (source.type !== "bind" || await this.declaredBindIsDirectory(source.source)) {
+        backupable.push(source);
+      }
+    }
+    return backupable;
   }
   /**
    * The container's own `Config.Env`, as `KEY=value` pairs already split.

package/dist/{chunk-GNOMEMNI.js → chunk-KATXZ5AB.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-T6DVUX4F.js → chunk-KCMEWNP7.js}

@@ -8,13 +8,14 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-2BAKEGGF.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";
 import {
   access,
   mkdir as fsMkdir,
+  open as fsOpen,
   readFile as fsReadFile,
   rename as fsRename,
   rm as fsRm,
@@ -82,9 +83,19 @@ var LocalExecutor = class {
       });
     });
   }
-  async writeFile(path, content) {
+  async writeFile(path, content, opts) {
     await fsMkdir(dirname(path), { recursive: true });
-    await fsWriteFile(path, content, "utf-8");
+    if (opts?.mode === void 0) {
+      await fsWriteFile(path, content, "utf-8");
+      return;
+    }
+    const file = await fsOpen(path, "w", opts.mode);
+    try {
+      await file.chmod(opts.mode);
+      await file.writeFile(content, "utf-8");
+    } finally {
+      await file.close();
+    }
   }
   async rename(from, to) {
     await fsRename(from, to);

package/dist/{chunk-N5YZMO33.js → chunk-L4DRH6ZA.js}

@@ -44,6 +44,15 @@ var SshDisconnectedError = class extends Error {
     this.name = "SshDisconnectedError";
   }
 };
+var SshExecRequestError = class extends Error {
+  constructor(cause) {
+    super(cause.message, { cause });
+    this.name = "SshExecRequestError";
+  }
+};
+function isSshExecRequestError(err) {
+  return err instanceof SshExecRequestError || err instanceof Error && err.name === "SshExecRequestError";
+}
 function isSshDisconnectedError(err) {
   return err instanceof SshDisconnectedError || err instanceof Error && err.name === "SshDisconnectedError";
 }
@@ -67,7 +76,7 @@ function isRetryableRemoteConnectionError(err) {
   );
 }
 function isRemoteConnectionError(err) {
-  return isSshAuthError(err) || isRetryableRemoteConnectionError(err);
+  return isSshAuthError(err) || isRetryableRemoteConnectionError(err) || isSshExecRequestError(err);
 }
 var MAX_COMMAND_CHARS = 120;
 function commandForError(command) {
@@ -100,6 +109,8 @@ function formatDuration(startMs) {
 
 export {
   SshDisconnectedError,
+  SshExecRequestError,
+  isSshExecRequestError,
   isSshAuthError,
   HostChannelUnavailableError,
   isRetryableRemoteConnectionError,

package/dist/{chunk-BO6CY4V2.js → chunk-NF7NQOAP.js}

@@ -7,13 +7,43 @@ import {
   isContainerPortForwarder,
   managedDeploymentIdFromUnit,
   tryExec
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-7TQP6723.js";
 import {
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/port-listen.ts
 var PROC_NET_TCP_FILES = ["/proc/net/tcp", "/proc/net/tcp6"];
+var PROBE_LISTENING = "__OPENSHIP_PORT_LISTENING__";
+var PROBE_FREE = "__OPENSHIP_PORT_FREE__";
+var PROBE_UNAVAILABLE = "__OPENSHIP_PORT_UNAVAILABLE__";
+function buildPortProbeCommand(port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new RangeError(`Invalid TCP port: ${port}`);
+  }
+  return [
+    `lsof_output="$(lsof -nP -t -iTCP:${port} -sTCP:LISTEN 2>&1)"`,
+    `lsof_status=$?`,
+    `if [ "$lsof_status" -eq 0 ] && [ -n "$lsof_output" ] && printf '%s\\n' "$lsof_output" | grep -Eqv '^[0-9]+$'; then`,
+    `  : # Unexpected lsof output: fall through to ss instead of guessing.`,
+    `elif [ "$lsof_status" -eq 0 ] && [ -n "$lsof_output" ]; then`,
+    `  printf '${PROBE_LISTENING}\\n'`,
+    `  exit 0`,
+    `elif [ "$lsof_status" -eq 1 ] && [ -z "$lsof_output" ]; then`,
+    `  printf '${PROBE_FREE}\\n'`,
+    `  exit 0`,
+    `fi`,
+    `ss_output="$(ss -tln "sport = :${port}" 2>&1)"`,
+    `ss_status=$?`,
+    `if [ "$ss_status" -eq 0 ] && printf '%s\\n' "$ss_output" | grep -q LISTEN; then`,
+    `  printf '${PROBE_LISTENING}\\n'`,
+    `elif [ "$ss_status" -eq 0 ]; then`,
+    `  printf '${PROBE_FREE}\\n'`,
+    `else`,
+    `  printf '${PROBE_UNAVAILABLE}\\n'`,
+    `fi`
+  ].join("\n");
+}
 var TCP_LISTEN = "0A";
 function parseListeningPorts(procText) {
   const ports = /* @__PURE__ */ new Set();
@@ -33,7 +63,15 @@ function parseListeningPorts(procText) {
   }
   return ports;
 }
+function parsePortProbeOutput(out) {
+  const trimmed = out.trim();
+  if (trimmed === PROBE_LISTENING) return true;
+  if (trimmed === PROBE_FREE) return false;
+  if (trimmed === PROBE_UNAVAILABLE) return null;
+  return null;
+}
 async function probePortListeningOnce(executor, port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
   const readable = [];
   for (const file of PROC_NET_TCP_FILES) {
     try {
@@ -41,8 +79,13 @@ async function probePortListeningOnce(executor, port) {
     } catch {
     }
   }
-  if (readable.length === 0) return null;
-  return parseListeningPorts(readable.join("\n")).has(port);
+  if (readable.length > 0) return parseListeningPorts(readable.join("\n")).has(port);
+  try {
+    const out = await executor.exec(buildPortProbeCommand(port), { timeout: 5e3 });
+    return parsePortProbeOutput(out);
+  } catch {
+    return null;
+  }
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));

package/dist/{chunk-FCGJN5Q5.js → chunk-NIOLZENU.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-634DDFT5.js";
+} from "./chunk-H36ASAYI.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -36,18 +36,18 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-7YBWXEM6.js";
+} from "./chunk-OEYXXSAM.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-5UXHT6ED.js";
+} from "./chunk-IXBOV7BE.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-NUT6HKK6.js";
+} from "./chunk-WG5PDWZ3.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,17 +58,17 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-37XZTLBJ.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-7TQP6723.js";
 import {
   isValidEmail
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -1564,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.9"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.7.1"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-7YBWXEM6.js → chunk-OEYXXSAM.js}

@@ -7,20 +7,20 @@ import {
   composeInstallExists,
   readComposeEnvFile,
   startUnitHint
-} from "./chunk-5UXHT6ED.js";
+} from "./chunk-IXBOV7BE.js";
 import {
   INTERNAL_TOKEN_FILE,
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   edgeCrashReason
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-37XZTLBJ.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-7TQP6723.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";

package/dist/{chunk-6GU6JSK6.js → chunk-S5GU345P.js}

@@ -13,14 +13,14 @@ import {
   resolveDockerRootDirectory,
   resolveDockerfileCandidates,
   resolveWithinDirectory
-} from "./chunk-AHJYP7DG.js";
+} from "./chunk-IVMPA6RC.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-VAI5VOOI.js";
+} from "./chunk-2YAY5XHK.js";
 import {
   isValidEnvKey
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 import {
   __commonJS,
   __toESM