openship 0.7.0 → 0.7.1

package/dist/{chunk-CMGRMPRQ.js → chunk-7TQP6723.js}

@@ -6,11 +6,11 @@ import {
   formatDuration,
   isRemoteConnectionError,
   systemDebug
-} from "./chunk-N5YZMO33.js";
+} from "./chunk-L4DRH6ZA.js";
 import {
   safeErrorMessage,
   shellQuote
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/probe-exec.ts
 async function tryExec(executor, command, opts) {

package/dist/{chunk-MZYD3LFP.js → chunk-AMADTKC6.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 
 // ../../packages/adapters/src/runtime/managed-artifact.ts
 var MANAGED_ARTIFACT_BASE = "/opt/openship";

package/dist/{chunk-JWW5YAFL.js → chunk-B2BQX6JX.js}

@@ -4,12 +4,12 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 import {
   formatDuration,
   isRemoteConnectionError,
   systemDebug
-} from "./chunk-N5YZMO33.js";
+} from "./chunk-L4DRH6ZA.js";
 import {
   assessHostSupport,
   classifyDistro,
@@ -17,7 +17,7 @@ import {
   parseSystemArch,
   parseSystemOs,
   safeErrorMessage
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-DZBXOF5Q.js → chunk-BBPKAQ54.js}

@@ -5,17 +5,17 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-7MKZP4TW.js";
+} from "./chunk-XJSLJLNY.js";
 import {
   createDockerBuildContext,
   resolveDockerBuildArgs
-} from "./chunk-QNQFS37A.js";
+} from "./chunk-S5GU345P.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-ZFA3MZ5N.js";
+} from "./chunk-CQ2JOXEQ.js";
 import {
   BuildLogger,
   dockerBuildContextDirectory,
@@ -29,10 +29,10 @@ import {
   splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-SYQ3FOLE.js";
+} from "./chunk-IVMPA6RC.js";
 import {
   isRuntimeNotFoundError
-} from "./chunk-N5YZMO33.js";
+} from "./chunk-L4DRH6ZA.js";
 import {
   PRICING,
   STACKS,
@@ -44,7 +44,7 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-IVRTIKNZ.js → chunk-COI4VFRW.js}

@@ -1418,6 +1418,26 @@ function parseEnv(ctx, v, path) {
   }
   return out;
 }
+function parseBuildArgs(ctx, v, path) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path, "must be an object of string or null build arguments");
+    return void 0;
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(v)) {
+    if (!isValidEnvKey(key)) {
+      ctx.err(`${path}.${key}`, "has an invalid build argument name");
+      continue;
+    }
+    if (value === null || typeof value === "string") {
+      out[key] = value;
+    } else {
+      ctx.err(`${path}.${key}`, "must be a string or null");
+    }
+  }
+  return out;
+}
 function parseDomains(ctx, v, path) {
   if (v === void 0) return void 0;
   if (!Array.isArray(v)) {
@@ -1488,7 +1508,10 @@ function parseRoutes(ctx, v, path) {
       const source = ctx.str(h.source, `${p}.source`);
       const list = Array.isArray(h.headers) ? h.headers.map((kv, j) => {
         const key = ctx.str(kv?.key, `${p}.headers[${j}].key`);
-        const value = ctx.str(kv?.value, `${p}.headers[${j}].value`);
+        const value = ctx.str(
+          kv?.value,
+          `${p}.headers[${j}].value`
+        );
         return key && value !== void 0 ? { key, value } : null;
       }).filter(Boolean) : [];
       return source ? { source, headers: list } : null;
@@ -1569,6 +1592,7 @@ function parseServices(ctx, v, path) {
       image: ctx.str(item.image, `${p}.image`),
       build: ctx.str(item.build, `${p}.build`),
       dockerfile: ctx.str(item.dockerfile, `${p}.dockerfile`),
+      buildArgs: parseBuildArgs(ctx, item.buildArgs, `${p}.buildArgs`),
       ports: ctx.strArray(item.ports, `${p}.ports`),
       volumes: ctx.strArray(item.volumes, `${p}.volumes`),
       dependsOn: ctx.strArray(item.dependsOn, `${p}.dependsOn`),
@@ -4070,6 +4094,7 @@ var catalog_default = {
             GOTRUE_API_HOST: "0.0.0.0",
             GOTRUE_API_PORT: "9999",
             API_EXTERNAL_URL: "{{publicUrl:kong}}",
+            GOTRUE_SAML_EXTERNAL_URL: "{{publicUrl:kong}}/auth/v1",
             GOTRUE_DB_DRIVER: "postgres",
             GOTRUE_DB_DATABASE_URL: "postgres://supabase_auth_admin:{{config:POSTGRES_PASSWORD}}@db:5432/postgres",
             GOTRUE_SITE_URL: "{{publicUrl:kong}}",
@@ -4326,7 +4351,7 @@ var catalog_default = {
         {
           service: "kong",
           path: "/usr/local/kong/kong.yml",
-          content: '_format_version: "3.0"\n_transform: true\n\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n      - key: {{config:ANON_KEY}}\n  - username: service_role\n    keyauth_credentials:\n      - key: {{config:SERVICE_ROLE_KEY}}\n\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\n\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: {{config:DASHBOARD_USERNAME}}\n    password: {{config:DASHBOARD_PASSWORD}}\n\nservices:\n  - name: auth-v1-open\n    url: http://auth:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths:\n          - /auth/v1/verify\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://auth:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths:\n          - /auth/v1/callback\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://auth:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths:\n          - /auth/v1/authorize\n    plugins:\n      - name: cors\n  - name: auth-v1\n    url: http://auth:9999/\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths:\n          - /auth/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: rest-v1\n    url: http://rest:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths:\n          - /rest/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: graphql-v1\n    url: http://rest:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths:\n          - /graphql/v1\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - Content-Profile:graphql_public\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-ws\n    url: http://realtime-dev.supabase-realtime:4000/socket/\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths:\n          - /realtime/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: storage-v1\n    url: http://storage:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths:\n          - /storage/v1/\n    plugins:\n      - name: cors\n  - name: meta\n    url: http://meta:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths:\n          - /pg/\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n  - name: dashboard\n    url: http://studio:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths:\n          - /\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n'
+          content: '_format_version: "3.0"\n_transform: true\n\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n      - key: {{config:ANON_KEY}}\n  - username: service_role\n    keyauth_credentials:\n      - key: {{config:SERVICE_ROLE_KEY}}\n\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\n\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: {{config:DASHBOARD_USERNAME}}\n    password: {{config:DASHBOARD_PASSWORD}}\n\nservices:\n  - name: auth-v1-open\n    url: http://auth:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths:\n          - /auth/v1/verify\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://auth:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths:\n          - /auth/v1/callback\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://auth:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths:\n          - /auth/v1/authorize\n    plugins:\n      - name: cors\n  - name: auth-v1-open-sso-acs\n    url: http://auth:9999/sso/saml/acs\n    routes:\n      - name: auth-v1-open-sso-acs\n        strip_path: true\n        paths:\n          - /auth/v1/sso/saml/acs\n    plugins:\n      - name: cors\n  - name: auth-v1-open-sso-metadata\n    url: http://auth:9999/sso/saml/metadata\n    routes:\n      - name: auth-v1-open-sso-metadata\n        strip_path: true\n        paths:\n          - /auth/v1/sso/saml/metadata\n    plugins:\n      - name: cors\n  - name: auth-v1\n    url: http://auth:9999/\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths:\n          - /auth/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: rest-v1\n    url: http://rest:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths:\n          - /rest/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: graphql-v1\n    url: http://rest:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths:\n          - /graphql/v1\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - Content-Profile:graphql_public\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-ws\n    url: http://realtime-dev.supabase-realtime:4000/socket/\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths:\n          - /realtime/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: storage-v1\n    url: http://storage:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths:\n          - /storage/v1/\n    plugins:\n      - name: cors\n  - name: meta\n    url: http://meta:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths:\n          - /pg/\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n  - name: dashboard\n    url: http://studio:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths:\n          - /\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n'
         },
         {
           service: "db",
@@ -25441,6 +25466,13 @@ var AUDIT_EVENTS = {
     tone: "warning",
     description: "Cleanup did not complete, so the app record was kept for a safe retry."
   },
+  "project.build_cache.cleared": {
+    category: "apps",
+    action: "cleared the Docker build cache for",
+    label: "Build cache cleared",
+    tone: "warning",
+    description: "Unused build cache was removed from the app's Docker host."
+  },
   "project:write": {
     category: "apps",
     action: "changed",

package/dist/{chunk-ZFA3MZ5N.js → chunk-CQ2JOXEQ.js}

@@ -6,13 +6,13 @@ import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-SYQ3FOLE.js";
+} from "./chunk-IVMPA6RC.js";
 import {
   LocalExecutor
-} from "./chunk-J4SYG2LC.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   wrapLocalBuildCommand
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 
 // ../../packages/adapters/src/runtime/local-build.ts
 var LOCAL_BUILD_DIR = "/tmp/openship/.builds";

package/dist/{chunk-BOD2IQ3P.js → chunk-DQR5TPFB.js}

@@ -5,23 +5,23 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   envOps,
   opScript
-} from "./chunk-3LWGDMJU.js";
+} from "./chunk-KATXZ5AB.js";
 import {
   resolveEnvironment
-} from "./chunk-JWW5YAFL.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   sq
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 import {
   describeProcess,
   probeListeningPortOwners
-} from "./chunk-GEHV7JBS.js";
+} from "./chunk-NF7NQOAP.js";
 import {
   SYSTEM,
   answered,
   refused,
   safeErrorMessage
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";

package/dist/{chunk-AUBB5DLY.js → chunk-ETK6IBCH.js}

@@ -19,7 +19,7 @@ import {
   isCloudFrontedHost,
   luaSourceAvailable,
   reloadBareOpenResty
-} from "./chunk-BOD2IQ3P.js";
+} from "./chunk-DQR5TPFB.js";
 import {
   edgeDownExplanation,
   explainEdgeDown,
@@ -30,17 +30,17 @@ import {
 } from "./chunk-R4VDPFLS.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-JWW5YAFL.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   logEntry,
   sq
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 import {
   edgeFailureReason
-} from "./chunk-YGA52DHX.js";
+} from "./chunk-37XZTLBJ.js";
 import {
   probeListeningPort
-} from "./chunk-GEHV7JBS.js";
+} from "./chunk-NF7NQOAP.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -48,7 +48,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {

package/dist/{chunk-RHHCAWW3.js → chunk-FNWNUYS3.js}

@@ -4,15 +4,15 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   hostRefusal
-} from "./chunk-3LWGDMJU.js";
+} from "./chunk-KATXZ5AB.js";
 import {
   elevatedExecutor,
   resolveEnvironment
-} from "./chunk-JWW5YAFL.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   answered,
   refused
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/privilege.ts
 function rootChecked(executor, why) {

package/dist/{chunk-3KUW2UC6.js → chunk-GPTBEPUE.js}

@@ -8,30 +8,32 @@ import {
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-JAKVPLHT.js";
+} from "./chunk-2YAY5XHK.js";
 import {
   connectSshClient,
   openDockerDialStdioChannel,
   openSftp,
   openSshUnixSocket,
   reconcileKnownHosts
-} from "./chunk-HBQWOJRP.js";
+} from "./chunk-TKK5NPDQ.js";
 import {
   LocalExecutor
-} from "./chunk-J4SYG2LC.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   emitBufferedLines,
   flushBufferedLines,
   hasLocalCommand,
   logEntry,
   sq
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 import {
   HostChannelUnavailableError,
   SshDisconnectedError,
+  SshExecRequestError,
   commandForError,
-  isSshAuthError
-} from "./chunk-N5YZMO33.js";
+  isSshAuthError,
+  isSshExecRequestError
+} from "./chunk-L4DRH6ZA.js";
 import {
   HOST_CHANNEL_AUTH_REJECTED,
   HOST_CHANNEL_NOT_PROVISIONED,
@@ -42,7 +44,7 @@ import {
   hostChannelAccount,
   hostFirewallRule,
   safeErrorMessage
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/executor.ts
 import { existsSync, readFileSync } from "fs";
@@ -254,6 +256,9 @@ var remoteDirname = posix.dirname;
 var SFTP_OPERATION_TIMEOUT_MS = 3e4;
 var CHANNEL_CLOSE_GRACE_MS = 750;
 var TRANSPORT_CLOSE_GRACE_MS = 250;
+function tagExecRequestError(error) {
+  return error.message === "Unable to exec" ? new SshExecRequestError(error) : error;
+}
 function abortError(operation, signal) {
   const reason = signal.reason;
   const suffix = reason instanceof Error && reason.message ? `: ${reason.message}` : "";
@@ -619,18 +624,20 @@ var SshExecutor = class _SshExecutor {
     if (this.inflight.size > 0) this.dropSftp();
     else this.resetConnection();
   }
-  /** Returns true if the error is an SSH channel-open failure. */
+  /** Returns true if the error is an SSH channel-open or channel-exec failure. */
   static isChannelError(err) {
     if (!(err instanceof Error)) return false;
+    if (isSshExecRequestError(err)) return true;
     const msg = err.message.toLowerCase();
     return msg.includes("channel open failure") || msg.includes("open failed");
   }
   /**
    * Run an operation, and if it fails opening an SSH channel on a half-dead
    * cached connection ("Channel open failure: open failed" — common after the
-   * idle timeout drops the socket), drop the connection and retry ONCE on a
-   * fresh one. This is why `exec` survives a stale connection; the SFTP-based
-   * ops (writeFile/readFile/exists) must go through it too, or a deploy's route
+   * idle timeout drops the socket), recover channel capacity and retry ONCE.
+   * An idle connection is replaced; a busy one stays alive so its other command
+   * is not aborted (see recoverFromChannelError). The SFTP-based ops
+   * (writeFile/readFile/exists) must go through this too, or a deploy's route
    * write fails spuriously and only succeeds on a manual redeploy.
    */
   async withChannelRetry(fn) {
@@ -703,7 +710,7 @@ var SshExecutor = class _SshExecutor {
       );
       timer.unref?.();
       client.exec(_SshExecutor.ENV_PREFIX + command, (err, stream) => {
-        if (err) return finish(() => reject(err));
+        if (err) return finish(() => reject(tagExecRequestError(err)));
         channel = stream;
         if (terminating) {
           try {
@@ -788,7 +795,7 @@ var SshExecutor = class _SshExecutor {
         return;
       }
       client.exec(_SshExecutor.ENV_PREFIX + command, (err, stream) => {
-        if (err) return finish(() => reject(err));
+        if (err) return finish(() => reject(tagExecRequestError(err)));
         channel = stream;
         if (terminating || signal?.aborted) {
           try {
@@ -2102,7 +2109,7 @@ async function verifyHostChannelAuth(config) {
   let hint = null;
   let forwarding = "unknown";
   try {
-    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-WVLLOAYK.js");
+    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-FZDWP5PQ.js");
     const client = await connectSshClient2({
       host: config.host,
       port: config.port,

package/dist/{chunk-TT7P5ZZ3.js → chunk-H36ASAYI.js}

@@ -10,28 +10,28 @@ import {
   readComposeEnvFile,
   resolveLocalEnvironmentSync,
   thisHost
-} from "./chunk-SPR7N2EK.js";
+} from "./chunk-IXBOV7BE.js";
 import {
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   systemCatalog
-} from "./chunk-7MKZP4TW.js";
+} from "./chunk-XJSLJLNY.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
-} from "./chunk-BOD2IQ3P.js";
+} from "./chunk-DQR5TPFB.js";
 import {
   DEFAULT_DOCKER_SOCKET_PATH,
   resolveLocalDockerSocketPath
-} from "./chunk-TPGBT5UR.js";
+} from "./chunk-7MCPDYKP.js";
 import {
   LocalExecutor
-} from "./chunk-J4SYG2LC.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-YGA52DHX.js";
+} from "./chunk-37XZTLBJ.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_BLOCKED,
@@ -51,7 +51,7 @@ import {
   hostFirewallRule,
   hostFirewallRuleRemoval,
   wrapText
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // src/lib/host-channel-preflight.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -1627,7 +1627,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.7.0" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.7.1" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [

package/dist/{chunk-SYQ3FOLE.js → chunk-IVMPA6RC.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-JAKVPLHT.js";
+} from "./chunk-2YAY5XHK.js";
 import {
   TRANSFER_EXCLUDES,
   nodeBinDirs,
@@ -13,7 +13,7 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellQuote
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/runtime/git-clone.ts
 var sq = shellQuote;

package/dist/{chunk-SPR7N2EK.js → chunk-IXBOV7BE.js}

@@ -134,10 +134,10 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-DZBXOF5Q.js";
+} from "./chunk-BBPKAQ54.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-BOD2IQ3P.js";
+} from "./chunk-DQR5TPFB.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
@@ -146,26 +146,26 @@ import {
   resolveExecExitCode,
   startAttachStream,
   startExecStream
-} from "./chunk-TPGBT5UR.js";
+} from "./chunk-7MCPDYKP.js";
 import {
   BareRuntime
-} from "./chunk-5CFUYMPE.js";
+} from "./chunk-3YSSXSC2.js";
 import {
   createExecutor
-} from "./chunk-3KUW2UC6.js";
+} from "./chunk-GPTBEPUE.js";
 import {
   envOps
-} from "./chunk-3LWGDMJU.js";
+} from "./chunk-KATXZ5AB.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-JWW5YAFL.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   MAIL_HOST_STATE_DIR
-} from "./chunk-CMGRMPRQ.js";
+} from "./chunk-7TQP6723.js";
 import {
   FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
@@ -177,7 +177,7 @@ import {
   validateBackupPath,
   validateClearPath,
   withTimeout
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";

package/dist/{chunk-3LWGDMJU.js → chunk-KATXZ5AB.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-J4SYG2LC.js → chunk-KCMEWNP7.js}

@@ -8,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-J2NDOB7D.js";
+} from "./chunk-2BAKEGGF.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";

package/dist/{chunk-N5YZMO33.js → chunk-L4DRH6ZA.js}

@@ -44,6 +44,15 @@ var SshDisconnectedError = class extends Error {
     this.name = "SshDisconnectedError";
   }
 };
+var SshExecRequestError = class extends Error {
+  constructor(cause) {
+    super(cause.message, { cause });
+    this.name = "SshExecRequestError";
+  }
+};
+function isSshExecRequestError(err) {
+  return err instanceof SshExecRequestError || err instanceof Error && err.name === "SshExecRequestError";
+}
 function isSshDisconnectedError(err) {
   return err instanceof SshDisconnectedError || err instanceof Error && err.name === "SshDisconnectedError";
 }
@@ -67,7 +76,7 @@ function isRetryableRemoteConnectionError(err) {
   );
 }
 function isRemoteConnectionError(err) {
-  return isSshAuthError(err) || isRetryableRemoteConnectionError(err);
+  return isSshAuthError(err) || isRetryableRemoteConnectionError(err) || isSshExecRequestError(err);
 }
 var MAX_COMMAND_CHARS = 120;
 function commandForError(command) {
@@ -100,6 +109,8 @@ function formatDuration(startMs) {
 
 export {
   SshDisconnectedError,
+  SshExecRequestError,
+  isSshExecRequestError,
   isSshAuthError,
   HostChannelUnavailableError,
   isRetryableRemoteConnectionError,

package/dist/{chunk-GEHV7JBS.js → chunk-NF7NQOAP.js}

@@ -7,10 +7,10 @@ import {
   isContainerPortForwarder,
   managedDeploymentIdFromUnit,
   tryExec
-} from "./chunk-CMGRMPRQ.js";
+} from "./chunk-7TQP6723.js";
 import {
   shellQuote
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // ../../packages/adapters/src/system/port-listen.ts
 var PROC_NET_TCP_FILES = ["/proc/net/tcp", "/proc/net/tcp6"];

package/dist/{chunk-KYTTPWRP.js → chunk-NIOLZENU.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-TT7P5ZZ3.js";
+} from "./chunk-H36ASAYI.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -36,18 +36,18 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-LL7M7GL4.js";
+} from "./chunk-OEYXXSAM.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-SPR7N2EK.js";
+} from "./chunk-IXBOV7BE.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-5D27WZBW.js";
+} from "./chunk-WG5PDWZ3.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,17 +58,17 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-J4SYG2LC.js";
+} from "./chunk-KCMEWNP7.js";
 import {
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-YGA52DHX.js";
+} from "./chunk-37XZTLBJ.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-CMGRMPRQ.js";
+} from "./chunk-7TQP6723.js";
 import {
   isValidEmail
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -1564,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.7.0"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.7.1"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;