v2.1.2

changelog.md

@@ -3,6 +3,71 @@
 ## Pending
 
 
+## 2026-05-25 - 2.1.2
+
+### Fixes
+
+- keep self-upgrades alive after stopping the service (upgrade)
+  - Launch dashboard-triggered upgrades as transient systemd units outside the service cgroup.
+  - Download and validate installer binaries before stopping the running service.
+  - Restart the previous service if installation fails after it was stopped.
+
+## 2026-05-25 - 2.1.1
+
+### Fixes
+
+- disable dees-catalog build scripts in workspace config (pnpm-workspace)
+  - Adds @design.estate/dees-catalog to pnpm allowBuilds with a false value to explicitly prevent its build scripts from running.
+
+## 2026-05-25 - 2.1.0
+
+### Features
+
+- add App Store upgrade progress tracking and interactive workspace processes (appstore,workspace)
+  - Track App Store upgrade operations with async start/list requests and streamed progress updates.
+  - Show running and failed upgrade status in App Store and service detail views while preventing duplicate upgrade actions.
+  - Route App Store upgrades through the shared service update flow to restore service routes before gateway sync.
+  - Add backend workspace shell discovery plus interactive process start/input/kill/output/exit APIs backed by Docker exec streams.
+  - Bump Docker and workspace UI dependencies for interactive stdin streaming and shell selection support.
+
+## 2026-05-25 - 2.0.0
+
+### Breaking Changes
+
+- switch Onebox App Store resolution to the shared appstore client
+  - Uses `@serve.zone/appstore` and `@serve.zone/interfaces` for App Store metadata, parsing, and Docker digest resolution
+  - Renames App Store typed request methods to `getAppStoreTemplates`, `getAppStoreConfig`, `installAppStoreApp`, and `getUpgradeableAppStoreServices`
+  - Removes local duplicated App Store DTO and resolver code while preserving Onebox install and upgrade behavior
+
+## 2026-05-25 - 1.31.0
+
+### Features
+
+- resolve repo manifests and docker digest-tracked images (appstore)
+  - Add catalog source, resolved source, channel, runtime, upgrade strategy, and version metadata types for appstore manifests.
+  - Resolve catalog entries from repo manifests and pin digest-tracked Docker images using registry digests.
+  - Propagate resolved image digests into app version configs and service creation options.
+  - Add runtime coverage for repo manifest resolution and digest-tracked latest images.
+
+## 2026-05-24 - 1.30.2
+
+### Fixes
+
+- reduce remaining reverse proxy wording to required legacy SmartProxy cleanup and migration identifiers
+- clean up legacy reverse proxy naming for SmartProxy (smartproxy)
+  - Update legacy reverse proxy service naming and logs used during SmartProxy startup cleanup.
+  - Clarify migration and documentation wording for the legacy reverse proxy to SmartProxy transition.
+  - Bump @serve.zone/catalog to ^2.12.6 and add pnpm workspace build dependency settings.
+
+## 2026-05-24 - 1.30.1
+
+### Fixes
+
+- align Onebox settings gateway cards with the dees-tile footer action pattern
+- align settings gateway cards with dees-tile footer actions (settings-ui)
+  - Replaces custom gateway card wrappers with dees-tile header and footer slots.
+  - Uses tile-styled action buttons for Admin UI and dcrouter settings saves.
+
 ## 2026-05-24 - 1.30.0
 
 ### Features

deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/onebox",
-  "version": "1.30.0",
+  "version": "2.1.2",
   "exports": "./mod.ts",
   "tasks": {
     "test": "deno test --allow-all test/",
@@ -15,7 +15,7 @@
     "@std/assert": "jsr:@std/assert@^1.0.19",
     "@std/encoding": "jsr:@std/encoding@^1.0.10",
     "@db/sqlite": "jsr:@db/sqlite@0.13.0",
-    "@apiclient.xyz/docker": "npm:@apiclient.xyz/docker@^5.1.4",
+    "@apiclient.xyz/docker": "npm:@apiclient.xyz/docker@^5.1.5",
     "@apiclient.xyz/cloudflare": "npm:@apiclient.xyz/cloudflare@7.1.0",
     "@push.rocks/smartacme": "npm:@push.rocks/smartacme@^9.5.0",
     "@push.rocks/smartregistry": "npm:@push.rocks/smartregistry@^2.9.2",
@@ -27,7 +27,9 @@
     "@push.rocks/smartguard": "npm:@push.rocks/smartguard@^3.1.0",
     "@push.rocks/smartjwt": "npm:@push.rocks/smartjwt@^2.2.2",
     "@api.global/typedsocket": "npm:@api.global/typedsocket@^4.1.3",
-    "@serve.zone/containerarchive": "npm:@serve.zone/containerarchive@^0.1.3"
+    "@serve.zone/containerarchive": "npm:@serve.zone/containerarchive@^0.1.3",
+    "@serve.zone/interfaces": "npm:@serve.zone/interfaces@^6.0.0",
+    "@serve.zone/appstore": "npm:@serve.zone/appstore@^0.2.0"
   },
   "compilerOptions": {
     "lib": [

install.sh

@@ -170,14 +170,55 @@ DOWNLOAD_URL="${GITEA_BASE_URL}/${GITEA_REPO}/releases/download/${VERSION}/${BIN
 echo "Download URL: $DOWNLOAD_URL"
 echo ""
 
-# Check if service is running and stop it
+# Check whether the service should be restarted after a successful install.
 SERVICE_WAS_RUNNING=0
 if systemctl is-enabled --quiet "$SERVICE_NAME" 2>/dev/null || systemctl is-active --quiet "$SERVICE_NAME" 2>/dev/null; then
   SERVICE_WAS_RUNNING=1
-  if systemctl is-active --quiet "$SERVICE_NAME" 2>/dev/null; then
+fi
-    echo "Stopping Onebox service..."
+
-    systemctl stop "$SERVICE_NAME"
+# Download and validate the new binary before touching the running service.
+echo "Downloading Onebox binary..."
+TEMP_DIR=$(mktemp -d)
+TEMP_FILE="$TEMP_DIR/$BINARY_NAME"
+cleanup_temp() {
+  rm -rf "$TEMP_DIR"
+}
+trap cleanup_temp EXIT
+
+if ! curl -fSL "$DOWNLOAD_URL" -o "$TEMP_FILE"; then
+  echo "Error: Failed to download binary from $DOWNLOAD_URL"
+  echo ""
+  echo "Please check:"
+  echo "  1. Your internet connection"
+  echo "  2. The specified version exists: ${GITEA_BASE_URL}/${GITEA_REPO}/releases"
+  echo "  3. The platform binary is available for this release"
+  exit 1
+fi
+
+if [ ! -s "$TEMP_FILE" ]; then
+  echo "Error: Downloaded file is empty or does not exist"
+  exit 1
+fi
+
+chmod +x "$TEMP_FILE"
+if ! "$TEMP_FILE" --version >/dev/null 2>&1; then
+  echo "Error: Downloaded file is not an executable Onebox binary"
+  exit 1
+fi
+
+SERVICE_STOPPED=0
+restart_previous_service_on_error() {
+  if [ $SERVICE_STOPPED -eq 1 ]; then
+    echo "Installation failed after stopping Onebox; restarting previous service..."
+    systemctl start "$SERVICE_NAME" || true
   fi
+}
+trap 'restart_previous_service_on_error; cleanup_temp' ERR
+
+if [ $SERVICE_WAS_RUNNING -eq 1 ] && systemctl is-active --quiet "$SERVICE_NAME" 2>/dev/null; then
+  echo "Stopping Onebox service..."
+  systemctl stop "$SERVICE_NAME"
+  SERVICE_STOPPED=1
 fi
 
 # Clean installation directory - ensure only binary exists
@@ -190,44 +231,10 @@ fi
 echo "Creating installation directory: $INSTALL_DIR"
 mkdir -p "$INSTALL_DIR"
 
-# Download binary
+# Install binary
-echo "Downloading Onebox binary..."
-TEMP_FILE="$INSTALL_DIR/onebox.download"
-curl -sSL "$DOWNLOAD_URL" -o "$TEMP_FILE"
-
-if [ $? -ne 0 ]; then
-  echo "Error: Failed to download binary from $DOWNLOAD_URL"
-  echo ""
-  echo "Please check:"
-  echo "  1. Your internet connection"
-  echo "  2. The specified version exists: ${GITEA_BASE_URL}/${GITEA_REPO}/releases"
-  echo "  3. The platform binary is available for this release"
-  rm -f "$TEMP_FILE"
-  exit 1
-fi
-
-# Check if download was successful (file exists and not empty)
-if [ ! -s "$TEMP_FILE" ]; then
-  echo "Error: Downloaded file is empty or does not exist"
-  rm -f "$TEMP_FILE"
-  exit 1
-fi
-
-# Move to final location
 BINARY_PATH="$INSTALL_DIR/onebox"
-mv "$TEMP_FILE" "$BINARY_PATH"
+if ! install -m 0755 "$TEMP_FILE" "$BINARY_PATH" || [ ! -f "$BINARY_PATH" ]; then
-
+  echo "Error: Failed to install binary to $BINARY_PATH"
-if [ $? -ne 0 ] || [ ! -f "$BINARY_PATH" ]; then
-  echo "Error: Failed to move binary to $BINARY_PATH"
-  rm -f "$TEMP_FILE" 2>/dev/null
-  exit 1
-fi
-
-# Make executable
-chmod +x "$BINARY_PATH"
-
-if [ $? -ne 0 ]; then
-  echo "Error: Failed to make binary executable"
   exit 1
 fi
 
@@ -256,10 +263,13 @@ if [ $SERVICE_WAS_RUNNING -eq 1 ]; then
   onebox systemd enable
   echo "Restarting Onebox service..."
   systemctl restart "$SERVICE_NAME"
+  SERVICE_STOPPED=0
   echo "Service restarted successfully."
   echo ""
 fi
 
+trap - ERR
+
 echo "================================================"
 echo "  Onebox Installation Complete!"
 echo "================================================"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/onebox",
-  "version": "1.30.0",
+  "version": "2.1.2",
   "description": "Self-hosted container platform with automatic SSL and DNS - a mini Heroku for single servers",
   "main": "mod.ts",
   "type": "module",
@@ -56,9 +56,11 @@
   "dependencies": {
     "@api.global/typedrequest-interfaces": "^3.0.19",
     "@api.global/typedsocket": "^4.1.3",
-    "@design.estate/dees-catalog": "^3.81.0",
+    "@design.estate/dees-catalog": "^3.82.0",
     "@design.estate/dees-element": "^2.2.4",
-    "@serve.zone/catalog": "^2.12.5"
+    "@serve.zone/appstore": "^0.2.0",
+    "@serve.zone/catalog": "^2.12.6",
+    "@serve.zone/interfaces": "^6.0.0"
   },
   "devDependencies": {
     "@git.zone/tsbundle": "^2.10.4",

pnpm-lock.yaml

@@ -15,14 +15,20 @@ importers:
         specifier: ^4.1.3
         version: 4.1.3(@push.rocks/smartserve@2.0.4)
       '@design.estate/dees-catalog':
-        specifier: ^3.81.0
+        specifier: ^3.82.0
-        version: 3.81.0(@tiptap/pm@2.27.2)
+        version: 3.82.0(@tiptap/pm@2.27.2)
       '@design.estate/dees-element':
         specifier: ^2.2.4
         version: 2.2.4
+      '@serve.zone/appstore':
+        specifier: ^0.2.0
+        version: 0.2.0
       '@serve.zone/catalog':
-        specifier: ^2.12.5
+        specifier: ^2.12.6
-        version: 2.12.5(@tiptap/pm@2.27.2)
+        version: 2.12.6(@tiptap/pm@2.27.2)
+      '@serve.zone/interfaces':
+        specifier: ^6.0.0
+        version: 6.0.0
     devDependencies:
       '@git.zone/tsbundle':
         specifier: ^2.10.4
@@ -75,6 +81,9 @@ packages:
   '@design.estate/dees-catalog@3.81.0':
     resolution: {integrity: sha512-N7ocwSKVdjDQWmVV2XWiyg3dotGEuxP4/jhyB6duH8zJ3k63wmGm8+FeoP+LzRc8/U0Bl8w7UZrewlkIEMstUA==}
 
+  '@design.estate/dees-catalog@3.82.0':
+    resolution: {integrity: sha512-OvPglDHI8J8K8+hmtxHyvVLzKMr8rQSFXVxf6xT60q/om3QoQacwS8cPI/RmnEKT+mzvDk/vnNpt9/Tw0cTmWA==}
+
   '@design.estate/dees-comms@1.0.30':
     resolution: {integrity: sha512-KchMlklJfKAjQiJiR0xmofXtQ27VgZtBIxcMwPE9d+h3jJRv+lPZxzBQVOM0eyM0uS44S5vJMZ11IeV4uDXSHg==}
 
@@ -977,8 +986,14 @@ packages:
   '@sec-ant/readable-stream@0.4.1':
     resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
 
-  '@serve.zone/catalog@2.12.5':
+  '@serve.zone/appstore@0.2.0':
-    resolution: {integrity: sha512-0AgHnxonJ7xyYdA02s4tN9/aZG8yBYml4sAA7AUt9fYpRtKYMuZXUcUOS3Rz/FvUu1PrKe7QLtex9VK5IqZDPw==}
+    resolution: {integrity: sha512-qt2LVaRpzfJdUywllm+F0njwnN3aHc2aZHEcjc9REn1VDT47UuUEGaKkfNiosGK0GJqb1hPI/GwyuGMe4H4q7w==}
+
+  '@serve.zone/catalog@2.12.6':
+    resolution: {integrity: sha512-FjieZNCHTCHufMre8OSP8bFP9L4DPL9yNtd7UMwD1yQ8wublgAq6eWrx6Tfb+3k8Hyof33BBt4rbFyrvIEBk+A==}
+
+  '@serve.zone/interfaces@6.0.0':
+    resolution: {integrity: sha512-nCidhOH0XlX+7e6xaJDq6fwnwaWasB/4w2LHkV7A96G+m+7EXZqbbaKSboUlaiGDly0dWNajk2FrYFo64ZucPA==}
 
   '@tempfix/lenis@1.3.20':
     resolution: {integrity: sha512-ypeB0FuHLHOCQXW4d0RQ69txPJJH+1CHcpsZIUdcv2t1vR0IVyQr2vHihtde9UOXhjzqEnUphWon/UcJNsa0YA==}
@@ -2534,6 +2549,42 @@ snapshots:
       - supports-color
       - vue
 
+  '@design.estate/dees-catalog@3.82.0(@tiptap/pm@2.27.2)':
+    dependencies:
+      '@design.estate/dees-domtools': 2.5.6
+      '@design.estate/dees-element': 2.2.4
+      '@design.estate/dees-wcctools': 3.9.0
+      '@fortawesome/fontawesome-svg-core': 7.2.0
+      '@fortawesome/free-brands-svg-icons': 7.2.0
+      '@fortawesome/free-regular-svg-icons': 7.2.0
+      '@fortawesome/free-solid-svg-icons': 7.2.0
+      '@push.rocks/smarti18n': 1.1.0
+      '@push.rocks/smartpromise': 4.2.4
+      '@push.rocks/smartstring': 4.1.1
+      '@tempfix/webcontainer__api': 1.6.1
+      '@tiptap/core': 2.27.2(@tiptap/pm@2.27.2)
+      '@tiptap/extension-link': 2.27.2(@tiptap/core@2.27.2(@tiptap/pm@2.27.2))(@tiptap/pm@2.27.2)
+      '@tiptap/extension-text-align': 2.27.2(@tiptap/core@2.27.2(@tiptap/pm@2.27.2))
+      '@tiptap/extension-typography': 2.27.2(@tiptap/core@2.27.2(@tiptap/pm@2.27.2))
+      '@tiptap/extension-underline': 2.27.2(@tiptap/core@2.27.2(@tiptap/pm@2.27.2))
+      '@tiptap/starter-kit': 2.27.2
+      '@tsclass/tsclass': 9.5.1
+      echarts: 5.6.0
+      highlight.js: 11.11.1
+      ibantools: 4.5.4
+      lightweight-charts: 5.2.0
+      lucide: 1.14.0
+      monaco-editor: 0.55.1
+      pdfjs-dist: 4.10.38
+      xterm: 5.3.0
+      xterm-addon-fit: 0.8.0(xterm@5.3.0)
+    transitivePeerDependencies:
+      - '@nuxt/kit'
+      - '@tiptap/pm'
+      - react
+      - supports-color
+      - vue
+
   '@design.estate/dees-comms@1.0.30':
     dependencies:
       '@api.global/typedrequest': 3.3.0
@@ -2543,7 +2594,7 @@ snapshots:
 
   '@design.estate/dees-domtools@2.5.6':
     dependencies:
-      '@api.global/typedrequest': 3.3.0
+      '@api.global/typedrequest': 3.3.1
       '@design.estate/dees-comms': 1.0.30
       '@push.rocks/lik': 6.4.1
       '@push.rocks/smartdelay': 3.1.0
@@ -3572,7 +3623,11 @@ snapshots:
 
   '@sec-ant/readable-stream@0.4.1': {}
 
-  '@serve.zone/catalog@2.12.5(@tiptap/pm@2.27.2)':
+  '@serve.zone/appstore@0.2.0':
+    dependencies:
+      '@serve.zone/interfaces': 6.0.0
+
+  '@serve.zone/catalog@2.12.6(@tiptap/pm@2.27.2)':
     dependencies:
       '@design.estate/dees-catalog': 3.81.0(@tiptap/pm@2.27.2)
       '@design.estate/dees-domtools': 2.5.6
@@ -3585,6 +3640,12 @@ snapshots:
       - supports-color
       - vue
 
+  '@serve.zone/interfaces@6.0.0':
+    dependencies:
+      '@api.global/typedrequest-interfaces': 3.0.19
+      '@push.rocks/smartlog-interfaces': 3.0.2
+      '@tsclass/tsclass': 9.5.1
+
   '@tempfix/lenis@1.3.20': {}
 
   '@tempfix/webcontainer__api@1.6.1': {}

pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+allowBuilds:
+  '@design.estate/dees-catalog': false
+  esbuild: true
+ignoredBuiltDependencies:
+  - '@design.estate/dees-catalog'

readme.hints.md

@@ -46,7 +46,7 @@ ts/database/
 
 ## Current Migration Version: 15
 
-Migration 15 renames the core reverse proxy platform service from `caddy` to `smartproxy`.
+Migration 15 renames the legacy core reverse proxy platform service type to `smartproxy`.
 
 ## Reverse Proxy (April 2026 - SmartProxy Docker Service)
 

readme.md

@@ -183,7 +183,7 @@ onebox config set cloudflareZoneId zone-id
 
 ## App Store
 
-The App Store manager fetches catalog data from `serve.zone/appstore-apptemplates` and caches it briefly. Templates can declare platform requirements, so installing an app can automatically provision MongoDB, S3-compatible storage, ClickHouse, Redis, or MariaDB resources and inject the resulting credentials as environment variables.
+The App Store manager fetches metadata from `serve.zone/appstore` through `@serve.zone/appstore` and caches it briefly. Templates can declare platform requirements, so installing an app can automatically provision MongoDB, S3-compatible storage, ClickHouse, Redis, or MariaDB resources and inject the resulting credentials as environment variables.
 
 ```bash
 onebox appstore list

test/appstore_runtime_test.ts

@@ -2,12 +2,14 @@ import { assertEquals, assertThrows } from '@std/assert';
 
 import { AppStoreManager } from '../ts/classes/appstore.ts';
 import { OneboxDockerManager } from '../ts/classes/docker.ts';
-import type { IAppVersionConfig } from '../ts/classes/appstore-types.ts';
+import type * as servezoneInterfaces from '@serve.zone/interfaces';
 import type { IService } from '../ts/types.ts';
 
+type IAppStoreVersionConfig = servezoneInterfaces.appstore.IAppStoreVersionConfig;
+
 const createAppStore = () => new AppStoreManager({} as any);
 
-const baseConfig: IAppVersionConfig = {
+const baseConfig: IAppStoreVersionConfig = {
   image: 'example/app:1.0.0',
   port: 3000,
   envVars: [
@@ -81,6 +83,96 @@ Deno.test('appstore rejects invalid template ports and volumes', () => {
   );
 });
 
+Deno.test('appstore resolves repo manifests and docker digest-tracked latest images', async () => {
+  const appStoreBaseUrl = 'https://appstore.example.test';
+  const manifestUrl = 'https://code.example.test/cloudly/servezone.appstore.json';
+  const digest = 'sha256:1234567890abcdef';
+
+  const fakeFetch: typeof fetch = async (input, init) => {
+    const url = input instanceof Request ? input.url : input.toString();
+    const method = init?.method || 'GET';
+
+    if (url === `${appStoreBaseUrl}/appstore.resolved.json`) {
+      return new Response('not found', { status: 404 });
+    }
+
+    if (url === `${appStoreBaseUrl}/appstore.json`) {
+      return Response.json({
+        schemaVersion: 1,
+        updatedAt: '2026-05-24T00:00:00Z',
+        apps: [
+          {
+            id: 'cloudly',
+            name: 'Cloudly',
+            description: 'Central metadata can stay curated.',
+            category: 'Dev Tools',
+            latestVersion: '1.0.0',
+            source: {
+              type: 'repoManifest',
+              url: manifestUrl,
+              ref: 'main',
+            },
+          },
+        ],
+      });
+    }
+
+    if (url === manifestUrl) {
+      return Response.json({
+        schemaVersion: 1,
+        app: {
+          id: 'cloudly',
+          name: 'Cloudly',
+          description: 'Manifest-owned app metadata.',
+          category: 'Dev Tools',
+          maintainer: 'serve.zone',
+        },
+        latestVersion: 'latest',
+        source: {
+          type: 'dockerImage',
+          image: 'registry.example.test/serve.zone/cloudly:latest',
+          tracking: 'digest',
+        },
+        runtime: {
+          image: 'registry.example.test/serve.zone/cloudly:latest',
+          port: 80,
+        },
+      });
+    }
+
+    if (
+      url === 'https://registry.example.test/v2/serve.zone/cloudly/manifests/latest' &&
+      method === 'HEAD'
+    ) {
+      return new Response(null, {
+        status: 200,
+        headers: { 'docker-content-digest': digest },
+      });
+    }
+
+    return new Response(`unexpected ${method} ${url}`, { status: 500 });
+  };
+
+  const appStore = new AppStoreManager({} as any, {
+    baseUrl: appStoreBaseUrl,
+    fetch: fakeFetch,
+  });
+
+  const appStoreIndex = await appStore.getAppStore();
+  assertEquals(appStoreIndex.apps[0].latestVersion, `latest@${digest}`);
+  assertEquals(appStoreIndex.apps[0].resolvedSource?.manifestHash?.length, 64);
+  assertEquals(appStoreIndex.apps[0].upgradeStrategy, 'dockerDigest');
+
+  const appMeta = await appStore.getAppMeta('cloudly');
+  assertEquals(appMeta.latestVersion, `latest@${digest}`);
+  assertEquals(appMeta.versions, [`latest@${digest}`]);
+
+  const config = await appStore.getAppVersionConfig('cloudly', appMeta.latestVersion);
+  assertEquals(config.image, 'registry.example.test/serve.zone/cloudly:latest');
+  assertEquals(config.appStoreVersion, `latest@${digest}`);
+  assertEquals(config.resolvedImageDigest, digest);
+});
+
 Deno.test('docker service spec validation rejects unsafe volume and port declarations', () => {
   const dockerManager = new OneboxDockerManager();
 

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/onebox',
-  version: '1.30.0',
+  version: '2.1.2',
   description: 'Self-hosted container platform with automatic SSL and DNS - a mini Heroku for single servers'
 }

ts/classes/appstore-types.ts

@@ -1,109 +0,0 @@
-/**
- * App Store type definitions
- */
-
-export interface ICatalog {
-  schemaVersion: number;
-  updatedAt: string;
-  apps: ICatalogApp[];
-}
-
-export interface ICatalogApp {
-  id: string;
-  name: string;
-  description: string;
-  category: string;
-  iconName?: string;
-  iconUrl?: string;
-  latestVersion: string;
-  tags?: string[];
-}
-
-export interface IAppCatalogVolume {
-  name?: string;
-  source?: string;
-  mountPath: string;
-  driver?: string;
-  readOnly?: boolean;
-  backup?: boolean;
-  options?: Record<string, string>;
-}
-
-export type TAppCatalogVolumeSpec = string | IAppCatalogVolume;
-
-export interface IAppCatalogPublishedPort {
-  targetPort: number;
-  targetPortEnd?: number;
-  publishedPort?: number;
-  publishedPortEnd?: number;
-  protocol?: 'tcp' | 'udp';
-  hostIp?: string;
-}
-
-export interface IAppMeta {
-  id: string;
-  name: string;
-  description: string;
-  category: string;
-  iconName?: string;
-  latestVersion: string;
-  versions: string[];
-  maintainer?: string;
-  links?: Record<string, string>;
-}
-
-export interface IAppVersionConfig {
-  image: string;
-  port: number;
-  envVars?: Array<{ key: string; value: string; description: string; required?: boolean }>;
-  volumes?: TAppCatalogVolumeSpec[];
-  publishedPorts?: IAppCatalogPublishedPort[];
-  platformRequirements?: {
-    mongodb?: boolean;
-    s3?: boolean;
-    clickhouse?: boolean;
-    redis?: boolean;
-    mariadb?: boolean;
-  };
-  minOneboxVersion?: string;
-}
-
-export interface IAppInstallOptions {
-  appId: string;
-  version?: string;
-  serviceName: string;
-  domain?: string;
-  port?: number;
-  publishedPorts?: IAppCatalogPublishedPort[];
-  envVars?: Record<string, string>;
-  autoDNS?: boolean;
-}
-
-export interface IMigrationContext {
-  service: {
-    name: string;
-    image: string;
-    envVars: Record<string, string>;
-    port: number;
-  };
-  fromVersion: string;
-  toVersion: string;
-}
-
-export interface IMigrationResult {
-  success: boolean;
-  envVars?: Record<string, string>;
-  image?: string;
-  port?: number;
-  volumes?: IAppCatalogVolume[];
-  publishedPorts?: IAppCatalogPublishedPort[];
-  warnings: string[];
-}
-
-export interface IUpgradeableService {
-  serviceName: string;
-  appTemplateId: string;
-  currentVersion: string;
-  latestVersion: string;
-  hasMigration: boolean;
-}

ts/classes/appstore.ts

@@ -1,117 +1,148 @@
 /**
  * App Store Manager
- * Fetches, caches, and serves app templates from the remote appstore-apptemplates repo.
+ * Fetches, caches, and serves app templates from the remote App Store repo.
- * The remote repo is the single source of truth — no fallback catalog.
  */
 
-import type {
+import * as plugins from '../plugins.ts';
-  ICatalog,
-  ICatalogApp,
-  IAppMeta,
-  IAppCatalogVolume,
-  IAppInstallOptions,
-  IAppVersionConfig,
-  IMigrationContext,
-  IMigrationResult,
-  IUpgradeableService,
-} from './appstore-types.ts';
 import { logger } from '../logging.ts';
 import { getErrorMessage } from '../utils/error.ts';
 import type { Onebox } from './onebox.ts';
-import type { IService, IServiceVolume } from '../types.ts';
+import type { IService, IServicePublishedPort, IServiceVolume } from '../types.ts';
 import { projectInfo } from '../info.ts';
 
-export class AppStoreManager {
+type IAppStoreIndex = plugins.servezoneInterfaces.appstore.IAppStoreIndex;
-  private oneboxRef: Onebox;
+type IAppStoreApp = plugins.servezoneInterfaces.appstore.IAppStoreApp;
-  private catalogCache: ICatalog | null = null;
+type IAppStoreAppMeta = plugins.servezoneInterfaces.appstore.IAppStoreAppMeta;
-  private lastFetchTime = 0;
+type IAppStoreVersionConfig = plugins.servezoneInterfaces.appstore.IAppStoreVersionConfig;
-  private readonly repoBaseUrl = 'https://code.foss.global/serve.zone/appstore-apptemplates/raw/branch/main';
+type IAppStoreInstallOptions = plugins.servezoneInterfaces.appstore.IAppStoreInstallRequest & {
-  private readonly cacheTtlMs = 5 * 60 * 1000; // 5 minutes
+  autoDNS?: boolean;
+};
+type IUpgradeableAppStoreService = plugins.servezoneInterfaces.appstore.IUpgradeableAppStoreService;
 
-  constructor(oneboxRef: Onebox) {
+export interface IAppStoreManagerOptions {
-    this.oneboxRef = oneboxRef;
+  baseUrl?: string;
+  fetch?: typeof fetch;
+  resolveDockerDigests?: boolean;
+}
+
+export interface IMigrationContext {
+  service: {
+    name: string;
+    image: string;
+    envVars: Record<string, string>;
+    port: number;
+  };
+  fromVersion: string;
+  toVersion: string;
+}
+
+export interface IMigrationResult {
+  success: boolean;
+  envVars?: Record<string, string>;
+  image?: string;
+  imageDigest?: string;
+  port?: number;
+  volumes?: IServiceVolume[];
+  publishedPorts?: IServicePublishedPort[];
+  warnings: string[];
+}
+
+export interface IAppStoreUpgradeApplyOptions {
+  onProgress?: (progressArg: { step: string; message: string }) => void | Promise<void>;
+}
+
+export class AppStoreManager {
+  private appStoreCache: IAppStoreIndex | null = null;
+  private appStoreResolver: plugins.servezoneAppstore.AppStoreResolver;
+  private lastFetchTime = 0;
+  private readonly appStoreBaseUrl: string;
+  private readonly fetchRef: typeof fetch;
+  private readonly resolveDockerDigests: boolean;
+  private readonly cacheTtlMs = 5 * 60 * 1000;
+
+  constructor(
+    private oneboxRef: Onebox,
+    optionsArg: IAppStoreManagerOptions = {},
+  ) {
+    this.appStoreBaseUrl = optionsArg.baseUrl || 'https://code.foss.global/serve.zone/appstore/raw/branch/main';
+    this.fetchRef = optionsArg.fetch || fetch;
+    this.resolveDockerDigests = optionsArg.resolveDockerDigests ?? true;
+    this.appStoreResolver = this.createAppStoreResolver();
   }
 
-  async init(): Promise<void> {
+  public async init(): Promise<void> {
     try {
-      await this.getCatalog();
+      await this.getAppStore();
-      logger.info(`App Store initialized with ${this.catalogCache?.apps.length || 0} templates`);
+      logger.info(`App Store initialized with ${this.appStoreCache?.apps.length || 0} templates`);
     } catch (error) {
       logger.warn(`App Store initialization failed: ${getErrorMessage(error)}`);
       logger.warn('App Store will retry on next request');
     }
   }
 
-  /**
+  public async getAppStore(): Promise<IAppStoreIndex> {
-   * Get the catalog (cached, refreshes after TTL)
-   */
-  async getCatalog(): Promise<ICatalog> {
     const now = Date.now();
-    if (this.catalogCache && (now - this.lastFetchTime) < this.cacheTtlMs) {
+    if (this.appStoreCache && (now - this.lastFetchTime) < this.cacheTtlMs) {
-      return this.catalogCache;
+      return this.appStoreCache;
     }
 
     try {
-      const catalog = await this.fetchJson('catalog.json') as ICatalog;
+      const resolver = this.createAppStoreResolver();
-      if (catalog && catalog.apps && Array.isArray(catalog.apps)) {
+      const appStore = await resolver.getAppStoreIndex();
-        this.catalogCache = catalog;
+      this.appStoreResolver = resolver;
-        this.lastFetchTime = now;
+      this.appStoreCache = appStore;
-        return catalog;
+      this.lastFetchTime = now;
-      }
+      return appStore;
-      throw new Error('Invalid catalog format');
     } catch (error) {
-      logger.warn(`Failed to fetch remote catalog: ${getErrorMessage(error)}`);
+      logger.warn(`Failed to fetch remote App Store: ${getErrorMessage(error)}`);
-      // Return cached if available, otherwise return empty catalog
+      if (this.appStoreCache) {
-      if (this.catalogCache) {
+        return this.appStoreCache;
-        return this.catalogCache;
       }
       return { schemaVersion: 1, updatedAt: '', apps: [] };
     }
   }
 
-  /**
+  public async getApps(): Promise<IAppStoreApp[]> {
-   * Get the catalog apps list (convenience method for the API)
+    return (await this.getAppStore()).apps;
-   */
-  async getApps(): Promise<ICatalogApp[]> {
-    const catalog = await this.getCatalog();
-    return catalog.apps;
   }
 
-  /**
+  public async getAppMeta(appIdArg: string): Promise<IAppStoreAppMeta> {
-   * Fetch app metadata (versions list, etc.)
-   */
-  async getAppMeta(appId: string): Promise<IAppMeta> {
     try {
-      return await this.fetchJson(`apps/${appId}/app.json`) as IAppMeta;
+      await this.getAppStore();
+      return await this.appStoreResolver.getAppMeta(appIdArg);
     } catch (error) {
-      throw new Error(`Failed to fetch metadata for app '${appId}': ${getErrorMessage(error)}`);
+      throw new Error(`Failed to fetch metadata for app '${appIdArg}': ${getErrorMessage(error)}`);
     }
   }
 
-  /**
+  public async getAppVersionConfig(
-   * Fetch full config for an app version
+    appIdArg: string,
-   */
+    versionArg?: string,
-  async getAppVersionConfig(appId: string, version: string): Promise<IAppVersionConfig> {
+  ): Promise<IAppStoreVersionConfig> {
     try {
-      const config = await this.fetchJson(`apps/${appId}/versions/${version}/config.json`) as IAppVersionConfig;
+      const version = versionArg || (await this.getAppMeta(appIdArg)).latestVersion;
-      this.validateAppVersionConfig(config, `${appId}@${version}`);
+      await this.getAppStore();
-      return config;
+      return await this.appStoreResolver.getAppVersionConfig(appIdArg, version);
     } catch (error) {
-      throw new Error(`Failed to fetch config for ${appId}@${version}: ${getErrorMessage(error)}`);
+      throw new Error(`Failed to fetch config for ${appIdArg}@${versionArg || 'latest'}: ${getErrorMessage(error)}`);
     }
   }
 
-  async installApp(optionsArg: IAppInstallOptions): Promise<IService> {
+  public async installApp(optionsArg: IAppStoreInstallOptions): Promise<IService> {
     this.validateInstallOptions(optionsArg);
     const appMeta = await this.getAppMeta(optionsArg.appId);
     const version = optionsArg.version || appMeta.latestVersion;
     const config = await this.getAppVersionConfig(optionsArg.appId, version);
+    const appStoreVersion = config.appStoreVersion || version;
     this.assertRuntimeCompatibility(config);
     const servicePort = optionsArg.port || config.port;
     this.assertValidPort(servicePort, 'install service port');
     const volumes = this.normalizeVolumes(config.volumes);
     const publishedPorts = optionsArg.publishedPorts || config.publishedPorts || [];
-    this.validatePublishedPorts(publishedPorts, `${optionsArg.appId}@${version}`);
+    this.validateAppVersionConfig(
+      { ...config, port: servicePort, publishedPorts },
+      `${optionsArg.appId}@${version} install`,
+    );
 
     const envVars = this.getAppStoreEnvVars(config, optionsArg.envVars || {});
     if (this.requiresTemplateValue(envVars, 'SERVICE_DOMAIN') && !optionsArg.domain) {
@@ -133,105 +164,95 @@ export class AppStoreManager {
       enableRedis: Boolean(config.platformRequirements?.redis),
       enableMariaDB: Boolean(config.platformRequirements?.mariadb),
       appTemplateId: optionsArg.appId,
-      appTemplateVersion: version,
+      appTemplateVersion: appStoreVersion,
+      imageDigest: config.resolvedImageDigest,
     });
   }
 
-  /**
+  public async getUpgradeableAppStoreServices(): Promise<IUpgradeableAppStoreService[]> {
-   * Compare deployed services against catalog to find those with available upgrades
+    const appStore = await this.getAppStore();
-   */
-  async getUpgradeableServices(): Promise<IUpgradeableService[]> {
-    const catalog = await this.getCatalog();
     const services = this.oneboxRef.database.getAllServices();
-    const upgradeable: IUpgradeableService[] = [];
+    const upgradeable: IUpgradeableAppStoreService[] = [];
 
     for (const service of services) {
       if (!service.appTemplateId || !service.appTemplateVersion) continue;
 
-      const catalogApp = catalog.apps.find(a => a.id === service.appTemplateId);
+      const appStoreApp = appStore.apps.find((appArg: IAppStoreApp) => appArg.id === service.appTemplateId);
-      if (!catalogApp) continue;
+      if (!appStoreApp || appStoreApp.latestVersion === service.appTemplateVersion) continue;
 
-      if (catalogApp.latestVersion !== service.appTemplateVersion) {
+      upgradeable.push({
-        // Check if a migration script exists
+        serviceName: service.name,
-        const hasMigration = await this.hasMigrationScript(
+        appTemplateId: service.appTemplateId,
+        currentVersion: service.appTemplateVersion,
+        latestVersion: appStoreApp.latestVersion,
+        hasMigration: await this.hasMigrationScript(
           service.appTemplateId,
           service.appTemplateVersion,
-          catalogApp.latestVersion,
+          appStoreApp.latestVersion,
-        );
+        ),
-
+      });
-        upgradeable.push({
-          serviceName: service.name,
-          appTemplateId: service.appTemplateId,
-          currentVersion: service.appTemplateVersion,
-          latestVersion: catalogApp.latestVersion,
-          hasMigration,
-        });
-      }
     }
 
     return upgradeable;
   }
 
-  /**
+  public async hasMigrationScript(
-   * Check if a migration script exists for a specific version transition
+    appIdArg: string,
-   */
+    fromVersionArg: string,
-  async hasMigrationScript(appId: string, fromVersion: string, toVersion: string): Promise<boolean> {
+    toVersionArg: string,
+  ): Promise<boolean> {
     try {
-      const scriptPath = `apps/${appId}/versions/${toVersion}/migrate-from-${fromVersion}.ts`;
+      await this.fetchText(`apps/${appIdArg}/versions/${toVersionArg}/migrate-from-${fromVersionArg}.ts`);
-      await this.fetchText(scriptPath);
       return true;
     } catch {
       return false;
     }
   }
 
-  /**
+  public async executeMigration(
-   * Execute a migration in a sandboxed Deno child process
+    serviceArg: IService,
-   */
+    fromVersionArg: string,
-  async executeMigration(service: IService, fromVersion: string, toVersion: string): Promise<IMigrationResult> {
+    toVersionArg: string,
-    const appId = service.appTemplateId;
+  ): Promise<IMigrationResult> {
+    const appId = serviceArg.appTemplateId;
     if (!appId) {
       throw new Error('Service has no appTemplateId');
     }
 
-    // Fetch the migration script
+    const scriptPath = `apps/${appId}/versions/${toVersionArg}/migrate-from-${fromVersionArg}.ts`;
-    const scriptPath = `apps/${appId}/versions/${toVersion}/migrate-from-${fromVersion}.ts`;
     let scriptContent: string;
     try {
       scriptContent = await this.fetchText(scriptPath);
     } catch {
-      // No migration script — do a simple config-based upgrade
+      logger.info(`No migration script for ${appId} ${fromVersionArg} -> ${toVersionArg}, using config-only upgrade`);
-      logger.info(`No migration script for ${appId} ${fromVersion} -> ${toVersion}, using config-only upgrade`);
+      const config = await this.getAppVersionConfig(appId, toVersionArg);
-      const config = await this.getAppVersionConfig(appId, toVersion);
       return {
         success: true,
         image: config.image,
+        imageDigest: config.resolvedImageDigest,
         port: config.port,
         volumes: this.normalizeVolumes(config.volumes),
         publishedPorts: config.publishedPorts,
-        envVars: undefined, // Keep existing env vars
+        envVars: undefined,
         warnings: [],
       };
     }
 
-    // Write to temp file
     const tempFile = `/tmp/onebox-migration-${crypto.randomUUID()}.ts`;
     await Deno.writeTextFile(tempFile, scriptContent);
 
     try {
-      // Prepare context
       const context: IMigrationContext = {
         service: {
-          name: service.name,
+          name: serviceArg.name,
-          image: service.image,
+          image: serviceArg.image,
-          envVars: service.envVars,
+          envVars: serviceArg.envVars,
-          port: service.port,
+          port: serviceArg.port,
         },
-        fromVersion,
+        fromVersion: fromVersionArg,
-        toVersion,
+        toVersion: toVersionArg,
       };
 
-      // Execute in sandboxed Deno child process
       const cmd = new Deno.Command('deno', {
         args: ['run', '--allow-env', '--allow-net=none', '--allow-read=none', '--allow-write=none', tempFile],
         stdin: 'piped',
@@ -240,27 +261,22 @@ export class AppStoreManager {
       });
 
       const child = cmd.spawn();
-
-      // Write context to stdin
       const writer = child.stdin.getWriter();
       await writer.write(new TextEncoder().encode(JSON.stringify(context)));
       await writer.close();
 
-      // Read result
       const output = await child.output();
-      const exitCode = output.code;
       const stdout = new TextDecoder().decode(output.stdout);
       const stderr = new TextDecoder().decode(output.stderr);
 
-      if (exitCode !== 0) {
+      if (output.code !== 0) {
-        logger.error(`Migration script failed (exit ${exitCode}): ${stderr.substring(0, 500)}`);
+        logger.error(`Migration script failed (exit ${output.code}): ${stderr.substring(0, 500)}`);
         return {
           success: false,
           warnings: [`Migration script failed: ${stderr.substring(0, 200)}`],
         };
       }
 
-      // Parse result from stdout
       try {
         const result = JSON.parse(stdout) as IMigrationResult;
         result.success = true;
@@ -273,58 +289,46 @@ export class AppStoreManager {
         };
       }
     } finally {
-      // Cleanup temp file
       try {
         await Deno.remove(tempFile);
       } catch {
-        // Ignore cleanup errors
+        // Ignore cleanup errors.
       }
     }
   }
 
-  /**
+  public async applyUpgrade(
-   * Apply an upgrade: update image, env vars, recreate container
+    serviceNameArg: string,
-   */
+    migrationResultArg: IMigrationResult,
-  async applyUpgrade(
+    newVersionArg: string,
-    serviceName: string,
+    optionsArg: IAppStoreUpgradeApplyOptions = {},
-    migrationResult: IMigrationResult,
-    newVersion: string,
   ): Promise<IService> {
-    const service = this.oneboxRef.database.getServiceByName(serviceName);
+    const service = this.oneboxRef.database.getServiceByName(serviceNameArg);
     if (!service) {
-      throw new Error(`Service not found: ${serviceName}`);
+      throw new Error(`Service not found: ${serviceNameArg}`);
     }
 
-    // Stop the existing container
-    if (service.containerID && service.status === 'running') {
-      await this.oneboxRef.services.stopService(serviceName);
-    }
-
-    // Update service record
     const updates: Partial<IService> = {
-      appTemplateVersion: newVersion,
+      appTemplateVersion: newVersionArg,
     };
 
-    if (migrationResult.image) {
+    if (migrationResultArg.image) {
-      updates.image = migrationResult.image;
+      updates.image = migrationResultArg.image;
     }
-
+    if (migrationResultArg.imageDigest !== undefined) {
-    if (migrationResult.port) {
+      updates.imageDigest = migrationResultArg.imageDigest;
-      updates.port = migrationResult.port;
     }
-
+    if (migrationResultArg.port) {
-    if (migrationResult.volumes) {
+      updates.port = migrationResultArg.port;
-      updates.volumes = migrationResult.volumes;
     }
-
+    if (migrationResultArg.volumes) {
-    if (migrationResult.publishedPorts) {
+      updates.volumes = migrationResultArg.volumes;
-      updates.publishedPorts = migrationResult.publishedPorts;
     }
-
+    if (migrationResultArg.publishedPorts) {
-    if (migrationResult.envVars) {
+      updates.publishedPorts = migrationResultArg.publishedPorts;
-      // Merge: migration result provides base, user overrides preserved
+    }
-      const mergedEnvVars = { ...migrationResult.envVars };
+    if (migrationResultArg.envVars) {
-      // Keep any user-set env vars that aren't in the migration result
+      const mergedEnvVars = { ...migrationResultArg.envVars };
       for (const [key, value] of Object.entries(service.envVars)) {
         if (!(key in mergedEnvVars)) {
           mergedEnvVars[key] = value;
@@ -333,100 +337,46 @@ export class AppStoreManager {
       updates.envVars = mergedEnvVars;
     }
 
-    this.oneboxRef.database.updateService(service.id!, updates);
+    const updatedService = await this.oneboxRef.services.updateService(
+      serviceNameArg,
+      updates,
+      {
+        onProgress: async (progressArg) => {
+          await optionsArg.onProgress?.(progressArg);
+        },
+      },
+    );
 
-    // Pull new image if changed
+    logger.success(`Service '${serviceNameArg}' upgraded to App Store version ${newVersionArg}`);
-    const newImage = migrationResult.image || service.image;
+    return updatedService;
-    if (migrationResult.image && migrationResult.image !== service.image) {
-      await this.oneboxRef.docker.pullImage(newImage);
-    }
-
-    // Recreate and start container
-    const updatedService = this.oneboxRef.database.getServiceByName(serviceName)!;
-
-    // Remove old container
-    if (service.containerID) {
-      try {
-        await this.oneboxRef.docker.removeContainer(service.containerID, true);
-      } catch {
-        // Container might already be gone
-      }
-    }
-
-    // Create new container
-    const containerID = await this.oneboxRef.docker.createContainer(updatedService);
-    this.oneboxRef.database.updateService(service.id!, { containerID, status: 'starting' });
-
-    // Start container
-    await this.oneboxRef.docker.startContainer(containerID);
-    this.oneboxRef.database.updateService(service.id!, { status: 'running' });
-
-    logger.success(`Service '${serviceName}' upgraded to template version ${newVersion}`);
-    return this.oneboxRef.database.getServiceByName(serviceName)!;
   }
 
-  /**
+  public normalizeVolumes(volumesArg: IAppStoreVersionConfig['volumes'] = []): IServiceVolume[] {
-   * Fetch JSON from the remote repo
+    return this.appStoreResolver.normalizeVolumes(volumesArg) as IServiceVolume[];
-   */
-  private async fetchJson(path: string): Promise<unknown> {
-    const url = `${this.repoBaseUrl}/${path}`;
-    const response = await fetch(url);
-    if (!response.ok) {
-      throw new Error(`HTTP ${response.status} for ${url}`);
-    }
-    return response.json();
   }
 
-  /**
+  public validateAppVersionConfig(configArg: IAppStoreVersionConfig, labelArg = 'app config'): void {
-   * Fetch text from the remote repo
+    this.appStoreResolver.validateAppStoreVersionConfig(configArg, labelArg);
-   */
+  }
-  private async fetchText(path: string): Promise<string> {
+
-    const url = `${this.repoBaseUrl}/${path}`;
+  private createAppStoreResolver(): plugins.servezoneAppstore.AppStoreResolver {
-    const response = await fetch(url);
+    return new plugins.servezoneAppstore.AppStoreResolver({
+      baseUrl: this.appStoreBaseUrl,
+      fetch: this.fetchRef,
+      resolveDockerDigests: this.resolveDockerDigests,
+    });
+  }
+
+  private async fetchText(pathArg: string): Promise<string> {
+    const url = `${this.appStoreBaseUrl}/${pathArg}`;
+    const response = await this.fetchRef(url);
     if (!response.ok) {
       throw new Error(`HTTP ${response.status} for ${url}`);
     }
     return response.text();
   }
 
-  public normalizeVolumes(volumesArg: IAppVersionConfig['volumes'] = []): IServiceVolume[] {
+  private validateInstallOptions(optionsArg: IAppStoreInstallOptions): void {
-    return volumesArg.map((volumeArg, indexArg): IAppCatalogVolume => {
-      if (typeof volumeArg === 'string') {
-        return { mountPath: volumeArg };
-      }
-      return volumeArg;
-    }).map((volumeArg, indexArg) => {
-      this.validateVolume(volumeArg, `volume ${indexArg + 1}`);
-      return volumeArg;
-    });
-  }
-
-  public validateAppVersionConfig(configArg: IAppVersionConfig, labelArg = 'app config'): void {
-    if (!configArg || typeof configArg !== 'object') {
-      throw new Error(`Invalid ${labelArg}: config must be an object`);
-    }
-    if (!configArg.image || typeof configArg.image !== 'string') {
-      throw new Error(`Invalid ${labelArg}: image is required`);
-    }
-    if (configArg.image.endsWith(':latest')) {
-      logger.warn(`App template ${labelArg} uses a mutable ':latest' image tag`);
-    }
-    this.assertValidPort(configArg.port, `${labelArg} port`);
-
-    for (const envVar of configArg.envVars || []) {
-      if (!envVar.key || !/^[A-Z_][A-Z0-9_]*$/.test(envVar.key)) {
-        throw new Error(`Invalid ${labelArg}: env var key '${envVar.key}' is not valid`);
-      }
-      if (envVar.value !== undefined && typeof envVar.value !== 'string') {
-        throw new Error(`Invalid ${labelArg}: env var '${envVar.key}' value must be a string`);
-      }
-    }
-
-    this.normalizeVolumes(configArg.volumes);
-    this.validatePublishedPorts(configArg.publishedPorts || [], labelArg);
-  }
-
-  private validateInstallOptions(optionsArg: IAppInstallOptions): void {
     if (!optionsArg.appId || !/^[a-z0-9][a-z0-9-]*$/.test(optionsArg.appId)) {
       throw new Error(`Invalid app id: ${optionsArg.appId}`);
     }
@@ -436,66 +386,6 @@ export class AppStoreManager {
     if (optionsArg.port !== undefined) {
       this.assertValidPort(optionsArg.port, 'install service port');
     }
-    if (optionsArg.publishedPorts) {
-      this.validatePublishedPorts(optionsArg.publishedPorts, `install options for ${optionsArg.appId}`);
-    }
-  }
-
-  private validateVolume(volumeArg: IAppCatalogVolume, labelArg: string): void {
-    if (!volumeArg.mountPath || !volumeArg.mountPath.startsWith('/')) {
-      throw new Error(`Invalid ${labelArg}: mountPath must be an absolute path`);
-    }
-    if (volumeArg.mountPath.includes(':')) {
-      throw new Error(`Invalid ${labelArg}: mountPath must not contain ':'`);
-    }
-    if ((volumeArg.source || volumeArg.name)?.includes(':')) {
-      throw new Error(`Invalid ${labelArg}: source/name must not contain ':'`);
-    }
-  }
-
-  private validatePublishedPorts(
-    publishedPortsArg: IAppVersionConfig['publishedPorts'] = [],
-    labelArg: string,
-  ): void {
-    const seenPublishedPorts = new Set<string>();
-    for (const portArg of publishedPortsArg) {
-      const protocol = portArg.protocol || 'tcp';
-      const targetStart = portArg.targetPort;
-      const targetEnd = portArg.targetPortEnd || targetStart;
-      const publishedStart = portArg.publishedPort || targetStart;
-      const publishedEnd = portArg.publishedPortEnd || (publishedStart + (targetEnd - targetStart));
-      const hostIp = portArg.hostIp || '0.0.0.0';
-
-      if (!['tcp', 'udp'].includes(protocol)) {
-        throw new Error(`Invalid ${labelArg}: published port protocol '${protocol}' is not supported`);
-      }
-      this.assertValidPort(targetStart, `${labelArg} targetPort`);
-      this.assertValidPort(targetEnd, `${labelArg} targetPortEnd`);
-      this.assertValidPort(publishedStart, `${labelArg} publishedPort`);
-      this.assertValidPort(publishedEnd, `${labelArg} publishedPortEnd`);
-      if (targetEnd < targetStart || publishedEnd < publishedStart) {
-        throw new Error(`Invalid ${labelArg}: published port ranges must be ascending`);
-      }
-      if ((targetEnd - targetStart) !== (publishedEnd - publishedStart)) {
-        throw new Error(`Invalid ${labelArg}: target and published port ranges must have the same size`);
-      }
-      if ((targetEnd - targetStart) > 1000) {
-        throw new Error(`Invalid ${labelArg}: published port ranges may not exceed 1001 ports`);
-      }
-
-      for (let offset = 0; offset <= targetEnd - targetStart; offset++) {
-        const publishedPort = publishedStart + offset;
-        const publishedKey = `${hostIp}/${protocol}/${publishedPort}`;
-        const wildcardKey = `0.0.0.0/${protocol}/${publishedPort}`;
-        const conflictsWithWildcard = hostIp === '0.0.0.0'
-          ? Array.from(seenPublishedPorts).some((keyArg) => keyArg.endsWith(`/${protocol}/${publishedPort}`))
-          : seenPublishedPorts.has(wildcardKey);
-        if (seenPublishedPorts.has(publishedKey) || conflictsWithWildcard) {
-          throw new Error(`Invalid ${labelArg}: duplicate published port ${hostIp}:${publishedPort}/${protocol}`);
-        }
-        seenPublishedPorts.add(publishedKey);
-      }
-    }
   }
 
   private assertValidPort(portArg: number, labelArg: string): void {
@@ -505,7 +395,7 @@ export class AppStoreManager {
   }
 
   private getAppStoreEnvVars(
-    configArg: IAppVersionConfig,
+    configArg: IAppStoreVersionConfig,
     overridesArg: Record<string, string>,
   ): Record<string, string> {
     const envVars: Record<string, string> = {};
@@ -519,14 +409,10 @@ export class AppStoreManager {
       envVars[envVar.key] = value;
     }
 
-    for (const [key, value] of Object.entries(overridesArg)) {
+    Object.assign(envVars, overridesArg);
-      envVars[key] = value;
-    }
 
     if (missingRequiredEnvVars.length > 0) {
-      throw new Error(
+      throw new Error(`Missing required app env var(s): ${missingRequiredEnvVars.join(', ')}`);
-        `Missing required app env var(s): ${missingRequiredEnvVars.join(', ')}`,
-      );
     }
 
     return envVars;
@@ -536,7 +422,7 @@ export class AppStoreManager {
     return Object.values(envVarsArg).some((value) => value.includes(`\${${templateNameArg}}`));
   }
 
-  private assertRuntimeCompatibility(configArg: IAppVersionConfig): void {
+  private assertRuntimeCompatibility(configArg: IAppStoreVersionConfig): void {
     if (!configArg.minOneboxVersion) return;
     if (this.compareVersions(projectInfo.version, configArg.minOneboxVersion) < 0) {
       throw new Error(

ts/classes/docker.ts

@@ -14,6 +14,12 @@ type TExpandedPublishedPort = Required<Pick<
   'targetPort' | 'publishedPort' | 'protocol' | 'hostIp'
 >>;
 
+export interface IInteractiveContainerExec {
+  stream: plugins.nodeStream.Duplex;
+  close: () => Promise<void>;
+  inspect: () => Promise<{ ExitCode?: number | null; Running?: boolean }>;
+}
+
 export class OneboxDockerManager {
   private dockerClient: InstanceType<typeof plugins.docker.Docker> | null = null;
   private networkName = 'onebox-network';
@@ -1128,32 +1134,37 @@ export class OneboxDockerManager {
   /**
    * Execute a command in a running container
    */
+  private async resolveContainer(containerID: string): Promise<any> {
+    let container: any = null;
+    try {
+      container = await this.dockerClient!.getContainerById(containerID);
+    } catch {
+      // Not a direct container ID — try Swarm service lookup.
+    }
+
+    if (!container) {
+      const serviceContainerId = await this.getContainerIdForService(containerID);
+      if (serviceContainerId) {
+        try {
+          container = await this.dockerClient!.getContainerById(serviceContainerId);
+        } catch {
+          // Service container also not found.
+        }
+      }
+    }
+
+    if (!container) {
+      throw new Error(`Container not found: ${containerID}`);
+    }
+    return container;
+  }
+
   async execInContainer(
     containerID: string,
     cmd: string[]
   ): Promise<{ stdout: string; stderr: string; exitCode: number }> {
     try {
-      let container: any = null;
+      const container = await this.resolveContainer(containerID);
-      try {
-        container = await this.dockerClient!.getContainerById(containerID);
-      } catch {
-        // Not a direct container ID — try Swarm service lookup
-      }
-
-      if (!container) {
-        const serviceContainerId = await this.getContainerIdForService(containerID);
-        if (serviceContainerId) {
-          try {
-            container = await this.dockerClient!.getContainerById(serviceContainerId);
-          } catch {
-            // Service container also not found
-          }
-        }
-      }
-
-      if (!container) {
-        throw new Error(`Container not found: ${containerID}`);
-      }
 
       const { stream, inspect } = await container.exec(cmd, {
         attachStdout: true,
@@ -1190,6 +1201,19 @@ export class OneboxDockerManager {
     }
   }
 
+  async startInteractiveExecInContainer(
+    containerID: string,
+    cmd: string[],
+  ): Promise<IInteractiveContainerExec> {
+    const container = await this.resolveContainer(containerID);
+    return await container.exec(cmd, {
+      tty: true,
+      attachStdin: true,
+      attachStdout: true,
+      attachStderr: true,
+    });
+  }
+
   /**
    * Create a platform service container (MongoDB, MinIO, etc.)
    * Platform containers are long-running infrastructure services

ts/classes/services.ts

@@ -11,6 +11,26 @@ import { OneboxDatabase } from './database.ts';
 import { OneboxDockerManager } from './docker.ts';
 import type { PlatformServicesManager } from './platform-services/index.ts';
 
+export type TServiceUpdateProgressStep =
+  | 'stopping'
+  | 'pulling-image'
+  | 'updating-record'
+  | 'removing-container'
+  | 'creating-container'
+  | 'starting'
+  | 'restoring-route'
+  | 'syncing-gateway'
+  | 'complete';
+
+export interface IServiceUpdateProgress {
+  step: TServiceUpdateProgressStep;
+  message: string;
+}
+
+export interface IServiceUpdateOptions {
+  onProgress?: (progressArg: IServiceUpdateProgress) => void | Promise<void>;
+}
+
 export class OneboxServicesManager {
   private oneboxRef: any; // Will be Onebox instance
   private database: OneboxDatabase;
@@ -107,6 +127,7 @@ export class OneboxServicesManager {
         registryRepository: options.useOneboxRegistry ? options.name : undefined,
         registryImageTag: options.registryImageTag || 'latest',
         autoUpdateOnPush: options.autoUpdateOnPush,
+        imageDigest: options.imageDigest,
         // Platform requirements
         platformRequirements,
         // App Store template tracking
@@ -582,9 +603,15 @@ export class OneboxServicesManager {
       envVars?: Record<string, string>;
       volumes?: IService['volumes'];
       publishedPorts?: IService['publishedPorts'];
-    }
+      imageDigest?: string;
+      appTemplateVersion?: string;
+    },
+    optionsArg: IServiceUpdateOptions = {},
   ): Promise<IService> {
     try {
+      const emitProgress = async (step: TServiceUpdateProgressStep, message: string) => {
+        await optionsArg.onProgress?.({ step, message });
+      };
       const service = this.database.getServiceByName(name);
       if (!service) {
         throw new Error(`Service not found: ${name}`);
@@ -598,6 +625,7 @@ export class OneboxServicesManager {
       // Stop the container if running
       if (wasRunning && oldContainerID) {
         logger.info(`Stopping service ${name} for updates...`);
+        await emitProgress('stopping', `Stopping ${name} before updating its container`);
         try {
           await this.docker.stopContainer(oldContainerID);
         } catch (error) {
@@ -608,10 +636,12 @@ export class OneboxServicesManager {
       // Pull new image if changed
       if (updates.image && updates.image !== service.image) {
         logger.info(`Pulling new image: ${updates.image}`);
+        await emitProgress('pulling-image', `Pulling image ${updates.image}`);
         await this.docker.pullImage(updates.image, updates.registry || service.registry);
       }
 
       // Update service in database
+      await emitProgress('updating-record', `Updating service record for ${name}`);
       const updateData: any = {
         updatedAt: Date.now(),
       };
@@ -622,6 +652,8 @@ export class OneboxServicesManager {
       if (updates.envVars !== undefined) updateData.envVars = updates.envVars;
       if (updates.volumes !== undefined) updateData.volumes = updates.volumes;
       if (updates.publishedPorts !== undefined) updateData.publishedPorts = updates.publishedPorts;
+      if (updates.imageDigest !== undefined) updateData.imageDigest = updates.imageDigest;
+      if (updates.appTemplateVersion !== undefined) updateData.appTemplateVersion = updates.appTemplateVersion;
 
       this.database.updateService(service.id!, updateData);
 
@@ -630,6 +662,7 @@ export class OneboxServicesManager {
 
       // Remove old container
       if (oldContainerID) {
+        await emitProgress('removing-container', `Removing old container for ${name}`);
         try {
           await this.docker.removeContainer(oldContainerID, true);
           logger.info(`Removed old container for ${name}`);
@@ -640,6 +673,7 @@ export class OneboxServicesManager {
 
       // Create new container with updated config
       logger.info(`Creating new container for ${name}...`);
+      await emitProgress('creating-container', `Creating replacement container for ${name}`);
       const containerID = await this.docker.createContainer(updatedService);
       this.database.updateService(service.id!, { containerID });
 
@@ -673,6 +707,7 @@ export class OneboxServicesManager {
       // Restart the container if it was running
       if (wasRunning) {
         logger.info(`Starting updated service ${name}...`);
+        await emitProgress('starting', `Starting updated service ${name}`);
         this.database.updateService(service.id!, { status: 'starting' });
         await this.docker.startContainer(containerID);
         this.database.updateService(service.id!, { status: 'running' });
@@ -684,8 +719,21 @@ export class OneboxServicesManager {
 
       const refreshedService = this.database.getServiceByName(name)!;
       if (refreshedService.domain && refreshedService.status === 'running') {
+        await emitProgress('restoring-route', `Restoring route ${refreshedService.domain} -> ${refreshedService.port}`);
+        try {
+          await this.oneboxRef.reverseProxy.addRoute(
+            refreshedService.id!,
+            refreshedService.domain,
+            refreshedService.port,
+          );
+        } catch (error) {
+          logger.warn(`Failed to restore reverse proxy route for ${refreshedService.domain}: ${getErrorMessage(error)}`);
+          throw error;
+        }
+        await emitProgress('syncing-gateway', `Syncing external gateway route for ${refreshedService.domain}`);
         await this.syncExternalGatewayRoute(refreshedService);
       }
+      await emitProgress('complete', `Service ${name} update completed`);
       await this.broadcastServiceUpdate(name, 'updated');
       return refreshedService;
     } catch (error) {

ts/classes/smartproxy.ts

@@ -10,7 +10,7 @@ import { logger } from '../logging.ts';
 import { getErrorMessage } from '../utils/error.ts';
 
 const SMARTPROXY_SERVICE_NAME = 'onebox-smartproxy';
-const LEGACY_CADDY_SERVICE_NAME = 'onebox-caddy';
+const LEGACY_REVERSE_PROXY_SERVICE_NAME = 'onebox-caddy';
 const SMARTPROXY_IMAGE = 'code.foss.global/host.today/ht-docker-smartproxy:latest';
 const SMARTPROXY_ADMIN_CONTAINER_PORT = 3000;
 const SMARTPROXY_HTTP_CONTAINER_PORT = 80;
@@ -102,10 +102,12 @@ export class SmartProxyManager {
 
       logger.info('Starting SmartProxy Docker service...');
 
-      const legacyService = await this.getExistingService(LEGACY_CADDY_SERVICE_NAME);
+      const legacyService = await this.getExistingService(LEGACY_REVERSE_PROXY_SERVICE_NAME);
       if (legacyService) {
-        logger.info('Legacy Caddy service exists, removing it before SmartProxy startup...');
+        logger.info(
-        await this.removeService(LEGACY_CADDY_SERVICE_NAME);
+          `Legacy reverse proxy service ${LEGACY_REVERSE_PROXY_SERVICE_NAME} exists, removing it before SmartProxy startup...`,
+        );
+        await this.removeService(LEGACY_REVERSE_PROXY_SERVICE_NAME);
         await new Promise((resolve) => setTimeout(resolve, 2000));
       }
 

ts/classes/update-manager.ts

@@ -66,24 +66,43 @@ export class OneboxUpdateManager {
       };
     }
 
-    const command = new Deno.Command('bash', {
+    const unitName = `onebox-upgrade-${Date.now()}`;
-      args: ['-c', this.createDetachedUpgradeScript()],
+    const command = new Deno.Command('systemd-run', {
+      args: [
+        '--unit',
+        unitName,
+        '--description',
+        `Onebox upgrade to ${targetVersion}`,
+        '--collect',
+        '--property=Type=oneshot',
+        '--setenv=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+        'bash',
+        '-lc',
+        this.createDetachedUpgradeScript(),
+      ],
       stdin: 'null',
-      stdout: 'null',
+      stdout: 'piped',
-      stderr: 'null',
+      stderr: 'piped',
-      detached: true,
     });
-    const child = command.spawn();
+    const result = await command.output();
-    child.unref();
+    if (!result.success) {
+      const stderr = new TextDecoder().decode(result.stderr).trim();
+      const stdout = new TextDecoder().decode(result.stdout).trim();
+      throw new Error(
+        `Failed to start Onebox upgrade systemd unit: ${
+          stderr || stdout || `exit code ${result.code}`
+        }`,
+      );
+    }
     this.upgradeStartedAt = Date.now();
 
-    logger.info(`Started detached Onebox upgrade process ${child.pid}`);
+    logger.info(`Started Onebox upgrade systemd unit ${unitName}`);
     return {
       accepted: true,
       currentVersion: status.currentVersion,
       targetVersion,
       message: 'Onebox upgrade started. The service will restart automatically.',
-      pid: child.pid,
+      unitName,
       logPath: UPGRADE_LOG_PATH,
     };
   }
@@ -107,7 +126,7 @@ export class OneboxUpdateManager {
     }
 
     const installCommand = new Deno.Command('bash', {
-      args: ['-c', `curl -sSL ${ONEBOX_INSTALL_SCRIPT_URL} | bash`],
+      args: ['-c', `set -o pipefail; curl -fsSL ${ONEBOX_INSTALL_SCRIPT_URL} | bash`],
       stdin: 'inherit',
       stdout: 'inherit',
       stderr: 'inherit',
@@ -202,11 +221,12 @@ export class OneboxUpdateManager {
   private createDetachedUpgradeScript(): string {
     return `
 set -e
+set -o pipefail
 mkdir -p /var/log
 {
   echo "==== Onebox upgrade started $(date -Is) ===="
   sleep 2
-  curl -sSL ${ONEBOX_INSTALL_SCRIPT_URL} | bash
+  curl -fsSL ${ONEBOX_INSTALL_SCRIPT_URL} | bash
   echo "==== Onebox upgrade finished $(date -Is) ===="
 } >> ${UPGRADE_LOG_PATH} 2>&1
 `;

ts/cli.ts

@@ -9,7 +9,9 @@ import { Onebox } from './classes/onebox.ts';
 import { OneboxDaemon } from './classes/daemon.ts';
 import { OneboxSystemd } from './classes/systemd.ts';
 import { OneboxUpdateManager } from './classes/update-manager.ts';
-import type { IAppVersionConfig } from './classes/appstore-types.ts';
+import type * as servezoneInterfaces from '@serve.zone/interfaces';
+
+type IAppStoreVersionConfig = servezoneInterfaces.appstore.IAppStoreVersionConfig;
 
 export async function runCli(): Promise<void> {
   const args = Deno.args;
@@ -591,7 +593,7 @@ function parseEnvArgs(args: string[]): Record<string, string> {
 }
 
 function getAppStoreEnvVars(
-  configArg: IAppVersionConfig,
+  configArg: IAppStoreVersionConfig,
   overridesArg: Record<string, string>,
 ): Record<string, string> {
   const envVars: Record<string, string> = {};

ts/database/migrations/migration-015-smartproxy-platform-service.ts

@@ -3,7 +3,7 @@ import type { TQueryFunction } from '../types.ts';
 
 export class Migration015SmartProxyPlatformService extends BaseMigration {
   readonly version = 15;
-  readonly description = 'Rename Caddy platform service to SmartProxy';
+  readonly description = 'Rename legacy reverse proxy platform service to SmartProxy';
 
   up(query: TQueryFunction): void {
     query(

ts/opsserver/handlers/appstore.handler.ts

@@ -3,20 +3,209 @@ import { logger } from '../../logging.ts';
 import type { OpsServer } from '../classes.opsserver.ts';
 import * as interfaces from '../../../ts_interfaces/index.ts';
 import { requireAdminIdentity } from '../helpers/guards.ts';
+import { getErrorMessage } from '../../utils/error.ts';
+
+type IAppStoreUpgradeOperation = interfaces.requests.IAppStoreUpgradeOperation;
+type TAppStoreUpgradeStep = interfaces.requests.TAppStoreUpgradeStep;
 
 export class AppStoreHandler {
   public typedrouter = new plugins.typedrequest.TypedRouter();
+  private upgradeOperations = new Map<string, IAppStoreUpgradeOperation>();
 
   constructor(private opsServerRef: OpsServer) {
     this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
     this.registerHandlers();
   }
 
+  private getUpgradeOperations(): IAppStoreUpgradeOperation[] {
+    return Array.from(this.upgradeOperations.values())
+      .sort((a, b) => b.startedAt - a.startedAt)
+      .slice(0, 25);
+  }
+
+  private getRunningUpgrade(serviceNameArg: string): IAppStoreUpgradeOperation | null {
+    for (const operation of this.upgradeOperations.values()) {
+      if (operation.serviceName === serviceNameArg && operation.status === 'running') {
+        return operation;
+      }
+    }
+    return null;
+  }
+
+  private async createUpgradeOperation(
+    serviceNameArg: string,
+    targetVersionArg: string,
+  ): Promise<IAppStoreUpgradeOperation> {
+    const existingRunning = this.getRunningUpgrade(serviceNameArg);
+    if (existingRunning) {
+      throw new plugins.typedrequest.TypedResponseError(
+        `An upgrade is already running for ${serviceNameArg}`,
+      );
+    }
+
+    const existingService = this.opsServerRef.oneboxRef.database.getServiceByName(serviceNameArg);
+    if (!existingService) {
+      throw new plugins.typedrequest.TypedResponseError(`Service not found: ${serviceNameArg}`);
+    }
+    if (!existingService.appTemplateId) {
+      throw new plugins.typedrequest.TypedResponseError('Service was not deployed from an app template');
+    }
+    if (!existingService.appTemplateVersion) {
+      throw new plugins.typedrequest.TypedResponseError('Service has no tracked template version');
+    }
+
+    const now = Date.now();
+    const operation: IAppStoreUpgradeOperation = {
+      id: crypto.randomUUID(),
+      serviceName: existingService.name,
+      appTemplateId: existingService.appTemplateId,
+      fromVersion: existingService.appTemplateVersion,
+      targetVersion: targetVersionArg,
+      status: 'running',
+      step: 'queued',
+      progressLines: [`Queued upgrade ${existingService.appTemplateVersion} -> ${targetVersionArg}`],
+      warnings: [],
+      startedAt: now,
+      updatedAt: now,
+    };
+
+    this.upgradeOperations.set(operation.id, operation);
+    await this.pushUpgradeProgress(operation);
+    return operation;
+  }
+
+  private async updateUpgradeOperation(
+    operationIdArg: string,
+    stepArg: TAppStoreUpgradeStep,
+    messageArg: string,
+    updatesArg: Partial<IAppStoreUpgradeOperation> = {},
+  ): Promise<IAppStoreUpgradeOperation> {
+    const existing = this.upgradeOperations.get(operationIdArg);
+    if (!existing) {
+      throw new Error(`Upgrade operation not found: ${operationIdArg}`);
+    }
+
+    const nextOperation: IAppStoreUpgradeOperation = {
+      ...existing,
+      ...updatesArg,
+      step: stepArg,
+      updatedAt: Date.now(),
+      progressLines: [...existing.progressLines, messageArg].slice(-200),
+    };
+    this.upgradeOperations.set(operationIdArg, nextOperation);
+    await this.pushUpgradeProgress(nextOperation);
+    return nextOperation;
+  }
+
+  private async pushUpgradeProgress(operationArg: IAppStoreUpgradeOperation): Promise<void> {
+    await this.opsServerRef.pushDashboardEvent('pushAppStoreUpgradeProgress', {
+      operation: operationArg,
+    });
+  }
+
+  private async performUpgrade(operationIdArg: string): Promise<interfaces.data.IService> {
+    let operation = this.upgradeOperations.get(operationIdArg);
+    if (!operation) {
+      throw new Error(`Upgrade operation not found: ${operationIdArg}`);
+    }
+
+    try {
+      operation = await this.updateUpgradeOperation(
+        operation.id,
+        'validating',
+        `Validating ${operation.serviceName} for App Store upgrade`,
+      );
+
+      const existingService = this.opsServerRef.oneboxRef.database.getServiceByName(operation.serviceName);
+      if (!existingService) {
+        throw new Error(`Service not found: ${operation.serviceName}`);
+      }
+      if (!existingService.appTemplateId || !existingService.appTemplateVersion) {
+        throw new Error('Service is missing App Store template metadata');
+      }
+
+      logger.info(
+        `Upgrading service '${operation.serviceName}' from v${operation.fromVersion} to v${operation.targetVersion}`,
+      );
+
+      await this.updateUpgradeOperation(
+        operation.id,
+        'migration',
+        `Resolving migration for ${operation.appTemplateId} ${operation.fromVersion} -> ${operation.targetVersion}`,
+      );
+
+      const migrationResult = await this.opsServerRef.oneboxRef.appStore.executeMigration(
+        existingService,
+        operation.fromVersion,
+        operation.targetVersion,
+      );
+
+      if (!migrationResult.success) {
+        throw new Error(`Migration failed: ${migrationResult.warnings.join('; ')}`);
+      }
+
+      if (migrationResult.warnings.length > 0) {
+        operation = await this.updateUpgradeOperation(
+          operation.id,
+          'migration',
+          `Migration completed with ${migrationResult.warnings.length} warning(s)`,
+          { warnings: migrationResult.warnings },
+        );
+      }
+
+      await this.updateUpgradeOperation(
+        operation.id,
+        'applying',
+        `Applying upgrade to ${operation.serviceName}`,
+      );
+
+      const updatedService = await this.opsServerRef.oneboxRef.appStore.applyUpgrade(
+        operation.serviceName,
+        migrationResult,
+        operation.targetVersion,
+        {
+          onProgress: async (progressArg) => {
+            await this.updateUpgradeOperation(
+              operation!.id,
+              progressArg.step as TAppStoreUpgradeStep,
+              progressArg.message,
+            );
+          },
+        },
+      );
+
+      await this.updateUpgradeOperation(
+        operation.id,
+        'complete',
+        `Upgrade completed for ${operation.serviceName}`,
+        {
+          status: 'success',
+          completedAt: Date.now(),
+          service: updatedService,
+          warnings: migrationResult.warnings,
+        },
+      );
+
+      return updatedService;
+    } catch (error) {
+      await this.updateUpgradeOperation(
+        operation.id,
+        'failed',
+        `Upgrade failed: ${getErrorMessage(error)}`,
+        {
+          status: 'failed',
+          completedAt: Date.now(),
+          error: getErrorMessage(error),
+        },
+      );
+      throw error;
+    }
+  }
+
   private registerHandlers(): void {
-    // Get app templates (catalog)
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetAppTemplates>(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetAppStoreTemplates>(
-        'getAppTemplates',
+        'getAppStoreTemplates',
         async (dataArg) => {
           await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
           const apps = await this.opsServerRef.oneboxRef.appStore.getApps();
@@ -25,10 +214,9 @@ export class AppStoreHandler {
       ),
     );
 
-    // Get app config for a specific version
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetAppConfig>(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetAppStoreConfig>(
-        'getAppConfig',
+        'getAppStoreConfig',
         async (dataArg) => {
           await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
           const config = await this.opsServerRef.oneboxRef.appStore.getAppVersionConfig(
@@ -42,8 +230,8 @@ export class AppStoreHandler {
     );
 
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_InstallAppTemplate>(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_InstallAppStoreApp>(
-        'installAppTemplate',
+        'installAppStoreApp',
         async (dataArg) => {
           await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
           const service = await this.opsServerRef.oneboxRef.appStore.installApp(dataArg.install);
@@ -52,64 +240,54 @@ export class AppStoreHandler {
       ),
     );
 
-    // Get services with available upgrades
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetUpgradeableServices>(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetUpgradeableAppStoreServices>(
-        'getUpgradeableServices',
+        'getUpgradeableAppStoreServices',
         async (dataArg) => {
           await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
-          const services = await this.opsServerRef.oneboxRef.appStore.getUpgradeableServices();
+          const services = await this.opsServerRef.oneboxRef.appStore.getUpgradeableAppStoreServices();
           return { services };
         },
       ),
     );
 
-    // Upgrade a service to a new template version
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_UpgradeService>(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_UpgradeAppStoreService>(
-        'upgradeService',
+        'upgradeAppStoreService',
         async (dataArg) => {
           await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
-
+          const operation = await this.createUpgradeOperation(dataArg.serviceName, dataArg.targetVersion);
-          const existingService = this.opsServerRef.oneboxRef.database.getServiceByName(dataArg.serviceName);
+          const updatedService = await this.performUpgrade(operation.id);
-          if (!existingService) {
+          const completedOperation = this.upgradeOperations.get(operation.id)!;
-            throw new plugins.typedrequest.TypedResponseError(`Service not found: ${dataArg.serviceName}`);
-          }
-          if (!existingService.appTemplateId) {
-            throw new plugins.typedrequest.TypedResponseError('Service was not deployed from an app template');
-          }
-          if (!existingService.appTemplateVersion) {
-            throw new plugins.typedrequest.TypedResponseError('Service has no tracked template version');
-          }
-
-          logger.info(`Upgrading service '${dataArg.serviceName}' from v${existingService.appTemplateVersion} to v${dataArg.targetVersion}`);
-
-          // Execute migration
-          const migrationResult = await this.opsServerRef.oneboxRef.appStore.executeMigration(
-            existingService,
-            existingService.appTemplateVersion,
-            dataArg.targetVersion,
-          );
-
-          if (!migrationResult.success) {
-            throw new plugins.typedrequest.TypedResponseError(
-              `Migration failed: ${migrationResult.warnings.join('; ')}`,
-            );
-          }
-
-          // Apply the upgrade
-          const updatedService = await this.opsServerRef.oneboxRef.appStore.applyUpgrade(
-            dataArg.serviceName,
-            migrationResult,
-            dataArg.targetVersion,
-          );
 
           return {
             service: updatedService,
-            warnings: migrationResult.warnings,
+            warnings: completedOperation.warnings,
           };
         },
       ),
     );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_StartAppStoreServiceUpgrade>(
+        'startAppStoreServiceUpgrade',
+        async (dataArg) => {
+          await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
+          const operation = await this.createUpgradeOperation(dataArg.serviceName, dataArg.targetVersion);
+          void this.performUpgrade(operation.id).catch(() => {});
+          return { operation };
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetAppStoreUpgradeOperations>(
+        'getAppStoreUpgradeOperations',
+        async (dataArg) => {
+          await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
+          return { operations: this.getUpgradeOperations() };
+        },
+      ),
+    );
   }
 }

ts/opsserver/handlers/workspace.handler.ts

@@ -5,8 +5,21 @@ import * as interfaces from '../../../ts_interfaces/index.ts';
 import { requireAdminIdentity } from '../helpers/guards.ts';
 import { getErrorMessage } from '../../utils/error.ts';
 
+interface IWorkspaceProcessSession {
+  processId: string;
+  serviceName: string;
+  userId: string;
+  stream: plugins.nodeStream.Duplex;
+  close: () => Promise<void>;
+  inspect: () => Promise<{ ExitCode?: number | null; Running?: boolean }>;
+  finalized: boolean;
+}
+
+const getWorkspaceProcessTag = (processIdArg: string) => `workspaceProcess:${processIdArg}`;
+
 export class WorkspaceHandler {
   public typedrouter = new plugins.typedrequest.TypedRouter();
+  private workspaceProcesses = new Map<string, IWorkspaceProcessSession>();
 
   constructor(private opsServerRef: OpsServer) {
     this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
@@ -24,6 +37,111 @@ export class WorkspaceHandler {
     return service.containerID;
   }
 
+  private validateProcessId(processIdArg: string): void {
+    if (!/^[a-zA-Z0-9_-]{8,80}$/.test(processIdArg)) {
+      throw new plugins.typedrequest.TypedResponseError('Invalid workspace process id');
+    }
+  }
+
+  private async getShellCommandForContainer(
+    containerIdArg: string,
+  ): Promise<interfaces.requests.IWorkspaceShellCommand> {
+    const candidates: interfaces.requests.IWorkspaceShellCommand[] = [
+      { command: '/bin/bash', args: ['-il'], label: 'bash', prompt: '# ' },
+      { command: 'bash', args: ['-il'], label: 'bash', prompt: '# ' },
+      { command: '/bin/sh', args: ['-i'], label: 'sh', prompt: '# ' },
+      { command: 'sh', args: ['-i'], label: 'sh', prompt: '# ' },
+      { command: '/bin/ash', args: ['-i'], label: 'ash', prompt: '# ' },
+      { command: 'ash', args: ['-i'], label: 'ash', prompt: '# ' },
+      { command: '/usr/bin/zsh', args: ['-il'], label: 'zsh', prompt: '# ' },
+      { command: 'zsh', args: ['-il'], label: 'zsh', prompt: '# ' },
+    ];
+
+    for (const candidate of candidates) {
+      const result = await this.opsServerRef.oneboxRef.docker.execInContainer(
+        containerIdArg,
+        [candidate.command, '-c', 'printf onebox-shell'],
+      );
+      if (result.exitCode === 0 && result.stdout.includes('onebox-shell')) {
+        return candidate;
+      }
+    }
+
+    throw new plugins.typedrequest.TypedResponseError(
+      'No supported interactive shell found in the target container',
+    );
+  }
+
+  private async getProcessSession(
+    dataArg: { identity: interfaces.data.IIdentity; processId: string },
+  ): Promise<IWorkspaceProcessSession> {
+    const identity = await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
+    this.validateProcessId(dataArg.processId);
+    const session = this.workspaceProcesses.get(dataArg.processId);
+    if (!session) {
+      throw new plugins.typedrequest.TypedResponseError(`Workspace process not found: ${dataArg.processId}`);
+    }
+    if (session.userId !== identity.userId) {
+      throw new plugins.typedrequest.TypedResponseError('Workspace process belongs to another session');
+    }
+    return session;
+  }
+
+  private async pushWorkspaceProcessOutput(processIdArg: string, outputArg: string): Promise<void> {
+    const typedsocket = (this.opsServerRef.server as any)?.typedserver?.typedsocket;
+    if (!typedsocket) return;
+
+    const connections = await typedsocket.findAllTargetConnectionsByTag(getWorkspaceProcessTag(processIdArg));
+    await Promise.allSettled(
+      connections.map((connection: any) => typedsocket
+        .createTypedRequest(
+          'pushWorkspaceProcessOutput',
+          connection,
+        )
+        .fire({ processId: processIdArg, output: outputArg })),
+    );
+  }
+
+  private async pushWorkspaceProcessExit(processIdArg: string, exitCodeArg: number): Promise<void> {
+    const typedsocket = (this.opsServerRef.server as any)?.typedserver?.typedsocket;
+    if (!typedsocket) return;
+
+    const connections = await typedsocket.findAllTargetConnectionsByTag(getWorkspaceProcessTag(processIdArg));
+    await Promise.allSettled(
+      connections.map((connection: any) => typedsocket
+        .createTypedRequest(
+          'pushWorkspaceProcessExit',
+          connection,
+        )
+        .fire({ processId: processIdArg, exitCode: exitCodeArg })),
+    );
+  }
+
+  private async finalizeWorkspaceProcess(processIdArg: string, fallbackExitCodeArg = -1): Promise<void> {
+    const session = this.workspaceProcesses.get(processIdArg);
+    if (!session || session.finalized) return;
+    session.finalized = true;
+
+    let exitCode = fallbackExitCodeArg;
+    try {
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      const inspectResult = await session.inspect();
+      if (typeof inspectResult.ExitCode === 'number') {
+        exitCode = inspectResult.ExitCode;
+      }
+    } catch (error) {
+      logger.debug(`Failed to inspect workspace process ${processIdArg}: ${getErrorMessage(error)}`);
+    }
+
+    this.workspaceProcesses.delete(processIdArg);
+    await this.pushWorkspaceProcessExit(processIdArg, exitCode);
+    try {
+      await session.close();
+    } catch {
+      // The hijacked connection may already be closed by Docker.
+    }
+  }
+
   private registerHandlers(): void {
     // Read file from container
     this.typedrouter.addTypedHandler(
@@ -176,6 +294,108 @@ export class WorkspaceHandler {
       ),
     );
 
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_WorkspaceGetShellCommand>(
+        'workspaceGetShellCommand',
+        async (dataArg) => {
+          await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
+          const containerId = await this.resolveContainerId(dataArg.serviceName);
+          const shellCommand = await this.getShellCommandForContainer(containerId);
+          return { shellCommand };
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_WorkspaceStartProcess>(
+        'workspaceStartProcess',
+        async (dataArg) => {
+          const identity = await requireAdminIdentity(this.opsServerRef.adminHandler, dataArg);
+          this.validateProcessId(dataArg.processId);
+          if (this.workspaceProcesses.has(dataArg.processId)) {
+            throw new plugins.typedrequest.TypedResponseError(`Workspace process already exists: ${dataArg.processId}`);
+          }
+
+          const containerId = await this.resolveContainerId(dataArg.serviceName);
+          const command = dataArg.args ? [dataArg.command, ...dataArg.args] : [dataArg.command];
+          const interactiveExec = await this.opsServerRef.oneboxRef.docker.startInteractiveExecInContainer(
+            containerId,
+            command,
+          );
+
+          const session: IWorkspaceProcessSession = {
+            processId: dataArg.processId,
+            serviceName: dataArg.serviceName,
+            userId: identity.userId,
+            stream: interactiveExec.stream,
+            close: interactiveExec.close,
+            inspect: interactiveExec.inspect,
+            finalized: false,
+          };
+          this.workspaceProcesses.set(dataArg.processId, session);
+
+          interactiveExec.stream.on('data', (chunk: Uint8Array | string) => {
+            const output = typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk);
+            void this.pushWorkspaceProcessOutput(dataArg.processId, output);
+          });
+          interactiveExec.stream.on('error', (error: Error) => {
+            void this.pushWorkspaceProcessOutput(
+              dataArg.processId,
+              `\r\n[workspace process error: ${getErrorMessage(error)}]\r\n`,
+            );
+            void this.finalizeWorkspaceProcess(dataArg.processId, -1);
+          });
+          interactiveExec.stream.on('end', () => {
+            void this.finalizeWorkspaceProcess(dataArg.processId, -1);
+          });
+          interactiveExec.stream.on('close', () => {
+            void this.finalizeWorkspaceProcess(dataArg.processId, -1);
+          });
+
+          return { processId: dataArg.processId };
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_WorkspaceProcessInput>(
+        'workspaceProcessInput',
+        async (dataArg) => {
+          const session = await this.getProcessSession(dataArg);
+          if (session.finalized || session.stream.writableEnded) {
+            return {};
+          }
+          await new Promise<void>((resolve, reject) => {
+            session.stream.write(dataArg.input, (error?: Error | null) => {
+              if (error) {
+                reject(error);
+              } else {
+                resolve();
+              }
+            });
+          });
+          return {};
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_WorkspaceKillProcess>(
+        'workspaceKillProcess',
+        async (dataArg) => {
+          const session = await this.getProcessSession(dataArg);
+          session.stream.destroy();
+          try {
+            await session.close();
+          } catch {
+            // The stream may already be closed.
+          }
+          await this.finalizeWorkspaceProcess(dataArg.processId, -1);
+          return {};
+        },
+      ),
+    );
+
     logger.info('Workspace handler registered');
   }
 }

ts/plugins.ts

@@ -82,6 +82,11 @@ export { smartguard, smartjwt };
 import { ContainerArchive } from '@serve.zone/containerarchive';
 export { ContainerArchive };
 
+// serve.zone App Store contracts and resolver
+import * as servezoneInterfaces from '@serve.zone/interfaces';
+import * as servezoneAppstore from '@serve.zone/appstore';
+export { servezoneInterfaces, servezoneAppstore };
+
 // Node.js compat for streaming
 import * as nodeFs from 'node:fs';
 import * as nodeStream from 'node:stream';

ts/types.ts

@@ -333,6 +333,7 @@ export interface IServiceDeployOptions {
   useOneboxRegistry?: boolean;
   registryImageTag?: string;
   autoUpdateOnPush?: boolean;
+  imageDigest?: string;
   // Platform service requirements
   enableMongoDB?: boolean;
   enableS3?: boolean;

ts_interfaces/data/system.ts

@@ -2,7 +2,7 @@
  * System status data shapes for Onebox
  */
 
-import type { TPlatformServiceType, TPlatformServiceStatus } from './platform.ts';
+import type { TPlatformServiceStatus, TPlatformServiceType } from './platform.ts';
 
 export interface IOneboxUpdateStatus {
   currentVersion: string;
@@ -20,6 +20,7 @@ export interface IOneboxUpgradeStartResult {
   targetVersion: string;
   message: string;
   pid?: number;
+  unitName?: string;
   logPath?: string;
 }
 

ts_interfaces/requests/appstore.ts

@@ -1,125 +1,112 @@
+import type * as servezoneInterfaces from '@serve.zone/interfaces';
 import * as plugins from '../plugins.ts';
 import * as data from '../data/index.ts';
 
-export interface ICatalogApp {
+export type IAppStoreApp = servezoneInterfaces.appstore.IAppStoreApp;
-  id: string;
+export type IAppStoreVersionConfig = servezoneInterfaces.appstore.IAppStoreVersionConfig;
-  name: string;
+export type IAppStoreAppMeta = servezoneInterfaces.appstore.IAppStoreAppMeta;
-  description: string;
+export type IUpgradeableAppStoreService = servezoneInterfaces.appstore.IUpgradeableAppStoreService;
-  category: string;
-  iconName?: string;
-  iconUrl?: string;
-  latestVersion: string;
-  tags?: string[];
-}
 
-export interface IAppVersionConfig {
+export interface IAppStoreInstallOptions extends servezoneInterfaces.appstore.IAppStoreInstallRequest {
-  image: string;
-  port: number;
-  envVars?: Array<{ key: string; value: string; description: string; required?: boolean }>;
-  volumes?: Array<string | data.IServiceVolume>;
-  publishedPorts?: data.IServicePublishedPort[];
-  platformRequirements?: {
-    mongodb?: boolean;
-    s3?: boolean;
-    clickhouse?: boolean;
-    redis?: boolean;
-    mariadb?: boolean;
-  };
-  minOneboxVersion?: string;
-}
-
-export interface IAppInstallOptions {
-  appId: string;
-  version?: string;
-  serviceName: string;
-  domain?: string;
-  port?: number;
-  publishedPorts?: data.IServicePublishedPort[];
-  envVars?: Record<string, string>;
   autoDNS?: boolean;
 }
 
-export interface IAppMeta {
+export type TAppStoreUpgradeStatus = 'running' | 'success' | 'failed';
-  id: string;
-  name: string;
-  description: string;
-  category: string;
-  iconName?: string;
-  latestVersion: string;
-  versions: string[];
-  maintainer?: string;
-  links?: Record<string, string>;
-}
 
-export interface IUpgradeableService {
+export type TAppStoreUpgradeStep =
+  | 'queued'
+  | 'validating'
+  | 'migration'
+  | 'applying'
+  | 'stopping'
+  | 'pulling-image'
+  | 'updating-record'
+  | 'removing-container'
+  | 'creating-container'
+  | 'starting'
+  | 'restoring-route'
+  | 'syncing-gateway'
+  | 'complete'
+  | 'failed';
+
+export interface IAppStoreUpgradeOperation {
+  id: string;
   serviceName: string;
   appTemplateId: string;
-  currentVersion: string;
+  fromVersion: string;
-  latestVersion: string;
+  targetVersion: string;
-  hasMigration: boolean;
+  status: TAppStoreUpgradeStatus;
+  step: TAppStoreUpgradeStep;
+  progressLines: string[];
+  warnings: string[];
+  error?: string;
+  startedAt: number;
+  updatedAt: number;
+  completedAt?: number;
+  service?: data.IService;
 }
 
-export interface IReq_GetAppTemplates extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_GetAppStoreTemplates extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_GetAppTemplates
+  IReq_GetAppStoreTemplates
 > {
-  method: 'getAppTemplates';
+  method: 'getAppStoreTemplates';
   request: {
     identity: data.IIdentity;
   };
   response: {
-    apps: ICatalogApp[];
+    apps: IAppStoreApp[];
   };
 }
 
-export interface IReq_GetAppConfig extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_GetAppStoreConfig extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_GetAppConfig
+  IReq_GetAppStoreConfig
 > {
-  method: 'getAppConfig';
+  method: 'getAppStoreConfig';
   request: {
     identity: data.IIdentity;
     appId: string;
     version: string;
   };
   response: {
-    config: IAppVersionConfig;
+    config: IAppStoreVersionConfig;
-    appMeta: IAppMeta;
+    appMeta: IAppStoreAppMeta;
   };
 }
 
-export interface IReq_InstallAppTemplate extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_InstallAppStoreApp extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_InstallAppTemplate
+  IReq_InstallAppStoreApp
 > {
-  method: 'installAppTemplate';
+  method: 'installAppStoreApp';
   request: {
     identity: data.IIdentity;
-    install: IAppInstallOptions;
+    install: IAppStoreInstallOptions;
   };
   response: {
     service: data.IService;
   };
 }
 
-export interface IReq_GetUpgradeableServices extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_GetUpgradeableAppStoreServices extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_GetUpgradeableServices
+  IReq_GetUpgradeableAppStoreServices
 > {
-  method: 'getUpgradeableServices';
+  method: 'getUpgradeableAppStoreServices';
   request: {
     identity: data.IIdentity;
   };
   response: {
-    services: IUpgradeableService[];
+    services: IUpgradeableAppStoreService[];
   };
 }
 
-export interface IReq_UpgradeService extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_UpgradeAppStoreService extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_UpgradeService
+  IReq_UpgradeAppStoreService
 > {
-  method: 'upgradeService';
+  method: 'upgradeAppStoreService';
   request: {
     identity: data.IIdentity;
     serviceName: string;
@@ -130,3 +117,42 @@ export interface IReq_UpgradeService extends plugins.typedrequestInterfaces.impl
     warnings: string[];
   };
 }
+
+export interface IReq_StartAppStoreServiceUpgrade extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_StartAppStoreServiceUpgrade
+> {
+  method: 'startAppStoreServiceUpgrade';
+  request: {
+    identity: data.IIdentity;
+    serviceName: string;
+    targetVersion: string;
+  };
+  response: {
+    operation: IAppStoreUpgradeOperation;
+  };
+}
+
+export interface IReq_GetAppStoreUpgradeOperations extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetAppStoreUpgradeOperations
+> {
+  method: 'getAppStoreUpgradeOperations';
+  request: {
+    identity: data.IIdentity;
+  };
+  response: {
+    operations: IAppStoreUpgradeOperation[];
+  };
+}
+
+export interface IReq_PushAppStoreUpgradeProgress extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_PushAppStoreUpgradeProgress
+> {
+  method: 'pushAppStoreUpgradeProgress';
+  request: {
+    operation: IAppStoreUpgradeOperation;
+  };
+  response: {};
+}

ts_interfaces/requests/workspace.ts

@@ -1,6 +1,13 @@
 import * as plugins from '../plugins.ts';
 import * as data from '../data/index.ts';
 
+export interface IWorkspaceShellCommand {
+  command: string;
+  args?: string[];
+  label?: string;
+  prompt?: string;
+}
+
 export interface IReq_WorkspaceReadFile extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_WorkspaceReadFile
@@ -104,3 +111,83 @@ export interface IReq_WorkspaceExec extends plugins.typedrequestInterfaces.imple
     exitCode: number;
   };
 }
+
+export interface IReq_WorkspaceGetShellCommand extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_WorkspaceGetShellCommand
+> {
+  method: 'workspaceGetShellCommand';
+  request: {
+    identity: data.IIdentity;
+    serviceName: string;
+  };
+  response: {
+    shellCommand: IWorkspaceShellCommand;
+  };
+}
+
+export interface IReq_WorkspaceStartProcess extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_WorkspaceStartProcess
+> {
+  method: 'workspaceStartProcess';
+  request: {
+    identity: data.IIdentity;
+    serviceName: string;
+    processId: string;
+    command: string;
+    args?: string[];
+  };
+  response: {
+    processId: string;
+  };
+}
+
+export interface IReq_WorkspaceProcessInput extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_WorkspaceProcessInput
+> {
+  method: 'workspaceProcessInput';
+  request: {
+    identity: data.IIdentity;
+    processId: string;
+    input: string;
+  };
+  response: {};
+}
+
+export interface IReq_WorkspaceKillProcess extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_WorkspaceKillProcess
+> {
+  method: 'workspaceKillProcess';
+  request: {
+    identity: data.IIdentity;
+    processId: string;
+  };
+  response: {};
+}
+
+export interface IReq_PushWorkspaceProcessOutput extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_PushWorkspaceProcessOutput
+> {
+  method: 'pushWorkspaceProcessOutput';
+  request: {
+    processId: string;
+    output: string;
+  };
+  response: {};
+}
+
+export interface IReq_PushWorkspaceProcessExit extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_PushWorkspaceProcessExit
+> {
+  method: 'pushWorkspaceProcessExit';
+  request: {
+    processId: string;
+    exitCode: number;
+  };
+  response: {};
+}

ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/onebox',
-  version: '1.30.0',
+  version: '2.1.2',
   description: 'Self-hosted container platform with automatic SSL and DNS - a mini Heroku for single servers'
 }

ts_web/appstate.ts

@@ -58,8 +58,9 @@ export interface ISettingsState {
 }
 
 export interface IAppStoreState {
-  apps: interfaces.requests.ICatalogApp[];
+  apps: interfaces.requests.IAppStoreApp[];
-  upgradeableServices: interfaces.requests.IUpgradeableService[];
+  upgradeableServices: interfaces.requests.IUpgradeableAppStoreService[];
+  upgradeOperations: interfaces.requests.IAppStoreUpgradeOperation[];
 }
 
 export interface IUiState {
@@ -154,6 +155,7 @@ export const appStoreStatePart = await appState.getStatePart<IAppStoreState>(
   {
     apps: [],
     upgradeableServices: [],
+    upgradeOperations: [],
   },
   'soft',
 );
@@ -1101,6 +1103,19 @@ const upsertService = (
   return updatedServices;
 };
 
+const upsertUpgradeOperation = (
+  operations: interfaces.requests.IAppStoreUpgradeOperation[],
+  operation: interfaces.requests.IAppStoreUpgradeOperation,
+): interfaces.requests.IAppStoreUpgradeOperation[] => {
+  const existingIndex = operations.findIndex((item) => item.id === operation.id);
+  const updatedOperations = existingIndex === -1
+    ? [operation, ...operations]
+    : operations.map((item) => item.id === operation.id ? operation : item);
+  return updatedOperations
+    .sort((a, b) => b.startedAt - a.startedAt)
+    .slice(0, 25);
+};
+
 socketRouter.addTypedHandler(
   new plugins.domtools.plugins.typedrequest.TypedHandler<interfaces.requests.IReq_PushServiceUpdate>(
     'pushServiceUpdate',
@@ -1137,6 +1152,33 @@ socketRouter.addTypedHandler(
   ),
 );
 
+socketRouter.addTypedHandler(
+  new plugins.domtools.plugins.typedrequest.TypedHandler<interfaces.requests.IReq_PushAppStoreUpgradeProgress>(
+    'pushAppStoreUpgradeProgress',
+    async (dataArg) => {
+      const state = appStoreStatePart.getState();
+      appStoreStatePart.setState({
+        ...state,
+        upgradeOperations: upsertUpgradeOperation(state.upgradeOperations, dataArg.operation),
+        upgradeableServices: dataArg.operation.status === 'success'
+          ? state.upgradeableServices.filter((service) => service.serviceName !== dataArg.operation.serviceName)
+          : state.upgradeableServices,
+      });
+      if (dataArg.operation.service) {
+        const servicesState = servicesStatePart.getState();
+        servicesStatePart.setState({
+          ...servicesState,
+          services: upsertService(servicesState.services, dataArg.operation.service),
+          currentService: servicesState.currentService?.name === dataArg.operation.service.name
+            ? dataArg.operation.service
+            : servicesState.currentService,
+        });
+      }
+      return {};
+    },
+  ),
+);
+
 // Handle server-pushed platform service log entries
 socketRouter.addTypedHandler(
   new plugins.domtools.plugins.typedrequest.TypedHandler<interfaces.requests.IReq_PushPlatformServiceLog>(
@@ -1226,13 +1268,13 @@ async function disconnectSocket() {
 // App Store Actions
 // ============================================================================
 
-export const fetchAppTemplatesAction = appStoreStatePart.createAction(
+export const fetchAppStoreTemplatesAction = appStoreStatePart.createAction(
   async (statePartArg) => {
     const context = getActionContext();
     try {
       const typedRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
-        interfaces.requests.IReq_GetAppTemplates
+        interfaces.requests.IReq_GetAppStoreTemplates
-      >('/typedrequest', 'getAppTemplates');
+      >('/typedrequest', 'getAppStoreTemplates');
       const response = await typedRequest.fire({ identity: context.identity! });
       return { ...statePartArg.getState(), apps: response.apps };
     } catch (err) {
@@ -1242,13 +1284,13 @@ export const fetchAppTemplatesAction = appStoreStatePart.createAction(
   },
 );
 
-export const fetchUpgradeableServicesAction = appStoreStatePart.createAction(
+export const fetchUpgradeableAppStoreServicesAction = appStoreStatePart.createAction(
   async (statePartArg) => {
     const context = getActionContext();
     try {
       const typedRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
-        interfaces.requests.IReq_GetUpgradeableServices
+        interfaces.requests.IReq_GetUpgradeableAppStoreServices
-      >('/typedrequest', 'getUpgradeableServices');
+      >('/typedrequest', 'getUpgradeableAppStoreServices');
       const response = await typedRequest.fire({ identity: context.identity! });
       return { ...statePartArg.getState(), upgradeableServices: response.services };
     } catch (err) {
@@ -1258,26 +1300,41 @@ export const fetchUpgradeableServicesAction = appStoreStatePart.createAction(
   },
 );
 
-export const upgradeServiceAction = appStoreStatePart.createAction<{
+export const fetchAppStoreUpgradeOperationsAction = appStoreStatePart.createAction(
+  async (statePartArg) => {
+    const context = getActionContext();
+    try {
+      const typedRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
+        interfaces.requests.IReq_GetAppStoreUpgradeOperations
+      >('/typedrequest', 'getAppStoreUpgradeOperations');
+      const response = await typedRequest.fire({ identity: context.identity! });
+      return { ...statePartArg.getState(), upgradeOperations: response.operations };
+    } catch (err) {
+      console.error('Failed to fetch upgrade operations:', err);
+      return statePartArg.getState();
+    }
+  },
+);
+
+export const upgradeAppStoreServiceAction = appStoreStatePart.createAction<{
   serviceName: string;
   targetVersion: string;
 }>(async (statePartArg, dataArg) => {
   const context = getActionContext();
   try {
     const typedRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
-      interfaces.requests.IReq_UpgradeService
+      interfaces.requests.IReq_StartAppStoreServiceUpgrade
-    >('/typedrequest', 'upgradeService');
+    >('/typedrequest', 'startAppStoreServiceUpgrade');
-    await typedRequest.fire({
+    const response = await typedRequest.fire({
       identity: context.identity!,
       serviceName: dataArg.serviceName,
       targetVersion: dataArg.targetVersion,
     });
-    // Re-fetch upgradeable services and services list
+    const state = statePartArg.getState();
-    const upgradeReq = new plugins.domtools.plugins.typedrequest.TypedRequest<
+    return {
-      interfaces.requests.IReq_GetUpgradeableServices
+      ...state,
-    >('/typedrequest', 'getUpgradeableServices');
+      upgradeOperations: upsertUpgradeOperation(state.upgradeOperations, response.operation),
-    const upgradeResp = await upgradeReq.fire({ identity: context.identity! });
+    };
-    return { ...statePartArg.getState(), upgradeableServices: upgradeResp.services };
   } catch (err) {
     console.error('Failed to upgrade service:', err);
     return statePartArg.getState();

ts_web/elements/ob-view-appstore.ts

@@ -19,19 +19,20 @@ export class ObViewAppStore extends DeesElement {
   accessor appStoreState: appstate.IAppStoreState = {
     apps: [],
     upgradeableServices: [],
+    upgradeOperations: [],
   };
 
   @state()
   accessor currentView: 'grid' | 'detail' = 'grid';
 
   @state()
-  accessor selectedApp: interfaces.requests.ICatalogApp | null = null;
+  accessor selectedApp: interfaces.requests.IAppStoreApp | null = null;
 
   @state()
-  accessor selectedAppMeta: interfaces.requests.IAppMeta | null = null;
+  accessor selectedAppMeta: interfaces.requests.IAppStoreAppMeta | null = null;
 
   @state()
-  accessor selectedAppConfig: interfaces.requests.IAppVersionConfig | null = null;
+  accessor selectedAppConfig: interfaces.requests.IAppStoreVersionConfig | null = null;
 
   @state()
   accessor selectedVersion: string = '';
@@ -331,7 +332,10 @@ export class ObViewAppStore extends DeesElement {
 
   async connectedCallback() {
     super.connectedCallback();
-    await appstate.appStoreStatePart.dispatchAction(appstate.fetchAppTemplatesAction, null);
+    await Promise.all([
+      appstate.appStoreStatePart.dispatchAction(appstate.fetchAppStoreTemplatesAction, null),
+      appstate.appStoreStatePart.dispatchAction(appstate.fetchAppStoreUpgradeOperationsAction, null),
+    ]);
   }
 
   public render(): TemplateResult {
@@ -357,6 +361,7 @@ export class ObViewAppStore extends DeesElement {
 
     return html`
       <ob-sectionheading>App Store</ob-sectionheading>
+      ${this.renderUpgradeOperations()}
       ${appTemplates.length === 0
         ? html`<div class="loading-spinner">Loading app templates...</div>`
         : html`
@@ -369,6 +374,27 @@ export class ObViewAppStore extends DeesElement {
     `;
   }
 
+  private renderUpgradeOperations(): TemplateResult | '' {
+    const visibleOperations = this.appStoreState.upgradeOperations
+      .filter((operation) => operation.status === 'running' || operation.status === 'failed')
+      .slice(0, 3);
+    if (visibleOperations.length === 0) return '';
+
+    return html`
+      <div class="detail-card">
+        <div class="section-label">Recent Upgrade Operations</div>
+        <div class="footprint-list">
+          ${visibleOperations.map((operation) => html`
+            <div class="footprint-item">
+              <span>${operation.serviceName}: ${operation.fromVersion} &rarr; ${operation.targetVersion}</span>
+              <span class="footprint-meta">${operation.status} / ${operation.step}</span>
+            </div>
+          `)}
+        </div>
+      </div>
+    `;
+  }
+
   private renderDetailView(): TemplateResult {
     if (this.loading) {
       return html`
@@ -541,7 +567,7 @@ export class ObViewAppStore extends DeesElement {
     `;
   }
 
-  private renderDeploymentFootprint(config: interfaces.requests.IAppVersionConfig): TemplateResult | '' {
+  private renderDeploymentFootprint(config: interfaces.requests.IAppStoreVersionConfig): TemplateResult | '' {
     const volumes = this.getConfigVolumes(config);
     const publishedPorts = config.publishedPorts || [];
 
@@ -577,7 +603,7 @@ export class ObViewAppStore extends DeesElement {
     `;
   }
 
-  private renderDeployConfirmation(config: interfaces.requests.IAppVersionConfig): TemplateResult | '' {
+  private renderDeployConfirmation(config: interfaces.requests.IAppStoreVersionConfig): TemplateResult | '' {
     const volumes = this.getConfigVolumes(config);
     const publishedPorts = config.publishedPorts || [];
     if (volumes.length === 0 && publishedPorts.length === 0) return '';
@@ -590,7 +616,7 @@ export class ObViewAppStore extends DeesElement {
     `;
   }
 
-  private getConfigVolumes(config: interfaces.requests.IAppVersionConfig): interfaces.data.IServiceVolume[] {
+  private getConfigVolumes(config: interfaces.requests.IAppStoreVersionConfig): interfaces.data.IServiceVolume[] {
     return (config.volumes || []).map((volume) => {
       if (typeof volume === 'string') {
         return { mountPath: volume };
@@ -658,8 +684,8 @@ export class ObViewAppStore extends DeesElement {
       if (!identity) return;
 
       const typedRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
-        interfaces.requests.IReq_GetAppConfig
+        interfaces.requests.IReq_GetAppStoreConfig
-      >('/typedrequest', 'getAppConfig');
+      >('/typedrequest', 'getAppStoreConfig');
 
       const response = await typedRequest.fire({ identity, appId, version });
 
@@ -728,8 +754,8 @@ export class ObViewAppStore extends DeesElement {
       const identity = appstate.loginStatePart.getState().identity;
       if (!identity) return;
       const typedRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
-        interfaces.requests.IReq_InstallAppTemplate
+        interfaces.requests.IReq_InstallAppStoreApp
-      >('/typedrequest', 'installAppTemplate');
+      >('/typedrequest', 'installAppStoreApp');
       await typedRequest.fire({
         identity,
         install: {

ts_web/elements/ob-view-services.ts

@@ -146,6 +146,7 @@ export class ObViewServices extends DeesElement {
   accessor appStoreState: appstate.IAppStoreState = {
     apps: [],
     upgradeableServices: [],
+    upgradeOperations: [],
   };
 
   constructor() {
@@ -226,7 +227,8 @@ export class ObViewServices extends DeesElement {
     await Promise.all([
       appstate.servicesStatePart.dispatchAction(appstate.fetchServicesAction, null),
       appstate.servicesStatePart.dispatchAction(appstate.fetchPlatformServicesAction, null),
-      appstate.appStoreStatePart.dispatchAction(appstate.fetchUpgradeableServicesAction, null),
+      appstate.appStoreStatePart.dispatchAction(appstate.fetchUpgradeableAppStoreServicesAction, null),
+      appstate.appStoreStatePart.dispatchAction(appstate.fetchAppStoreUpgradeOperationsAction, null),
     ]);
 
     // If a platform service was selected from the dashboard, navigate to its detail
@@ -471,9 +473,21 @@ export class ObViewServices extends DeesElement {
     const upgradeInfo = service
       ? this.appStoreState.upgradeableServices.find((u) => u.serviceName === service.name)
       : null;
+    const upgradeOperation = service
+      ? this.appStoreState.upgradeOperations.find((operation) => {
+          return operation.serviceName === service.name && operation.status === 'running';
+        })
+      : null;
+    const latestUpgradeOperation = service
+      ? this.appStoreState.upgradeOperations.find((operation) => operation.serviceName === service.name)
+      : null;
 
     return html`
       <ob-sectionheading>Service Details</ob-sectionheading>
+      ${upgradeOperation ? this.renderUpgradeOperation(upgradeOperation) : ''}
+      ${!upgradeOperation && latestUpgradeOperation?.status === 'failed'
+        ? this.renderUpgradeOperation(latestUpgradeOperation)
+        : ''}
       ${upgradeInfo ? html`
         <div style="
           background: linear-gradient(135deg, rgba(59, 130, 246, 0.1), rgba(139, 92, 246, 0.1));
@@ -496,18 +510,14 @@ export class ObViewServices extends DeesElement {
           <button
             class="deploy-button"
             style="padding: 8px 16px; font-size: 13px;"
+            ?disabled=${Boolean(upgradeOperation)}
             @click=${async () => {
-              await appstate.appStoreStatePart.dispatchAction(appstate.upgradeServiceAction, {
+              await appstate.appStoreStatePart.dispatchAction(appstate.upgradeAppStoreServiceAction, {
                 serviceName: upgradeInfo.serviceName,
                 targetVersion: upgradeInfo.latestVersion,
               });
-              // Refresh service data
-              appstate.servicesStatePart.dispatchAction(appstate.fetchServiceAction, {
-                name: upgradeInfo.serviceName,
-              });
-              appstate.servicesStatePart.dispatchAction(appstate.fetchServicesAction, null);
             }}
-          >Upgrade</button>
+          >${upgradeOperation ? 'Upgrading...' : 'Upgrade'}</button>
         </div>
       ` : ''}
       <sz-service-detail-view
@@ -544,6 +554,53 @@ export class ObViewServices extends DeesElement {
     `;
   }
 
+  private renderUpgradeOperation(
+    operationArg: interfaces.requests.IAppStoreUpgradeOperation,
+  ): TemplateResult {
+    const color = operationArg.status === 'failed' ? '#f87171' : '#60a5fa';
+    return html`
+      <div style="
+        background: var(--ci-shade-1, #09090b);
+        border: 1px solid ${color};
+        border-radius: 8px;
+        padding: 16px;
+        margin-bottom: 16px;
+      ">
+        <div style="display: flex; justify-content: space-between; gap: 16px; align-items: flex-start;">
+          <div>
+            <div style="font-size: 14px; font-weight: 600; color: var(--ci-shade-7, #e4e4e7);">
+              Upgrade ${operationArg.fromVersion} &rarr; ${operationArg.targetVersion}: ${operationArg.step}
+            </div>
+            <div style="font-size: 12px; color: var(--ci-shade-4, #71717a); margin-top: 4px;">
+              ${operationArg.status === 'running' ? 'Operation is running in the background.' : operationArg.error || 'Operation finished.'}
+            </div>
+          </div>
+          <span style="font-size: 12px; color: ${color}; text-transform: uppercase; letter-spacing: 0.04em;">
+            ${operationArg.status}
+          </span>
+        </div>
+        <div style="
+          margin-top: 12px;
+          padding: 10px 12px;
+          background: var(--ci-shade-0, #030305);
+          border-radius: 6px;
+          color: var(--ci-shade-5, #a1a1aa);
+          font-family: monospace;
+          font-size: 12px;
+          line-height: 1.5;
+          max-height: 130px;
+          overflow: auto;
+          white-space: pre-wrap;
+        ">${operationArg.progressLines.slice(-8).join('\n')}</div>
+        ${operationArg.warnings.length > 0 ? html`
+          <div style="margin-top: 10px; color: #fbbf24; font-size: 12px;">
+            ${operationArg.warnings.join(' | ')}
+          </div>
+        ` : ''}
+      </div>
+    `;
+  }
+
   private renderBackupsView(): TemplateResult {
     return html`
       <ob-sectionheading>Backups</ob-sectionheading>

ts_web/elements/ob-view-settings.ts

@@ -48,31 +48,45 @@ export class ObViewSettings extends DeesElement {
     cssManager.defaultStyles,
     shared.viewHostCss,
     css`
-      .gateway-card {
+      dees-tile {
+        display: block;
         margin-bottom: 24px;
-        border: 1px solid ${cssManager.bdTheme('#e4e4e7', '#27272a')};
-        border-radius: 12px;
-        background: ${cssManager.bdTheme('#ffffff', '#09090b')};
-        overflow: hidden;
-        box-shadow: 0 1px 2px ${cssManager.bdTheme('rgba(0,0,0,0.04)', 'rgba(0,0,0,0.2)')};
       }
 
       .gateway-header {
-        padding: 16px 20px;
+        height: 36px;
-        border-bottom: 1px solid ${cssManager.bdTheme('#f4f4f5', '#27272a')};
+        display: flex;
-        background: ${cssManager.bdTheme('#fafafa', '#101013')};
+        align-items: center;
+        padding: 0 16px;
+        width: 100%;
+        box-sizing: border-box;
+      }
+
+      .gateway-heading {
+        flex: 1;
+        display: flex;
+        align-items: baseline;
+        gap: 8px;
+        min-width: 0;
       }
 
       .gateway-title {
-        font-size: 15px;
+        font-size: 13px;
-        font-weight: 600;
+        font-weight: 500;
-        color: ${cssManager.bdTheme('#18181b', '#fafafa')};
+        letter-spacing: -0.01em;
+        color: var(--dees-color-text-secondary);
+        white-space: nowrap;
+        overflow: hidden;
+        text-overflow: ellipsis;
       }
 
       .gateway-subtitle {
-        margin-top: 4px;
+        font-size: 12px;
-        font-size: 13px;
+        color: var(--dees-color-text-muted);
-        color: ${cssManager.bdTheme('#71717a', '#a1a1aa')};
+        letter-spacing: -0.01em;
+        white-space: nowrap;
+        overflow: hidden;
+        text-overflow: ellipsis;
       }
 
       .gateway-content {
@@ -176,8 +190,51 @@ export class ObViewSettings extends DeesElement {
 
       .gateway-footer {
         display: flex;
+        flex-direction: row;
         justify-content: flex-end;
-        padding: 0 20px 20px;
+        align-items: center;
+        gap: 0;
+        height: 36px;
+        width: 100%;
+        box-sizing: border-box;
+      }
+
+      .tile-button {
+        padding: 0 16px;
+        height: 100%;
+        text-align: center;
+        font-size: 12px;
+        font-weight: 500;
+        cursor: pointer;
+        user-select: none;
+        transition: all 0.15s ease;
+        background: transparent;
+        border: none;
+        border-left: 1px solid var(--dees-color-border-subtle);
+        color: var(--dees-color-text-muted);
+        white-space: nowrap;
+        display: flex;
+        align-items: center;
+        gap: 6px;
+      }
+
+      .tile-button:first-child {
+        border-left: none;
+      }
+
+      .tile-button:hover {
+        background: var(--dees-color-hover);
+        color: var(--dees-color-text-primary);
+      }
+
+      .tile-button.primary {
+        color: ${cssManager.bdTheme('hsl(217.2 91.2% 59.8%)', 'hsl(213.1 93.9% 67.8%)')};
+        font-weight: 600;
+      }
+
+      .tile-button.primary:hover {
+        background: ${cssManager.bdTheme('hsl(217.2 91.2% 59.8% / 0.08)', 'hsl(213.1 93.9% 67.8% / 0.08)')};
+        color: ${cssManager.bdTheme('hsl(217.2 91.2% 50%)', 'hsl(213.1 93.9% 75%)')};
       }
 
       @media (max-width: 700px) {
@@ -249,24 +306,23 @@ export class ObViewSettings extends DeesElement {
   private renderAdminUiSettings(): TemplateResult {
     const settings = this.settingsState.settings;
     return html`
-      <section class="gateway-card">
+      <dees-tile>
-        <div class="gateway-header">
+        <div slot="header" class="gateway-header">
-          <div class="gateway-title">Onebox Admin UI</div>
+          <div class="gateway-heading">
-          <div class="gateway-subtitle">Configure the public hostname for this Onebox dashboard. Onebox keeps this route separate from app service domains.</div>
+            <span class="gateway-title">Onebox Admin UI</span>
+            <span class="gateway-subtitle">Configure the public hostname for this Onebox dashboard</span>
+          </div>
         </div>
         <div class="gateway-content">
           ${this.renderGatewayInput('adminUiDomain', 'Admin UI Domain', settings?.adminUiDomain || '', 'Example: onebox.example.com. Leave empty to disable the public Admin UI route.')}
           ${this.renderGatewayReadonly('Local Target', 'Onebox OpsServer on port 3000', 'The external gateway forwards to SmartProxy, which forwards this hostname to the Onebox Admin UI.')}
         </div>
-        <div class="gateway-footer">
+        <div slot="footer" class="gateway-footer">
-          <dees-button
+          <button class="tile-button primary" type="button" @click=${() => this.saveAdminUiSettings()}>
-            .text=${'Save Admin UI Domain'}
+            Save Admin UI Domain
-            .type=${'default'}
+          </button>
-            .icon=${'lucide:Save'}
-            @click=${() => this.saveAdminUiSettings()}
-          ></dees-button>
         </div>
-      </section>
+      </dees-tile>
     `;
   }
 
@@ -274,10 +330,12 @@ export class ObViewSettings extends DeesElement {
     const settings = this.settingsState.settings;
     const mode = settings?.dcrouterMode || 'managed';
     return html`
-      <section class="gateway-card">
+      <dees-tile>
-        <div class="gateway-header">
+        <div slot="header" class="gateway-header">
-          <div class="gateway-title">dcrouter Gateway</div>
+          <div class="gateway-heading">
-          <div class="gateway-subtitle">Run a local managed dcrouter or delegate routing, DNS, and certificates to an external dcrouter.</div>
+            <span class="gateway-title">dcrouter Gateway</span>
+            <span class="gateway-subtitle">Run a local managed dcrouter or delegate routing to an external dcrouter</span>
+          </div>
         </div>
         <div class="gateway-mode-row">
           ${this.renderModeButton('managed', 'Managed Local', mode)}
@@ -303,15 +361,12 @@ export class ObViewSettings extends DeesElement {
             <div class="gateway-disabled">dcrouter route delegation is disabled. Onebox will keep using its local SmartProxy directly.</div>
           `}
         </div>
-        <div class="gateway-footer">
+        <div slot="footer" class="gateway-footer">
-          <dees-button
+          <button class="tile-button primary" type="button" @click=${() => this.saveExternalGatewaySettings()}>
-            .text=${'Save dcrouter Settings'}
+            Save dcrouter Settings
-            .type=${'default'}
+          </button>
-            .icon=${'lucide:Save'}
-            @click=${() => this.saveExternalGatewaySettings()}
-          ></dees-button>
         </div>
-      </section>
+      </dees-tile>
     `;
   }
 

ts_web/environments/backend-environment.ts

@@ -12,19 +12,30 @@ type IExecutionEnvironment = import('@design.estate/dees-catalog').IExecutionEnv
 type IFileEntry = import('@design.estate/dees-catalog').IFileEntry;
 type IFileWatcher = import('@design.estate/dees-catalog').IFileWatcher;
 type IProcessHandle = import('@design.estate/dees-catalog').IProcessHandle;
+type IWorkspaceShellCommand = interfaces.requests.IWorkspaceShellCommand;
 
 const domtools = plugins.deesElement.domtools;
 
+interface IWorkspaceProcessState {
+  outputController: ReadableStreamDefaultController<string>;
+  resolveExit: (exitCodeArg: number) => void;
+}
+
 export class BackendExecutionEnvironment implements IExecutionEnvironment {
   readonly type = 'backend' as const;
   private _ready = false;
   private identity: interfaces.data.IIdentity;
+  private processRouter = new plugins.domtools.plugins.typedrequest.TypedRouter();
+  private processSocket: InstanceType<typeof plugins.typedsocket.TypedSocket> | null = null;
+  private processSocketPromise: Promise<InstanceType<typeof plugins.typedsocket.TypedSocket>> | null = null;
+  private processStates = new Map<string, IWorkspaceProcessState>();
 
   constructor(
     private serviceName: string,
     identity: interfaces.data.IIdentity,
   ) {
     this.identity = identity;
+    this.registerProcessSocketHandlers();
   }
 
   get ready(): boolean {
@@ -44,6 +55,12 @@ export class BackendExecutionEnvironment implements IExecutionEnvironment {
   }
 
   async destroy(): Promise<void> {
+    for (const processId of Array.from(this.processStates.keys())) {
+      await this.killProcess(processId).catch(() => {});
+    }
+    await this.processSocket?.stop().catch(() => {});
+    this.processSocket = null;
+    this.processSocketPromise = null;
     this._ready = false;
   }
 
@@ -103,38 +120,142 @@ export class BackendExecutionEnvironment implements IExecutionEnvironment {
   }
 
   async spawn(command: string, args?: string[]): Promise<IProcessHandle> {
-    // For interactive shell: execute the command via the workspace exec API
+    const socket = await this.ensureProcessSocket();
-    // and return a process handle that bridges stdin/stdout
+    const processId = crypto.randomUUID();
-    const cmd = args ? [command, ...args] : [command];
+    await socket.setTag(`workspaceProcess:${processId}`, true);
-    const fullCommand = cmd.join(' ');
 
-    // Use a non-interactive exec for now — full interactive shell would need
+    let resolveExit: (exitCodeArg: number) => void = () => {};
-    // TypedSocket bidirectional streaming (to be implemented)
+    const exit = new Promise<number>((resolve) => {
-    const result = await this.fireRequest<interfaces.requests.IReq_WorkspaceExec>(
+      resolveExit = resolve;
-      'workspaceExec',
+    });
-      { command: cmd[0], args: cmd.slice(1) },
-    );
-
-    // Create a ReadableStream from the exec output
     const output = new ReadableStream<string>({
-      start(controller) {
+      start: (controller) => {
-        if (result.stdout) controller.enqueue(result.stdout);
+        this.processStates.set(processId, {
-        if (result.stderr) controller.enqueue(result.stderr);
+          outputController: controller,
-        controller.close();
+          resolveExit,
+        });
+      },
+      cancel: async () => {
+        await this.killProcess(processId).catch(() => {});
       },
     });
 
-    // Create a writable stream (no-op for non-interactive)
+    try {
-    const inputStream = new WritableStream<string>();
+      await socket.createTypedRequest<interfaces.requests.IReq_WorkspaceStartProcess>(
+        'workspaceStartProcess',
+      ).fire({
+        identity: this.identity,
+        serviceName: this.serviceName,
+        processId,
+        command,
+        args,
+      });
+    } catch (error) {
+      const processState = this.processStates.get(processId);
+      this.processStates.delete(processId);
+      await socket.removeTag(`workspaceProcess:${processId}`).catch(() => {});
+      try {
+        processState?.outputController.error(error);
+      } catch {
+        // The stream may already have been cancelled by the terminal.
+      }
+      throw error;
+    }
+
+    const input = new WritableStream<string>({
+      write: async (chunkArg) => {
+        await socket.createTypedRequest<interfaces.requests.IReq_WorkspaceProcessInput>(
+          'workspaceProcessInput',
+        ).fire({
+          identity: this.identity,
+          processId,
+          input: chunkArg,
+        });
+      },
+      abort: async () => {
+        await this.killProcess(processId).catch(() => {});
+      },
+    });
 
     return {
       output,
-      input: inputStream,
+      input,
-      exit: Promise.resolve(result.exitCode),
+      exit,
-      kill: () => {},
+      kill: () => {
+        void this.killProcess(processId);
+      },
     };
   }
 
+  async getShellCommand(): Promise<IWorkspaceShellCommand> {
+    const result = await this.fireRequest<interfaces.requests.IReq_WorkspaceGetShellCommand>(
+      'workspaceGetShellCommand',
+      {},
+    );
+    return result.shellCommand;
+  }
+
+  private registerProcessSocketHandlers(): void {
+    this.processRouter.addTypedHandler(
+      new plugins.domtools.plugins.typedrequest.TypedHandler<interfaces.requests.IReq_PushWorkspaceProcessOutput>(
+        'pushWorkspaceProcessOutput',
+        async (dataArg: interfaces.requests.IReq_PushWorkspaceProcessOutput['request']) => {
+          this.processStates.get(dataArg.processId)?.outputController.enqueue(dataArg.output);
+          return {};
+        },
+      ),
+    );
+
+    this.processRouter.addTypedHandler(
+      new plugins.domtools.plugins.typedrequest.TypedHandler<interfaces.requests.IReq_PushWorkspaceProcessExit>(
+        'pushWorkspaceProcessExit',
+        async (dataArg: interfaces.requests.IReq_PushWorkspaceProcessExit['request']) => {
+          this.completeProcessState(dataArg.processId, dataArg.exitCode);
+          await this.processSocket?.removeTag(`workspaceProcess:${dataArg.processId}`).catch(() => {});
+          return {};
+        },
+      ),
+    );
+  }
+
+  private async ensureProcessSocket(): Promise<InstanceType<typeof plugins.typedsocket.TypedSocket>> {
+    if (this.processSocket) return this.processSocket;
+    if (!this.processSocketPromise) {
+      this.processSocketPromise = plugins.typedsocket.TypedSocket.createClient(
+        this.processRouter,
+        plugins.typedsocket.TypedSocket.useWindowLocationOriginUrl(),
+        { autoReconnect: true },
+      );
+    }
+    this.processSocket = await this.processSocketPromise;
+    return this.processSocket;
+  }
+
+  private completeProcessState(processIdArg: string, exitCodeArg: number): void {
+    const processState = this.processStates.get(processIdArg);
+    if (!processState) return;
+    try {
+      processState.outputController.close();
+    } catch {
+      // The terminal may already have cancelled the stream.
+    }
+    processState.resolveExit(exitCodeArg);
+    this.processStates.delete(processIdArg);
+  }
+
+  private async killProcess(processIdArg: string): Promise<void> {
+    const socket = this.processSocket;
+    if (!socket) return;
+    await socket.createTypedRequest<interfaces.requests.IReq_WorkspaceKillProcess>(
+      'workspaceKillProcess',
+    ).fire({
+      identity: this.identity,
+      processId: processIdArg,
+    }).catch(() => {});
+    this.completeProcessState(processIdArg, -1);
+    await socket.removeTag(`workspaceProcess:${processIdArg}`).catch(() => {});
+  }
+
   /**
    * Helper to fire TypedRequests to the workspace API
    */