belt 0.2.9 → 0.2.11

data/lib/belt/cli/bucket_security.rb

@@ -71,20 +71,26 @@ module Belt
       def harden_bucket(bucket, audit)
         unless audit[:versioning]
           enable_versioning(bucket)
-          puts '  enable  versioning'
+          say_security '  enable  versioning'
         end
         unless audit[:encryption]
           enable_encryption(bucket)
-          puts '  enable  AES-256 encryption'
+          say_security '  enable  AES-256 encryption'
         end
         unless audit[:public_access_block]
           block_public_access(bucket)
-          puts '  enable  public access block'
+          say_security '  enable  public access block'
         end
         return if audit[:tls_policy]
 
         apply_tls_policy(bucket)
-        puts '  enable  TLS-only bucket policy'
+        say_security '  enable  TLS-only bucket policy'
+      end
+
+      def say_security(message)
+        return if respond_to?(:say, true) && @quiet
+
+        puts message
       end
 
       private

data/lib/belt/cli/deploy_command.rb

@@ -9,6 +9,7 @@ require_relative 'terraform_command'
 require_relative 'backup_config'
 require_relative 'backup_runner'
 require_relative 'environment_config'
+require_relative 'path_gem_materializer'
 
 module Belt
   module CLI
@@ -150,6 +151,7 @@ module Belt
         puts "belt → deploying #{@env} (in #{env_dir}/)\n\n"
 
         ensure_lockfile_consistent!
+        warn_active_path_gems!
         generate_routes_if_needed
         run_backups unless @skip_backup
 
@@ -457,9 +459,55 @@ module Belt
         FileUtils.cp(gemfile, build_dir) if File.exist?(gemfile)
         FileUtils.cp(lockfile, build_dir) if File.exist?(lockfile)
 
+        copy_vendor_cache(build_dir)
+        materialize_path_gems!(build_dir)
+
         puts '    📁 Copied handlers, controllers, models, lib, config'
       end
 
+      # Stage prebuilt .gem files so Docker `bundle install` can install unreleased
+      # gems as normal package installs (with specifications/), not path/git layouts.
+      # Prefer project-root vendor/cache (next to Gemfile — Bundler's natural path);
+      # fall back to lambda/vendor/cache for older layouts.
+      def copy_vendor_cache(build_dir)
+        cache_dir = [
+          File.join(@project_root, 'vendor', 'cache'),
+          File.join(@project_root, 'lambda', 'vendor', 'cache')
+        ].find { |dir| Dir.exist?(dir) && !Dir.empty?(dir) }
+        return unless cache_dir
+
+        dest = File.join(build_dir, 'vendor', 'cache')
+        FileUtils.mkdir_p(dest)
+        FileUtils.cp_r(Dir.glob(File.join(cache_dir, '*')), dest)
+        gem_count = Dir.glob(File.join(dest, '*.gem')).size
+        puts "    📦 Copied vendor/cache (#{gem_count} local gem(s))"
+      end
+
+      # path: gems install under bundler/gems/ with no specifications/ — Lambda's
+      # bare `require 'belt'` can't see them. Build real .gem files into the
+      # package's vendor/cache and pin versions in the *build* Gemfile/lock only.
+      def materialize_path_gems!(build_dir)
+        gems = PathGemMaterializer.materialize!(build_dir, project_root: @project_root)
+        return if gems.empty?
+
+        puts "    🔧 Materialized path gem(s) → vendor/cache: #{gems.join(', ')}"
+      end
+
+      # path: gems need host-side materialize before Docker install. --rebuild
+      # always does it. Full terraform apply needs a conveyor-belt build that
+      # includes path-gem materialize (discord-vendor-cache-gemfile-parent+).
+      def warn_active_path_gems!
+        lockfile = File.join(@project_root, 'Gemfile.lock')
+        return unless File.exist?(lockfile)
+        return unless File.read(lockfile).match?(/^PATH\n/)
+
+        puts '  ⚠ Gemfile.lock has PATH gems (path: in Gemfile).'
+        puts "    Safe now: belt deploy #{@env} --rebuild (always materializes)."
+        puts '    Full terraform apply needs conveyor-belt with path-gem materialize.'
+        puts '    Or pin a version + drop a built .gem in vendor/cache/'
+        puts ''
+      end
+
       def build_gems(build_dir)
         puts '    🐳 Building gems in Docker (Lambda-compatible)...'
 

data/lib/belt/cli/destroy_command.rb

@@ -44,10 +44,11 @@ module Belt
         when 'environment'
           name = args.shift
           if name.nil? || name.empty?
-            puts 'Usage: belt destroy environment <name>'
+            puts 'Usage: belt destroy environment <name> [--force] [--skip-terraform]'
             exit 1
           end
-          new(generator, name, []).destroy
+          flags = parse_environment_flags(args)
+          new(generator, name, [], **flags).destroy
         when 'frontend'
           new(generator, nil, []).destroy
         when 'views'
@@ -67,6 +68,19 @@ module Belt
         end
       end
 
+      def self.parse_environment_flags(args)
+        flags = { force: false, skip_terraform: false }
+        args.each do |arg|
+          case arg
+          when '--force', '-f'
+            flags[:force] = true
+          when '--skip-terraform'
+            flags[:skip_terraform] = true
+          end
+        end
+        flags
+      end
+
       def self.parse_field(arg)
         name, type = arg.split(':', 2)
         { name: name, type: type || 'string' }
@@ -84,26 +98,37 @@ module Belt
             resource      Alias for scaffold
             model         Remove an ActiveItem model
             controller    Remove a controller
-            environment   Remove a deployment environment directory
+            environment   Remove a deployment environment and tear down infrastructure
             frontend      Remove the frontend/ directory
             views         Remove React pages for a resource
 
+          Environment options:
+            --force, -f          Skip all prompts (CI mode)
+            --skip-terraform     Delete local files without running terraform destroy
+
           Examples:
             belt d scaffold post title:string body:text status:string
             belt d model user
             belt d controller comments
             belt d environment staging
+            belt d environment dev --skip-terraform
+            belt d environment dev --force
             belt d frontend
             belt d views post
 
           ⚠ This is destructive. Files will be permanently deleted.
+
+          For environments: if terraform state is detected, you'll be prompted to run
+          `terraform destroy` first to tear down cloud resources before removing files.
         HELP
       end
 
-      def initialize(generator, name, fields)
+      def initialize(generator, name, fields, force: false, skip_terraform: false)
         @generator = generator
         @name = name&.downcase&.gsub(/[^a-z0-9_]/, '_')
         @fields = fields
+        @force = force
+        @skip_terraform = skip_terraform
         @app_name = detect_namespace
         @singular_name = @name ? Belt::Inflector.singularize(@name) : nil
         @resource_name = @singular_name ? Belt::Inflector.pluralize(@singular_name) : nil
@@ -149,15 +174,99 @@ module Belt
 
       def destroy_environment
         dir = "infrastructure/#{@name}"
-        if Dir.exist?(dir)
-          FileUtils.rm_rf(dir)
-          @removed << dir
-          puts "  remove  #{dir}/"
-          puts "\n✓ Environment '#{@name}' destroyed!"
-        else
+
+        unless Dir.exist?(dir)
           puts "✗ Environment '#{@name}' not found at #{dir}/"
           exit 1
         end
+
+        # Check if terraform state exists (infra may still be live)
+        if !@skip_terraform && terraform_state_exists?(dir)
+          puts "⚠  Environment '#{@name}' appears to have active infrastructure."
+          puts "   Terraform state was found — resources may still be running.\n\n"
+
+          if @force
+            puts '   --force passed, skipping terraform destroy.'
+          else
+            puts '   Options:'
+            puts '     1) Run `terraform destroy` to tear down infrastructure first (recommended)'
+            puts '     2) Skip terraform and just delete the local files (--skip-terraform)'
+            puts "     3) Cancel\n\n"
+
+            print "   Run terraform destroy for '#{@name}'? [y/N/skip] "
+            response = $stdin.gets&.strip&.downcase
+
+            case response
+            when 'y', 'yes'
+              run_terraform_destroy(dir)
+            when 'skip', 's'
+              puts '   Skipping terraform destroy.'
+            else
+              puts 'Cancelled.'
+              exit 0
+            end
+          end
+        end
+
+        # Final confirmation before deleting files
+        unless @force
+          print "\nPermanently delete #{dir}/? [y/N] "
+          response = $stdin.gets&.strip&.downcase
+          unless response&.start_with?('y')
+            puts 'Cancelled.'
+            exit 0
+          end
+        end
+
+        FileUtils.rm_rf(dir)
+        @removed << dir
+        puts "  remove  #{dir}/"
+        puts "\n✓ Environment '#{@name}' destroyed!"
+      end
+
+      def terraform_state_exists?(dir)
+        # Check for local .terraform directory (initialized state)
+        return true if Dir.exist?(File.join(dir, '.terraform'))
+
+        # Check if backend.tf exists (remote state configured)
+        backend_file = File.join(dir, 'backend.tf')
+        return false unless File.exist?(backend_file)
+
+        # Try to query remote state — if terraform is initialized and state exists,
+        # the environment likely has live resources
+        Dir.chdir(dir) do
+          # Quick check: does `terraform show` return anything?
+          output = `terraform show -no-color 2>&1`
+          Process.last_status.success? && !output.strip.empty? && !output.include?('No state')
+        end
+      rescue StandardError
+        # If we can't determine state, assume it might exist and warn
+        true
+      end
+
+      def run_terraform_destroy(dir)
+        puts "\n━━━ terraform destroy (#{@name}) ━━━"
+
+        Dir.chdir(dir) do
+          # Initialize if needed
+          unless Dir.exist?('.terraform')
+            puts '  Initializing terraform...'
+            unless system('terraform', 'init', '-input=false')
+              puts "\n✗ terraform init failed. You may need to destroy manually:"
+              puts "  cd #{dir} && terraform init && terraform destroy"
+              exit 1
+            end
+          end
+
+          # Run destroy with auto-approve (user already confirmed)
+          unless system('terraform', 'destroy', '-auto-approve')
+            puts "\n✗ terraform destroy failed."
+            puts '  Infrastructure may still be running. Fix and retry, or use --skip-terraform.'
+            exit 1
+          end
+        end
+
+        puts '  ✓ Infrastructure destroyed.'
       end
 
       def destroy_frontend

data/lib/belt/cli/doctor_command.rb

@@ -0,0 +1,208 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+
+module Belt
+  module CLI
+    class DoctorCommand
+      REQUIRED_TOOLS = [
+        { name: 'aws', check: %w[aws --version],
+          install_url: 'https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html' },
+        { name: 'terraform', check: %w[terraform --version],
+          install_url: 'https://developer.hashicorp.com/terraform/install' },
+        { name: 'ruby', check: %w[ruby --version], min_version: '3.3' },
+        { name: 'bundler', check: %w[bundle --version], install_hint: 'gem install bundler' }
+      ].freeze
+
+      def self.run(args)
+        verbose = args.include?('--verbose') || args.include?('-v')
+
+        if args.include?('--help') || args.include?('-h')
+          puts usage
+          exit 0
+        end
+
+        new(verbose: verbose).run
+      end
+
+      def self.usage
+        <<~USAGE
+          Usage: belt doctor [options]
+
+          Check system dependencies and AWS configuration for Belt.
+
+          Options:
+            -v, --verbose    Show detailed output for each check
+            -h, --help       Show this help
+        USAGE
+      end
+
+      def initialize(verbose: false)
+        @verbose = verbose
+        @issues = []
+        @warnings = []
+      end
+
+      def run
+        puts "Belt Doctor\n"
+        puts "Checking your system for Belt prerequisites...\n\n"
+
+        check_tools
+        check_aws_credentials
+        check_aws_identity
+
+        puts ''
+        print_summary
+      end
+
+      private
+
+      def check_tools
+        puts '── Tools ──'
+        REQUIRED_TOOLS.each do |tool|
+          check_tool(tool)
+        end
+        puts ''
+      end
+
+      def check_tool(tool)
+        output, status = Open3.capture2e(*tool[:check])
+
+        if status.success?
+          version = extract_version(output)
+          if tool[:min_version] && version && Gem::Version.new(version) < Gem::Version.new(tool[:min_version])
+            print_warn(tool[:name], "found #{version}, need >= #{tool[:min_version]}")
+            @warnings << "#{tool[:name]} version #{version} is below minimum #{tool[:min_version]}"
+          else
+            print_ok(tool[:name], version ? version.to_s : output.strip.lines.first&.strip)
+          end
+        else
+          print_fail(tool[:name], 'not found')
+          hint = tool[:install_hint] || tool[:install_url]
+          puts "         Install: #{hint}" if hint
+          @issues << "#{tool[:name]} is not installed"
+        end
+      end
+
+      def check_aws_credentials
+        puts '── AWS Configuration ──'
+
+        # Check for credential sources
+        has_profile = ENV.fetch('AWS_PROFILE', nil) && !ENV['AWS_PROFILE'].empty?
+        has_env_keys = ENV.fetch('AWS_ACCESS_KEY_ID', nil) && !ENV['AWS_ACCESS_KEY_ID'].empty?
+        has_config_file = File.exist?(File.expand_path('~/.aws/config'))
+        has_credentials_file = File.exist?(File.expand_path('~/.aws/credentials'))
+
+        if has_profile
+          print_ok('AWS_PROFILE', ENV.fetch('AWS_PROFILE', nil))
+        elsif has_env_keys
+          print_ok('AWS_ACCESS_KEY_ID', 'set (environment variable)')
+        elsif has_credentials_file
+          print_ok('~/.aws/credentials', 'exists')
+        elsif has_config_file
+          print_ok('~/.aws/config', 'exists')
+        else
+          print_fail('AWS credentials', 'no credential source found')
+          puts '         Set AWS_PROFILE, or configure credentials via:'
+          puts '           aws configure sso    # SSO (recommended)'
+          puts '           aws configure        # access key + secret'
+          @issues << 'No AWS credentials configured'
+          return
+        end
+
+        # Check config file for profiles
+        return unless has_config_file && @verbose
+
+        profiles = parse_aws_config_profiles
+        puts "         Profiles: #{profiles.join(', ')}" if profiles.any?
+      end
+
+      def check_aws_identity
+        output, status = Open3.capture2e('aws', 'sts', 'get-caller-identity')
+
+        if status.success?
+          data = begin
+            JSON.parse(output)
+          rescue JSON::ParserError
+            {}
+          end
+          account = data['Account'] || '?'
+          arn = data['Arn'] || '?'
+          print_ok('Authentication', "account #{account}")
+          puts "         ARN: #{arn}" if @verbose
+        else
+          error = output.strip
+          if error.include?('ExpiredToken') || error.include?('expired')
+            print_fail('Authentication', 'credentials expired')
+            puts '         Run: aws sso login'
+            @issues << 'AWS credentials are expired — run `aws sso login`'
+          elsif error.include?('InvalidClientTokenId') || error.include?('SignatureDoesNotMatch')
+            print_fail('Authentication', 'invalid credentials')
+            puts '         Your access key or secret is incorrect.'
+            puts '         Run: aws configure'
+            @issues << 'AWS credentials are invalid'
+          elsif error.include?('Could not connect') || error.include?('Unable to locate credentials')
+            print_fail('Authentication', 'unable to authenticate')
+            puts '         Run: aws configure sso    # or set AWS_PROFILE'
+            @issues << 'Unable to authenticate with AWS'
+          else
+            print_fail('Authentication', 'failed')
+            puts "         #{error.lines.first&.strip}" if error.length.positive?
+            @issues << 'AWS authentication failed'
+          end
+        end
+      end
+
+      def print_summary
+        if @issues.empty? && @warnings.empty?
+          puts '✓ All checks passed — you\'re ready to belt!'
+        elsif @issues.empty?
+          puts "⚠ #{@warnings.size} warning#{'s' if @warnings.size > 1}:"
+          @warnings.each { |w| puts "  • #{w}" }
+        else
+          puts "✗ #{@issues.size} issue#{'s' if @issues.size > 1} found:"
+          @issues.each { |i| puts "  • #{i}" }
+          @warnings.each { |w| puts "  • ⚠ #{w}" } if @warnings.any?
+          puts "\nFix the issues above, then run `belt doctor` again."
+          exit 1
+        end
+      end
+
+      def print_ok(label, detail = nil)
+        msg = "  ✓ #{label}"
+        msg += " — #{detail}" if detail
+        puts msg
+      end
+
+      def print_fail(label, detail = nil)
+        msg = "  ✗ #{label}"
+        msg += " — #{detail}" if detail
+        puts msg
+      end
+
+      def print_warn(label, detail = nil)
+        msg = "  ⚠ #{label}"
+        msg += " — #{detail}" if detail
+        puts msg
+      end
+
+      def extract_version(output)
+        # Match common version patterns:
+        #   "aws-cli/2.15.0" "Terraform v1.7.0" "Bundler version 2.5.0" "ruby 3.3.0"
+        match = output.match(%r{(?:version\s+|v|/|^ruby\s+)(\d+\.\d+(?:\.\d+)?)}i)
+        match ? match[1] : nil
+      end
+
+      def parse_aws_config_profiles
+        config_path = File.expand_path('~/.aws/config')
+        return [] unless File.exist?(config_path)
+
+        File.readlines(config_path)
+            .filter_map { |line| line.match(/\[profile\s+(.+)\]/)&.captures&.first }
+      rescue StandardError
+        []
+      end
+    end
+  end
+end

data/lib/belt/cli/environment_command.rb

@@ -26,11 +26,13 @@ module Belt
         new(env_name).generate
       end
 
-      def initialize(env_name, quiet: false, domain: nil)
+      def initialize(env_name, quiet: false, domain: nil, announce: true)
         @env_name = env_name.downcase.gsub(/[^a-z0-9_-]/, '')
         @app_name = detect_app_name
         @domain = domain
         @quiet = quiet
+        @announce = announce
+        @state_bucket = resolve_state_bucket
       end
 
       def generate
@@ -41,19 +43,18 @@ module Belt
           exit 1
         end
 
-        puts "Creating environment: #{@env_name}"
+        puts "Creating environment: #{@env_name}" unless @quiet
         FileUtils.mkdir_p(dest_dir)
 
         templates.each do |template_name, dest_file|
           dest_path = File.join(dest_dir, dest_file)
           write_template(template_name, dest_path)
-          puts "  create  #{dest_path}"
+          puts "  create  #{dest_path}" unless @quiet
         end
 
-        puts "\n✓ Environment '#{@env_name}' created!"
-
-        return if @quiet
+        return if @quiet || !@announce
 
+        puts "\n✓ Environment '#{@env_name}' created!"
         puts "\nNext steps:"
         puts "  cd #{dest_dir}"
         puts '  terraform init'
@@ -80,6 +81,37 @@ module Belt
         content = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
         File.write(dest_path, content)
       end
+
+      # Resolve the state bucket name to use in backend.tf.
+      # Priority: existing sibling backend.tf → AWS account ID → bare placeholder.
+      def resolve_state_bucket
+        bucket_from_sibling || bucket_from_aws || 'belt-terraform-state'
+      end
+
+      def bucket_from_sibling
+        Dir.glob('infrastructure/*/backend.tf').each do |f|
+          match = File.read(f).match(/bucket\s*=\s*"([^"]+)"/)
+          next unless match
+          # Skip the bare placeholder — it means state wasn't set up yet
+          return match[1] unless match[1] == 'belt-terraform-state'
+        end
+        nil
+      end
+
+      def bucket_from_aws
+        require 'open3'
+        output, status = Open3.capture2e('aws', 'sts', 'get-caller-identity')
+        return nil unless status.success?
+
+        data = begin
+          JSON.parse(output)
+        rescue StandardError
+          nil
+        end
+        return nil unless data&.dig('Account')
+
+        "belt-terraform-state-#{data['Account']}"
+      end
     end
   end
 end

data/lib/belt/cli/frontend_command.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'erb'
 require 'json'
+require 'open3'
 require_relative 'app_detection'
 
 module Belt
@@ -28,8 +29,10 @@ module Belt
         new(framework).generate
       end
 
-      def initialize(framework)
+      def initialize(framework, quiet: false, announce: true)
         @framework = framework
+        @quiet = quiet
+        @announce = announce
         @app_name = detect_app_name
         @module_name = @app_name.split(/[-_]/).map(&:capitalize).join
       end
@@ -42,7 +45,7 @@ module Belt
           exit 1
         end
 
-        puts "Creating #{@framework} frontend application..."
+        puts "Creating #{@framework} frontend application..." unless @quiet
         framework_dir = File.join(TEMPLATE_DIR, @framework)
 
         unless Dir.exist?(framework_dir)
@@ -52,25 +55,35 @@ module Belt
 
         copy_template(framework_dir, dest_dir)
 
-        puts "\n✓ Frontend (#{@framework}) created in frontend/"
+        puts "\n✓ Frontend (#{@framework}) created in frontend/" unless @quiet
 
         install_dependencies(dest_dir)
         setup_frontend_infra_for_existing_environments
 
+        return if @quiet || !@announce
+
         puts "\nNext steps:"
         puts '  belt server                   # Start local dev server'
         puts '  belt deploy                   # Deploy everything to AWS'
       end
 
+      def npm_ok?
+        @npm_ok != false
+      end
+
       private
 
       def install_dependencies(dest_dir)
-        puts "\n  Installing npm dependencies..."
-        success = system('npm', 'install', '--prefix', dest_dir, '--loglevel', 'error')
-        if success
-          puts '  ✓ Dependencies installed'
+        puts "\n  Installing npm dependencies..." unless @quiet
+        _output, status = Open3.capture2e(
+          'npm', 'install', '--prefix', dest_dir, '--no-fund', '--no-audit'
+        )
+        if status.success?
+          puts '  ✓ npm dependencies installed' unless @quiet
+          @npm_ok = true
         else
-          puts "  ⚠ npm install failed — run `cd #{dest_dir} && npm install` manually"
+          puts "  ⚠ npm install failed — run `cd #{dest_dir} && npm install` manually" unless @quiet
+          @npm_ok = false
         end
       end
 
@@ -79,16 +92,16 @@ module Belt
         frontend_tf = File.join(module_dir, 'frontend.tf')
 
         if File.exist?(frontend_tf)
-          puts "  skip    #{frontend_tf} (already exists)"
+          puts "  skip    #{frontend_tf} (already exists)" unless @quiet
           return
         end
 
         return unless Dir.exist?(module_dir)
 
-        puts "\n  Setting up frontend infrastructure..."
+        puts "\n  Setting up frontend infrastructure..." unless @quiet
         require_relative 'frontend_setup_command'
         FrontendSetupCommand.new(nil, quiet: true).run
-        puts "  create  #{frontend_tf}"
+        puts "  create  #{frontend_tf}" unless @quiet
       end
 
       def copy_template(src_dir, dest_dir)
@@ -107,7 +120,7 @@ module Belt
           else
             FileUtils.cp(src, dest_path)
           end
-          puts "  create  #{dest_path}"
+          puts "  create  #{dest_path}" unless @quiet
         end
       end
     end