@akash-chowdhury-24/deployhub 2.0.0 → 2.0.3

package/src/deployment/providers/ec2.js

@@ -1,7 +1,93 @@
+import { execa } from 'execa';
 import { createSshProvider } from './ssh.js';
+import { createLogger } from '../../logger/index.js';
 
-export function createEc2Provider(config, envName, env) {
-  return createSshProvider(config, envName, env);
+/**
+ * @param {import('../../core/config.js').DeployHubConfig} config
+ * @param {string} envName
+ * @param {Record<string, string>} [env]
+ */
+export function createEc2Provider(config, envName, env = process.env) {
+  const log = createLogger('ec2');
+  const instanceId = env.EC2_INSTANCE_ID;
+  const region = env.AWS_REGION || 'us-east-1';
+
+  async function resolveHost() {
+    const environment = config.environments[envName];
+    if (environment?.host || env.SSH_HOST) {
+      return environment?.host || env.SSH_HOST;
+    }
+
+    if (!instanceId) {
+      throw new Error(
+        'EC2 host unknown. Set SSH_HOST to your instance public IP, or set EC2_INSTANCE_ID with AWS credentials for auto lookup.'
+      );
+    }
+
+    log.info(`Looking up public IP for instance ${instanceId}...`);
+
+    /** @type {Record<string, string>} */
+    const awsEnv = { ...process.env };
+    if (env.AWS_ACCESS_KEY_ID) awsEnv.AWS_ACCESS_KEY_ID = env.AWS_ACCESS_KEY_ID;
+    if (env.AWS_SECRET_ACCESS_KEY) awsEnv.AWS_SECRET_ACCESS_KEY = env.AWS_SECRET_ACCESS_KEY;
+    awsEnv.AWS_DEFAULT_REGION = region;
+
+    try {
+      const { stdout } = await execa(
+        'aws',
+        [
+          'ec2',
+          'describe-instances',
+          '--instance-ids',
+          instanceId,
+          '--query',
+          'Reservations[0].Instances[0].PublicIpAddress',
+          '--output',
+          'text',
+          '--region',
+          region,
+        ],
+        { stdio: 'pipe', env: awsEnv }
+      );
+      const publicIp = stdout.trim();
+      if (!publicIp || publicIp === 'None') {
+        throw new Error('No public IP returned');
+      }
+      log.info(`Resolved EC2 host: ${publicIp}`);
+      return publicIp;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(
+        `Could not resolve public IP for ${instanceId} — ${msg}. Set SSH_HOST manually or install/configure AWS CLI with ec2:DescribeInstances access.`
+      );
+    }
+  }
+
+  const sshProvider = createSshProvider(config, envName, env);
+
+  async function connect() {
+    const host = await resolveHost();
+    const environment = config.environments[envName];
+    if (environment && !environment.host) {
+      environment.host = host;
+    }
+    if (!env.SSH_HOST) {
+      env.SSH_HOST = host;
+    }
+    return sshProvider.connect();
+  }
+
+  return {
+    ...sshProvider,
+    connect,
+    deploy: sshProvider.deploy.bind(sshProvider),
+    rollback: sshProvider.rollback.bind(sshProvider),
+    healthCheck: sshProvider.healthCheck.bind(sshProvider),
+    testConnection: async () => {
+      const ssh = await connect();
+      ssh.dispose();
+    },
+  };
 }
 
 export default { createEc2Provider };

package/src/deployment/providers/gcp-vm.js

@@ -1,7 +1,94 @@
+import { execa } from 'execa';
 import { createSshProvider } from './ssh.js';
+import { createLogger } from '../../logger/index.js';
 
-export function createGcpVmProvider(config, envName, env) {
-  return createSshProvider(config, envName, env);
+/**
+ * @param {import('../../core/config.js').DeployHubConfig} config
+ * @param {string} envName
+ * @param {Record<string, string>} [env]
+ */
+export function createGcpVmProvider(config, envName, env = process.env) {
+  const log = createLogger('gcp-vm');
+  const projectId = env.GCP_PROJECT_ID;
+  const zone = env.GCP_ZONE;
+  const instanceName = env.GCP_INSTANCE_NAME;
+
+  async function resolveHost() {
+    const environment = config.environments[envName];
+    if (environment?.host || env.SSH_HOST) {
+      return environment?.host || env.SSH_HOST;
+    }
+
+    if (!projectId || !zone || !instanceName) {
+      throw new Error(
+        'GCP VM host unknown. Set SSH_HOST to your instance external IP, or set GCP_PROJECT_ID, GCP_ZONE, and GCP_INSTANCE_NAME for auto lookup.'
+      );
+    }
+
+    log.info(`Looking up external IP for GCP instance ${instanceName}...`);
+
+    /** @type {Record<string, string>} */
+    const gcpEnv = { ...process.env };
+    if (env.GCP_KEY_FILE) {
+      gcpEnv.GOOGLE_APPLICATION_CREDENTIALS = env.GCP_KEY_FILE;
+    }
+
+    try {
+      const { stdout } = await execa(
+        'gcloud',
+        [
+          'compute',
+          'instances',
+          'describe',
+          instanceName,
+          '--zone',
+          zone,
+          '--project',
+          projectId,
+          '--format',
+          'get(networkInterfaces[0].accessConfigs[0].natIP)',
+        ],
+        { stdio: 'pipe', env: gcpEnv }
+      );
+      const publicIp = stdout.trim();
+      if (!publicIp) {
+        throw new Error('No external IP returned');
+      }
+      log.info(`Resolved GCP VM host: ${publicIp}`);
+      return publicIp;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(
+        `Could not resolve external IP for ${instanceName} — ${msg}. Set SSH_HOST manually or run gcloud auth login and verify project/zone/instance name.`
+      );
+    }
+  }
+
+  const sshProvider = createSshProvider(config, envName, env);
+
+  async function connect() {
+    const host = await resolveHost();
+    const environment = config.environments[envName];
+    if (environment && !environment.host) {
+      environment.host = host;
+    }
+    if (!env.SSH_HOST) {
+      env.SSH_HOST = host;
+    }
+    return sshProvider.connect();
+  }
+
+  return {
+    ...sshProvider,
+    connect,
+    deploy: sshProvider.deploy.bind(sshProvider),
+    rollback: sshProvider.rollback.bind(sshProvider),
+    healthCheck: sshProvider.healthCheck.bind(sshProvider),
+    testConnection: async () => {
+      const ssh = await connect();
+      ssh.dispose();
+    },
+  };
 }
 
 export default { createGcpVmProvider };

package/src/deployment/providers/kubernetes.js

@@ -1,27 +1,124 @@
 import { execa } from 'execa';
+import fs from 'fs-extra';
+import path from 'path';
+import os from 'os';
 import { createLogger } from '../../logger/index.js';
 
-export function createKubernetesProvider(config, envName) {
+/**
+ * @param {import('../../core/config.js').DeployHubConfig} config
+ * @param {string} envName
+ * @param {Record<string, string>} [env]
+ */
+export function createKubernetesProvider(config, envName, env = process.env) {
   const log = createLogger('kubernetes');
 
+  const kubeconfig = env.KUBECONFIG || path.join(os.homedir(), '.kube', 'config');
+  const context = env.KUBE_CONTEXT || '';
+  const namespace = env.KUBE_NAMESPACE || config.project || 'default';
+
+  function getKubectlEnv() {
+    const expanded = kubeconfig.replace(/^~/, os.homedir());
+    return { ...process.env, KUBECONFIG: path.resolve(expanded) };
+  }
+
+  /**
+   * @param {string[]} baseArgs
+   */
+  function kubectlArgs(baseArgs) {
+    /** @type {string[]} */
+    const args = [...baseArgs];
+    if (context) args.push('--context', context);
+    if (namespace) args.push('--namespace', namespace);
+    return args;
+  }
+
+  /**
+   * @param {string} artifactDir
+   */
   async function deploy(artifactDir) {
-    log.info('Deploying to Kubernetes...');
-    await execa('kubectl', ['apply', '-f', '.'], {
-      cwd: artifactDir,
+    log.info(`Deploying to Kubernetes (namespace: ${namespace}${context ? `, context: ${context}` : ''})...`);
+
+    const manifestDir = artifactDir;
+    const hasManifests =
+      (await fs.pathExists(path.join(manifestDir, 'k8s'))) ||
+      (await fs.readdir(manifestDir)).some((f) => /\.ya?ml$/.test(f));
+
+    if (!hasManifests) {
+      throw new Error(
+        'No Kubernetes manifests found in artifact. Add .yaml files or a k8s/ directory to your project.'
+      );
+    }
+
+    const applyTarget = (await fs.pathExists(path.join(manifestDir, 'k8s')))
+      ? path.join(manifestDir, 'k8s')
+      : manifestDir;
+
+    await execa('kubectl', kubectlArgs(['apply', '-f', applyTarget]), {
       stdio: 'inherit',
+      env: getKubectlEnv(),
     });
+
+    const imageName = env.DOCKER_IMAGE_NAME;
+    const imageTag = env.DOCKER_IMAGE_TAG || config.version || 'latest';
+    if (imageName && config.project) {
+      await execa(
+        'kubectl',
+        kubectlArgs([
+          'set',
+          'image',
+          `deployment/${config.project}`,
+          `${config.project}=${imageName}:${imageTag}`,
+        ]),
+        { stdio: 'pipe', env: getKubectlEnv() }
+      ).catch(() => {
+        log.warn('kubectl set image skipped (deployment name may differ from project name)');
+      });
+    }
+
+    log.success('Kubernetes deployment complete');
   }
 
   async function rollback(artifactDir) {
-    await deploy(artifactDir);
+    log.info('Rolling back Kubernetes deployment...');
+    await execa('kubectl', kubectlArgs(['rollout', 'undo', `deployment/${config.project}`]), {
+      stdio: 'inherit',
+      env: getKubectlEnv(),
+    }).catch(async () => {
+      log.warn('kubectl rollout undo failed — redeploying previous artifact instead');
+      await deploy(artifactDir);
+    });
   }
 
   async function healthCheck() {
-    return true;
+    const url = config.healthCheck?.url;
+    if (url) {
+      try {
+        const { stdout } = await execa('curl', ['-sf', '-o', '/dev/null', '-w', '%{http_code}', url], {
+          stdio: 'pipe',
+        });
+        return stdout.trim().startsWith('2');
+      } catch {
+        return false;
+      }
+    }
+
+    try {
+      await execa(
+        'kubectl',
+        kubectlArgs(['rollout', 'status', `deployment/${config.project}`, '--timeout=30s']),
+        { stdio: 'pipe', env: getKubectlEnv() }
+      );
+      return true;
+    } catch {
+      return false;
+    }
   }
 
   async function testConnection() {
-    await execa('kubectl', ['cluster-info'], { stdio: 'pipe' });
+    await execa('kubectl', kubectlArgs(['cluster-info']), {
+      stdio: 'pipe',
+      env: getKubectlEnv(),
+    });
   }
 
   return { deploy, rollback, healthCheck, testConnection };

package/src/deployment/providers/ssh.js

@@ -4,6 +4,7 @@ import path from 'path';
 import os from 'os';
 import { createLogger } from '../../logger/index.js';
 import { getNginxSitePath } from '../../utils/nginx.js';
+import { shellQuote, formatRemoteCommandFailure } from '../../utils/shell-quote.js';
 
 /** @type {Set<string>} */
 const NODE_FRAMEWORKS = new Set(['express', 'nestjs', 'fastify', 'koa', 'nextjs', 'node']);
@@ -12,6 +13,8 @@ const PYTHON_FRAMEWORKS = new Set(['fastapi', 'django', 'flask', 'python']);
 /** @type {Set<string>} */
 const PHP_FRAMEWORKS = new Set(['laravel', 'symfony', 'php']);
 
+const sh = shellQuote;
+
 /**
  * @param {import('../../core/config.js').DeployHubConfig} config
  * @param {string} envName
@@ -39,27 +42,44 @@ export function createSshProvider(config, envName, env = process.env) {
   const port = environment.port || config.port || Number(env.SSH_PORT) || 3000;
   const sshKey = env.SSH_KEY;
   const keyPath = environment.keyPath || env.SSH_KEY_PATH;
+  const sshPort = Number(env.SSH_SSH_PORT) || environment.sshPort || 22;
 
   const log = createLogger('ssh');
 
   async function connect() {
     if (!host || !user) {
-      throw new Error('SSH host and user are required. Set SSH_HOST and SSH_USER in .env');
+      throw new Error(
+        'SSH host and user are required. Set SSH_HOST and SSH_USER in .env (see .env.example comments).'
+      );
+    }
+
+    if (!sshKey && !keyPath) {
+      throw new Error(
+        'SSH authentication required. Set SSH_KEY_PATH (local) or SSH_KEY (CI secret) in .env — see .env.example.'
+      );
     }
 
     const ssh = new NodeSSH();
     /** @type {import('node-ssh').SSHConnectOptions} */
-    const connectOpts = { host, username: user };
+    const connectOpts = { host, username: user, port: sshPort };
 
     if (sshKey) {
       const tmpKeyPath = path.join(os.tmpdir(), 'deployhub-ssh-key');
       await fs.writeFile(tmpKeyPath, sshKey, { mode: 0o600 });
       connectOpts.privateKeyPath = tmpKeyPath;
     } else if (keyPath) {
-      connectOpts.privateKeyPath = keyPath;
+      const expanded = keyPath.replace(/^~/, os.homedir());
+      connectOpts.privateKeyPath = path.resolve(expanded);
     }
 
-    await ssh.connect(connectOpts);
+    try {
+      await ssh.connect(connectOpts);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(
+        `SSH connection failed to ${user}@${host}:${sshPort} — ${msg}. Check SSH_HOST, SSH_USER, SSH_KEY_PATH, and that port ${sshPort} is open in your firewall/security group.`
+      );
+    }
     return ssh;
   }
 
@@ -71,7 +91,14 @@ export function createSshProvider(config, envName, env = process.env) {
     log.info(`$ ${command}`);
     const result = await ssh.execCommand(command);
     if (result.code !== 0 && result.code !== null) {
-      log.warn(`Command exited with code ${result.code}: ${result.stderr || result.stdout}`);
+      const message = formatRemoteCommandFailure(
+        command,
+        result.code,
+        result.stderr,
+        result.stdout
+      );
+      log.error(message);
+      throw new Error(message);
     }
     return result;
   }
@@ -106,26 +133,27 @@ export function createSshProvider(config, envName, env = process.env) {
   async function runBackendStartSequence(ssh, targetPath) {
     const framework = resolveFramework();
     const startCommand = resolveStartCommand();
+    const dir = sh(targetPath);
 
     if (NODE_FRAMEWORKS.has(framework)) {
-      await exec(ssh, `cd ${targetPath} && npm install --production`);
+      await exec(ssh, `cd ${dir} && npm install --production`);
       const start = startCommand || 'npm start';
       if (start === 'npm start') {
         await exec(
           ssh,
-          `cd ${targetPath} && pm2 restart ${appName} || pm2 start npm --name "${appName}" -- start`
+          `cd ${dir} && pm2 restart ${sh(appName)} || pm2 start npm --name ${sh(appName)} -- start`
         );
       } else if (start.startsWith('npm run ')) {
         const script = start.replace('npm run ', '');
         await exec(
           ssh,
-          `cd ${targetPath} && pm2 restart ${appName} || pm2 start npm --name "${appName}" -- run ${script}`
+          `cd ${dir} && pm2 restart ${sh(appName)} || pm2 start npm --name ${sh(appName)} -- run ${script}`
         );
       } else {
         const [cmd, ...args] = start.split(' ');
         await exec(
           ssh,
-          `cd ${targetPath} && pm2 restart ${appName} || pm2 start ${cmd} --name "${appName}" -- ${args.join(' ')}`
+          `cd ${dir} && pm2 restart ${sh(appName)} || pm2 start ${cmd} --name ${sh(appName)} -- ${args.join(' ')}`
         );
       }
       await exec(ssh, 'pm2 save');
@@ -133,15 +161,15 @@ export function createSshProvider(config, envName, env = process.env) {
     }
 
     if (PYTHON_FRAMEWORKS.has(framework)) {
-      await exec(ssh, `cd ${targetPath} && pip install -r requirements.txt`);
+      await exec(ssh, `cd ${dir} && pip install -r requirements.txt`);
       if (framework === 'django') {
-        await exec(ssh, `cd ${targetPath} && python manage.py migrate`);
+        await exec(ssh, `cd ${dir} && python manage.py migrate`);
       }
       if (framework === 'fastapi') {
         await exec(ssh, 'pkill uvicorn || true');
         await exec(
           ssh,
-          `cd ${targetPath} && nohup uvicorn main:app --host 0.0.0.0 --port ${port} > app.log 2>&1 &`
+          `cd ${dir} && nohup uvicorn main:app --host 0.0.0.0 --port ${port} > app.log 2>&1 &`
         );
       } else {
         await exec(ssh, 'pkill gunicorn || true');
@@ -149,17 +177,17 @@ export function createSshProvider(config, envName, env = process.env) {
           framework === 'django' ? 'config.wsgi:application' : 'app:app';
         await exec(
           ssh,
-          `cd ${targetPath} && nohup gunicorn ${appTarget} --bind 0.0.0.0:${port} --daemon`
+          `cd ${dir} && nohup gunicorn ${appTarget} --bind 0.0.0.0:${port} --daemon`
         );
       }
       return;
     }
 
     if (PHP_FRAMEWORKS.has(framework)) {
-      await exec(ssh, `cd ${targetPath} && composer install --no-dev`);
+      await exec(ssh, `cd ${dir} && composer install --no-dev`);
       if (framework === 'laravel') {
-        await exec(ssh, `cd ${targetPath} && php artisan migrate --force`);
-        await exec(ssh, `cd ${targetPath} && php artisan config:cache`);
+        await exec(ssh, `cd ${dir} && php artisan migrate --force`);
+        await exec(ssh, `cd ${dir} && php artisan config:cache`);
       }
       await exec(ssh, 'sudo systemctl restart php8.2-fpm');
       await exec(ssh, 'sudo systemctl reload nginx');
@@ -167,47 +195,47 @@ export function createSshProvider(config, envName, env = process.env) {
     }
 
     if (framework === 'spring' || framework === 'java') {
-      await exec(ssh, `cd ${targetPath} && pkill -f "*.jar" || true`);
+      await exec(ssh, `cd ${dir} && pkill -f "*.jar" || true`);
       await exec(
         ssh,
-        `cd ${targetPath} && nohup java -jar target/*.jar > app.log 2>&1 &`
+        `cd ${dir} && nohup java -jar target/*.jar > app.log 2>&1 &`
       );
       return;
     }
 
     if (framework === 'go') {
-      await exec(ssh, `cd ${targetPath} && pkill ${appName} || true`);
+      await exec(ssh, `cd ${dir} && pkill ${sh(appName)} || true`);
       await exec(
         ssh,
-        `cd ${targetPath} && nohup ./bin/app > app.log 2>&1 &`
+        `cd ${dir} && nohup ./bin/app > app.log 2>&1 &`
       );
       return;
     }
 
     if (framework === 'dotnet') {
-      await exec(ssh, `cd ${targetPath} && pkill -f "dotnet" || true`);
+      await exec(ssh, `cd ${dir} && pkill -f "dotnet" || true`);
       const dll = startCommand?.replace('dotnet ', '') || 'App.dll';
       await exec(
         ssh,
-        `cd ${targetPath} && nohup dotnet ${dll} > app.log 2>&1 &`
+        `cd ${dir} && nohup dotnet ${dll} > app.log 2>&1 &`
       );
       return;
     }
 
     if (framework === 'rails') {
-      await exec(ssh, `cd ${targetPath} && bundle install --deployment`);
-      await exec(ssh, `cd ${targetPath} && pkill puma || true`);
+      await exec(ssh, `cd ${dir} && bundle install --deployment`);
+      await exec(ssh, `cd ${dir} && pkill puma || true`);
       await exec(
         ssh,
-        `cd ${targetPath} && nohup bundle exec puma -p ${port} > app.log 2>&1 &`
+        `cd ${dir} && nohup bundle exec puma -p ${port} > app.log 2>&1 &`
       );
       return;
     }
 
-    await exec(ssh, `cd ${targetPath} && npm install --production`);
+    await exec(ssh, `cd ${dir} && npm install --production`);
     await exec(
       ssh,
-      `cd ${targetPath} && pm2 restart ${appName} || pm2 start npm --name "${appName}" -- start`
+      `cd ${dir} && pm2 restart ${sh(appName)} || pm2 start npm --name ${sh(appName)} -- start`
     );
     await exec(ssh, 'pm2 save');
   }
@@ -222,11 +250,11 @@ export function createSshProvider(config, envName, env = process.env) {
 
     await exec(
       ssh,
-      `sudo cp ${nginxConfRemote} ${sitePath} 2>/dev/null || sudo cp ${targetPath}/nginx.conf ${sitePath}`
+      `sudo cp ${sh(nginxConfRemote)} ${sh(sitePath)} 2>/dev/null || sudo cp ${sh(`${targetPath}/nginx.conf`)} ${sh(sitePath)}`
     );
     await exec(
       ssh,
-      `sudo ln -sf ${sitePath} /etc/nginx/sites-enabled/${path.basename(sitePath)}`
+      `sudo ln -sf ${sh(sitePath)} ${sh(`/etc/nginx/sites-enabled/${path.basename(sitePath)}`)}`
     );
     await exec(ssh, 'sudo nginx -t');
     await exec(ssh, 'sudo systemctl reload nginx');
@@ -238,8 +266,8 @@ export function createSshProvider(config, envName, env = process.env) {
    * @param {string} targetPath
    */
   async function extractToPath(ssh, remoteZip, targetPath) {
-    await exec(ssh, `mkdir -p ${targetPath}`);
-    await exec(ssh, `unzip -o ${remoteZip} -d ${targetPath}`);
+    await exec(ssh, `mkdir -p ${sh(targetPath)}`);
+    await exec(ssh, `unzip -o ${sh(remoteZip)} -d ${sh(targetPath)}`);
   }
 
   /**
@@ -259,19 +287,19 @@ export function createSshProvider(config, envName, env = process.env) {
 
       if (projectType === 'both') {
         const remoteStaging = `/tmp/deployhub-staging-${Date.now()}`;
-        await exec(ssh, `mkdir -p ${remoteStaging}`);
-        await exec(ssh, `unzip -o ${remoteZip} -d ${remoteStaging}`);
+        await exec(ssh, `mkdir -p ${sh(remoteStaging)}`);
+        await exec(ssh, `unzip -o ${sh(remoteZip)} -d ${sh(remoteStaging)}`);
 
-        await exec(ssh, `mkdir -p ${frontendDeployPath}`);
+        await exec(ssh, `mkdir -p ${sh(frontendDeployPath)}`);
         await exec(
           ssh,
-          `rsync -a ${remoteStaging}/ ${frontendDeployPath}/ --exclude backend || cp -r ${remoteStaging}/* ${frontendDeployPath}/`
+          `rsync -a ${sh(remoteStaging)}/ ${sh(frontendDeployPath)}/ --exclude backend || cp -r ${sh(remoteStaging)}/* ${sh(frontendDeployPath)}/`
         );
 
-        await exec(ssh, `mkdir -p ${backendDeployPath}`);
+        await exec(ssh, `mkdir -p ${sh(backendDeployPath)}`);
         await exec(
           ssh,
-          `rsync -a ${remoteStaging}/backend/ ${backendDeployPath}/ || cp -r ${remoteStaging}/backend/* ${backendDeployPath}/`
+          `rsync -a ${sh(remoteStaging)}/backend/ ${sh(backendDeployPath)}/ || cp -r ${sh(remoteStaging)}/backend/* ${sh(backendDeployPath)}/`
         );
 
         if (await remoteFileExists(ssh, `${frontendDeployPath}/nginx.conf`)) {
@@ -279,7 +307,7 @@ export function createSshProvider(config, envName, env = process.env) {
         }
 
         await runBackendStartSequence(ssh, backendDeployPath);
-        await exec(ssh, `rm -rf ${remoteStaging}`);
+        await exec(ssh, `rm -rf ${sh(remoteStaging)}`);
       } else if (projectType === 'backend') {
         log.info(`Backend deploy path: ${deployPath}`);
         await extractToPath(ssh, remoteZip, deployPath);
@@ -296,7 +324,7 @@ export function createSshProvider(config, envName, env = process.env) {
         }
       }
 
-      await exec(ssh, `rm -f ${remoteZip}`);
+      await exec(ssh, `rm -f ${sh(remoteZip)}`);
       log.success('Deployment complete');
     } finally {
       ssh.dispose();
@@ -308,8 +336,8 @@ export function createSshProvider(config, envName, env = process.env) {
    * @param {string} remotePath
    */
   async function remoteFileExists(ssh, remotePath) {
-    const result = await ssh.execCommand(`test -f ${remotePath} && echo yes`);
-    return result.stdout.trim() === 'yes';
+    const result = await ssh.execCommand(`test -f ${sh(remotePath)} && echo yes`);
+    return result.code === 0 && result.stdout.trim() === 'yes';
   }
 
   async function rollback(artifactDir) {
@@ -322,7 +350,7 @@ export function createSshProvider(config, envName, env = process.env) {
 
     const ssh = await connect();
     try {
-      const result = await ssh.execCommand(`curl -sf -o /dev/null -w "%{http_code}" "${url}"`);
+      const result = await ssh.execCommand(`curl -sf -o /dev/null -w "%{http_code}" ${sh(url)}`);
       return result.stdout.trim().startsWith('2');
     } finally {
       ssh.dispose();