@akash-chowdhury-24/deployhub 2.0.13 → 2.0.15

package/README.md

@@ -86,7 +86,7 @@ This interactive wizard will:
 - Set up storage providers (AWS, Google Drive, Azure, GCP, Dropbox, Local)
 - Optionally configure deployment targets (SSH, Docker, EC2, Azure VM, GCP VM, Kubernetes)
 - Generate `deployhub.config.json`
-- Generate `.github/workflows/deployhub.yml`
+- Generate `.github/workflows/deployhub.yml` and `.github/workflows/deployhub-rollback.yml`
 - Generate `.env.example`
 
 ### 2. Configure credentials
@@ -182,7 +182,8 @@ The wizard asks the same core questions for every setup:
 **Generated files:**
 
 - `deployhub.config.json` — project settings (no secrets)
-- `.github/workflows/deployhub.yml` — CI pipeline
+- `.github/workflows/deployhub.yml` — CI deploy pipeline (push to main)
+- `.github/workflows/deployhub-rollback.yml` — manual CI rollback (`workflow_dispatch`)
 - `.env.example` — list of env vars you may need
 - `nginx.conf` — auto-generated if frontend deploys to SSH
 - `Dockerfile` — auto-generated if missing and you chose Docker or Kubernetes deploy (your existing `Dockerfile` is never overwritten)
@@ -231,9 +232,25 @@ deployhub artifact restore <buildId> # download a past build
 deployhub deploy                     # deploy latest artifact without rebuilding
 deployhub rollback                   # previous build from history
 deployhub rollback <buildId>         # exact build (required if semver is ambiguous)
+deployhub sync-workflows             # regenerate deploy + rollback GitHub Actions YAML
+deployhub sync-k8s-ports             # fix containerPort/targetPort in existing k8s manifests
 deployhub logs                       # last deployment logs
 ```
 
+### Rollback behavior
+
+`deployhub rollback` restores a previous artifact from storage `history.json` and redeploys it:
+
+| Argument | Behavior |
+|----------|----------|
+| *(none)* | Rolls back to the **previous** build (second entry in newest-first history) |
+| Exact `buildId` | Rolls back to that specific build |
+| Semver / version string matching **multiple** builds | Does **not** guess — prints the matching `buildId`s and exits; re-run with an exact one |
+
+`buildId` looks like `{semver}-{stamp}` where the stamp is a short git SHA when available, otherwise a CI run id, otherwise a high-resolution timestamp. When `DOCKER_IMAGE_TAG` is left unset, Docker and Kubernetes use that same `buildId` as the image tag — so you can correlate an artifact in storage with the image that was pushed.
+
+For CI-triggered rollback, see [CI rollback](#ci-rollback-deployhub-rollbackyml).
+
 ---
 
 ## Walkthrough: Storage only
@@ -555,17 +572,27 @@ All JS frontends share the same install/build flow: `npm ci` → `npm run build`
 After `init`, commit these files:
 
 ```bash
-git add deployhub.config.json .github/workflows/deployhub.yml .env.example
+git add deployhub.config.json .github/workflows/deployhub.yml .github/workflows/deployhub-rollback.yml .env.example
 git commit -m "Add DeployHub CI"
 ```
 
 1. Open **Settings → Secrets and variables → Actions** in your GitHub repo.
 2. Add every secret listed at the end of `deployhub init` (storage + deployment).
-3. Push to `main` or `master` — the workflow triggers on push.
+3. Push to `main` or `master` — the deploy workflow triggers on push.
+
+The deploy workflow (`deployhub.yml`) installs the correct language runtime (Node, Python, Java, Go, .NET, Ruby) based on your `deployhub.config.json`, installs DeployHub, runs `deployhub build`, and uses your secrets.
+
+To run a deploy manually: **Actions → DeployHub → Run workflow**.
+
+### CI rollback (`deployhub-rollback.yml`)
 
-The workflow installs the correct language runtime (Node, Python, Java, Go, .NET, Ruby) based on your `deployhub.config.json`, installs DeployHub, runs `deployhub build`, and uses your secrets.
+`init` also generates a separate **DeployHub Rollback** workflow (`deployhub-rollback.yml`). It is triggered only via GitHub Actions' **Run workflow** button (not on push):
 
-To run manually: **Actions → DeployHub → Run workflow**.
+1. Open **Actions → DeployHub Rollback → Run workflow**.
+2. Optionally enter an exact `buildId` (leave blank to roll back to the previous build).
+3. Run the workflow.
+
+Already-initialized projects that only have `deployhub.yml` will not get the rollback workflow from a re-run of unrelated commands — run **`deployhub sync-workflows`** once to regenerate both workflow files from your current `deployhub.config.json`, then commit and push.
 
 ---
 
@@ -648,6 +675,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### SSH
 
+**Verification:** Real-world verified DEPLOY and ROLLBACK.
+
 **Prerequisites (before `deployhub init`):**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (deploy path ownership + Nginx/sudo for frontends)
 - [ ] A Linux server with SSH enabled
@@ -687,7 +716,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Docker
 
-**Verification:** Real-world verified (local and CI Docker deploys).
+**Verification:** Real-world verified DEPLOY and ROLLBACK (local and CI).
 
 **Prerequisites:**
 - [ ] Docker installed (`docker --version` works)
@@ -722,6 +751,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### AWS EC2
 
+**Verification:** Real-world verified DEPLOY and ROLLBACK.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (`ec2-user` on Amazon Linux)
 - [ ] EC2 instance launched in AWS Console (DeployHub does not create it)
@@ -758,6 +789,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Azure VM
 
+**Verification:** Real-world verified DEPLOY. Rollback logic confirmed via shared-SSH-path audit; not yet live-tested independently.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (`azureuser` or your VM login user)
 - [ ] Azure VM created in Portal (DeployHub does not provision it)
@@ -792,6 +825,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### GCP VM
 
+**Verification:** Real-world verified DEPLOY. Rollback logic confirmed via shared-SSH-path audit; not yet live-tested independently.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (your GCP SSH username)
 - [ ] Compute Engine VM created (DeployHub does not create it)
@@ -832,7 +867,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Kubernetes
 
-**Verification:** Real-world verified (including k3s and CI deploys).
+**Verification:** Real-world verified DEPLOY and ROLLBACK (including k3s and CI).
 
 **Prerequisites:**
 - [ ] Existing Kubernetes cluster (DeployHub does not provision clusters)
@@ -868,7 +903,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 6. Add GitHub Secrets for CI (see table — **`KUBECONFIG` must be the file contents, not a path**)
 7. Run `deployhub doctor`, then `git push origin main`
 
-> **Warning — Service `targetPort`:** the default `targetPort` in generated `k8s/service.yaml` may not match your app's actual exposed port (e.g. a static nginx image serves on port **80**, not the config's default like 3000). Verify and adjust `k8s/service.yaml`'s `targetPort` (and the Deployment `containerPort` if needed) before your first deploy.
+> **Ports in generated Kubernetes manifests:** `containerPort` and `targetPort` are derived from your project's Dockerfile `EXPOSE` line (frontend / nginx images correctly get **80**; backends get their real exposed port). If no Dockerfile or usable `EXPOSE` exists yet, DeployHub falls back to a per-project-type default that matches its Dockerfile templates. Fresh `init` does **not** require a manual port edit. The Service's external `port:` stays **80** for all project types by design (Ingress-friendly); only the internal `targetPort` / `containerPort` track the container. Already-initialized projects with stale `3000` values can run `deployhub sync-k8s-ports` to patch just those fields.
 
 | Variable | Description | Example | Where to get it |
 |----------|-------------|---------|-----------------|
@@ -961,8 +996,10 @@ Run `deployhub doctor` after any config change.
 | `deployhub storage list` | List storage providers and connection status |
 | `deployhub deploy` | Deploy latest artifact |
 | `deployhub rollback [buildId\|semver]` | Previous build, or exact buildId (ambiguous semver lists matches and exits) |
+| `deployhub sync-workflows` | Regenerate `.github/workflows/deployhub.yml` and `deployhub-rollback.yml` from config |
+| `deployhub sync-k8s-ports` | Update only `containerPort` / `targetPort` in `k8s/deployment.yaml` and `k8s/service.yaml` from Dockerfile `EXPOSE` (or config/fallback). Does **not** change replicas, resources, env, or probes. Heavily customized / multi-container manifests may need a manual review |
 | `deployhub logs` | Show logs from last deployment |
-| `deployhub doctor` | Pre-flight checks |
+| `deployhub doctor` | Pre-flight checks (including an informational warning if the rollback workflow file is missing) |
 | `deployhub verify` | Health check on configured endpoint |
 | `deployhub clean` | Remove old local artifacts |
 | `deployhub update` | Check for CLI updates |
@@ -1009,6 +1046,8 @@ Add these secrets in your repository (Settings → Secrets and variables → Act
 | `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_HOST` | Docker deployment (`DOCKER_IMAGE_TAG` optional) |
 | `KUBECONFIG`, `KUBE_CONTEXT`, `KUBE_NAMESPACE`, `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_IMAGE_TAG`, `KUBE_IMAGE_PULL_SECRET` | Kubernetes — **`KUBECONFIG` in GitHub Secrets must be the kubeconfig file contents (or base64), not a filesystem path**. `DOCKER_IMAGE_TAG`, `KUBE_NAMESPACE`, `DOCKER_REGISTRY_URL`, and `KUBE_IMAGE_PULL_SECRET` are optional |
 
+**Kubernetes rollback vs deploy — registry credentials:** Kubernetes **rollback** specifically **requires** `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_TOKEN`. Rollback rebuilds and must push a fresh image tagged with the restored `buildId`; without registry credentials it fails loudly and early (a rollback that cannot push can never succeed against a real cluster). This is stricter than a normal Kubernetes **deploy**, which may still allow local-only / no-push flows in some setups. If deploy worked without those secrets but rollback fails asking for them, that asymmetry is intentional.
+
 See [Deployment method guides](#deployment-method-guides) for full per-method variable tables with examples.
 
 ## `deployhub doctor` Output
@@ -1025,11 +1064,14 @@ The doctor command runs independent checks and always completes without crashing
   Checking Health endpoint...   ✓ URL reachable (HTTP 200)
   Checking Secrets...           ✓ All required env vars present
   Checking GitHub Actions...    ✓ Workflow file exists at .github/workflows/deployhub.yml
+  Checking Rollback workflow... ✓ Missing .github/workflows/deployhub-rollback.yml — run deployhub sync-workflows to add CI rollback (workflow_dispatch)
   Checking Storage write...     ✓ Test upload succeeded
 
-  ✓ Ready to deploy (10/10 checks passed)
+  ✓ Ready to deploy (11/11 checks passed)
 ```
 
+The **Rollback workflow** check is informational and non-blocking (`✓` even when the file is missing). It suggests `deployhub sync-workflows` so already-initialized projects can pick up `deployhub-rollback.yml` without a full re-init. When the file exists, the message confirms the path instead.
+
 If checks fail:
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/cli/index.js

@@ -13,6 +13,8 @@ import { registerDoctorCommand } from '../commands/doctor.js';
 import { registerVerifyCommand } from '../commands/verify.js';
 import { registerCleanCommand } from '../commands/clean.js';
 import { registerUpdateCommand } from '../commands/update.js';
+import { registerSyncWorkflowsCommand } from '../commands/sync-workflows.js';
+import { registerSyncK8sPortsCommand } from '../commands/sync-k8s-ports.js';
 import { formatVersionOutput, printBanner, shouldShowBanner } from '../utils/author.js';
 
 loadEnv();
@@ -41,5 +43,7 @@ registerDoctorCommand(program);
 registerVerifyCommand(program);
 registerCleanCommand(program);
 registerUpdateCommand(program);
+registerSyncWorkflowsCommand(program);
+registerSyncK8sPortsCommand(program);
 
 program.parse();

package/src/commands/artifact.js

@@ -55,10 +55,21 @@ export function registerArtifactCommand(program) {
       if (opts.remote) {
         console.log(chalk.bold('\nRemote history (storage):\n'));
         try {
-          const history = await loadArtifactHistory(config.storage || [], config.project);
+          const { entries: history, source } = await loadArtifactHistory(
+            config.storage || [],
+            config.project
+          );
           if (history.length === 0) {
-            console.log(chalk.yellow('  (no history.json found)'));
+            console.log(
+              chalk.yellow(
+                '  No artifact history found for this project — you may not have deployed any builds yet.'
+              )
+            );
           } else {
+            if (source) {
+              console.log(chalk.gray(`  Source: ${source}`));
+              console.log('');
+            }
             for (const e of history) {
               console.log(
                 `  ${chalk.cyan(e.buildId)}  semver=${e.semver}  ${e.uploadedAt || ''}`
@@ -67,11 +78,8 @@ export function registerArtifactCommand(program) {
             }
           }
         } catch (err) {
-          console.log(
-            chalk.yellow(
-              `  Could not load remote history: ${err instanceof Error ? err.message : String(err)}`
-            )
-          );
+          const detail = err instanceof Error ? err.message : String(err);
+          console.log(chalk.red(`  ${detail}`));
         }
       }
 
@@ -101,8 +109,8 @@ export function registerArtifactCommand(program) {
 
       const history = await loadArtifactHistory(config.storage || [], config.project);
       const histMatch =
-        history.find((e) => e.buildId === needle || e.buildId === versionOrBuildId) ||
-        history.find((e) => e.semver === needle);
+        history.entries.find((e) => e.buildId === needle || e.buildId === versionOrBuildId) ||
+        history.entries.find((e) => e.semver === needle);
 
       const restoreDir = path.join(cwd, '.deployhub-restore', `v${needle}`);
       await fs.ensureDir(restoreDir);

package/src/commands/doctor.js

@@ -7,7 +7,7 @@ import axios from 'axios';
 import { loadConfig, loadEnv } from '../core/config.js';
 import { testProvider } from '../storage/index.js';
 import { getDeploymentProvider } from '../deployment/index.js';
-import { PROVIDER_ENV_MAP } from '../utils/github-actions.js';
+import { PROVIDER_ENV_MAP, getRollbackWorkflowDoctorCheck } from '../utils/github-actions.js';
 import { printDoctorFooter } from '../utils/author.js';
 import { createLocalProvider } from '../storage/providers/local.js';
 import {
@@ -888,11 +888,28 @@ export function registerDoctorCommand(program) {
           return {
             name: 'GitHub Actions',
             pass: false,
-            message: 'Workflow file missing — run deployhub init',
+            message: 'Workflow file missing — run deployhub init or deployhub sync-workflows',
           };
         })
       );
 
+      const hasStorage = (config.storage || []).length > 0;
+      const hasDeploy = (config.deploy || []).length > 0;
+      if (hasStorage && hasDeploy) {
+        results.push(
+          await runCheck('Rollback workflow', async () => {
+            const check = await getRollbackWorkflowDoctorCheck(cwd, config);
+            return (
+              check || {
+                name: 'Rollback workflow',
+                pass: true,
+                message: 'Skipped',
+              }
+            );
+          })
+        );
+      }
+
       results.push(
         await runCheck('Storage write', async () => {
           const provider = createLocalProvider();

package/src/commands/init.js

@@ -535,6 +535,7 @@ export function registerInitCommand(program) {
       console.log(chalk.bold('Generated files:'));
       console.log('  • deployhub.config.json');
       console.log('  • .github/workflows/deployhub.yml');
+      console.log('  • .github/workflows/deployhub-rollback.yml');
       console.log('  • .env.example');
       console.log('');
       printAuthorFooter();

package/src/commands/sync-k8s-ports.js

@@ -0,0 +1,71 @@
+import chalk from 'chalk';
+import { loadConfig, loadEnv } from '../core/config.js';
+import { resolveContainerPort } from '../utils/dockerfile-expose.js';
+import {
+  getDefaultKubernetesManifestPaths,
+  syncKubernetesManifestPorts,
+} from '../utils/kubernetes-manifests.js';
+import fs from 'fs-extra';
+
+/**
+ * Surgically fix containerPort/targetPort in existing k8s manifests from Dockerfile EXPOSE.
+ * @param {import('commander').Command} program
+ */
+export function registerSyncK8sPortsCommand(program) {
+  program
+    .command('sync-k8s-ports')
+    .description(
+      'Update only containerPort/targetPort in k8s/deployment.yaml and k8s/service.yaml ' +
+        'from the Dockerfile EXPOSE port (or config/fallback). Does not change replicas, ' +
+        'resources, env, probes, or Service port. Heavily customized / multi-container ' +
+        'manifests may need a manual review.'
+    )
+    .action(async () => {
+      loadEnv();
+      const cwd = process.cwd();
+      const config = await loadConfig(cwd);
+
+      const { deploymentPath, servicePath } = getDefaultKubernetesManifestPaths(cwd);
+      const hasDeployment = await fs.pathExists(deploymentPath);
+      const hasService = await fs.pathExists(servicePath);
+
+      if (!hasDeployment && !hasService) {
+        console.log(
+          chalk.yellow(
+            'No k8s/deployment.yaml or k8s/service.yaml found — nothing to patch. ' +
+              'Generate starter manifests via deployhub init, or add manifests under ./k8s/.'
+          )
+        );
+        return;
+      }
+
+      const { port, source } = await resolveContainerPort(cwd, config);
+      const result = await syncKubernetesManifestPorts(cwd, port);
+
+      console.log(
+        chalk.green(
+          `✓ Resolved container port ${port} (source: ${source})`
+        )
+      );
+
+      if (result.patched.length === 0) {
+        console.log(chalk.gray('  Port fields already match — no files changed.'));
+      } else {
+        for (const file of result.patched) {
+          console.log(chalk.gray(`  Updated ${file}`));
+        }
+      }
+
+      console.log('');
+      console.log(
+        chalk.yellow(
+          'Note: Only containerPort and targetPort are updated. Replicas, resources, env, ' +
+            'probes, and Service port: are left unchanged. If your manifests are heavily ' +
+            'customized (multiple containers, non-standard field layout), review the diff ' +
+            'manually before deploying.'
+        )
+      );
+    });
+}
+
+export default { registerSyncK8sPortsCommand };

package/src/commands/sync-workflows.js

@@ -0,0 +1,43 @@
+import chalk from 'chalk';
+import { loadConfig, loadEnv } from '../core/config.js';
+import {
+  writeWorkflowFile,
+  DEPLOY_WORKFLOW_FILENAME,
+  ROLLBACK_WORKFLOW_FILENAME,
+} from '../utils/github-actions.js';
+
+/**
+ * Regenerate GitHub Actions workflows from deployhub.config.json (no interactive init).
+ * @param {import('commander').Command} program
+ */
+export function registerSyncWorkflowsCommand(program) {
+  program
+    .command('sync-workflows')
+    .description(
+      'Regenerate .github/workflows/deployhub.yml and deployhub-rollback.yml from deployhub.config.json'
+    )
+    .action(async () => {
+      loadEnv();
+      const cwd = process.cwd();
+      const config = await loadConfig(cwd);
+
+      const storage = config.storage || [];
+      const deploy = config.deploy || [];
+      const environments = config.environments || {};
+      const cliSource = config.cli?.source;
+
+      await writeWorkflowFile(storage, deploy, environments, cwd, cliSource, config);
+
+      console.log(chalk.green('✓ Regenerated GitHub Actions workflows:'));
+      console.log(`  • .github/workflows/${DEPLOY_WORKFLOW_FILENAME}`);
+      console.log(`  • .github/workflows/${ROLLBACK_WORKFLOW_FILENAME}`);
+      console.log('');
+      console.log(
+        chalk.gray(
+          'Commit and push these files, then use Actions → DeployHub Rollback (workflow_dispatch) to roll back.'
+        )
+      );
+    });
+}
+
+export default { registerSyncWorkflowsCommand };

package/src/deployment/index.js

@@ -71,13 +71,14 @@ export async function deployToAll(config, artifactDir, envNames) {
  * @param {import('../core/config.js').DeployHubConfig} config
  * @param {string} artifactDir
  * @param {string[]} [envNames]
+ * @param {{ buildId?: string, semver?: string, remoteKey?: string }} [meta]
  */
-export async function rollbackAll(config, artifactDir, envNames) {
+export async function rollbackAll(config, artifactDir, envNames, meta) {
   const targets = envNames || config.deploy || [];
   for (const envName of targets) {
     const envConfig = config.environments[envName];
     const provider = getDeploymentProvider(envConfig.type, config, envName);
-    await provider.rollback(artifactDir);
+    await provider.rollback(artifactDir, meta);
   }
 }
 

package/src/deployment/providers/azure-vm.js

@@ -21,7 +21,8 @@ export function createAzureVmProvider(config, envName, env = process.env) {
 
     if (!subscriptionId || !resourceGroup || !vmName) {
       throw new Error(
-        'Azure VM host unknown. Set SSH_HOST to your VM public IP, or set AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, and AZURE_VM_NAME for auto lookup.'
+        'Could not resolve host via Azure VM lookup, and no SSH_HOST was set — ' +
+          'provide SSH_HOST (VM public IP/DNS) or set AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, and AZURE_VM_NAME for auto lookup.'
       );
     }
 
@@ -55,34 +56,54 @@ export function createAzureVmProvider(config, envName, env = process.env) {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(
-        `Could not resolve public IP for VM ${vmName} — ${msg}. Set SSH_HOST manually or run az login and verify resource group/VM name.`
+        `Could not resolve host via Azure VM lookup (${vmName}): ${msg}. ` +
+          'Set SSH_HOST to the VM public IP/DNS, or run az login and verify resource group/VM name.'
       );
     }
   }
 
-  const sshProvider = createSshProvider(config, envName, env);
-
-  async function connect() {
+  /**
+   * Resolve host (skipping cloud lookup when SSH_HOST/environment.host is set),
+   * then create an SSH provider that closes over the resolved host.
+   */
+  async function getSshProvider() {
     const host = await resolveHost();
+    if (!host) {
+      throw new Error(
+        'Could not resolve host via Azure VM lookup, and no SSH_HOST was set — provide one or the other.'
+      );
+    }
     const environment = config.environments[envName];
-    if (environment && !environment.host) {
+    if (environment) {
       environment.host = host;
     }
-    if (!env.SSH_HOST) {
-      env.SSH_HOST = host;
-    }
-    return sshProvider.connect();
+    return createSshProvider(config, envName, { ...env, SSH_HOST: host });
   }
 
   return {
-    ...sshProvider,
-    connect,
-    deploy: sshProvider.deploy.bind(sshProvider),
-    rollback: sshProvider.rollback.bind(sshProvider),
-    healthCheck: sshProvider.healthCheck.bind(sshProvider),
-    testConnection: async () => {
-      const ssh = await connect();
-      ssh.dispose();
+    async connect() {
+      const ssh = await getSshProvider();
+      return ssh.connect();
+    },
+    async deploy(artifactDir, options) {
+      const ssh = await getSshProvider();
+      return ssh.deploy(artifactDir, options);
+    },
+    async rollback(artifactDir, meta) {
+      const ssh = await getSshProvider();
+      return ssh.rollback(artifactDir, meta);
+    },
+    async healthCheck() {
+      const ssh = await getSshProvider();
+      return ssh.healthCheck();
+    },
+    async testConnection() {
+      const ssh = await getSshProvider();
+      return ssh.testConnection();
+    },
+    async runRemoteCheck(command) {
+      const ssh = await getSshProvider();
+      return ssh.runRemoteCheck(command);
     },
   };
 }

package/src/deployment/providers/docker.js

@@ -1,6 +1,7 @@
 import { execa } from 'execa';
 import { createLogger } from '../../logger/index.js';
 import { createDockerImageDeployContext } from '../../utils/docker-image-deploy.js';
+import { resolveDockerImageRefForTag } from '../../utils/docker-image.js';
 
 /**
  * @param {import('../../core/config.js').DeployHubConfig} config
@@ -14,12 +15,17 @@ export function createDockerProvider(config, envName, env = process.env) {
 
   /**
    * @param {string} artifactDir
+   * @param {{ fullImage?: string, skipImageReuse?: boolean }} [options]
    */
-  async function deploy(artifactDir) {
-    log.info(`Deploying via Docker (image: ${fullImage})...`);
+  async function deploy(artifactDir, options = {}) {
+    const imageRef = options.fullImage || fullImage;
+    log.info(`Deploying via Docker (image: ${imageRef})...`);
     const dockerEnv = getDockerEnv();
 
-    const result = await ensureImageReadyForDeploy(artifactDir);
+    const result = await ensureImageReadyForDeploy(artifactDir, {
+      fullImage: options.fullImage,
+      skipImageReuse: options.skipImageReuse,
+    });
     if (result.ranCompose) {
       log.success('Docker deployment complete');
       return;
@@ -31,7 +37,7 @@ export function createDockerProvider(config, envName, env = process.env) {
       { stdio: 'pipe', env: dockerEnv }
     ).catch(() => {});
 
-    await execa('docker', ['run', '-d', '--rm', '--name', config.project, fullImage], {
+    await execa('docker', ['run', '-d', '--rm', '--name', config.project, imageRef], {
       stdio: 'inherit',
       env: dockerEnv,
     });
@@ -39,9 +45,25 @@ export function createDockerProvider(config, envName, env = process.env) {
     log.success('Docker deployment complete');
   }
 
-  async function rollback(artifactDir) {
-    log.info('Rolling back Docker deployment (redeploy previous artifact)...');
-    await deploy(artifactDir);
+  /**
+   * @param {string} artifactDir
+   * @param {{ buildId?: string, semver?: string, remoteKey?: string }} [meta]
+   */
+  async function rollback(artifactDir, meta = {}) {
+    if (!meta.buildId) {
+      throw new Error(
+        'Docker rollback requires buildId from the restored artifact history entry'
+      );
+    }
+
+    const rollbackImage = resolveDockerImageRefForTag(config, env, meta.buildId).fullImage;
+    log.info(
+      `Rolling back Docker to buildId=${meta.buildId} (image: ${rollbackImage})...`
+    );
+    await deploy(artifactDir, {
+      fullImage: rollbackImage,
+      skipImageReuse: true,
+    });
   }
 
   async function healthCheck() {