genbox 1.0.63 → 1.0.65

package/dist/commands/rebuild.js

@@ -44,130 +44,344 @@ const ora_1 = __importDefault(require("ora"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const child_process_1 = require("child_process");
 const config_loader_1 = require("../config-loader");
 const profile_resolver_1 = require("../profile-resolver");
 const api_1 = require("../api");
 const genbox_selector_1 = require("../genbox-selector");
 const schema_v4_1 = require("../schema-v4");
 const db_utils_1 = require("../db-utils");
-function getPublicSshKey() {
-    const home = os.homedir();
-    const potentialKeys = [
-        path.join(home, '.ssh', 'id_ed25519.pub'),
-        path.join(home, '.ssh', 'id_rsa.pub'),
-    ];
-    for (const keyPath of potentialKeys) {
-        if (fs.existsSync(keyPath)) {
-            const content = fs.readFileSync(keyPath, 'utf-8').trim();
-            if (content)
-                return content;
-        }
+const utils_1 = require("../utils");
+// ============================================================================
+// SSH Utilities for Soft Rebuild
+// ============================================================================
+function sshExec(ip, keyPath, command, timeoutSecs = 30) {
+    const sshOpts = `-i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=${timeoutSecs}`;
+    try {
+        const result = (0, child_process_1.execSync)(`ssh ${sshOpts} dev@${ip} "${command.replace(/"/g, '\\"')}"`, {
+            encoding: 'utf8',
+            timeout: (timeoutSecs + 10) * 1000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return { success: true, output: result.trim() };
     }
-    throw new Error('No public SSH key found in ~/.ssh/');
-}
-function getPrivateSshKey() {
-    const home = os.homedir();
-    const potentialKeys = [
-        path.join(home, '.ssh', 'id_ed25519'),
-        path.join(home, '.ssh', 'id_rsa'),
-    ];
-    for (const keyPath of potentialKeys) {
-        if (fs.existsSync(keyPath)) {
-            return fs.readFileSync(keyPath, 'utf-8');
-        }
+    catch (error) {
+        const stderr = error.stderr?.toString().trim() || '';
+        const stdout = error.stdout?.toString().trim() || '';
+        return { success: false, output: stdout, error: stderr || error.message };
     }
-    return undefined;
 }
-async function rebuildGenbox(id, payload) {
-    return (0, api_1.fetchApi)(`/genboxes/${id}/rebuild`, {
-        method: 'POST',
-        body: JSON.stringify(payload),
+async function sshExecStream(ip, keyPath, command, options = {}) {
+    return new Promise((resolve) => {
+        const sshArgs = [
+            '-i', keyPath,
+            '-o', 'IdentitiesOnly=yes',
+            '-o', 'StrictHostKeyChecking=no',
+            '-o', 'UserKnownHostsFile=/dev/null',
+            '-o', 'LogLevel=ERROR',
+            '-o', `ConnectTimeout=${options.timeoutSecs || 30}`,
+            `dev@${ip}`,
+            command,
+        ];
+        const child = (0, child_process_1.spawn)('ssh', sshArgs, { stdio: ['pipe', 'pipe', 'pipe'] });
+        child.stdout?.on('data', (data) => {
+            const lines = data.toString().split('\n');
+            for (const line of lines) {
+                if (line.trim() && options.onStdout) {
+                    options.onStdout(line);
+                }
+            }
+        });
+        child.stderr?.on('data', (data) => {
+            const lines = data.toString().split('\n');
+            for (const line of lines) {
+                if (line.trim() && options.onStderr) {
+                    options.onStderr(line);
+                }
+            }
+        });
+        child.on('close', (code) => {
+            resolve({ success: code === 0, code: code || 0 });
+        });
+        child.on('error', () => {
+            resolve({ success: false, code: -1 });
+        });
     });
 }
-/**
- * Parse .env.genbox file into segregated sections
- */
-function parseEnvGenboxSections(content) {
-    const sections = new Map();
-    let currentSection = 'GLOBAL';
-    let currentContent = [];
-    for (const line of content.split('\n')) {
-        const sectionMatch = line.match(/^# === ([^=]+) ===$/);
-        if (sectionMatch) {
-            if (currentContent.length > 0) {
-                sections.set(currentSection, currentContent.join('\n').trim());
-            }
-            currentSection = sectionMatch[1].trim();
-            currentContent = [];
-        }
-        else if (currentSection !== 'END') {
-            currentContent.push(line);
-        }
-    }
-    if (currentContent.length > 0 && currentSection !== 'END') {
-        sections.set(currentSection, currentContent.join('\n').trim());
-    }
-    return sections;
+async function scpUpload(localPath, ip, remotePath, keyPath) {
+    return new Promise((resolve) => {
+        const scpArgs = [
+            '-o', 'StrictHostKeyChecking=no',
+            '-o', 'UserKnownHostsFile=/dev/null',
+            '-o', 'ConnectTimeout=30',
+            '-i', keyPath,
+            localPath,
+            `dev@${ip}:${remotePath}`,
+        ];
+        const child = (0, child_process_1.spawn)('scp', scpArgs, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stderr = '';
+        child.stderr?.on('data', (data) => {
+            stderr += data.toString();
+        });
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve({ success: true });
+            }
+            else {
+                resolve({ success: false, error: stderr.trim() || 'SCP failed' });
+            }
+        });
+        child.on('error', (err) => {
+            resolve({ success: false, error: err.message });
+        });
+    });
 }
-/**
- * Build a map of service URL variables based on connection type
- */
-function buildServiceUrlMap(envVarsFromFile, connectTo) {
-    const urlMap = {};
-    const prefix = connectTo ? `${connectTo.toUpperCase()}_` : 'LOCAL_';
-    const serviceNames = new Set();
-    for (const key of Object.keys(envVarsFromFile)) {
-        const match = key.match(/^(LOCAL|STAGING|PRODUCTION)_(.+_URL)$/);
-        if (match) {
-            serviceNames.add(match[2]);
+async function runSoftRebuild(options) {
+    const { genbox, resolved, config, keyPath, envFiles, snapshotId, snapshotS3Key, gitToken, onStep, onLog } = options;
+    const ip = genbox.ipAddress;
+    const log = (line, type) => {
+        if (onLog) {
+            onLog(line, type);
         }
-    }
-    for (const serviceName of serviceNames) {
-        const prefixedKey = `${prefix}${serviceName}`;
-        const localKey = `LOCAL_${serviceName}`;
-        const value = envVarsFromFile[prefixedKey] || envVarsFromFile[localKey];
-        if (value) {
-            urlMap[serviceName] = value;
+    };
+    try {
+        // Step 1: Stop all services
+        onStep?.('Stopping services...');
+        log('Stopping PM2 processes...', 'dim');
+        await sshExec(ip, keyPath, 'source ~/.nvm/nvm.sh 2>/dev/null; pm2 kill 2>/dev/null || true', 30);
+        // Find and stop docker compose in repo directories
+        for (const repo of resolved.repos) {
+            log(`Stopping Docker Compose in ${repo.path}...`, 'dim');
+            await sshExec(ip, keyPath, `cd ${repo.path} 2>/dev/null && docker compose down 2>/dev/null || true`, 60);
+        }
+        // Step 2: Clean up repo directories
+        onStep?.('Cleaning up repositories...');
+        for (const repo of resolved.repos) {
+            log(`Removing ${repo.path}...`, 'dim');
+            const cleanResult = await sshExec(ip, keyPath, `rm -rf ${repo.path}`, 30);
+            if (!cleanResult.success) {
+                log(`Warning: Failed to clean ${repo.path}: ${cleanResult.error}`, 'error');
+            }
         }
-    }
-    if (!urlMap['API_URL']) {
-        const apiUrl = envVarsFromFile[`${prefix}API_URL`] ||
-            envVarsFromFile['LOCAL_API_URL'] ||
-            envVarsFromFile['STAGING_API_URL'];
-        if (apiUrl) {
-            urlMap['API_URL'] = apiUrl;
+        // Step 3: Clone repositories with correct branches
+        onStep?.('Cloning repositories...');
+        for (const repo of resolved.repos) {
+            const repoUrl = gitToken && repo.url.startsWith('https://')
+                ? repo.url.replace('https://', `https://${gitToken}@`)
+                : repo.url;
+            // Determine branch to checkout
+            const sourceBranch = repo.sourceBranch || repo.branch || 'main';
+            const targetBranch = repo.newBranch || repo.branch || 'main';
+            log(`Cloning ${repo.name} (branch: ${sourceBranch})...`, 'info');
+            // Create parent directory if needed
+            const parentDir = path.dirname(repo.path);
+            await sshExec(ip, keyPath, `mkdir -p ${parentDir}`, 10);
+            // Clone the repo
+            const cloneCmd = `git clone --depth=1 --single-branch --branch ${sourceBranch} '${repoUrl}' ${repo.path}`;
+            const cloneResult = await sshExecStream(ip, keyPath, cloneCmd, {
+                onStdout: (line) => log(line, 'dim'),
+                onStderr: (line) => {
+                    // Git outputs progress to stderr, filter out non-errors
+                    if (!line.includes('Cloning into') && !line.includes('Receiving objects') && !line.includes('Resolving deltas')) {
+                        log(line, 'dim');
+                    }
+                },
+                timeoutSecs: 120,
+            });
+            if (!cloneResult.success) {
+                return { success: false, error: `Failed to clone ${repo.name}` };
+            }
+            // Create new branch if needed
+            if (repo.newBranch && repo.newBranch !== sourceBranch) {
+                log(`Creating new branch: ${repo.newBranch}`, 'info');
+                const branchResult = await sshExec(ip, keyPath, `cd ${repo.path} && git checkout -b ${repo.newBranch}`, 10);
+                if (!branchResult.success) {
+                    log(`Warning: Failed to create branch ${repo.newBranch}: ${branchResult.error}`, 'error');
+                }
+            }
+            log(`✓ Cloned ${repo.name}`, 'success');
+        }
+        // Step 4: Upload and place .env files
+        if (envFiles.length > 0) {
+            onStep?.('Setting up environment files...');
+            // Create staging directory
+            await sshExec(ip, keyPath, 'mkdir -p ~/.env-staging', 10);
+            for (const envFile of envFiles) {
+                log(`Writing ${envFile.stagingName}...`, 'dim');
+                // Write env file content to a temp file locally, then SCP it
+                const tempLocalPath = path.join(os.tmpdir(), `genbox-env-${Date.now()}-${envFile.stagingName}`);
+                fs.writeFileSync(tempLocalPath, envFile.content);
+                const scpResult = await scpUpload(tempLocalPath, ip, `~/.env-staging/${envFile.stagingName}`, keyPath);
+                fs.unlinkSync(tempLocalPath);
+                if (!scpResult.success) {
+                    log(`Warning: Failed to upload ${envFile.stagingName}: ${scpResult.error}`, 'error');
+                    continue;
+                }
+                // Move to final location
+                const parentDir = path.dirname(envFile.remotePath);
+                await sshExec(ip, keyPath, `mkdir -p ${parentDir}`, 10);
+                const moveResult = await sshExec(ip, keyPath, `mv ~/.env-staging/${envFile.stagingName} ${envFile.remotePath}`, 10);
+                if (!moveResult.success) {
+                    log(`Warning: Failed to move ${envFile.stagingName} to ${envFile.remotePath}`, 'error');
+                }
+            }
         }
+        // Step 5: Install dependencies
+        onStep?.('Installing dependencies...');
+        for (const repo of resolved.repos) {
+            // Check for package.json
+            const hasPackageJson = await sshExec(ip, keyPath, `test -f ${repo.path}/package.json && echo yes || echo no`, 10);
+            if (hasPackageJson.output === 'yes') {
+                log(`Installing npm dependencies in ${repo.name}...`, 'info');
+                // Determine package manager (prefer pnpm)
+                const hasPnpmLock = await sshExec(ip, keyPath, `test -f ${repo.path}/pnpm-lock.yaml && echo yes || echo no`, 10);
+                const installCmd = hasPnpmLock.output === 'yes'
+                    ? `cd ${repo.path} && source ~/.nvm/nvm.sh && pnpm install --frozen-lockfile`
+                    : `cd ${repo.path} && source ~/.nvm/nvm.sh && npm install`;
+                const installResult = await sshExecStream(ip, keyPath, installCmd, {
+                    onStdout: (line) => {
+                        if (line.includes('Packages:') || line.includes('added') || line.includes('Done')) {
+                            log(line, 'dim');
+                        }
+                    },
+                    timeoutSecs: 300,
+                });
+                if (!installResult.success) {
+                    log(`Warning: npm install failed in ${repo.name}`, 'error');
+                }
+                else {
+                    log(`✓ Dependencies installed in ${repo.name}`, 'success');
+                }
+            }
+        }
+        // Step 6: Start Docker Compose services
+        onStep?.('Starting Docker services...');
+        for (const repo of resolved.repos) {
+            const hasDockerCompose = await sshExec(ip, keyPath, `test -f ${repo.path}/docker-compose.yml -o -f ${repo.path}/docker-compose.yaml -o -f ${repo.path}/compose.yaml && echo yes || echo no`, 10);
+            if (hasDockerCompose.output === 'yes') {
+                log(`Starting Docker Compose in ${repo.name}...`, 'info');
+                const composeResult = await sshExecStream(ip, keyPath, `cd ${repo.path} && docker compose up -d`, {
+                    onStdout: (line) => log(line, 'dim'),
+                    timeoutSecs: 180,
+                });
+                if (!composeResult.success) {
+                    log(`Warning: Docker Compose failed in ${repo.name}`, 'error');
+                }
+                else {
+                    log(`✓ Docker services started in ${repo.name}`, 'success');
+                }
+            }
+        }
+        // Step 7: Restore database if snapshot provided
+        if (snapshotId && snapshotS3Key) {
+            onStep?.('Restoring database...');
+            log('Fetching database snapshot...', 'info');
+            try {
+                // Get download URL from API
+                const downloadInfo = await (0, api_1.getSnapshotDownloadUrl)(snapshotId);
+                // Download snapshot on the server
+                log('Downloading snapshot to server...', 'dim');
+                const downloadCmd = `curl -sL -o /tmp/db-snapshot.gz '${downloadInfo.downloadUrl}'`;
+                const downloadResult = await sshExecStream(ip, keyPath, downloadCmd, {
+                    timeoutSecs: 300,
+                });
+                if (!downloadResult.success) {
+                    log('Warning: Failed to download database snapshot', 'error');
+                }
+                else {
+                    // Wait for MongoDB to be ready
+                    log('Waiting for MongoDB...', 'dim');
+                    await sshExec(ip, keyPath, `
+            for i in {1..30}; do
+              if docker ps --format '{{.Names}}' | grep -q mongodb; then
+                container=$(docker ps --format '{{.Names}}' | grep mongodb | head -1)
+                if docker exec $container mongosh --quiet --eval "db.runCommand({ping:1})" 2>/dev/null; then
+                  break
+                fi
+              fi
+              sleep 2
+            done
+          `, 120);
+                    // Get MongoDB container name and port
+                    const containerResult = await sshExec(ip, keyPath, "docker ps --format '{{.Names}}' | grep -i mongo | head -1", 10);
+                    const mongoContainer = containerResult.output || 'mongodb';
+                    // Get the MongoDB port
+                    const portResult = await sshExec(ip, keyPath, `docker port ${mongoContainer} 27017 2>/dev/null | cut -d: -f2 || echo 27017`, 10);
+                    const mongoPort = portResult.output.trim() || '27017';
+                    // Restore the database
+                    log('Restoring database from snapshot...', 'info');
+                    const restoreCmd = `mongorestore --host localhost --port ${mongoPort} --archive=/tmp/db-snapshot.gz --gzip --drop`;
+                    const restoreResult = await sshExecStream(ip, keyPath, restoreCmd, {
+                        onStdout: (line) => log(line, 'dim'),
+                        timeoutSecs: 300,
+                    });
+                    if (!restoreResult.success) {
+                        log('Warning: Database restore may have failed (non-zero exit)', 'error');
+                    }
+                    else {
+                        log('✓ Database restored', 'success');
+                    }
+                    // Cleanup
+                    await sshExec(ip, keyPath, 'rm -f /tmp/db-snapshot.gz', 10);
+                }
+            }
+            catch (error) {
+                log(`Warning: Database restore failed: ${error.message}`, 'error');
+            }
+        }
+        // Step 8: Start PM2 services
+        onStep?.('Starting application services...');
+        for (const app of resolved.apps) {
+            const appConfig = config.apps[app.name];
+            if (!appConfig)
+                continue;
+            // Find the repo path for this app
+            const appPath = appConfig.path || app.name;
+            const repoPath = resolved.repos.find(r => r.name === app.name)?.path ||
+                (resolved.repos[0]?.path ? `${resolved.repos[0].path}/${appPath}` : null);
+            if (!repoPath)
+                continue;
+            // Check for PM2 ecosystem file or package.json scripts
+            const hasPm2Config = await sshExec(ip, keyPath, `test -f ${repoPath}/ecosystem.config.js -o -f ${repoPath}/ecosystem.config.cjs && echo yes || echo no`, 10);
+            if (hasPm2Config.output === 'yes') {
+                log(`Starting ${app.name} with PM2...`, 'info');
+                const pm2Result = await sshExecStream(ip, keyPath, `cd ${repoPath} && source ~/.nvm/nvm.sh && pm2 start ecosystem.config.js 2>/dev/null || pm2 start ecosystem.config.cjs`, {
+                    onStdout: (line) => log(line, 'dim'),
+                    timeoutSecs: 60,
+                });
+                if (pm2Result.success) {
+                    log(`✓ Started ${app.name}`, 'success');
+                }
+            }
+            else {
+                // Check for start script in package.json
+                const hasStartScript = await sshExec(ip, keyPath, `grep -q '"start"' ${repoPath}/package.json 2>/dev/null && echo yes || echo no`, 10);
+                if (hasStartScript.output === 'yes') {
+                    log(`Starting ${app.name} with PM2 (npm start)...`, 'info');
+                    const pm2Result = await sshExecStream(ip, keyPath, `cd ${repoPath} && source ~/.nvm/nvm.sh && pm2 start npm --name ${app.name} -- start`, {
+                        onStdout: (line) => log(line, 'dim'),
+                        timeoutSecs: 60,
+                    });
+                    if (pm2Result.success) {
+                        log(`✓ Started ${app.name}`, 'success');
+                    }
+                }
+            }
+        }
+        // Step 9: Save PM2 process list
+        log('Saving PM2 process list...', 'dim');
+        await sshExec(ip, keyPath, 'source ~/.nvm/nvm.sh && pm2 save 2>/dev/null || true', 10);
+        return { success: true };
     }
-    return urlMap;
-}
-/**
- * Build env content for a specific app
- */
-function buildAppEnvContent(sections, appName, serviceUrlMap) {
-    const parts = [];
-    const globalSection = sections.get('GLOBAL');
-    if (globalSection) {
-        parts.push(globalSection);
-    }
-    const appSection = sections.get(appName);
-    if (appSection) {
-        parts.push(appSection);
-    }
-    let envContent = parts.join('\n\n');
-    for (const [varName, value] of Object.entries(serviceUrlMap)) {
-        const pattern = new RegExp(`\\$\\{${varName}\\}`, 'g');
-        envContent = envContent.replace(pattern, value);
+    catch (error) {
+        return { success: false, error: error.message };
     }
-    envContent = envContent
-        .split('\n')
-        .filter(line => {
-        const trimmed = line.trim();
-        return trimmed === '' || trimmed.includes('=') || !trimmed.startsWith('#');
-    })
-        .join('\n')
-        .replace(/\n{3,}/g, '\n\n')
-        .trim();
-    return envContent;
+}
+async function rebuildGenbox(id, payload) {
+    return (0, api_1.fetchApi)(`/genboxes/${id}/rebuild`, {
+        method: 'POST',
+        body: JSON.stringify(payload),
+    });
 }
 /**
  * Build rebuild payload from resolved config
@@ -188,26 +402,15 @@ function buildRebuildPayload(resolved, config, publicKey, privateKey, configLoad
     const envGenboxPath = path.join(process.cwd(), '.env.genbox');
     if (fs.existsSync(envGenboxPath)) {
         const rawEnvContent = fs.readFileSync(envGenboxPath, 'utf-8');
-        const sections = parseEnvGenboxSections(rawEnvContent);
+        const sections = (0, utils_1.parseEnvGenboxSections)(rawEnvContent);
         const globalSection = sections.get('GLOBAL') || '';
-        const envVarsFromFile = {};
-        for (const line of globalSection.split('\n')) {
-            const match = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
-            if (match) {
-                let value = match[2].trim();
-                if ((value.startsWith('"') && value.endsWith('"')) ||
-                    (value.startsWith("'") && value.endsWith("'"))) {
-                    value = value.slice(1, -1);
-                }
-                envVarsFromFile[match[1]] = value;
-            }
-        }
+        const envVarsFromFile = (0, utils_1.parseEnvVarsFromSection)(globalSection);
         let connectTo;
         if (resolved.profile && config.profiles?.[resolved.profile]) {
             const profile = config.profiles[resolved.profile];
             connectTo = (0, config_loader_1.getProfileConnection)(profile);
         }
-        const serviceUrlMap = buildServiceUrlMap(envVarsFromFile, connectTo);
+        const serviceUrlMap = (0, utils_1.buildServiceUrlMap)(envVarsFromFile, connectTo);
         if (connectTo && Object.keys(serviceUrlMap).length > 0) {
             console.log(chalk_1.default.dim(`  Using ${connectTo} URLs for variable expansion`));
         }
@@ -219,7 +422,7 @@ function buildRebuildPayload(resolved, config, publicKey, privateKey, configLoad
             if (servicesSections.length > 0) {
                 for (const serviceSectionName of servicesSections) {
                     const serviceName = serviceSectionName.split('/')[1];
-                    const serviceEnvContent = buildAppEnvContent(sections, serviceSectionName, serviceUrlMap);
+                    const serviceEnvContent = (0, utils_1.buildAppEnvContent)(sections, serviceSectionName, serviceUrlMap);
                     const stagingName = `${app.name}-${serviceName}.env`;
                     const targetPath = `${repoPath}/apps/${serviceName}/.env`;
                     files.push({
@@ -231,7 +434,7 @@ function buildRebuildPayload(resolved, config, publicKey, privateKey, configLoad
                 }
             }
             else {
-                const appEnvContent = buildAppEnvContent(sections, app.name, serviceUrlMap);
+                const appEnvContent = (0, utils_1.buildAppEnvContent)(sections, app.name, serviceUrlMap);
                 files.push({
                     path: `/home/dev/.env-staging/${app.name}.env`,
                     content: appEnvContent,
@@ -253,8 +456,6 @@ function buildRebuildPayload(resolved, config, publicKey, privateKey, configLoad
     // Build repos
     const repos = {};
     for (const repo of resolved.repos) {
-        // DEBUG: Log repo values
-        console.log(chalk_1.default.dim(`  [DEBUG] Repo ${repo.name}: branch=${repo.branch}, newBranch=${repo.newBranch}, sourceBranch=${repo.sourceBranch}`));
         repos[repo.name] = {
             url: repo.url,
             path: repo.path,
@@ -263,6 +464,8 @@ function buildRebuildPayload(resolved, config, publicKey, privateKey, configLoad
             sourceBranch: repo.sourceBranch,
         };
     }
+    // Get local git config for commits
+    const gitConfig = (0, utils_1.getGitConfig)();
     return {
         publicKey,
         services,
@@ -271,110 +474,10 @@ function buildRebuildPayload(resolved, config, publicKey, privateKey, configLoad
         repos,
         privateKey,
         gitToken: envVars.GIT_TOKEN,
+        gitUserName: gitConfig.userName,
+        gitUserEmail: gitConfig.userEmail,
     };
 }
-/**
- * Validate git configuration and warn about missing credentials
- */
-function validateGitCredentials(repos, gitToken, privateKey) {
-    const warnings = [];
-    const errors = [];
-    for (const repo of repos) {
-        const isHttps = repo.url.startsWith('https://');
-        const isSsh = repo.url.startsWith('git@') || repo.url.includes('ssh://');
-        const isPrivateRepo = repo.url.includes('github.com') && !repo.url.includes('/public/');
-        if (isHttps && !gitToken && isPrivateRepo) {
-            warnings.push(`Repository '${repo.name}' uses HTTPS URL but GIT_TOKEN is not set.`);
-            warnings.push(`  Add GIT_TOKEN=<your-github-token> to .env.genbox for private repos.`);
-        }
-        if (isSsh && !privateKey) {
-            warnings.push(`Repository '${repo.name}' uses SSH URL but no SSH key was injected.`);
-        }
-    }
-    return { warnings, errors };
-}
-/**
- * Prompt for branch options interactively
- */
-async function promptForBranchOptions(resolved, config) {
-    // Get the default branch from config or first repo
-    const defaultBranch = config.defaults?.branch || resolved.repos[0]?.branch || 'main';
-    console.log(chalk_1.default.blue('=== Branch Configuration ==='));
-    console.log(chalk_1.default.dim(`Default branch: ${defaultBranch}`));
-    console.log('');
-    const branchChoice = await prompts.select({
-        message: 'Branch option:',
-        choices: [
-            {
-                name: `Use default branch (${defaultBranch})`,
-                value: 'default',
-            },
-            {
-                name: 'Use a different existing branch',
-                value: 'existing',
-            },
-            {
-                name: 'Create a new branch',
-                value: 'new',
-            },
-        ],
-        default: 'default',
-    });
-    if (branchChoice === 'default') {
-        return resolved;
-    }
-    if (branchChoice === 'existing') {
-        const branchName = await prompts.input({
-            message: 'Enter branch name:',
-            default: defaultBranch,
-            validate: (value) => {
-                if (!value.trim())
-                    return 'Branch name is required';
-                return true;
-            },
-        });
-        return {
-            ...resolved,
-            repos: resolved.repos.map(repo => ({
-                ...repo,
-                branch: branchName.trim(),
-                newBranch: undefined,
-                sourceBranch: undefined,
-            })),
-        };
-    }
-    if (branchChoice === 'new') {
-        const newBranchName = await prompts.input({
-            message: 'New branch name:',
-            validate: (value) => {
-                if (!value.trim())
-                    return 'Branch name is required';
-                if (!/^[\w\-./]+$/.test(value))
-                    return 'Invalid branch name (use letters, numbers, -, _, /, .)';
-                return true;
-            },
-        });
-        const sourceBranch = await prompts.input({
-            message: 'Create from branch:',
-            default: defaultBranch,
-            validate: (value) => {
-                if (!value.trim())
-                    return 'Source branch is required';
-                return true;
-            },
-        });
-        return {
-            ...resolved,
-            repos: resolved.repos.map(repo => ({
-                ...repo,
-                branch: newBranchName.trim(),
-                newBranch: newBranchName.trim(),
-                sourceBranch: sourceBranch.trim(),
-            })),
-        };
-    }
-    return resolved;
-}
 exports.rebuildCommand = new commander_1.Command('rebuild')
     .description('Rebuild an existing Genbox environment with updated configuration')
     .argument('[name]', 'Name of the Genbox to rebuild (optional - will prompt if not provided)')
@@ -387,6 +490,7 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
     .option('--db-source <source>', 'Database source for copy mode: staging, production')
     .option('--db-dump <path>', 'Path to existing database dump file')
     .option('-y, --yes', 'Skip interactive prompts')
+    .option('--hard', 'Full rebuild (reinstall OS) instead of soft rebuild')
     .action(async (name, options) => {
     try {
         // Select genbox (interactive if no name provided)
@@ -484,7 +588,7 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
         // Interactive branch selection only if no branch options specified and no stored branch
         // Skip if: -b, -f, -n, stored branch, or -y
         if (!options.branch && !options.fromBranch && !storedBranch && !options.newBranch && !options.yes && resolved.repos.length > 0) {
-            resolved = await promptForBranchOptions(resolved, config);
+            resolved = await (0, utils_1.promptForBranchOptionsRebuild)(resolved, config);
         }
         // Display what will be rebuilt
         console.log(chalk_1.default.bold('Rebuild Configuration:'));
@@ -522,11 +626,20 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
         // Confirm rebuild
         if (!options.yes) {
             console.log('');
-            console.log(chalk_1.default.yellow('Warning: Rebuild will reinstall the OS and rerun setup.'));
-            console.log(chalk_1.default.yellow('All unsaved work on the server will be lost.'));
+            if (options.hard) {
+                console.log(chalk_1.default.yellow('Warning: Hard rebuild will reinstall the OS and rerun setup.'));
+                console.log(chalk_1.default.yellow('All unsaved work on the server will be lost.'));
+            }
+            else {
+                console.log(chalk_1.default.blue('Soft rebuild will:'));
+                console.log(chalk_1.default.dim('  • Stop services (PM2, Docker Compose)'));
+                console.log(chalk_1.default.dim('  • Delete and re-clone repositories'));
+                console.log(chalk_1.default.dim('  • Reinstall dependencies and restart services'));
+                console.log(chalk_1.default.yellow('Note: Uncommitted changes in repos will be lost.'));
+            }
             console.log('');
             const confirm = await prompts.confirm({
-                message: `Rebuild genbox '${selectedName}'?`,
+                message: `${options.hard ? 'Hard rebuild' : 'Rebuild'} genbox '${selectedName}'?`,
                 default: false,
             });
             if (!confirm) {
@@ -535,7 +648,7 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
             }
         }
         // Get SSH keys
-        const publicKey = getPublicSshKey();
+        const publicKey = (0, utils_1.getPublicSshKey)();
         // Check if SSH auth is needed for git
         let privateKeyContent;
         const v3Config = config;
@@ -547,7 +660,7 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
                 default: true,
             });
             if (injectKey) {
-                privateKeyContent = getPrivateSshKey();
+                privateKeyContent = (0, utils_1.getPrivateSshKey)();
                 if (privateKeyContent) {
                     console.log(chalk_1.default.dim('  Using local SSH private key'));
                 }
@@ -674,7 +787,7 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
         }
         // Validate git credentials before rebuilding
         const envVarsForValidation = configLoader.loadEnvVars(process.cwd());
-        const gitValidation = validateGitCredentials(resolved.repos.map(r => ({ url: r.url, name: r.name })), envVarsForValidation.GIT_TOKEN, privateKeyContent);
+        const gitValidation = (0, utils_1.validateGitCredentials)(resolved.repos.map(r => ({ url: r.url, name: r.name })), envVarsForValidation.GIT_TOKEN, privateKeyContent);
         if (gitValidation.warnings.length > 0) {
             console.log('');
             console.log(chalk_1.default.yellow('⚠ Git Authentication Warnings:'));
@@ -698,6 +811,157 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
                 return;
             }
         }
+        // ================================================================
+        // SOFT REBUILD (default)
+        // ================================================================
+        if (!options.hard) {
+            // Verify server is accessible
+            if (!genbox.ipAddress) {
+                console.log(chalk_1.default.red('Error: Genbox has no IP address. It may still be provisioning.'));
+                console.log(chalk_1.default.dim('  Use --hard for a full rebuild, or wait for provisioning to complete.'));
+                return;
+            }
+            // Get SSH key path
+            let sshKeyPath;
+            try {
+                sshKeyPath = (0, utils_1.getPrivateSshKeyPath)();
+            }
+            catch (error) {
+                console.log(chalk_1.default.red(error.message));
+                return;
+            }
+            // Test SSH connection
+            console.log('');
+            console.log(chalk_1.default.dim('Testing SSH connection...'));
+            const testResult = sshExec(genbox.ipAddress, sshKeyPath, 'echo ok', 10);
+            if (!testResult.success || testResult.output !== 'ok') {
+                console.log(chalk_1.default.red('Error: Cannot connect to genbox via SSH.'));
+                console.log(chalk_1.default.dim(`  ${testResult.error || 'Connection failed'}`));
+                console.log(chalk_1.default.dim('  Use --hard for a full rebuild if the server is unresponsive.'));
+                return;
+            }
+            console.log(chalk_1.default.green('✓ SSH connection verified'));
+            // Build env files for soft rebuild
+            const envFilesForSoftRebuild = [];
+            const envGenboxPath = path.join(process.cwd(), '.env.genbox');
+            if (fs.existsSync(envGenboxPath)) {
+                const rawEnvContent = fs.readFileSync(envGenboxPath, 'utf-8');
+                const sections = (0, utils_1.parseEnvGenboxSections)(rawEnvContent);
+                const globalSection = sections.get('GLOBAL') || '';
+                const envVarsFromFile = {};
+                for (const line of globalSection.split('\n')) {
+                    const match = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
+                    if (match) {
+                        let value = match[2].trim();
+                        if ((value.startsWith('"') && value.endsWith('"')) ||
+                            (value.startsWith("'") && value.endsWith("'"))) {
+                            value = value.slice(1, -1);
+                        }
+                        envVarsFromFile[match[1]] = value;
+                    }
+                }
+                let connectTo;
+                if (resolved.profile && config.profiles?.[resolved.profile]) {
+                    const profile = config.profiles[resolved.profile];
+                    connectTo = (0, config_loader_1.getProfileConnection)(profile);
+                }
+                const serviceUrlMap = (0, utils_1.buildServiceUrlMap)(envVarsFromFile, connectTo);
+                for (const app of resolved.apps) {
+                    const appConfig = config.apps[app.name];
+                    const appPath = appConfig?.path || app.name;
+                    const repoPath = resolved.repos.find(r => r.name === app.name)?.path ||
+                        (resolved.repos[0]?.path ? `${resolved.repos[0].path}/${appPath}` : `/home/dev/${config.project.name}/${appPath}`);
+                    const servicesSections = Array.from(sections.keys()).filter(s => s.startsWith(`${app.name}/`));
+                    if (servicesSections.length > 0) {
+                        for (const serviceSectionName of servicesSections) {
+                            const serviceName = serviceSectionName.split('/')[1];
+                            const serviceEnvContent = (0, utils_1.buildAppEnvContent)(sections, serviceSectionName, serviceUrlMap);
+                            envFilesForSoftRebuild.push({
+                                stagingName: `${app.name}-${serviceName}.env`,
+                                remotePath: `${repoPath}/apps/${serviceName}/.env`,
+                                content: serviceEnvContent,
+                            });
+                        }
+                    }
+                    else {
+                        const appEnvContent = (0, utils_1.buildAppEnvContent)(sections, app.name, serviceUrlMap);
+                        envFilesForSoftRebuild.push({
+                            stagingName: `${app.name}.env`,
+                            remotePath: `${repoPath}/.env`,
+                            content: appEnvContent,
+                        });
+                    }
+                }
+            }
+            // Get git token from env
+            const envVars = configLoader.loadEnvVars(process.cwd());
+            // Run soft rebuild
+            console.log('');
+            console.log(chalk_1.default.blue('=== Starting Soft Rebuild ==='));
+            console.log('');
+            let currentStep = '';
+            const rebuildResult = await runSoftRebuild({
+                genbox,
+                resolved,
+                config,
+                keyPath: sshKeyPath,
+                envFiles: envFilesForSoftRebuild,
+                snapshotId,
+                snapshotS3Key,
+                gitToken: envVars.GIT_TOKEN,
+                onStep: (step) => {
+                    currentStep = step;
+                    console.log(chalk_1.default.blue(`\n=== ${step} ===`));
+                },
+                onLog: (line, type) => {
+                    switch (type) {
+                        case 'error':
+                            console.log(chalk_1.default.red(`  ${line}`));
+                            break;
+                        case 'success':
+                            console.log(chalk_1.default.green(`  ${line}`));
+                            break;
+                        case 'info':
+                            console.log(chalk_1.default.cyan(`  ${line}`));
+                            break;
+                        case 'dim':
+                        default:
+                            console.log(chalk_1.default.dim(`  ${line}`));
+                            break;
+                    }
+                },
+            });
+            console.log('');
+            if (rebuildResult.success) {
+                console.log(chalk_1.default.green(`✓ Soft rebuild completed successfully!`));
+                console.log('');
+                console.log(`Run ${chalk_1.default.cyan(`genbox status ${selectedName}`)} to check service status.`);
+            }
+            else {
+                console.log(chalk_1.default.red(`✗ Soft rebuild failed: ${rebuildResult.error}`));
+                console.log(chalk_1.default.dim(`  Failed during: ${currentStep}`));
+                console.log(chalk_1.default.dim(`  Use --hard for a full OS reinstall if needed.`));
+            }
+            // Notify API about the rebuild (for tracking)
+            try {
+                await (0, api_1.fetchApi)(`/genboxes/${genbox._id}/soft-rebuild-completed`, {
+                    method: 'POST',
+                    body: JSON.stringify({
+                        success: rebuildResult.success,
+                        branch: resolved.repos[0]?.branch,
+                        newBranch: resolved.repos[0]?.newBranch,
+                        sourceBranch: resolved.repos[0]?.sourceBranch,
+                    }),
+                });
+            }
+            catch {
+                // Silently ignore API notification failures
+            }
+            return;
+        }
+        // ================================================================
+        // HARD REBUILD (--hard flag)
+        // ================================================================
         // Build payload
         const payload = buildRebuildPayload(resolved, config, publicKey, privateKeyContent, configLoader);
         // Add database info to payload if we have a snapshot
@@ -712,11 +976,11 @@ exports.rebuildCommand = new commander_1.Command('rebuild')
         else if (dbMode === 'local' || dbMode === 'fresh') {
             payload.database = { mode: 'local' };
         }
-        // Execute rebuild
-        const rebuildSpinner = (0, ora_1.default)(`Rebuilding Genbox '${selectedName}'...`).start();
+        // Execute hard rebuild via API
+        const rebuildSpinner = (0, ora_1.default)(`Hard rebuilding Genbox '${selectedName}'...`).start();
         try {
             await rebuildGenbox(genbox._id, payload);
-            rebuildSpinner.succeed(chalk_1.default.green(`Genbox '${selectedName}' rebuild initiated!`));
+            rebuildSpinner.succeed(chalk_1.default.green(`Genbox '${selectedName}' hard rebuild initiated!`));
             console.log('');
             console.log(chalk_1.default.dim('Server is rebuilding. This may take a few minutes.'));
             console.log(chalk_1.default.dim('SSH connection will be temporarily unavailable.'));