thevoidforge 21.0.0

package/dist/wizard/lib/provisioners/self-deploy.js

@@ -0,0 +1,185 @@
+/**
+ * Self-Deploy Provisioner — deploys VoidForge itself to a remote VPS.
+ *
+ * Usage: npx voidforge deploy --self
+ *
+ * Steps:
+ * 1. Connect to VPS via SSH (EC2 or manual target)
+ * 2. Install: Node.js, Git, PM2, Caddy, Claude Code
+ * 3. Clone VoidForge, configure Caddy for HTTPS
+ * 4. Create forge-user (non-root PTY execution)
+ * 5. Generate initial admin credentials + TOTP secret
+ * 6. Start VoidForge as PM2-managed service
+ * 7. Report public URL + TOTP QR setup instructions
+ */
+/** Shell-escape a value to prevent command injection. */
+function shellEscape(value) {
+    // Reject any value containing shell metacharacters
+    if (/[;&|`$(){}\\!#\n\r]/.test(value)) {
+        throw new Error(`Unsafe value for shell interpolation: ${value.slice(0, 20)}...`);
+    }
+    // Wrap in single quotes for extra safety (single quotes prevent all expansion)
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/** Validate a domain name. */
+function isValidDomain(domain) {
+    return /^[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(domain);
+}
+const DEFAULT_CONFIG = {
+    nodeVersion: '22',
+    voidforgeRepo: 'https://github.com/tmcleod3/voidforge.git',
+    voidforgeBranch: 'main',
+};
+/**
+ * Generate the provision script that runs on the remote VPS.
+ * This script is piped over SSH — no files need to exist on the remote first.
+ */
+export function generateProvisionScript(config) {
+    // Validate all inputs before shell interpolation
+    if (!isValidDomain(config.domain)) {
+        throw new Error(`Invalid domain: ${config.domain}`);
+    }
+    const safeDomain = shellEscape(config.domain);
+    const safeRepo = shellEscape(config.voidforgeRepo);
+    const safeBranch = shellEscape(config.voidforgeBranch);
+    const safeNodeVersion = shellEscape(config.nodeVersion);
+    return `#!/bin/bash
+set -euo pipefail
+
+echo "=== VoidForge Self-Deploy ==="
+echo "Domain: ${safeDomain}"
+echo ""
+
+# 1. System packages
+echo "[1/7] Installing system packages..."
+sudo apt-get update -qq
+sudo apt-get install -y -qq curl git build-essential
+
+# 2. Node.js
+echo "[2/7] Installing Node.js ${safeNodeVersion}..."
+if ! command -v node &>/dev/null; then
+  curl -fsSL https://deb.nodesource.com/setup_${safeNodeVersion}.x | sudo -E bash -
+  sudo apt-get install -y -qq nodejs
+fi
+echo "  Node $(node --version)"
+
+# 3. PM2 + Caddy
+echo "[3/7] Installing PM2 and Caddy..."
+sudo npm install -g pm2 2>/dev/null || true
+sudo apt-get install -y -qq debian-keyring debian-archive-keyring apt-transport-https
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg 2>/dev/null || true
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list >/dev/null
+sudo apt-get update -qq
+sudo apt-get install -y -qq caddy
+
+# 4. forge-user (non-root PTY execution)
+echo "[4/7] Creating forge-user..."
+if ! id forge-user &>/dev/null; then
+  sudo useradd -m -s /bin/bash forge-user
+fi
+sudo mkdir -p /home/forge-user/projects
+sudo chown -R forge-user:forge-user /home/forge-user
+
+# 5. Clone VoidForge
+echo "[5/7] Cloning VoidForge..."
+VOIDFORGE_DIR="/opt/voidforge"
+sudo mkdir -p "$VOIDFORGE_DIR"
+sudo chown $(whoami) "$VOIDFORGE_DIR"
+if [ -d "$VOIDFORGE_DIR/.git" ]; then
+  cd "$VOIDFORGE_DIR" && git pull origin ${safeBranch}
+else
+  git clone --branch ${safeBranch} ${safeRepo} "$VOIDFORGE_DIR"
+fi
+cd "$VOIDFORGE_DIR" && npm install --production 2>/dev/null || true
+
+# 6. Caddy config
+echo "[6/7] Configuring Caddy for ${safeDomain}..."
+sudo tee /etc/caddy/Caddyfile > /dev/null << CADDY
+${config.domain} {
+    # Rate limiting on login endpoint
+    @login path /api/auth/login
+    handle @login {
+        reverse_proxy localhost:3141
+    }
+
+    # WebSocket upgrade for terminal
+    @ws {
+        path /ws/terminal
+        header Connection *Upgrade*
+        header Upgrade websocket
+    }
+    handle @ws {
+        reverse_proxy localhost:3141
+    }
+
+    # All other traffic
+    reverse_proxy localhost:3141
+
+    # Security headers (supplementing VoidForge's own headers)
+    header {
+        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+    }
+}
+CADDY
+sudo systemctl reload caddy
+
+# 7. Start VoidForge
+echo "[7/7] Starting VoidForge..."
+cd "$VOIDFORGE_DIR"
+pm2 delete voidforge 2>/dev/null || true
+pm2 start "npx tsx scripts/voidforge.ts init --remote" --name voidforge --cwd "$VOIDFORGE_DIR"
+pm2 save
+
+echo ""
+echo "═══════════════════════════════════════════"
+echo "  VoidForge deployed!"
+echo "═══════════════════════════════════════════"
+echo "  URL: https://${config.domain}"
+echo ""
+echo "  Open the URL above to create your admin"
+echo "  account (username + password + TOTP 2FA)."
+echo "═══════════════════════════════════════════"
+`;
+}
+/**
+ * Generate the Caddy config template for manual setup.
+ * Used when the user wants to configure Caddy themselves.
+ */
+export function generateCaddyTemplate(domain) {
+    return `# VoidForge Avengers Tower Remote — Caddy Configuration
+# Save to /etc/caddy/Caddyfile and run: sudo systemctl reload caddy
+
+${domain} {
+    # Optional: IP allowlist (uncomment and set your IPs)
+    # @blocked not remote_ip <your-ip>/32 <vpn-cidr>/24
+    # respond @blocked 403
+
+    # Rate limiting on login (requires caddy-ratelimit plugin)
+    # rate_limit {
+    #     zone forge_login {
+    #         key {remote_host}
+    #         events 5
+    #         window 1m
+    #     }
+    # }
+
+    # WebSocket upgrade for terminal connections
+    @ws {
+        path /ws/terminal
+        header Connection *Upgrade*
+        header Upgrade websocket
+    }
+    handle @ws {
+        reverse_proxy localhost:3141
+    }
+
+    # All other traffic
+    reverse_proxy localhost:3141
+
+    # HSTS (Caddy auto-provisions TLS certificates)
+    header {
+        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+    }
+}
+`;
+}

package/dist/wizard/lib/provisioners/static-s3.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Static S3 provisioner — creates real S3 bucket configured for static hosting + deploy script.
+ * Reuses the same AWS credentials as the VPS provisioner.
+ */
+import type { Provisioner } from './types.js';
+export declare const staticS3Provisioner: Provisioner;

package/dist/wizard/lib/provisioners/static-s3.js

@@ -0,0 +1,235 @@
+/**
+ * Static S3 provisioner — creates real S3 bucket configured for static hosting + deploy script.
+ * Reuses the same AWS credentials as the VPS provisioner.
+ */
+import { writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { recordResourcePending, recordResourceCreated } from '../provision-manifest.js';
+import { slugify } from './http-client.js';
+import { appendEnvSection } from '../env-writer.js';
+export const staticS3Provisioner = {
+    async validate(ctx) {
+        const errors = [];
+        if (!ctx.projectDir)
+            errors.push('Project directory is required');
+        if (!ctx.credentials['aws-access-key-id'])
+            errors.push('AWS Access Key ID is required');
+        if (!ctx.credentials['aws-secret-access-key'])
+            errors.push('AWS Secret Access Key is required');
+        return errors;
+    },
+    async provision(ctx, emit) {
+        const files = [];
+        const resources = [];
+        const outputs = {};
+        const region = ctx.credentials['aws-region'] || 'us-east-1';
+        const slug = slugify(ctx.projectName);
+        const bucketName = `${slug}-site`;
+        // Dynamic import of AWS SDK
+        let S3Client;
+        let s3Commands;
+        let STSClient;
+        let GetCallerIdentityCommand;
+        try {
+            const s3Mod = await import('@aws-sdk/client-s3');
+            const stsMod = await import('@aws-sdk/client-sts');
+            S3Client = s3Mod.S3Client;
+            s3Commands = s3Mod;
+            STSClient = stsMod.STSClient;
+            GetCallerIdentityCommand = stsMod.GetCallerIdentityCommand;
+        }
+        catch {
+            return {
+                success: false, resources, outputs, files,
+                error: 'AWS SDK not installed. Run: npm install @aws-sdk/client-s3 @aws-sdk/client-sts',
+            };
+        }
+        const awsConfig = {
+            region,
+            credentials: {
+                accessKeyId: ctx.credentials['aws-access-key-id'],
+                secretAccessKey: ctx.credentials['aws-secret-access-key'],
+            },
+        };
+        const s3 = new S3Client(awsConfig);
+        const sts = new STSClient(awsConfig);
+        // Step 1: Validate credentials
+        emit({ step: 'validate-creds', status: 'started', message: 'Validating AWS credentials' });
+        try {
+            const identity = await sts.send(new GetCallerIdentityCommand({}));
+            emit({ step: 'validate-creds', status: 'done', message: `Authenticated as ${identity.Arn}` });
+        }
+        catch (err) {
+            emit({ step: 'validate-creds', status: 'error', message: 'Invalid AWS credentials', detail: err.message });
+            return { success: false, resources, outputs, files, error: 'AWS credential validation failed' };
+        }
+        // Step 2: Create S3 bucket
+        emit({ step: 's3-bucket', status: 'started', message: `Creating S3 bucket "${bucketName}"` });
+        try {
+            await recordResourcePending(ctx.runId, 's3-bucket', bucketName, region);
+            // us-east-1 doesn't accept LocationConstraint
+            const createInput = { Bucket: bucketName };
+            if (region !== 'us-east-1') {
+                createInput.CreateBucketConfiguration = {
+                    LocationConstraint: region, // Cast to enum — SDK accepts any valid region string at runtime
+                };
+            }
+            await s3.send(new s3Commands.CreateBucketCommand(createInput));
+            resources.push({ type: 's3-bucket', id: bucketName, region });
+            await recordResourceCreated(ctx.runId, 's3-bucket', bucketName, region);
+            emit({ step: 's3-bucket', status: 'done', message: `Bucket "${bucketName}" created` });
+        }
+        catch (err) {
+            const msg = err.message || '';
+            if (msg.includes('BucketAlreadyOwnedByYou')) {
+                emit({ step: 's3-bucket', status: 'done', message: `Bucket "${bucketName}" already exists — using it` });
+                resources.push({ type: 's3-bucket', id: bucketName, region });
+                await recordResourceCreated(ctx.runId, 's3-bucket', bucketName, region);
+            }
+            else if (msg.includes('BucketAlreadyExists')) {
+                emit({ step: 's3-bucket', status: 'error', message: `Bucket name "${bucketName}" is taken by another AWS account`, detail: 'Use a more unique project name to generate a different bucket name' });
+                return { success: false, resources, outputs, files, error: `S3 bucket name "${bucketName}" is globally taken` };
+            }
+            else {
+                emit({ step: 's3-bucket', status: 'error', message: 'Failed to create S3 bucket', detail: msg });
+                return { success: false, resources, outputs, files, error: msg };
+            }
+        }
+        // Step 3: Configure bucket for static website hosting
+        emit({ step: 's3-website', status: 'started', message: 'Configuring static website hosting' });
+        try {
+            await s3.send(new s3Commands.PutBucketWebsiteCommand({
+                Bucket: bucketName,
+                WebsiteConfiguration: {
+                    IndexDocument: { Suffix: 'index.html' },
+                    ErrorDocument: { Key: 'index.html' }, // SPA fallback
+                },
+            }));
+            // Set public access policy
+            await s3.send(new s3Commands.DeletePublicAccessBlockCommand({ Bucket: bucketName }));
+            await s3.send(new s3Commands.PutBucketPolicyCommand({
+                Bucket: bucketName,
+                Policy: JSON.stringify({
+                    Version: '2012-10-17',
+                    Statement: [{
+                            Sid: 'PublicReadGetObject',
+                            Effect: 'Allow',
+                            Principal: '*',
+                            Action: 's3:GetObject',
+                            Resource: `arn:aws:s3:::${bucketName}/*`,
+                        }],
+                }),
+            }));
+            const websiteUrl = region === 'us-east-1'
+                ? `http://${bucketName}.s3-website-${region}.amazonaws.com`
+                : `http://${bucketName}.s3-website.${region}.amazonaws.com`;
+            outputs['S3_BUCKET'] = bucketName;
+            outputs['S3_WEBSITE_URL'] = websiteUrl;
+            emit({ step: 's3-website', status: 'done', message: `Static hosting enabled — ${websiteUrl}` });
+        }
+        catch (err) {
+            emit({ step: 's3-website', status: 'error', message: 'Failed to configure website hosting', detail: err.message });
+            // Non-fatal — bucket exists, user can configure manually
+        }
+        // Step 4: Generate deploy script
+        emit({ step: 's3-script', status: 'started', message: 'Generating deploy script' });
+        try {
+            const infraDir = join(ctx.projectDir, 'infra');
+            await mkdir(infraDir, { recursive: true });
+            const deployScript = `#!/usr/bin/env bash
+# deploy-s3.sh — Deploy static site to S3
+# Generated by VoidForge
+set -euo pipefail
+
+BUCKET="\${S3_BUCKET:-${bucketName}}"
+BUILD_DIR="\${BUILD_DIR:-dist}"
+
+echo "=== Deploying to S3 bucket: $BUCKET ==="
+
+# Sync build output to S3
+aws s3 sync "$BUILD_DIR" "s3://$BUCKET" \\
+  --delete \\
+  --cache-control "public, max-age=31536000, immutable" \\
+  --exclude "*.html" \\
+  --exclude "sw.js" \\
+  --exclude "manifest.json"
+
+# HTML and service worker files with short cache
+aws s3 sync "$BUILD_DIR" "s3://$BUCKET" \\
+  --cache-control "public, max-age=0, must-revalidate" \\
+  --exclude '*' \\
+  --include "*.html" \\
+  --include "sw.js" \\
+  --include "manifest.json"
+
+echo ""
+echo "=== Deploy complete ==="
+echo "Site: ${outputs['S3_WEBSITE_URL'] || `http://$BUCKET.s3-website.amazonaws.com`}"
+`;
+            await writeFile(join(infraDir, 'deploy-s3.sh'), deployScript, { mode: 0o755 });
+            files.push('infra/deploy-s3.sh');
+            emit({ step: 's3-script', status: 'done', message: 'Generated infra/deploy-s3.sh' });
+        }
+        catch (err) {
+            emit({ step: 's3-script', status: 'error', message: 'Failed to generate deploy script', detail: err.message });
+        }
+        // Step 5: Write .env
+        emit({ step: 's3-env', status: 'started', message: 'Writing S3 config to .env' });
+        try {
+            const envLines = [
+                `# VoidForge Static S3 — generated ${new Date().toISOString()}`,
+                `S3_BUCKET=${bucketName}`,
+            ];
+            if (outputs['S3_WEBSITE_URL'])
+                envLines.push(`S3_WEBSITE_URL=${outputs['S3_WEBSITE_URL']}`);
+            envLines.push('# Deploy with: ./infra/deploy-s3.sh (or auto-deploys via Haku wizard)');
+            await appendEnvSection(ctx.projectDir, envLines);
+            emit({ step: 's3-env', status: 'done', message: 'S3 config written to .env' });
+        }
+        catch (err) {
+            emit({ step: 's3-env', status: 'error', message: 'Failed to write .env', detail: err.message });
+        }
+        return { success: true, resources, outputs, files };
+    },
+    async cleanup(resources, credentials) {
+        if (resources.length === 0)
+            return;
+        const region = resources[0].region;
+        const awsConfig = {
+            region,
+            credentials: {
+                accessKeyId: credentials['aws-access-key-id'] ?? '',
+                secretAccessKey: credentials['aws-secret-access-key'] ?? '',
+            },
+        };
+        for (const resource of [...resources].reverse()) {
+            if (resource.type === 's3-bucket') {
+                try {
+                    const { S3Client, DeleteBucketCommand, ListObjectsV2Command, DeleteObjectsCommand } = await import('@aws-sdk/client-s3');
+                    const s3 = new S3Client(awsConfig);
+                    // Must empty bucket before deleting — paginate to handle >1000 objects
+                    let continuationToken;
+                    do {
+                        const listRes = await s3.send(new ListObjectsV2Command({
+                            Bucket: resource.id,
+                            ContinuationToken: continuationToken,
+                        }));
+                        if (listRes.Contents && listRes.Contents.length > 0) {
+                            await s3.send(new DeleteObjectsCommand({
+                                Bucket: resource.id,
+                                Delete: {
+                                    Objects: listRes.Contents.map((obj) => ({ Key: obj.Key })),
+                                },
+                            }));
+                        }
+                        continuationToken = listRes.IsTruncated ? listRes.NextContinuationToken : undefined;
+                    } while (continuationToken);
+                    await s3.send(new DeleteBucketCommand({ Bucket: resource.id }));
+                }
+                catch (err) {
+                    console.error(`Failed to cleanup S3 bucket ${resource.id}:`, err.message);
+                }
+            }
+        }
+    },
+};

package/dist/wizard/lib/provisioners/types.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Provisioner interfaces — shared across all deploy targets.
+ */
+export interface ProvisionContext {
+    runId: string;
+    projectDir: string;
+    projectName: string;
+    deployTarget: string;
+    framework: string;
+    database: string;
+    cache: string;
+    instanceType: string;
+    hostname: string;
+    credentials: Record<string, string>;
+    abortSignal?: AbortSignal;
+}
+export interface ProvisionEvent {
+    step: string;
+    status: 'started' | 'done' | 'error' | 'skipped' | 'warning';
+    message: string;
+    detail?: string;
+}
+export type ProvisionEmitter = (event: ProvisionEvent) => void;
+export interface CreatedResource {
+    type: string;
+    id: string;
+    region: string;
+}
+export interface ProvisionResult {
+    success: boolean;
+    resources: CreatedResource[];
+    outputs: Record<string, string>;
+    files: string[];
+    error?: string;
+}
+export interface Provisioner {
+    validate(ctx: ProvisionContext): Promise<string[]>;
+    provision(ctx: ProvisionContext, emit: ProvisionEmitter): Promise<ProvisionResult>;
+    cleanup(resources: CreatedResource[], credentials: Record<string, string>): Promise<void>;
+}

package/dist/wizard/lib/provisioners/types.js

@@ -0,0 +1,4 @@
+/**
+ * Provisioner interfaces — shared across all deploy targets.
+ */
+export {};

package/dist/wizard/lib/provisioners/vercel.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Vercel provisioner — creates a real Vercel project via API + generates vercel.json.
+ * v3.8.0: Links GitHub repo, sets env vars, polls deploy (ADR-015).
+ */
+import type { Provisioner } from './types.js';
+export declare const vercelProvisioner: Provisioner;