vibecarbon 0.1.0

package/src/lib/deploy/compose/reconcile.js

@@ -0,0 +1,74 @@
+/**
+ * Declarative Compose Reconciler
+ * Renders the state and scripts for remote reconciliation
+ */
+
+/**
+ * Render the reconcile.sh script
+ * @param {string} projectName
+ * @param {string} composeFlags
+ * @returns {string}
+ */
+export function renderReconcileScript(projectName, composeFlags) {
+  return `#!/bin/bash
+set -e
+
+# Declarative Compose Reconciler
+# Generated by Vibecarbon
+
+PROJECT_DIR="/opt/${projectName}"
+cd "$PROJECT_DIR"
+
+echo "Reconciling project: ${projectName}..."
+
+# 1. Pull latest images if needed.
+# --ignore-buildable only skips services with build but no image. Services
+# with both build and image sections (e.g. db) are NOT skipped and will
+# warn "access denied" since the tag is local-only. Non-fatal; the actual
+# build happens at step 2 via --build.
+echo "Pulling images..."
+docker compose ${composeFlags} pull --policy missing --ignore-buildable || true
+
+# 2. Re-create containers if state differs.
+# --build builds any service with a build section whose image isn't already
+# present locally. In prod, app build is reset (image-only via APP_IMAGE);
+# db keeps its build context and gets compiled here on first deploy. BuildKit
+# cache makes subsequent re-deploys a no-op when the build context is unchanged.
+echo "Updating containers..."
+docker compose ${composeFlags} up -d --remove-orphans --build
+
+# 3. Ensure systemd service is active (if applicable)
+if [ -f "/etc/systemd/system/${projectName}.service" ]; then
+  echo "Ensuring systemd service is active..."
+  systemctl daemon-reload
+  systemctl enable "${projectName}.service"
+fi
+
+echo "Reconciliation complete."
+`;
+}
+
+/**
+ * Render the systemd service unit
+ * @param {string} projectName
+ * @param {string} composeFlags
+ * @returns {string}
+ */
+export function renderSystemdUnit(projectName, composeFlags) {
+  return `[Unit]
+Description=Vibecarbon Project: ${projectName}
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/opt/${projectName}
+ExecStart=/usr/bin/docker compose ${composeFlags} up -d --remove-orphans
+ExecStop=/usr/bin/docker compose ${composeFlags} down
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+`;
+}

package/src/lib/deploy/github.js

@@ -0,0 +1,382 @@
+/**
+ * GitHub Integration & Workflows
+ * Logic for repository setup, environment secrets, and CI/CD generation
+ */
+
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import * as p from '@clack/prompts';
+import { c } from '../colors.js';
+import { checkDependency, runCommand } from '../command.js';
+import { buildGitAddArgv } from '../project.js';
+
+/**
+ * Check if GitHub CLI is authenticated
+ * @returns {boolean}
+ */
+export function checkGitHubAuth() {
+  try {
+    const result = runCommand('gh auth status', { silent: true, ignoreError: true });
+    return result !== null && result !== false;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Get the authenticated GitHub username
+ * @returns {string|null}
+ */
+export function getGitHubUsername() {
+  try {
+    const result = runCommand('gh api user -q .login', { silent: true, ignoreError: true });
+    return result?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if a GitHub repo already exists for this directory
+ * @returns {string|null}
+ */
+export function checkExistingRepo() {
+  try {
+    const result = runCommand('gh repo view --json nameWithOwner -q .nameWithOwner', {
+      silent: true,
+      ignoreError: true,
+    });
+    return result?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if git remote 'origin' is configured
+ * @returns {string|null}
+ */
+export function checkGitRemote() {
+  try {
+    const result = runCommand('git remote get-url origin', {
+      silent: true,
+      ignoreError: true,
+    });
+    return result?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Create a GitHub repository for the project
+ * @param {string} projectName
+ * @param {object} options
+ * @returns {Promise<object>}
+ */
+export async function createGitHubRepository(projectName, options = {}) {
+  const s = p.spinner();
+  const visibility = options.isPublic ? '--public' : '--private';
+
+  // Ensure we have a git repo
+  if (!existsSync(join(process.cwd(), '.git'))) {
+    s.start('Initializing git repository');
+    runCommand('git init', { silent: true });
+    s.stop('Git repository initialized');
+  }
+
+  // Ensure we have at least one commit
+  const hasCommits = runCommand('git rev-parse HEAD', { silent: true, ignoreError: true });
+  if (!hasCommits) {
+    s.start('Creating initial commit');
+    runCommand(buildGitAddArgv(), { silent: true, ignoreError: true });
+    runCommand('git commit -m "Initial commit - Vibecarbon project"', { silent: true });
+    s.stop('Initial commit created');
+  }
+
+  s.start(`Creating GitHub repository: ${projectName}`);
+  try {
+    // Create repo with source and remote in one command
+    runCommand(['gh', 'repo', 'create', projectName, visibility, '--source=.', '--remote=origin'], {
+      silent: true,
+      timeout: 60000,
+    });
+    s.stop('GitHub repository created');
+
+    // Get the repo URL
+    const repoUrl = runCommand('gh repo view --json url -q .url', { silent: true })?.trim();
+    return { success: true, url: repoUrl, name: projectName };
+  } catch (error) {
+    s.stop('Failed to create GitHub repository');
+    return { success: false, error: error.message };
+  }
+}
+
+/**
+ * Commit changes and push to GitHub to trigger deployment
+ * @param {string} branchName
+ * @param {string} workflowPath
+ * @param {object} options
+ * @returns {Promise<object>}
+ */
+export async function commitAndPush(branchName, workflowPath, options = {}) {
+  const s = p.spinner();
+  const skipCiStr = options.skipCi ? ' [skip ci]' : '';
+
+  // Stage the workflow file
+  s.start('Staging deployment workflow');
+  runCommand(buildGitAddArgv(process.cwd(), [workflowPath]), { silent: true, ignoreError: true });
+  s.stop('Changes staged');
+
+  // Commit
+  s.start('Committing changes');
+  const commitMessage = `Add deployment workflow and configuration${skipCiStr}`;
+  const commitResult = runCommand(['git', 'commit', '-m', commitMessage], {
+    silent: true,
+    ignoreError: true,
+  });
+  if (!commitResult) {
+    s.stop('No new changes to commit');
+  } else {
+    s.stop('Changes committed');
+  }
+
+  // Push
+  s.start(`Pushing to ${branchName} branch`);
+  try {
+    runCommand(['git', 'push', '-u', 'origin', branchName], { silent: true, timeout: 60000 });
+    s.stop(`Code pushed to ${branchName}`);
+    return { success: true };
+  } catch (error) {
+    s.stop(`Failed to push: ${error.message}`);
+    return { success: false, error: error.message };
+  }
+}
+
+/**
+ * Monitor GitHub Actions deployment progress
+ * @param {string} _repoName
+ * @param {number} timeout
+ * @returns {Promise<object>}
+ */
+export async function monitorDeployment(_repoName, timeout = 600000) {
+  const s = p.spinner();
+  s.start('Waiting for GitHub Actions deployment');
+
+  const startTime = Date.now();
+  let lastStatus = '';
+
+  while (Date.now() - startTime < timeout) {
+    try {
+      const result = runCommand('gh run list --limit 1 --json status,conclusion,name,url', {
+        silent: true,
+        ignoreError: true,
+      });
+
+      if (result) {
+        const runs = JSON.parse(result);
+        if (runs.length > 0) {
+          const run = runs[0];
+          const status = run.status;
+
+          if (status !== lastStatus) {
+            lastStatus = status;
+            if (status === 'completed') {
+              if (run.conclusion === 'success') {
+                s.stop('Deployment complete!');
+                return { success: true, url: run.url };
+              }
+              s.stop(`Deployment ${run.conclusion}`);
+              return { success: false, conclusion: run.conclusion, url: run.url };
+            }
+            s.message(`Deployment ${status}...`);
+          }
+        }
+      }
+    } catch {
+      // Ignore errors, keep polling
+    }
+
+    await new Promise((r) => setTimeout(r, 10000));
+  }
+
+  s.stop('Deployment monitoring timed out');
+  return { success: false, timedOut: true };
+}
+
+/**
+ * Orchestrate GitHub integration setup
+ * @param {object} projectConfig
+ * @param {string} _branchName
+ * @param {object} options
+ * @returns {Promise<object>}
+ */
+export async function setupGitHubIntegration(projectConfig, _branchName, options = {}) {
+  const { defaultCreate = true, isPublic = false, skipPrompts = false } = options;
+
+  // Check if gh CLI is available and authenticated
+  if (!checkDependency('gh', 'GitHub CLI')) {
+    p.log.warn('GitHub CLI (gh) not installed - skipping automatic GitHub setup');
+    return { skipped: true, reason: 'gh_not_installed' };
+  }
+
+  if (!checkGitHubAuth()) {
+    p.log.warn('GitHub CLI not authenticated');
+    p.log.info('Run: gh auth login');
+    return { skipped: true, reason: 'not_authenticated' };
+  }
+
+  // Check for existing repo
+  const existingRepo = checkExistingRepo();
+  const existingRemote = checkGitRemote();
+
+  if (existingRepo) {
+    p.log.info(`Using existing repository: ${c.bold(existingRepo)}`);
+    return { existing: true, repoName: existingRepo };
+  }
+
+  if (existingRemote && !existingRemote.includes('github.com')) {
+    p.log.warn(`Git remote points to non-GitHub URL: ${existingRemote}`);
+    if (!skipPrompts) {
+      const replace = await p.confirm({
+        message: 'Replace with GitHub remote?',
+        initialValue: false,
+      });
+      if (!replace) {
+        return { skipped: true, reason: 'non_github_remote' };
+      }
+      runCommand('git remote remove origin', { silent: true, ignoreError: true });
+    } else {
+      return { skipped: true, reason: 'non_github_remote' };
+    }
+  }
+
+  // Prompt for repo creation
+  let shouldCreate = defaultCreate;
+  if (!skipPrompts) {
+    shouldCreate = await p.confirm({
+      message: 'Create GitHub repository for auto deployment (CI/CD)?',
+      initialValue: true,
+    });
+  }
+
+  if (!shouldCreate) {
+    return { skipped: true, reason: 'user_declined' };
+  }
+
+  // Ask about visibility
+  let repoIsPublic = isPublic;
+  if (!skipPrompts && shouldCreate) {
+    const visibility = await p.select({
+      message: 'Repository visibility',
+      options: [
+        { value: 'private', label: 'Private', hint: 'recommended' },
+        { value: 'public', label: 'Public' },
+      ],
+      initialValue: 'private',
+    });
+    repoIsPublic = visibility === 'public';
+  }
+
+  // Create the repository
+  const result = await createGitHubRepository(projectConfig.projectName, {
+    isPublic: repoIsPublic,
+  });
+
+  if (result.success) {
+    return { created: true, repoName: projectConfig.projectName, url: result.url };
+  }
+
+  p.log.error(`Failed to create repository: ${result.error}`);
+  return { skipped: true, reason: 'creation_failed', error: result.error };
+}
+
+/**
+ * Setup GitHub environment and secrets
+ * @param {string} _projectName
+ * @param {string} envName
+ * @param {object} secrets
+ * @returns {Promise<boolean>}
+ */
+export async function setupGitHubEnvironment(_projectName, envName, secrets) {
+  const s = p.spinner();
+  s.start(`Setting up GitHub environment: ${envName}`);
+
+  try {
+    const repoInfo = runCommand('gh repo view --json nameWithOwner -q .nameWithOwner', {
+      silent: true,
+    }).trim();
+
+    // Create environment
+    runCommand(['gh', 'api', `repos/${repoInfo}/environments/${envName}`, '-X', 'PUT'], {
+      silent: true,
+      ignoreError: true,
+    });
+
+    // Set secrets for the environment
+    for (const [key, value] of Object.entries(secrets)) {
+      if (value && typeof value === 'string' && value.length > 0) {
+        runCommand(['gh', 'secret', 'set', key, '--env', envName, '--body', value], {
+          silent: true,
+          ignoreError: true,
+        });
+      }
+    }
+
+    s.stop(`GitHub environment '${envName}' configured`);
+    return true;
+  } catch (error) {
+    s.stop(`Failed to setup GitHub environment: ${error.message}`);
+    return false;
+  }
+}
+
+/**
+ * Create or checkout a git branch for deployment
+ * @param {string} branchName
+ * @returns {Promise<boolean>}
+ */
+export async function createGitBranch(branchName) {
+  const s = p.spinner();
+
+  if (branchName === 'main' || branchName === 'master') {
+    p.log.info(`Using '${branchName}' branch for deployment (push manually when ready)`);
+    return true;
+  }
+
+  try {
+    const hasCommits = runCommand('git rev-parse HEAD', {
+      silent: true,
+      ignoreError: true,
+    });
+    if (!hasCommits) {
+      p.log.warn(`No commits yet - create initial commit, then run: git checkout -b ${branchName}`);
+      return true;
+    }
+
+    const currentBranch = runCommand(['git', 'rev-parse', '--abbrev-ref', 'HEAD'], {
+      encoding: 'utf-8',
+    }).trim();
+
+    const existsLocally = runCommand(['git', 'rev-parse', '--verify', branchName], {
+      silent: true,
+      ignoreError: true,
+    });
+
+    if (existsLocally) {
+      s.start(`Checking out existing branch: ${branchName}`);
+      runCommand(['git', 'checkout', branchName], { silent: true });
+      s.stop(`Switched to branch '${branchName}'`);
+    } else {
+      s.start(`Creating branch '${branchName}' from '${currentBranch}'`);
+      runCommand(['git', 'checkout', '-b', branchName], { silent: true });
+      s.stop(`Created branch '${branchName}' from '${currentBranch}'`);
+    }
+
+    p.log.info(`Push when ready: git push -u origin ${branchName}`);
+    return true;
+  } catch (error) {
+    s.stop(`Failed to create branch: ${error.message}`);
+    return false;
+  }
+}

package/src/lib/deploy/image.js

@@ -0,0 +1,191 @@
+/**
+ * Sideload primitives for local-first deploys.
+ *
+ * Three responsibilities:
+ *   1. Generate a unique local image tag (pure)
+ *   2. Inspect git state (sha + dirty)
+ *   3. Build + sideload to a compose-mode server (laptop → docker daemon)
+ *
+ * The k8s-mode sideload lives in src/lib/deploy/k8s/k3s.js (`sideloadK3s`).
+ * No registry round-trip; the image goes operator → target directly.
+ *
+ * See docs/superpowers/specs/2026-04-25-local-first-deploy-design.md §1.
+ */
+
+import { execFileSync } from 'node:child_process';
+
+const LOCAL_REGISTRY_PREFIX = 'vibecarbon-local';
+
+/**
+ * Build a unique local image tag.
+ *
+ * Tag scheme: `<prefix>/<project>:<sha>[-dirty]-<timestamp>`. The
+ * `-dirty` marker fires when the working tree has uncommitted changes, so
+ * stale rebuilds from a clean tree don't collide with iterative
+ * uncommitted work. Timestamp is UTC YYYYMMDDHHMMSS for sortability.
+ *
+ * `prefix` defaults to the compose-mode default `vibecarbon-local`. The
+ * k8s-mode caller (buildAppImage in k8s/k3s.js) passes `10.0.1.1:5000` so
+ * the same tag works as both a sideload reference (kubelet `IfNotPresent`
+ * on static workers) and a registry-pull reference (CA-spawned workers
+ * pulling from master's local registry pod via `registries.yaml`).
+ *
+ * @param {{projectName: string, gitSha: string, isDirty: boolean, timestamp: string, prefix?: string}} args
+ * @returns {string}
+ */
+export function generateLocalImageTag({
+  projectName,
+  gitSha,
+  isDirty,
+  timestamp,
+  prefix = LOCAL_REGISTRY_PREFIX,
+}) {
+  const dirtyMarker = isDirty ? '-dirty' : '';
+  return `${prefix}/${projectName}:${gitSha}${dirtyMarker}-${timestamp}`;
+}
+
+/**
+ * Read git short-sha + dirty-state for `cwd`. Both halves swallow errors and
+ * return safe fallbacks: `nogit`/`false`. The caller (buildLocalImage)
+ * doesn't fail just because the project is outside a git repo or git isn't
+ * on PATH — sketch-mode users may not have committed yet.
+ *
+ * @param {string} cwd
+ * @returns {{gitSha: string, isDirty: boolean}}
+ */
+export function inspectGitState(cwd) {
+  let gitSha = 'nogit';
+  let isDirty = false;
+  try {
+    const sha = execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
+      cwd,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    gitSha = sha.trim() || 'nogit';
+  } catch {
+    return { gitSha: 'nogit', isDirty: false };
+  }
+  try {
+    const status = execFileSync('git', ['status', '--porcelain'], {
+      cwd,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    isDirty = status.trim().length > 0;
+  } catch {
+    // git status failed but rev-parse worked — non-fatal, treat as clean.
+  }
+  return { gitSha, isDirty };
+}
+
+/**
+ * Build a local container image and return its unique tag.
+ *
+ * Combines `inspectGitState` for cache-busting inputs, `generateLocalImageTag`
+ * for the tag scheme, and a `docker build` shell-out. Side-effecting; the
+ * docker build step inherits stdio so the operator sees layer progress.
+ *
+ * `tagPrefix` defaults to `vibecarbon-local` (compose-mode behavior). k8s
+ * mode passes `10.0.1.1:5000` so the resulting tag is a valid registry
+ * reference that CA-spawned workers can pull from master's local registry
+ * pod (Phase 1 wired the registries.yaml; Phase 6 wires the push).
+ *
+ * @param {string} projectDir - Project root with the Dockerfile.
+ * @param {{projectName: string, timestamp?: string, rebuild?: boolean, tagPrefix?: string}} options
+ * @returns {{tag: string, gitSha: string, isDirty: boolean}}
+ */
+export function buildLocalImage(projectDir, options) {
+  const { projectName, rebuild = false, tagPrefix } = options;
+  if (!projectName) {
+    throw new Error('buildLocalImage: projectName is required');
+  }
+  const timestamp = options.timestamp ?? defaultTimestamp();
+  const { gitSha, isDirty } = inspectGitState(projectDir);
+  const tag = generateLocalImageTag({
+    projectName,
+    gitSha,
+    isDirty,
+    timestamp,
+    prefix: tagPrefix,
+  });
+
+  const args = ['build'];
+  if (rebuild) args.push('--no-cache');
+  args.push('-t', tag, projectDir);
+
+  execFileSync('docker', args, { stdio: 'inherit' });
+  return { tag, gitSha, isDirty };
+}
+
+function defaultTimestamp() {
+  return new Date().toISOString().replace(/[-:T]/g, '').replace(/\..*$/, '');
+}
+
+/**
+ * Sideload a built local image to a compose-mode server.
+ *
+ * `set -o pipefail && docker save | gzip -1 | ssh target gunzip | docker load`
+ * streams the image tarball compressed over the wire — no temp file on
+ * either end, no registry. The image lands in the server's docker daemon
+ * and is immediately referenceable by tag for `docker compose up`.
+ *
+ * gzip on the wire: Node app images compress 3-5x (most layers are JS
+ * source + node_modules text), so a ~600MB save becomes ~150-200MB on
+ * the wire. The K8s sideload (sideloadK3s in k3s.js) used the same trick
+ * to drop sideload time from 23-29 min to 5-10 min on the operator's
+ * residential upload — compose-mode missed the optimization until now.
+ * `gzip -1` is universally present and dominant cost is network, not CPU.
+ *
+ * `pipefail` so a docker-save / gzip failure isn't masked by ssh's exit code.
+ * `StrictHostKeyChecking=accept-new` matches the convention used elsewhere
+ * in vibecarbon's ssh paths: trust-on-first-use, error on host-key change.
+ *
+ * @param {{tag: string, sshTarget: string, sshKey?: string}} args
+ */
+export function sideloadCompose({ tag, sshTarget, sshKey }) {
+  // SSH options mirror remote-build.js's wrapper script — same tradeoffs:
+  //   * StrictHostKeyChecking=no + UserKnownHostsFile=/dev/null: ephemeral
+  //     VPS IPs get recycled across e2e runs (and across customer
+  //     redeploys after destroy). accept-new + the operator's real
+  //     ~/.ssh/known_hosts would fail with "host key verification failed"
+  //     whenever a recycled IP shows up with a new host key, even with
+  //     BatchMode=yes (in fact especially then, since ssh can't prompt to
+  //     update the entry). iter-perfwave4 hit exactly this on first run.
+  //   * BatchMode=yes per feedback_ssh_batchmode_required.md (PR 1T):
+  //     fast-fail rather than hang on interactive password prompt if the
+  //     key fails.
+  //   * ConnectTimeout=30: bound the network half of dial; sideload's own
+  //     stream is unbounded (limited by docker save throughput).
+  const sshFlags = [
+    '-o',
+    'StrictHostKeyChecking=no',
+    '-o',
+    'UserKnownHostsFile=/dev/null',
+    '-o',
+    'BatchMode=yes',
+    '-o',
+    'ConnectTimeout=30',
+  ];
+  if (sshKey) sshFlags.unshift('-i', sshKey);
+  const cmd = `set -o pipefail && docker save ${tag} | gzip -1 | ssh ${sshFlags.join(' ')} ${sshTarget} 'gunzip | docker load'`;
+  // Capture stdio rather than inheriting it: ssh's "Permanently added" host-
+  // key warning + `docker load`'s "Loaded image:" success line both bypass
+  // the clack gutter when inherited and print flush-left, breaking the
+  // visual flow. On success we don't need either; on failure we surface
+  // the captured stderr for debugging via the thrown Error.
+  try {
+    execFileSync('bash', ['-c', cmd], { stdio: ['ignore', 'pipe', 'pipe'] });
+  } catch (err) {
+    const stderr = err.stderr?.toString().trim() || '';
+    const stdout = err.stdout?.toString().trim() || '';
+    // Surface whatever signal the operator can act on: child stderr first
+    // (real ssh / docker errors), then stdout, then the wrapping error's
+    // message (preserves "Connection refused" when execFileSync's own
+    // error string is the only thing we have).
+    const detail = [stderr, stdout, err.message].filter(Boolean).join('\n').trim();
+    const wrapped = new Error(`sideloadCompose failed (exit ${err.status ?? '?'}): ${detail}`);
+    wrapped.cause = err;
+    throw wrapped;
+  }
+}