vibecarbon 0.1.0

package/src/lib/operator-ip.js

@@ -0,0 +1,381 @@
+/**
+ * Operator-IP detection and management for the Hetzner Cloud firewall's
+ * SSH (port 22) and Kubernetes API (port 6443) rules.
+ *
+ * Architecture: a project-level list of operator CIDRs persisted in
+ * .vibecarbon.json under `operatorCidrs`. Every interactive command that
+ * needs SSH or k8s API access calls `ensureOperatorIpAccess` near the top
+ * of its run() — if the operator's current public IP isn't already covered
+ * by an entry in the list, the helper detects it, appends it, and patches
+ * the live Hetzner firewall via the Cloud API. Subsequent commands from
+ * the same IP are silent.
+ *
+ * Non-interactive (--yes) flows skip auto-detect and require either an
+ * already-populated list or an explicit ALLOWED_SSH_IPS env var, since CI
+ * runners have ephemeral IPs that would otherwise pollute the list.
+ *
+ * Exports:
+ *   - detectOperatorIp() — primary + fallback HTTP detector
+ *   - cidrFromIp(ip, version) — formats /32 or /128
+ *   - loadOperatorCidrs / addCidr / removeCidr / pruneCidrs / refreshLastUsed
+ *   - findMatchingCidr — checks if an IP is contained by any persisted CIDR
+ *   - applyToFirewall — patches the live Hetzner firewall via the Cloud API
+ *   - ensureOperatorIpAccess — the all-in-one helper for command run()s
+ */
+
+import { saveProjectConfig } from './config.js';
+import { fetchWithRetry } from './fetch-retry.js';
+
+// ============================================================================
+// IP DETECTION
+// ============================================================================
+
+const PRIMARY_DETECTOR = 'https://api.ipify.org';
+const FALLBACK_DETECTOR = 'https://icanhazip.com';
+
+/**
+ * Resolve the operator's current public IP. Returns { ip, version: 4|6 }.
+ * Throws if both detectors fail.
+ */
+export async function detectOperatorIp({ fetcher = fetchWithRetry } = {}) {
+  const errors = [];
+  for (const url of [PRIMARY_DETECTOR, FALLBACK_DETECTOR]) {
+    try {
+      const res = await fetcher(url, { method: 'GET' });
+      if (!res.ok) {
+        errors.push(`${url}: HTTP ${res.status}`);
+        continue;
+      }
+      const ip = (await res.text()).trim();
+      const version = ip.includes(':') ? 6 : 4;
+      if (!isValidIp(ip, version)) {
+        errors.push(`${url}: invalid response "${ip}"`);
+        continue;
+      }
+      return { ip, version };
+    } catch (err) {
+      errors.push(`${url}: ${err.message || err}`);
+    }
+  }
+  throw new Error(`Unable to detect operator IP — ${errors.join('; ')}`);
+}
+
+function isValidIp(ip, version) {
+  if (version === 4) {
+    if (!/^(\d{1,3}\.){3}\d{1,3}$/.test(ip)) return false;
+    return ip.split('.').every((p) => {
+      const n = Number(p);
+      return Number.isInteger(n) && n >= 0 && n <= 255;
+    });
+  }
+  // IPv6 — must contain colons and only hex chars
+  return /^[0-9a-fA-F:]+$/.test(ip) && ip.includes(':');
+}
+
+export function cidrFromIp(ip, version) {
+  return `${ip}/${version === 6 ? 128 : 32}`;
+}
+
+// ============================================================================
+// CIDR MATCHING
+// ============================================================================
+
+/**
+ * Find the first persisted CIDR entry that contains the given IP, or null.
+ */
+export function findMatchingCidr(list, ip, version) {
+  for (const entry of list) {
+    if (cidrContainsIp(entry.cidr, ip, version)) return entry;
+  }
+  return null;
+}
+
+export function cidrContainsIp(cidr, ip, version) {
+  const slashIdx = cidr.indexOf('/');
+  if (slashIdx < 0) return false;
+  const base = cidr.slice(0, slashIdx);
+  const bits = Number(cidr.slice(slashIdx + 1));
+  if (!Number.isInteger(bits) || bits < 0) return false;
+
+  const cidrIsV6 = base.includes(':');
+  if (cidrIsV6 !== (version === 6)) return false;
+
+  if (version === 4) {
+    if (bits > 32) return false;
+    const baseNum = ipv4ToInt(base);
+    const ipNum = ipv4ToInt(ip);
+    if (baseNum === null || ipNum === null) return false;
+    if (bits === 0) return true;
+    if (bits === 32) return baseNum === ipNum;
+    const mask = (-1 << (32 - bits)) >>> 0;
+    return (baseNum & mask) === (ipNum & mask);
+  }
+
+  if (bits > 128) return false;
+  const baseNum = ipv6ToBigInt(base);
+  const ipNum = ipv6ToBigInt(ip);
+  if (baseNum === null || ipNum === null) return false;
+  if (bits === 0) return true;
+  if (bits === 128) return baseNum === ipNum;
+  const shift = BigInt(128 - bits);
+  return baseNum >> shift === ipNum >> shift;
+}
+
+function ipv4ToInt(ip) {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  let n = 0;
+  for (const p of parts) {
+    const num = Number(p);
+    if (!Number.isInteger(num) || num < 0 || num > 255) return null;
+    n = (n << 8) | num;
+  }
+  return n >>> 0;
+}
+
+function ipv6ToBigInt(ip) {
+  const halves = ip.split('::');
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(':') : [];
+  const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+  if (head.length + tail.length > 8) return null;
+  if (halves.length === 1 && head.length !== 8) return null;
+  const fillCount = halves.length === 2 ? 8 - head.length - tail.length : 0;
+  const groups = [...head, ...new Array(fillCount).fill('0'), ...tail];
+  if (groups.length !== 8) return null;
+  let result = 0n;
+  for (const g of groups) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(g)) return null;
+    result = (result << 16n) | BigInt(Number.parseInt(g, 16));
+  }
+  return result;
+}
+
+// ============================================================================
+// CIDR LIST MANAGEMENT
+// ============================================================================
+
+export function loadOperatorCidrs(projectConfig) {
+  return projectConfig?.operatorCidrs ?? [];
+}
+
+/**
+ * Append a CIDR to the list, or refresh lastUsedAt if it's already present.
+ * Returns the new list (input is not mutated).
+ */
+export function addCidr(list, cidr, now = new Date()) {
+  const nowIso = now.toISOString();
+  const idx = list.findIndex((e) => e.cidr === cidr);
+  if (idx >= 0) {
+    return list.map((e, i) => (i === idx ? { ...e, lastUsedAt: nowIso } : e));
+  }
+  return [...list, { cidr, addedAt: nowIso, lastUsedAt: nowIso }];
+}
+
+export function removeCidr(list, cidr) {
+  return list.filter((e) => e.cidr !== cidr);
+}
+
+/**
+ * Drop entries whose lastUsedAt is older than maxAgeDays.
+ */
+export function pruneCidrs(list, now = new Date(), maxAgeDays = 90) {
+  const cutoff = now.getTime() - maxAgeDays * 86_400_000;
+  return list.filter((e) => {
+    const t = new Date(e.lastUsedAt).getTime();
+    return Number.isFinite(t) && t >= cutoff;
+  });
+}
+
+export function refreshLastUsed(list, cidr, now = new Date()) {
+  const nowIso = now.toISOString();
+  return list.map((e) => (e.cidr === cidr ? { ...e, lastUsedAt: nowIso } : e));
+}
+
+// ============================================================================
+// HETZNER FIREWALL UPDATE
+// ============================================================================
+
+const SSH_PORT = '22';
+const K8S_API_PORT = '6443';
+
+/**
+ * Patch the SSH (port 22) and Kubernetes API (port 6443) rules on each of
+ * the named environments' firewalls to use the given CIDR list as their
+ * source_ips. Other rules (HTTP/HTTPS, internal cluster traffic) are left
+ * unchanged.
+ *
+ * environments is an array of full env identifiers — for HA, pass
+ * ['<env>-primary', '<env>-standby']; for single, pass ['<env>'].
+ *
+ * Returns the names of firewalls that were updated. Firewalls that don't
+ * exist (env not yet deployed) are skipped silently.
+ */
+export async function applyToFirewall({ projectName, environments, operatorCidrs, apiToken }) {
+  const cidrs = operatorCidrs.map((e) => e.cidr);
+  if (cidrs.length === 0) {
+    throw new Error('Refusing to update firewall with empty CIDR list (would lock everyone out).');
+  }
+  if (!apiToken) {
+    throw new Error('Hetzner API token required to update firewall.');
+  }
+
+  const updated = [];
+  for (const env of environments) {
+    const fwName = `${projectName}-${env}-firewall`;
+    const fw = await findFirewallByName(apiToken, fwName);
+    if (!fw) continue;
+    const newRules = fw.rules.map((rule) => {
+      if (rule.direction === 'in' && (rule.port === SSH_PORT || rule.port === K8S_API_PORT)) {
+        return { ...rule, source_ips: cidrs };
+      }
+      return rule;
+    });
+    await setFirewallRules(apiToken, fw.id, newRules);
+    updated.push(fwName);
+  }
+  return updated;
+}
+
+async function findFirewallByName(apiToken, name) {
+  const res = await fetchWithRetry(
+    `https://api.hetzner.cloud/v1/firewalls?name=${encodeURIComponent(name)}`,
+    { headers: { Authorization: `Bearer ${apiToken}` } },
+  );
+  if (!res.ok) return null;
+  const { firewalls } = await res.json();
+  return firewalls?.[0] ?? null;
+}
+
+async function setFirewallRules(apiToken, firewallId, rules) {
+  const res = await fetchWithRetry(
+    `https://api.hetzner.cloud/v1/firewalls/${firewallId}/actions/set_rules`,
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ rules }),
+    },
+  );
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Hetzner firewall set_rules failed (${res.status}): ${body}`);
+  }
+}
+
+// ============================================================================
+// AUTO-ADD HELPER
+// ============================================================================
+
+/**
+ * Ensure the current operator's IP is covered by the project's CIDR list,
+ * persisting + applying to the live firewall if not.
+ *
+ * Inputs:
+ *   projectConfig — loaded .vibecarbon.json (must include projectName and
+ *     environments[<environment>] for the apply step to fire)
+ *   environment — user-facing env name
+ *   isHA — whether to update both '<env>-primary' and '<env>-standby'
+ *     firewalls (vs just '<env>')
+ *   apiToken — Hetzner Cloud API token (from ~/.vibecarbon/credentials.json)
+ *   yes — non-interactive mode flag
+ *   onMessage — optional callback invoked with a single info string when a
+ *     new CIDR is added (caller wires this to its logger)
+ *   cwd — passed to saveProjectConfig
+ *
+ * Returns { added, cidr, list, fromEnv }:
+ *   added — true if the list was modified this call
+ *   cidr — the CIDR that was added (or matched, when added=false)
+ *   list — the updated list
+ *   fromEnv — true if the list was bootstrapped from ALLOWED_SSH_IPS env var
+ */
+export async function ensureOperatorIpAccess({
+  projectConfig,
+  environment,
+  isHA = false,
+  apiToken,
+  yes = false,
+  onMessage,
+  cwd,
+}) {
+  const list = loadOperatorCidrs(projectConfig);
+
+  if (yes) {
+    if (list.length > 0) {
+      return { added: false, cidr: null, list };
+    }
+    const envCidrs = parseAllowedSshIpsEnv(process.env.ALLOWED_SSH_IPS);
+    if (envCidrs.length === 0) {
+      throw new Error(
+        'No operator CIDRs configured. Run `vibecarbon deploy` interactively first, or set ALLOWED_SSH_IPS="1.2.3.4/32,5.6.7.8/32".',
+      );
+    }
+    const now = new Date();
+    const newList = envCidrs.map((cidr) => ({
+      cidr,
+      addedAt: now.toISOString(),
+      lastUsedAt: now.toISOString(),
+    }));
+    persist(projectConfig, newList, cwd);
+    return { added: true, cidr: envCidrs.join(','), list: newList, fromEnv: true };
+  }
+
+  // Interactive path
+  let ip;
+  let version;
+  try {
+    ({ ip, version } = await detectOperatorIp());
+  } catch (err) {
+    throw new Error(
+      `${err.message}. Pass ALLOWED_SSH_IPS=... or run \`vibecarbon access add <cidr>\` manually.`,
+    );
+  }
+
+  const match = findMatchingCidr(list, ip, version);
+  if (match) {
+    const refreshed = refreshLastUsed(list, match.cidr);
+    persist(projectConfig, refreshed, cwd);
+    return { added: false, cidr: match.cidr, list: refreshed };
+  }
+
+  const newCidr = cidrFromIp(ip, version);
+  if (onMessage) onMessage(`Detected your IP: ${newCidr} — adding to access list...`);
+  const updatedList = addCidr(list, newCidr);
+  persist(projectConfig, updatedList, cwd);
+
+  // Apply to Hetzner firewall when the env is already deployed (firewall
+  // exists). For first-deploy bootstrap, the deploy flow itself will create
+  // the firewall with the right CIDRs from the persisted list.
+  const envDeployed = !!projectConfig?.environments?.[environment];
+  if (envDeployed && apiToken) {
+    const environments = isHA
+      ? [`${environment}-primary`, `${environment}-standby`]
+      : [environment];
+    await applyToFirewall({
+      projectName: projectConfig.projectName,
+      environments,
+      operatorCidrs: updatedList,
+      apiToken,
+    });
+  }
+
+  return { added: true, cidr: newCidr, list: updatedList };
+}
+
+function persist(projectConfig, newList, cwd) {
+  if (!projectConfig) return;
+  const updated = { ...projectConfig, operatorCidrs: newList };
+  // Mutate in place so callers holding a reference see the new list.
+  projectConfig.operatorCidrs = newList;
+  saveProjectConfig(updated, cwd);
+}
+
+export function parseAllowedSshIpsEnv(envVar) {
+  if (!envVar) return [];
+  return envVar
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}

package/src/lib/package-manager.js

@@ -0,0 +1,111 @@
+/**
+ * Package manager adaptation utilities
+ *
+ * Shared between create.js (initial project setup) and upgrade.js
+ * (re-apply adaptations after template files are replaced).
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runCommand } from './command.js';
+
+export function getPackageManagerVersion(pm) {
+  // Try to detect installed version, fall back to sensible defaults
+  // The packageManager field requires full semver (e.g., "pnpm@9.0.0" not "pnpm@9")
+  try {
+    const version = runCommand([pm, '--version'], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    // Validate it looks like a semver version
+    if (/^\d+\.\d+\.\d+/.test(version)) {
+      return `${pm}@${version}`;
+    }
+  } catch {
+    // Fall through to defaults
+  }
+
+  // Default versions (full semver required)
+  switch (pm) {
+    case 'npm':
+      return 'npm@10.0.0';
+    case 'bun':
+      return 'bun@1.0.0';
+    default:
+      return 'pnpm@9.15.4';
+  }
+}
+
+export function adaptDockerfileForPackageManager(projectDir, packageManager) {
+  if (packageManager === 'pnpm') return;
+
+  const dockerfilePath = join(projectDir, 'Dockerfile');
+  let content = readFileSync(dockerfilePath, 'utf-8');
+  const version = getPackageManagerVersion(packageManager); // e.g. "npm@10.0.0"
+
+  const lockfiles = { npm: 'package-lock.json', bun: 'bun.lock' };
+  const lockfile = lockfiles[packageManager];
+
+  // Package manager install line. Both halves rewrite together: the
+  // `command -v pnpm` check and the `npm install -g pnpm@9` fallback. If
+  // we leave `command -v pnpm` in place for bun/npm projects, the check
+  // always misses (no pnpm in the runtime image), forcing the fallback to
+  // run every build — functional but logically wrong (it installs bun
+  // even though bun was already installed by a prior layer).
+  if (packageManager === 'bun') {
+    content = content.replaceAll(
+      'command -v pnpm >/dev/null 2>&1 || npm install -g pnpm@9',
+      'command -v bun >/dev/null 2>&1 || npm install -g bun',
+    );
+  } else if (packageManager === 'npm') {
+    // npm is always present in node:* images, so the check is a no-op.
+    // Replace the whole line with a comment-and-true so the layer still
+    // exists (preserving the cache key) but does no real work.
+    content = content.replaceAll(
+      'command -v pnpm >/dev/null 2>&1 || npm install -g pnpm@9',
+      'true # npm is preinstalled in node:* base image',
+    );
+  } else {
+    content = content.replaceAll('npm install -g pnpm@9', `npm install -g ${version}`);
+  }
+
+  // lockfile COPY lines
+  content = content.replaceAll('pnpm-lock.yaml', lockfile);
+
+  // prod install (replace before general install — more specific match first)
+  const prodInstallMap = {
+    npm: 'npm ci --omit=dev',
+    bun: 'bun install --frozen-lockfile --production',
+  };
+  content = content.replaceAll(
+    'pnpm install --frozen-lockfile --prod',
+    prodInstallMap[packageManager],
+  );
+
+  // install commands
+  const installMap = {
+    npm: 'npm ci',
+    bun: 'bun install --frozen-lockfile',
+  };
+  content = content.replaceAll('pnpm install --frozen-lockfile', installMap[packageManager]);
+
+  // BuildKit cache mount path. The template hardcodes pnpm's store location;
+  // without this rewrite, bun and npm projects mount an empty cache at pnpm's
+  // path and never read from their own caches — every install pays full
+  // network cost. Fixing it is ~30-60s off warm-cache rebuilds for non-pnpm.
+  const cacheMountTargets = {
+    npm: '/root/.npm',
+    bun: '/root/.bun/install/cache',
+  };
+  content = content.replace(
+    /--mount=type=cache,id=pnpm,target=\/root\/\.local\/share\/pnpm\/store/g,
+    `--mount=type=cache,id=${packageManager},target=${cacheMountTargets[packageManager]}`,
+  );
+
+  // build commands
+  const run = packageManager === 'npm' ? 'npm run' : packageManager;
+  content = content.replaceAll('pnpm build:client', `${run} build:client`);
+  content = content.replaceAll('pnpm build:server', `${run} build:server`);
+
+  writeFileSync(dockerfilePath, content);
+}

package/src/lib/perf.js

@@ -0,0 +1,71 @@
+/**
+ * Lightweight performance-timing helper for deploy-path sub-steps.
+ *
+ * Enabled via `VIBECARBON_PERF=1`. When enabled, every `perfAsync` /
+ * `perfTimer` call emits a single stderr line in the form:
+ *
+ *   [perf] <stage.name> <ms>ms [<optional-note>]
+ *
+ * The e2e harness captures this and the post-run reporter
+ * aggregates every sub-step across all scenarios, sorted descending,
+ * so we can see exactly where the critical path spends its time.
+ *
+ * Writing to stderr (never stdout) keeps @clack/prompts spinners on
+ * stdout undisturbed.
+ *
+ * When the env var is unset, all of these are near-zero overhead:
+ * one Date.now() call and a boolean guard.
+ */
+
+const enabled =
+  process.env.VIBECARBON_PERF === '1' ||
+  process.env.VIBECARBON_PERF === 'true' ||
+  process.env.VIBECARBON_PERF === 'yes';
+
+/**
+ * Returns whether perf tracing is enabled. Cheap; call at boundaries
+ * you don't want to pay for when perf is off.
+ */
+export function perfEnabled() {
+  return enabled;
+}
+
+/**
+ * Open a manually-controlled timer. Call .end(note?) to emit the
+ * measurement. Always returns the ms duration whether or not perf
+ * tracing is enabled so callers can persist timings elsewhere.
+ */
+export function perfTimer(name) {
+  const start = Date.now();
+  let ended = false;
+  return {
+    end(note) {
+      if (ended) return 0;
+      ended = true;
+      const ms = Date.now() - start;
+      if (enabled) {
+        const suffix = note ? ` ${note}` : '';
+        process.stderr.write(`[perf] ${name} ${ms}ms${suffix}\n`);
+      }
+      return ms;
+    },
+  };
+}
+
+/**
+ * Wrap a promise-returning function in a perf timer. The returned
+ * promise resolves/rejects identically to the original; timing is
+ * captured on both paths (success notes nothing, failure notes
+ * `(failed)` so a reader can see which branch blew the budget).
+ */
+export async function perfAsync(name, fn) {
+  const t = perfTimer(name);
+  try {
+    const result = await fn();
+    t.end();
+    return result;
+  } catch (err) {
+    t.end('(failed)');
+    throw err;
+  }
+}

package/src/lib/project-guard.js

@@ -0,0 +1,39 @@
+/**
+ * Shared "are we in a Vibecarbon project?" guard.
+ *
+ * Every CLI subcommand that mutates or reads a project's tree must call
+ * `assertInProjectDir()` as its FIRST action — before banners, secret
+ * scans, prompt-clears, or anything else that touches the cwd. An
+ * accidental invocation from a parent directory (e.g. ~/repos) would
+ * otherwise descend into every sibling repo, dump real tokens to the
+ * scrollback (when a secret-scan runs), or print a confusing fatal
+ * error before any "not in a project" message ever appears.
+ *
+ * The check is deliberately strict: a Vibecarbon project always has
+ * `docker-compose.yml` at its root (templated by `vibecarbon create`),
+ * even for cloud-only k8s deploys. Requiring both `.vibecarbon.json`
+ * (loadProjectConfig, with package.json fallback) AND `docker-compose.yml`
+ * means the Vibecarbon source repo itself — which has a package.json but
+ * no docker-compose.yml — is correctly rejected.
+ */
+
+import * as p from '@clack/prompts';
+import { hasDockerCompose, loadProjectConfig } from './config.js';
+
+/**
+ * Verify the current working directory is a Vibecarbon project. On
+ * failure, print the canonical error/info pair and exit 1. Returns the
+ * loaded project config so callers don't have to reload it.
+ *
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @returns {object} - Project config from `loadProjectConfig`
+ */
+export function assertInProjectDir(cwd = process.cwd()) {
+  const projectConfig = loadProjectConfig(cwd);
+  if (!projectConfig || !hasDockerCompose(cwd)) {
+    p.log.error('Not in a Vibecarbon project directory.');
+    p.log.info('Run this command from within a project created with `vibecarbon create`.');
+    process.exit(1);
+  }
+  return projectConfig;
+}