vibecarbon 0.1.0

package/src/lib/server-types.js

@@ -0,0 +1,195 @@
+/**
+ * Server Type Selection Utilities
+ *
+ * Shared logic for building server type selection prompts used by
+ * both the deploy and scale commands.
+ */
+
+import { HetznerProvider } from './providers/hetzner.js';
+
+// Minimum server specs for a full Compose stack (Supabase + app + Traefik + socket-proxy)
+export const COMPOSE_MIN_RAM_GB = 4;
+
+// Curated K8s deployment profiles — sensible combinations of master + supabase + worker.
+// Each profile has ARM (cax) and x86 (cpx) variants; the correct one is chosen per region.
+export const K8S_PROFILES = [
+  {
+    name: 'starter',
+    label: 'Starter',
+    hint: 'Good for MVPs and low-traffic apps',
+    arm: { master: 'cax11', supabase: 'cax21', worker: 'cax11' },
+    x86: { master: 'cpx11', supabase: 'cpx21', worker: 'cpx11' },
+  },
+  {
+    name: 'production',
+    label: 'Production',
+    hint: 'Recommended for production workloads',
+    arm: { master: 'cax21', supabase: 'cax31', worker: 'cax21' },
+    x86: { master: 'cpx21', supabase: 'cpx31', worker: 'cpx21' },
+  },
+  {
+    name: 'enterprise',
+    label: 'Enterprise',
+    hint: 'High-traffic apps with large databases',
+    arm: { master: 'cax31', supabase: 'cax41', worker: 'cax31' },
+    x86: { master: 'cpx31', supabase: 'cpx41', worker: 'cpx31' },
+  },
+];
+
+/**
+ * Parse a price string like "€7.99/mo" into a number.
+ */
+export function parsePrice(priceStr) {
+  const match = (priceStr || '').match(/[\d.]+/);
+  return match ? Number.parseFloat(match[0]) : 0;
+}
+
+/**
+ * Format a server type label with aligned columns.
+ * Pre-computes column widths from the full list so values line up.
+ */
+function buildAlignedLabels(types) {
+  const nameW = Math.max(...types.map((t) => t.name.length));
+  const vcpuW = Math.max(...types.map((t) => String(t.vcpu).length));
+  const ramW = Math.max(...types.map((t) => String(t.ram).length));
+  const diskW = Math.max(...types.map((t) => String(t.disk).length));
+
+  return new Map(
+    types.map((t) => [
+      t.name,
+      `${t.name.padEnd(nameW)} - ${String(t.vcpu).padStart(vcpuW)} vCPU, ${String(t.ram).padStart(ramW)}GB RAM, ${String(t.disk).padStart(diskW)}GB`,
+    ]),
+  );
+}
+
+/**
+ * Build select options for Compose server type prompt.
+ * Disables types that are too small, marks minimum and recommended.
+ */
+export function buildComposeTypeOptions(regionTypes, defaultType) {
+  const { INFRA_COSTS } = HetznerProvider;
+  const filtered = regionTypes.filter((t) => !t.cpuType || t.cpuType === 'shared');
+  const labels = buildAlignedLabels(filtered);
+
+  return filtered.map((t) => {
+    const tooSmall = t.ram < COMPOSE_MIN_RAM_GB;
+    const isMinimum = !tooSmall && t.ram === COMPOSE_MIN_RAM_GB && t.disk <= 40;
+    const isRecommended = t.name === defaultType;
+
+    const serverCost = parsePrice(t.price);
+    const totalCost = serverCost + INFRA_COSTS.s3MinBucket;
+
+    let hint = '';
+    if (tooSmall) {
+      hint = `need ${COMPOSE_MIN_RAM_GB}GB+ RAM for Supabase`;
+    } else if (isMinimum) {
+      hint = `~€${totalCost.toFixed(0)}/mo total — minimum`;
+    } else if (isRecommended) {
+      hint = `~€${totalCost.toFixed(0)}/mo total — recommended`;
+    } else {
+      hint = `~€${totalCost.toFixed(0)}/mo total`;
+    }
+
+    return {
+      value: t.name,
+      label: labels.get(t.name),
+      hint,
+      disabled: tooSmall,
+    };
+  });
+}
+
+/**
+ * Build select options for K8s cluster size profiles.
+ * Calculates total monthly cost including all provisioned infra.
+ */
+export function buildK8sProfileOptions(_region, regionTypes, secondaryRegion) {
+  const { INFRA_COSTS, VOLUME_SIZES, SERVER_TYPES } = HetznerProvider;
+
+  // Determine available types (intersection of both regions for HA)
+  const availableNames = new Set(regionTypes.map((t) => t.name));
+  let effectiveAvailable = availableNames;
+  if (secondaryRegion) {
+    const secondaryNames = new Set(
+      HetznerProvider.getServerTypesForRegion(secondaryRegion).map((t) => t.name),
+    );
+    effectiveAvailable = new Set([...availableNames].filter((n) => secondaryNames.has(n)));
+  }
+
+  const hasArm = effectiveAvailable.has('cax11');
+  const regionMultiplier = secondaryRegion ? 2 : 1;
+
+  // Per-cluster fixed costs: floating IP + base CSI volumes
+  const fixedPerCluster = INFRA_COSTS.floatingIp + VOLUME_SIZES.base * INFRA_COSTS.volumePerGb;
+
+  return K8S_PROFILES.map((profile) => {
+    const variant = hasArm ? profile.arm : profile.x86;
+
+    // Check all types in this profile are available
+    const allAvailable = [variant.master, variant.supabase, variant.worker].every((t) =>
+      effectiveAvailable.has(t),
+    );
+    if (!allAvailable) return null;
+
+    const serverCost =
+      parsePrice(SERVER_TYPES[variant.master]?.price) +
+      parsePrice(SERVER_TYPES[variant.supabase]?.price) +
+      parsePrice(SERVER_TYPES[variant.worker]?.price);
+
+    const totalCost = (serverCost + fixedPerCluster) * regionMultiplier + INFRA_COSTS.s3MinBucket;
+
+    return {
+      value: profile.name,
+      label: `${profile.label}  ~€${totalCost.toFixed(0)}/mo`,
+      hint: `${profile.hint} (${variant.master} + ${variant.supabase} + ${variant.worker})`,
+      _variant: variant,
+    };
+  })
+    .filter(Boolean)
+    .concat([
+      {
+        value: 'advanced',
+        label: 'Advanced',
+        hint: 'Choose each node type individually',
+        _variant: null,
+      },
+    ]);
+}
+
+/**
+ * Detect which K8s profile matches the given server types.
+ * Returns the profile name or 'advanced' if no match.
+ */
+export function detectCurrentProfile(masterType, supabaseType, workerType) {
+  for (const profile of K8S_PROFILES) {
+    for (const arch of ['arm', 'x86']) {
+      const v = profile[arch];
+      if (v.master === masterType && v.supabase === supabaseType && v.worker === workerType) {
+        return profile.name;
+      }
+    }
+  }
+  return 'advanced';
+}
+
+/**
+ * Build a flat list of server type select options.
+ * Used for K8s Advanced mode individual node selection and the scale command.
+ *
+ * @param {Array} regionTypes - from HetznerProvider.getServerTypesForRegion()
+ * @param {object} [options]
+ * @param {boolean} [options.filterSharedCpu=true] - filter to shared CPU types only
+ * @returns {Array<{value: string, label: string}>}
+ */
+export function buildSimpleTypeOptions(regionTypes, { filterSharedCpu = true } = {}) {
+  const filtered = filterSharedCpu
+    ? regionTypes.filter((t) => !t.cpuType || t.cpuType === 'shared')
+    : regionTypes;
+
+  const labels = buildAlignedLabels(filtered);
+
+  return filtered.map((t) => ({
+    value: t.name,
+    label: labels.get(t.name),
+  }));
+}

package/src/lib/shell.js

@@ -0,0 +1,91 @@
+/**
+ * Shell / dotenv / SQL / YAML escaping helpers.
+ *
+ * All helpers produce values safe to paste into the corresponding sink.
+ * None of them perform any validation — callers must validate input before
+ * reaching a sink that a hostile value could corrupt.
+ */
+
+/**
+ * POSIX shell single-quote escape. Wraps value in single quotes and
+ * handles embedded single quotes via close-reopen (`'\''`).
+ */
+export function shEscape(value) {
+  return `'${String(value).replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * Dotenv single-quoted form. Same encoding as shEscape — dotenv parsers
+ * that support single-quoted values treat the content literally.
+ *
+ * NOTE: The output is valid for dotenv-package parsers that support
+ * multi-line single-quoted values (e.g. the `dotenv` npm package).
+ * It is NOT safe to `source` in bash if the value contains a literal
+ * newline — bash single-quoted strings do not span lines the same way.
+ */
+export function escapeDotenv(value) {
+  return shEscape(value);
+}
+
+/**
+ * Decode a single value from its dotenv-on-disk form back to the raw
+ * string we'd have passed to `escapeDotenv`. Handles the three shapes
+ * we emit / accept:
+ *
+ *   - `'POSIX-single-quoted'` (escapeDotenv output, with `'\''` for embedded `'`)
+ *   - `"double-quoted"` (legacy `.env` files; no escape-sequence interpretation)
+ *   - bare unquoted (legacy `.env` files; treated as the literal value)
+ *
+ * Inverse of `escapeDotenv` for any string that didn't contain a literal newline
+ * inside an unquoted value.
+ */
+export function unescapeDotenv(raw) {
+  if (raw == null) return '';
+  const v = String(raw);
+  if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) {
+    return v.slice(1, -1).replace(/'\\''/g, "'");
+  }
+  if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) {
+    return v.slice(1, -1);
+  }
+  return v;
+}
+
+/**
+ * Parse the full text of a `.env`-style file into a flat key→value map,
+ * decoding any escapeDotenv-quoted values back to their raw form.
+ *
+ * Skips blank lines and `#`-prefixed comments. Lines that don't match
+ * `KEY=VALUE` (e.g. `export FOO=bar` or stray text) are also ignored —
+ * we only care about the canonical `KEY=VALUE` shape that `renderBundle`
+ * itself produces. Multi-line single-quoted values are NOT supported here;
+ * we only emit single-line values from `escapeDotenv`, so the on-disk
+ * shape we read back is always single-line.
+ */
+export function parseDotenv(text) {
+  const out = {};
+  if (!text) return out;
+  for (const line of String(text).split('\n')) {
+    if (!line || line.startsWith('#')) continue;
+    const m = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
+    if (!m) continue;
+    out[m[1]] = unescapeDotenv(m[2]);
+  }
+  return out;
+}
+
+/**
+ * Postgres SQL single-quote escape. Returns a complete SQL string literal
+ * (including outer single quotes), ready to paste anywhere a SQL string
+ * literal is expected.
+ */
+export function escapeSql(value) {
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+
+/**
+ * YAML-safe encoding via JSON string literal.
+ */
+export function escapeYaml(value) {
+  return JSON.stringify(String(value));
+}

package/src/lib/ssh.js

@@ -0,0 +1,241 @@
+/**
+ * Shared SSH/SCP/kubectl helpers.
+ *
+ * All helpers use argv (spawn) form via runCommand — no local shell
+ * interpolation. The remote shell still parses whatever reaches it, so
+ * callers that build commands from dynamic data should either:
+ *   1. Use sshRun with an argv array (preferred — no remote shell parsing
+ *      of dynamic tokens), or
+ *   2. Use sshRunScript to execute a bash script SCP'd as a file.
+ *
+ * Host-key checking: first-provision callers pass { firstConnect: true }
+ * which switches StrictHostKeyChecking to accept-new (TOFU). All other
+ * calls use strict checking against a per-environment known_hosts file.
+ */
+
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runCommand } from './command.js';
+import { knownHostsPath } from './host-keys.js';
+import { shEscape } from './shell.js';
+
+// k3s writes its kubeconfig here; kubectl doesn't find it by default in SSH sessions.
+const K3S_KUBECONFIG = '/etc/rancher/k3s/k3s.yaml';
+
+/**
+ * Resolve the SSH key path for an environment.
+ * HA deployments store a shared SSH key under the base env name
+ * (e.g., deploy_key_prod). Internal cluster names use -primary / -standby
+ * suffixes for filesystem resources.
+ *
+ * K8s single-cluster deploys use a different filename convention
+ * (`ssh-<env>` — see deployK3s in src/lib/deploy/k8s/k3s.js). We probe
+ * that path too so backup/restore/scale/failover work for k8s
+ * single-cluster without changing the deploy-side filename. (Compose,
+ * compose-HA, and k8s-HA all use `deploy_key_<env>`.)
+ */
+export function getSSHKeyPath(environment) {
+  const baseEnv = environment.replace(/-(primary|standby)$/, '');
+  const candidates = [
+    join(process.cwd(), '.vibecarbon', `deploy_key_${baseEnv}`),
+    join(process.cwd(), '.vibecarbon', `deploy_key_${environment}`),
+    join(process.cwd(), '.vibecarbon', `ssh-${baseEnv}`),
+    join(process.cwd(), '.vibecarbon', `ssh-${environment}`),
+  ];
+  for (const path of candidates) {
+    if (existsSync(path)) return path;
+  }
+  // Nothing exists — fall back to the literal env-name path so caller
+  // error messages name what they asked for. Matches pre-fallback
+  // semantics for HA-suffixed environments.
+  return join(process.cwd(), '.vibecarbon', `deploy_key_${environment}`);
+}
+
+/**
+ * Build the SSH `-o` option args for host-key checking.
+ *
+ * - With `env`: StrictHostKeyChecking=yes against .vibecarbon/known_hosts_<env>
+ *   (or accept-new if firstConnect=true — used during first provision).
+ *
+ * - Without `env`: bypass the user's known_hosts with UserKnownHostsFile=
+ *   /dev/null and StrictHostKeyChecking=no, matching the deploy path's long-
+ *   standing SSH_OPTS in compose/index.js. This keeps backup/restore/scale/
+ *   failover consistent with the deploy flow and avoids the Hetzner recycled-
+ *   IP footgun: destroy-then-redeploy gives you the same public IP with a new
+ *   host key, and a stale TOFU entry in ~/.ssh/known_hosts would refuse the
+ *   reconnect. H-1 (tracked in docs/superpowers/specs/2026-04-17-security-
+ *   remediation-design.md) replaces this with env-scoped pinned known_hosts
+ *   across every CLI command — callers pass `env` once the deploy path
+ *   populates .vibecarbon/known_hosts_<env>.
+ */
+function sshHostKeyOpts(env, { firstConnect = false } = {}) {
+  const opts = [];
+  if (env) {
+    opts.push('-o', `UserKnownHostsFile=${knownHostsPath(env)}`);
+    opts.push('-o', `StrictHostKeyChecking=${firstConnect ? 'accept-new' : 'yes'}`);
+  } else {
+    opts.push('-o', 'UserKnownHostsFile=/dev/null');
+    opts.push('-o', 'StrictHostKeyChecking=no');
+  }
+  opts.push('-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10');
+  // ConnectTimeout only covers TCP connect — once the socket is open, ssh
+  // will wait indefinitely for the SSH banner / protocol traffic. RCA from
+  // iter-confirm 2026-05-02: a freshly-created Hetzner VPS accepted TCP on
+  // port 22 but never sent the SSH banner, so a scale.ha.fan SSH hung for
+  // ~600s ("Connection timed out during banner exchange") until the test
+  // runner SIGKILLed it. ServerAliveInterval+CountMax force ssh to give up
+  // after 60s of no protocol-level traffic, surfacing the failure cleanly
+  // so the existing waitForSSH/runCommandAsync retry layers can recover.
+  // Keepalives are protocol-level — long-running remote commands (tar, pg
+  // dumps) won't false-trigger because sshd acks keepalives independently
+  // of the command's stdout.
+  opts.push('-o', 'ServerAliveInterval=15', '-o', 'ServerAliveCountMax=4');
+  return opts;
+}
+
+/**
+ * Execute a command on a remote server via SSH using argv form.
+ *
+ * OpenSSH joins every post-hostname argv element with a single space before
+ * sending one command string to the remote shell — it does NOT re-quote. If
+ * we spread argv directly into ssh's invocation, any token containing a space,
+ * a pipe, parentheses, or another shell metacharacter would be word-split by
+ * the remote shell and parsed as separate tokens. For `sh -c 'gunzip | psql'`
+ * that means remote sh gets `-c gunzip` (script = "gunzip") and the pipe runs
+ * in the outer shell — silently wrong.
+ *
+ * We POSIX-quote each argv element and join them into a single command string
+ * here. The remote shell word-splits that string once, sees the quotes, and
+ * reconstructs exactly the argv we intended. The local side still uses
+ * spawn/argv (no local shell), so nothing on our end interprets the contents.
+ *
+ * @param {string} ip
+ * @param {string} sshKeyPath
+ * @param {string[]} argv - remote command + args (e.g. ['docker', 'ps'])
+ * @param {object} [options]
+ * @param {string} [options.env] - project env for host-key pinning
+ * @param {boolean} [options.firstConnect=false]
+ * @param {number} [options.timeout=120000]
+ * @param {boolean} [options.silent=true]
+ * @returns {string} - trimmed stdout
+ */
+export function sshRun(ip, sshKeyPath, argv, options = {}) {
+  const { env, firstConnect = false, timeout = 120_000, silent = true } = options;
+  if (!Array.isArray(argv) || argv.length === 0) {
+    throw new Error('sshRun requires a non-empty argv array');
+  }
+  const remoteCmd = argv.map(shEscape).join(' ');
+  const cmd = [
+    'ssh',
+    '-i',
+    sshKeyPath,
+    ...sshHostKeyOpts(env, { firstConnect }),
+    '--',
+    `root@${ip}`,
+    remoteCmd,
+  ];
+  const out = runCommand(cmd, { silent, timeout, returnOutput: true });
+  return typeof out === 'string' ? out.trim() : '';
+}
+
+/**
+ * Run a multi-line bash script on a remote server.
+ * The script is SCP'd to /tmp/vb-script-<uuid>.sh (mode 0700), executed
+ * via bash, then removed. Use for pipelines that genuinely need shell
+ * features; never interpolate untrusted values into the script string.
+ */
+export function sshRunScript(ip, sshKeyPath, bashScript, options = {}) {
+  const localTmp = mkdtempSync(join(tmpdir(), 'vb-sshscript-'));
+  const localPath = join(localTmp, 'script.sh');
+  const remotePath = `/tmp/vb-script-${Date.now()}-${Math.random().toString(36).slice(2, 10)}.sh`;
+  try {
+    writeFileSync(localPath, bashScript, { mode: 0o700 });
+    scpUpload(ip, sshKeyPath, localPath, remotePath, options);
+    return sshRun(ip, sshKeyPath, ['bash', remotePath], options);
+  } finally {
+    try {
+      sshRun(ip, sshKeyPath, ['rm', '-f', remotePath], {
+        ...options,
+        silent: true,
+        timeout: 15_000,
+      });
+    } catch {
+      // best-effort cleanup
+    }
+    rmSync(localTmp, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Download a file from a remote server via SCP. Argv form.
+ */
+export function scpDownload(ip, sshKeyPath, remotePath, localPath, options = {}) {
+  const { env, firstConnect = false, timeout = 300_000 } = options;
+  const cmd = [
+    'scp',
+    '-i',
+    sshKeyPath,
+    ...sshHostKeyOpts(env, { firstConnect }),
+    '--',
+    `root@${ip}:${remotePath}`,
+    localPath,
+  ];
+  runCommand(cmd, { silent: true, timeout });
+}
+
+/**
+ * Upload a file to a remote server via SCP. Argv form.
+ */
+export function scpUpload(ip, sshKeyPath, localPath, remotePath, options = {}) {
+  const { env, firstConnect = false, timeout = 300_000 } = options;
+  const cmd = [
+    'scp',
+    '-i',
+    sshKeyPath,
+    ...sshHostKeyOpts(env, { firstConnect }),
+    '--',
+    localPath,
+    `root@${ip}:${remotePath}`,
+  ];
+  runCommand(cmd, { silent: true, timeout });
+}
+
+/**
+ * Execute a kubectl command on a remote k3s server via SSH.
+ * Takes a kubectl argv array (WITHOUT the leading 'kubectl' token — sshKubectl
+ * prepends it). The KUBECONFIG env var is injected via `env VAR=VAL`.
+ *
+ * @param {string} ip
+ * @param {string} sshKeyPath
+ * @param {string[]} kubectlArgv - kubectl subcommand + args (e.g. ['get', 'pods', '-n', 'vibecarbon'])
+ * @param {object} [options]
+ * @returns {string} trimmed stdout
+ */
+export function sshKubectl(ip, sshKeyPath, kubectlArgv, options = {}) {
+  if (!Array.isArray(kubectlArgv) || kubectlArgv.length === 0) {
+    throw new Error('sshKubectl requires a non-empty argv array (without leading "kubectl")');
+  }
+  return sshRun(
+    ip,
+    sshKeyPath,
+    ['env', `KUBECONFIG=${K3S_KUBECONFIG}`, 'kubectl', ...kubectlArgv],
+    options,
+  );
+}
+
+/**
+ * Get the name of the PostgreSQL pod in the vibecarbon namespace.
+ */
+export function getPostgresPod(ip, sshKeyPath) {
+  return sshKubectl(ip, sshKeyPath, [
+    'get',
+    'pods',
+    '-n',
+    'vibecarbon',
+    '-l',
+    'app.kubernetes.io/name=supabase-db',
+    '-o',
+    'jsonpath={.items[0].metadata.name}',
+  ]);
+}