vibecarbon 0.1.0

package/src/shell.js

@@ -0,0 +1,222 @@
+/**
+ * `vibecarbon shell [env]`
+ *
+ * Drops the operator into an interactive bash with KUBECONFIG,
+ * HCLOUD_TOKEN, and HCLOUD_NETWORK exported so kubectl + hcloud
+ * "just work" against the named environment. Use SSH directly for
+ * per-node debug (the master IP + ssh key path are in the welcome
+ * banner). Companion to `vibecarbon deploy` — once the cluster is up
+ * the operator can iterate against it interactively.
+ *
+ * Defaults: env = first non-flag arg, falling back to `prod`. The
+ * kubeconfig + ssh key paths follow the same convention as the deploy
+ * code path:
+ *   <cwd>/.vibecarbon/kubeconfig-<env>
+ *   <cwd>/.vibecarbon/ssh-<env>
+ *
+ * Env vars are sourced from ~/.vibecarbon/credentials.json (HCLOUD_TOKEN)
+ * and from .vibecarbon.json (HCLOUD_NETWORK).
+ */
+
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { renderHelp } from './lib/cli/help.js';
+import { parseFlags } from './lib/cli/parse-flags.js';
+import { c } from './lib/colors.js';
+import { loadProjectConfig } from './lib/config.js';
+import { ensureOperatorIpAccess } from './lib/operator-ip.js';
+import { assertInProjectDir } from './lib/project-guard.js';
+
+/** @type {import('./lib/cli/parse-flags.js').CommandSpec & { summary?: string, description?: string }} */
+const SPEC = {
+  name: 'shell',
+  summary: 'Drop into an interactive shell with cluster context',
+  description: [
+    'Drops you into an interactive bash with KUBECONFIG, VC_SSH_KEY,',
+    'HCLOUD_TOKEN, HCLOUD_NETWORK, and VC_ENV exported so kubectl + hcloud',
+    'work against the named environment. Use SSH directly for per-node debug',
+    '(master IP + ssh key path are in the welcome banner).',
+    '',
+    'Exports:',
+    '  KUBECONFIG       <cwd>/.vibecarbon/kubeconfig-<env>',
+    '  VC_SSH_KEY       <cwd>/.vibecarbon/ssh-<env>',
+    '  HCLOUD_TOKEN     From ~/.vibecarbon/credentials.json',
+    '  HCLOUD_NETWORK   From .vibecarbon.json (if present)',
+    '  VC_ENV           Environment name (so PS1 can reference it)',
+  ].join('\n'),
+  positional: [
+    {
+      name: 'env',
+      optional: true,
+      description: 'Environment to load (default: prod)',
+    },
+  ],
+  flags: [{ name: 'h', boolean: true, description: 'Show this help' }],
+};
+
+function loadCredentialsHcloudToken() {
+  const credPath = join(homedir(), '.vibecarbon', 'credentials.json');
+  if (!existsSync(credPath)) return null;
+  try {
+    const data = JSON.parse(readFileSync(credPath, 'utf-8'));
+    return data?.hetzner?.apiToken ?? data?.hetznerApiToken ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function loadHcloudNetwork(envName) {
+  const projConfigPath = join(process.cwd(), '.vibecarbon.json');
+  if (!existsSync(projConfigPath)) return null;
+  try {
+    const data = JSON.parse(readFileSync(projConfigPath, 'utf-8'));
+    return data?.environments?.[envName]?.networkId ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export async function run(args) {
+  const { values, positional, errors } = parseFlags(args, SPEC);
+
+  if (errors.length > 0) {
+    for (const e of errors) {
+      process.stderr.write(`${c.error('✗')} ${e}\n`);
+    }
+    process.stderr.write(`Run ${c.info('vibecarbon shell -h')} for usage.\n`);
+    process.exit(1);
+  }
+
+  if (values.h) {
+    process.stdout.write(renderHelp(SPEC));
+    process.exit(0);
+  }
+
+  // Project guard runs first so an accidental `vibecarbon shell` from a
+  // parent directory emits the canonical message instead of confusing
+  // "kubeconfig not found" warnings.
+  assertInProjectDir();
+
+  const envName = /** @type {string|undefined} */ (positional.env) ?? 'prod';
+  const cwd = process.cwd();
+  const kubeconfig = join(cwd, '.vibecarbon', `kubeconfig-${envName}`);
+  const sshKey = join(cwd, '.vibecarbon', `ssh-${envName}`);
+
+  // Warn but don't bail if either is missing — the operator may be
+  // debugging exactly that case (e.g. cluster is half-up, only one of
+  // the two artifacts landed). Better to drop them in with what we have.
+  if (!existsSync(kubeconfig)) {
+    console.error(`${c.warning('!')} kubeconfig not found at ${kubeconfig}`);
+    console.error('  kubectl will not work until the cluster is bootstrapped.');
+  }
+  if (!existsSync(sshKey)) {
+    console.error(`${c.warning('!')} ssh key not found at ${sshKey}`);
+    console.error('  Per-node ssh debug will not work until deploy has run.');
+  }
+
+  const hcloudToken = loadCredentialsHcloudToken();
+  if (!hcloudToken) {
+    console.error(
+      `${c.warning('!')} HCLOUD_TOKEN not found in ~/.vibecarbon/credentials.json — hcloud CLI will be unauthenticated.`,
+    );
+  }
+  const hcloudNetwork = loadHcloudNetwork(envName);
+
+  // Auto-detect operator IP and ensure firewall lets us in. If the IP is
+  // already covered by an entry in .vibecarbon.json's operatorCidrs we
+  // refresh lastUsedAt and proceed silently.
+  const projectConfig = loadProjectConfig();
+  if (projectConfig && hcloudToken) {
+    try {
+      const isHA = !!projectConfig.environments?.[envName]?.ha?.enabled;
+      const result = await ensureOperatorIpAccess({
+        projectConfig,
+        environment: envName,
+        isHA,
+        apiToken: hcloudToken,
+        yes: false,
+        onMessage: (msg) => console.error(`${c.info('i')} ${msg}`),
+      });
+      if (result.added) {
+        console.error(`${c.success('✓')} Firewall updated: SSH/k8s API now allow ${result.cidr}`);
+      }
+    } catch (err) {
+      console.error(`${c.warning('!')} Operator-IP check failed: ${err.message}`);
+      console.error('  Continuing — kubectl/SSH may time out if your IP is not allowlisted.');
+    }
+  }
+
+  // Per-env known_hosts file (deploy populates this — see lib/host-keys.js).
+  // The ssh wrapper below points at it so reconnects after Hetzner recycles
+  // a public IP don't trip TOFU rejections, and host-key checking still
+  // works the way the deploy path expects.
+  const khPath = join(cwd, '.vibecarbon', `known_hosts_${envName}`);
+
+  const env = {
+    ...process.env,
+    KUBECONFIG: kubeconfig,
+    VC_SSH_KEY: sshKey,
+    VC_ENV: envName,
+    VC_KNOWN_HOSTS: khPath,
+  };
+  if (hcloudToken) env.HCLOUD_TOKEN = hcloudToken;
+  if (hcloudNetwork) env.HCLOUD_NETWORK = String(hcloudNetwork);
+
+  // Build a custom PS1 that's obviously not the user's normal prompt.
+  // --rcfile lets us inherit ~/.bashrc but layer on the prompt, a welcome
+  // banner showing what's exported, and an `ssh` shell function that
+  // matches the deploy path's options (BatchMode=yes so a missing key
+  // doesn't fall back to interactive password prompt; accept-new against
+  // VC_KNOWN_HOSTS so first-touch hosts don't y/N the operator).
+  const rcLines = [
+    '[ -f ~/.bashrc ] && source ~/.bashrc',
+    `export PS1='\\[\\033[1;36m\\](vc:${envName})\\[\\033[0m\\] \\w \\$ '`,
+    // Wrap ssh + scp so plain `ssh root@<ip>` works without password fall-
+    // back. Use a function (not alias) so it composes cleanly with `|` /
+    // `<()` and so the user can override per-call (`ssh -o BatchMode=no
+    // ...`) — function args come first, then our defaults.
+    'ssh()  { command ssh  -i "$VC_SSH_KEY" -o "UserKnownHostsFile=$VC_KNOWN_HOSTS" -o GlobalKnownHostsFile=/dev/null -o StrictHostKeyChecking=accept-new -o BatchMode=yes -o ConnectTimeout=10 "$@"; }',
+    'scp()  { command scp  -i "$VC_SSH_KEY" -o "UserKnownHostsFile=$VC_KNOWN_HOSTS" -o GlobalKnownHostsFile=/dev/null -o StrictHostKeyChecking=accept-new -o BatchMode=yes -o ConnectTimeout=10 "$@"; }',
+    'export -f ssh scp',
+    'echo ""',
+    `echo "  vibecarbon shell — env=${envName}"`,
+    `echo "  KUBECONFIG=${kubeconfig}"`,
+    `echo "  VC_SSH_KEY=${sshKey}"`,
+    `echo "  VC_KNOWN_HOSTS=${khPath}"`,
+    hcloudToken ? '  echo "  HCLOUD_TOKEN=<set>"' : '  echo "  HCLOUD_TOKEN=<unset>"',
+    hcloudNetwork ? `echo "  HCLOUD_NETWORK=${hcloudNetwork}"` : 'echo "  HCLOUD_NETWORK=<unset>"',
+    'echo ""',
+    'echo "Try: kubectl get nodes -o wide   |   ssh root@<ip> journalctl -u k3s   |   hcloud server list"',
+    'echo "ssh/scp are pre-configured (BatchMode + per-env known_hosts) — no password prompts."',
+    'echo "Type \\"exit\\" to leave."',
+    'echo ""',
+  ];
+  const rcContent = rcLines.join('\n');
+
+  // Write rc to a tmpfile that's deleted when the shell closes.
+  const { writeFileSync, unlinkSync, mkdtempSync } = await import('node:fs');
+  const { tmpdir } = await import('node:os');
+  const tmpDir = mkdtempSync(join(tmpdir(), 'vibecarbon-shell-'));
+  const rcPath = join(tmpDir, 'bashrc');
+  writeFileSync(rcPath, rcContent, { mode: 0o600 });
+
+  const child = spawn('bash', ['--rcfile', rcPath, '-i'], {
+    stdio: 'inherit',
+    env,
+    cwd,
+  });
+
+  await new Promise((resolve) => {
+    child.on('exit', (code) => {
+      try {
+        unlinkSync(rcPath);
+      } catch {
+        // best-effort cleanup
+      }
+      process.exit(code ?? 0);
+      resolve();
+    });
+  });
+}