vibecarbon 0.1.7 → 0.2.1

package/src/lib/deploy/orchestrator.js

@@ -542,7 +542,7 @@ export async function executeDeployment(args, gatheredConfig) {
       );
       s.stop('Compose HA deployment complete');
     } else {
-      const { setupServer, dockerLoginOnServer, startComposeStack } = await import(
+      const { setupServer, dockerLoginOnServer, startComposeStack, runMigrations } = await import(
         './compose/index.js'
       );
       const { setupServerFiles, waitForSSH: waitForComposeSSH } = await import(
@@ -782,6 +782,18 @@ export async function executeDeployment(args, gatheredConfig) {
         startComposeStack(serverIp, sshKeyPath, projectConfig.projectName, services),
       );
 
+      // Apply app migrations + reload PostgREST. The orchestrator's inline
+      // single-compose path previously skipped this (only deployComposeHA ran
+      // runMigrations), so compose-single shipped an EMPTY app schema — 0 public
+      // tables, every DB-backed feature 500'd, and db_schema verify failed with
+      // PGRST205. runMigrations waits for supabase_admin, applies each
+      // supabase/migrations/* with ON_ERROR_STOP=1 (a real failure aborts the
+      // deploy rather than silently shipping a schema-less prod), then reloads
+      // PostgREST's schema cache. Mirrors the HA path.
+      await perfAsync('deploy.compose.migrations', () =>
+        runMigrations(serverIp, sshKeyPath, projectConfig.projectName),
+      );
+
       // --- Verifiable success gate ---
       // Probe the app's own /api/health endpoint on the server itself (via
       // localhost + Host header), bypassing DNS/TLS. A successful deploy

package/src/lib/deploy/remote-build.js

@@ -36,8 +36,13 @@ export async function buildRemote(ip, sshKeyPath, imageTag, cwd, buildArgs = {})
   // key path via env var rather than string-interpolating into the script
   // to keep shell-escaping concerns out of the picture (paths with spaces
   // or quotes would otherwise break the wrapper).
+  // ServerAliveInterval/CountMax: BuildKit holds a long-lived SSH session for
+  // the build; on a congested/cross-region link it can stall and the http2
+  // session helper drops with "error reading preface ... file already closed".
+  // Keepalives let ssh detect a dead peer (~60s) and fail the attempt cleanly
+  // so the retry below can re-establish, instead of hanging to the build timeout.
   const sshWrapper = `#!/bin/bash
-exec /usr/bin/ssh -i "$VIBECARBON_SSH_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=30 "$@"
+exec /usr/bin/ssh -i "$VIBECARBON_SSH_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=30 -o ServerAliveInterval=15 -o ServerAliveCountMax=4 "$@"
 `;
   writeFileSync(sshWrapperPath, sshWrapper, { mode: 0o755 });
 
@@ -103,15 +108,31 @@ exec /usr/bin/ssh -i "$VIBECARBON_SSH_KEY" -o StrictHostKeyChecking=no -o UserKn
     // (compose-ha 2026-05-09T00:38 e2 failure). Treat the false return as a
     // hard failure so the error path captures + reports it.
     const buildT = perfTimer('deploy.image.remoteBuild');
-    const buildOk = runCommand(args, {
-      cwd,
-      stdio: 'inherit',
-      env,
-      timeout: 600000,
-    });
+    // BuildKit-over-SSH is flaky on first connect to a freshly-booted (often
+    // cross-region) VPS: the session helper intermittently drops mid-build with
+    // `http2: server: error reading preface ... file already closed` / an SSH
+    // reset, and runCommand returns false. Retry a few times — each attempt
+    // re-establishes a fresh SSH/BuildKit session, and BuildKit's cache makes
+    // retries cheap. Without this a single transient drop failed the whole
+    // deploy (compose-ha standby) or left no image so `docker compose up` later
+    // hit "pull access denied" (compose scale, e2e loop run #1).
+    const BUILD_ATTEMPTS = 3;
+    let buildOk = false;
+    for (let attempt = 1; attempt <= BUILD_ATTEMPTS; attempt++) {
+      buildOk = runCommand(args, { cwd, stdio: 'inherit', env, timeout: 600000 });
+      if (buildOk !== false) break;
+      if (attempt < BUILD_ATTEMPTS) {
+        console.error(
+          `[remote-build] docker build on ${ip} failed (attempt ${attempt}/${BUILD_ATTEMPTS}) — retrying in ${3 * attempt}s`,
+        );
+        await new Promise((r) => setTimeout(r, 3000 * attempt));
+      }
+    }
     buildT.end();
     if (buildOk === false) {
-      throw new Error(`docker build failed on ${ip} for tag ${imageTag}`);
+      throw new Error(
+        `docker build failed on ${ip} for tag ${imageTag} after ${BUILD_ATTEMPTS} attempts`,
+      );
     }
 
     s.stop(`Image built natively: ${imageTag}`);

package/src/remove.js

@@ -49,15 +49,15 @@ const SPEC = {
     { name: 'y', boolean: true, description: 'Skip confirmation prompts' },
     { name: 'force', boolean: true, description: 'Skip confirmation prompt (alias for -y)' },
     {
-      name: 'offline',
+      name: 'online',
       boolean: true,
-      description: 'Use bundled service definitions (for air-gapped environments)',
+      description: 'Fetch the latest service definitions from GitHub instead of the packaged copy',
     },
   ],
   examples: [
     { command: 'vibecarbon remove', description: 'prompts for a feature to remove' },
-    { command: 'vibecarbon remove n8n', description: 'remove a specific feature' },
-    { command: 'vibecarbon remove n8n -force', description: 'remove without confirmation' },
+    { command: 'vibecarbon remove redis', description: 'remove a specific feature' },
+    { command: 'vibecarbon remove redis -force', description: 'remove without confirmation' },
   ],
 };
 
@@ -94,7 +94,10 @@ function removeDirectory(dirPath) {
 // ============================================================================
 
 async function removeService(serviceName, options) {
-  const { force, offline } = options;
+  const { force } = options;
+  // Default to the packaged service definitions (mirrors `add`); `-online`
+  // opts into fetching the latest from GitHub.
+  const offline = !options.online;
 
   const projectManifest = loadManifest();
 
@@ -262,7 +265,7 @@ async function main(cliArgs) {
   for (const serviceName of services) {
     const result = await removeService(serviceName, {
       force,
-      offline: !!values.offline,
+      online: !!values.online,
     });
     if (!result) {
       success = false;

package/src/scale.js

@@ -439,9 +439,22 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       // Reuses the same code that does direct-mode deploy builds.
       if (oldAppImage && isLocalOnlyImageTag(oldAppImage)) {
         s.start(`Building image ${oldAppImage} on new server...`);
-        await perfAsync('scale.sideloadImage', () =>
+        const built = await perfAsync('scale.sideloadImage', () =>
           buildRemote(newIp, sshKeyPath, oldAppImage, process.cwd()),
         );
+        // buildRemote returns false on failure (after its own retries). The app
+        // image is local-only, so if it isn't built on the new server, the
+        // `docker compose up` below pulls it and dies ~a minute later with
+        // "pull access denied / repository does not exist" — a confusing
+        // downstream symptom. Fail loudly here instead; this guard was missing
+        // (the HA deploy path has the equivalent check). RCA: e2e loop run #1.
+        if (!built) {
+          s.stop('Remote image build failed on new server', 1);
+          throw new Error(
+            `scale: failed to build local app image ${oldAppImage} on new server ${newIp} ` +
+              `(buildRemote exhausted its retries) — aborting before compose up.`,
+          );
+        }
         s.stop('Image built on new server');
       }
 

package/carbon/content/docs/optional-services.mdx

@@ -1,160 +0,0 @@
----
-title: "Optional Services"
-description: "Add workflow automation, analytics, caching, monitoring, and CI/CD to your project."
-order: 10
----
-
-## Overview
-
-Vibecarbon ships with a core stack (Supabase, Traefik, Hono API, React SPA). You can extend it with optional services using the CLI:
-
-```bash
-# Interactive — prompts for which service to add
-npx vibecarbon add
-
-# Or seed the service name to skip the prompt
-npx vibecarbon add <service>
-```
-
-Each service adds Docker Compose files, Kubernetes manifests, environment variables, and feature flags to your project. Running the command multiple times is safe — it won't duplicate anything.
-
-```bash
-# See available services in the interactive prompt body
-npx vibecarbon add
-
-# Remove a previously added service
-npx vibecarbon remove <service>
-```
-
-## n8n — Workflow Automation
-
-A self-hosted workflow automation platform for building integrations, scheduled jobs, and webhook-driven pipelines.
-
-```bash
-npx vibecarbon add n8n
-```
-
-**What gets added:**
-- `docker-compose.n8n.yml` — n8n container with PostgreSQL backend
-- `k8s/base/n8n/` — Kubernetes manifests
-- `volumes/db/n8n-init.sh` — Database initialization script
-- Environment variables: `N8N_WEBHOOK_URL`, `N8N_API_KEY`
-- Feature flags: `VITE_N8N_ENABLED`, `N8N_ENABLED`
-
-| Setting | Value |
-|---------|-------|
-| Dev URL | http://n8n.localhost |
-| Port | 5678 |
-| Production auth | Traefik ForwardAuth (`super_admin` role) |
-
-## Metabase — Business Intelligence
-
-A self-hosted analytics dashboard that connects directly to your Supabase PostgreSQL database.
-
-```bash
-npx vibecarbon add metabase
-```
-
-**What gets added:**
-- `docker-compose.metabase.yml` — Metabase container
-- `k8s/base/metabase/` — Kubernetes manifests
-- `volumes/db/metabase-init.sh` — Database initialization script
-- Environment variables: `METABASE_ADMIN_EMAIL`, `METABASE_ADMIN_PASSWORD`
-- Feature flags: `VITE_METABASE_ENABLED`, `METABASE_ENABLED`
-
-| Setting | Value |
-|---------|-------|
-| Dev URL | http://metabase.localhost |
-| Port | 3001 |
-| Production auth | Traefik ForwardAuth (`super_admin` role) |
-
-## Redis — Caching & Sessions
-
-An in-memory data store for server-side caching, rate limiting, and session storage.
-
-```bash
-npx vibecarbon add redis
-```
-
-**What gets added:**
-- `docker-compose.redis.yml` — Redis container
-- `k8s/base/redis/` — Kubernetes manifests
-- Environment variables: `REDIS_PASSWORD` (auto-generated)
-- Feature flags: `VITE_REDIS_ENABLED`, `REDIS_ENABLED`
-
-| Setting | Value |
-|---------|-------|
-| Host | localhost:6379 |
-| Credentials | Stored in `.env.local` (`REDIS_PASSWORD`) |
-
-When `REDIS_URL` is set, the built-in rate limiter automatically uses Redis for distributed limiting across multiple replicas. Without Redis, it falls back to an in-memory store — this works for single-instance deployments but does not share state across replicas.
-
-## Observability — Monitoring Stack
-
-Enables the built-in Prometheus, Grafana, and Loki stack for metrics, dashboards, and log aggregation.
-
-```bash
-npx vibecarbon add observability
-```
-
-**What gets added:**
-- Enables `docker-compose.observability.yml` (already bundled in your project)
-- Feature flags: `VITE_OBSERVABILITY_ENABLED`, `OBSERVABILITY_ENABLED`
-
-| Setting | Value |
-|---------|-------|
-| Grafana URL | http://grafana.localhost |
-| Prometheus Port | 9190 |
-| Loki Port | 3100 |
-| Production auth | Traefik ForwardAuth (`super_admin` role) |
-
-## GitHub — Repository & CI/CD
-
-CI/CD lives in `vibecarbon configure`, not `vibecarbon add`. It creates the GitHub repository (if missing), installs the canonical build + deploy workflows under `.github/workflows/`, rewrites image references to `ghcr.io/<owner>/<project>`, and flips `cicdEnabled: true` in `vibecarbon.json`.
-
-```bash
-npx vibecarbon configure
-```
-
-Pick **CI/CD** from the feature list. The wizard handles repo creation, image-ref rewriting, and workflow installation in one pass.
-
-**Prerequisites:** The [GitHub CLI](https://cli.github.com/) (`gh`) must be installed and authenticated.
-
-**What gets added:**
-- `.github/workflows/vibecarbon-build.yml` — image build pipeline
-- `.github/workflows/deploy.yml` — k8s push-deploy pipeline
-- Container image + Flux GitRepository references updated to `<owner>/<project>`
-
-## Production Auth for Admin Services
-
-In development, n8n, Metabase, and Grafana are accessible without authentication. In production, they are protected by Traefik ForwardAuth — only users with the `super_admin` role can access them.
-
-The dev override compose files disable this requirement locally. When adding a new service that needs protection, follow the same pattern:
-
-1. Add `traefik.http.routers.<name>.middlewares=super-admin-auth@file` in the service compose file
-2. Create a dev override that sets the middleware to empty
-
-## Feature Flags
-
-Each service sets client and server feature flags in `.env.local`:
-
-| Service | Client Flag | Server Flag |
-|---------|------------|-------------|
-| n8n | `VITE_N8N_ENABLED` | `N8N_ENABLED` |
-| Metabase | `VITE_METABASE_ENABLED` | `METABASE_ENABLED` |
-| Redis | `VITE_REDIS_ENABLED` | `REDIS_ENABLED` |
-| Observability | `VITE_OBSERVABILITY_ENABLED` | `OBSERVABILITY_ENABLED` |
-
-Use these flags to conditionally render UI elements or enable server-side integrations:
-
-```typescript
-// Client-side
-if (import.meta.env.VITE_N8N_ENABLED === 'true') {
-  // Show n8n link in admin sidebar
-}
-
-// Server-side
-if (process.env.REDIS_ENABLED === 'true') {
-  // Use Redis for caching
-}
-```

package/carbon/src/client/components/MetricsStrip.tsx

@@ -1,48 +0,0 @@
-import { motion, useInView } from 'framer-motion';
-import { useRef } from 'react';
-import { useTranslation } from 'react-i18next';
-
-export function MetricsStrip() {
-  const { t } = useTranslation();
-  const ref = useRef<HTMLElement>(null);
-  const isInView = useInView(ref, { once: true, margin: '-50px' });
-
-  const METRICS = [
-    { value: t('landing.metrics.time.value'), label: t('landing.metrics.time.label') },
-    { value: t('landing.metrics.services.value'), label: t('landing.metrics.services.label') },
-    { value: t('landing.metrics.config.value'), label: t('landing.metrics.config.label') },
-    { value: t('landing.metrics.commands.value'), label: t('landing.metrics.commands.label') },
-  ];
-
-  return (
-    <section ref={ref} className="relative overflow-hidden border-y border-border/30">
-      <div className="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-primary/30 to-transparent" />
-      <div className="absolute inset-x-0 bottom-0 h-px bg-gradient-to-r from-transparent via-primary/30 to-transparent" />
-
-      {/* Horizontal gradient band behind */}
-      <div className="absolute inset-0 bg-gradient-to-r from-transparent via-primary/5 to-transparent" />
-      <div className="absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 w-[800px] h-[300px] rounded-full bg-primary/6 blur-[120px] pointer-events-none" />
-
-      <div className="relative mx-auto max-w-7xl px-6 py-16">
-        <div className="grid grid-cols-2 md:grid-cols-4 divide-x divide-border/30">
-          {METRICS.map((metric, i) => (
-            <motion.div
-              key={metric.label}
-              initial={{ opacity: 0, y: 20 }}
-              animate={isInView ? { opacity: 1, y: 0 } : {}}
-              transition={{ duration: 0.5, delay: i * 0.1 }}
-              className="px-6 py-4 text-center hover:bg-primary/[0.03] transition-colors duration-300"
-            >
-              <div className="metric-value text-2xl sm:text-3xl md:text-4xl font-black tracking-tight mb-2">
-                {metric.value}
-              </div>
-              <div className="text-xs sm:text-sm text-muted-foreground uppercase tracking-widest">
-                {metric.label}
-              </div>
-            </motion.div>
-          ))}
-        </div>
-      </div>
-    </section>
-  );
-}