vibecarbon 0.5.0 → 0.6.0

package/src/restore.js

@@ -19,33 +19,27 @@
 import { existsSync } from 'node:fs';
 import { basename } from 'node:path';
 import * as p from '@clack/prompts';
-import { listS3Backups } from './lib/backup-s3.js';
+import { formatInstant } from './lib/backup-format.js';
 import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
 import { selectEnvironment } from './lib/cli/select-environment.js';
 import { requireTTYOrFlags } from './lib/cli/tty-guard.js';
 import { c, printBanner } from './lib/colors.js';
-import {
-  loadBackupS3Config,
-  loadCredentials,
-  loadProjectConfig,
-  loadS3Config,
-} from './lib/config.js';
+import { loadCredentials, loadProjectConfig } from './lib/config.js';
 // Static imports (no cycle: neither compose/index.js nor compose/ha.js imports
 // restore.js). Aliased so runComposeRestore can default to the real functions
 // while still accepting injected mocks for unit tests.
 import { configureStandbyReplication as realConfigureStandbyReplication } from './lib/deploy/compose/ha.js';
 import { restoreCompose as realRestoreCompose } from './lib/deploy/compose/index.js';
-import { getS3Credentials } from './lib/hetzner-guided-setup.js';
 import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
-import { listPodBackups } from './lib/pod-backups.js';
 import { assertInProjectDir } from './lib/project-guard.js';
-import { getPostgresPod, getSSHKeyPath, sshKubectl, sshRunScript } from './lib/ssh.js';
+import { getPostgresPod, getSSHKeyPath, sshKubectl } from './lib/ssh.js';
 import { createTracker } from './lib/tracker.js';
 import { validateBackupFilename } from './lib/validators.js';
 import { VERSION } from './lib/version.js';
+import { listWalgBackups } from './lib/walg-backups.js';
 
 // ============================================================================
 // COMMAND SPEC — single source of truth for argv parsing AND help output.
@@ -74,24 +68,24 @@ const SPEC = {
     { name: 'env', value: '<name>', description: 'Environment seed (alternative to positional)' },
     {
       name: 'source',
-      value: '<file-or-name-or-latest>',
-      description: 'Backup source: local file path, S3 backup name, or `latest`',
+      value: '<latest|ISO-timestamp|file>',
+      description: 'Restore point: `latest`, an ISO-8601 timestamp (PITR), or a local file path',
     },
   ],
   examples: [
-    { command: 'vibecarbon restore', description: 'prompts for env and backup' },
+    { command: 'vibecarbon restore', description: 'prompts for env and restore point' },
     { command: 'vibecarbon restore prod -l', description: 'list available backups for prod' },
     {
-      command: 'vibecarbon restore prod -source myapp_20260507.tar.gz',
-      description: 'restore a specific backup from S3',
+      command: 'vibecarbon restore prod -y -source latest',
+      description: 'restore the most-recent backup, non-interactively',
     },
     {
-      command: 'vibecarbon restore prod -source ./backup.tar.gz -y',
-      description: 'restore from a local file, skipping confirmation',
+      command: 'vibecarbon restore prod -source 2026-06-22T14:30:00Z',
+      description: 'point-in-time recovery to a specific moment (wal-g WAL replay)',
     },
     {
-      command: 'vibecarbon restore prod -y -source latest',
-      description: 'restore the most-recent S3 backup, non-interactively',
+      command: 'vibecarbon restore prod -source ./backup.tar.gz -y',
+      description: 'restore from a local file, skipping confirmation',
     },
   ],
 };
@@ -100,11 +94,18 @@ const SPEC = {
 // RESTORE OPERATIONS (k8s mode)
 // ============================================================================
 
-function scaleDownApp(ip, sshKeyPath) {
-  sshKubectl(ip, sshKeyPath, ['scale', 'deployment', 'app', '-n', 'vibecarbon', '--replicas=0']);
+async function scaleDownApp(ip, sshKeyPath) {
+  await sshKubectl(ip, sshKeyPath, [
+    'scale',
+    'deployment',
+    'app',
+    '-n',
+    'vibecarbon',
+    '--replicas=0',
+  ]);
 
   try {
-    sshKubectl(ip, sshKeyPath, [
+    await sshKubectl(ip, sshKeyPath, [
       'rollout',
       'status',
       'deployment/app',
@@ -117,8 +118,15 @@ function scaleDownApp(ip, sshKeyPath) {
   }
 }
 
-function scaleUpApp(ip, sshKeyPath) {
-  sshKubectl(ip, sshKeyPath, ['scale', 'deployment', 'app', '-n', 'vibecarbon', '--replicas=2']);
+async function scaleUpApp(ip, sshKeyPath) {
+  await sshKubectl(ip, sshKeyPath, [
+    'scale',
+    'deployment',
+    'app',
+    '-n',
+    'vibecarbon',
+    '--replicas=2',
+  ]);
 }
 
 /**
@@ -147,12 +155,21 @@ export async function verifyPostgres(ip, sshKeyPath, opts = {}) {
     getPod = getPostgresPod,
     sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
   } = opts;
-  const pod = getPod(ip, sshKeyPath);
+  const pod = await getPod(ip, sshKeyPath);
   const deadline = Date.now() + timeoutMs;
   let lastErr = '';
   for (;;) {
     try {
-      exec(ip, sshKeyPath, ['exec', '-n', 'vibecarbon', pod, '--', 'pg_isready', '-U', 'postgres']);
+      await exec(ip, sshKeyPath, [
+        'exec',
+        '-n',
+        'vibecarbon',
+        pod,
+        '--',
+        'pg_isready',
+        '-U',
+        'postgres',
+      ]);
       return; // exit 0 = accepting connections
     } catch (err) {
       lastErr = err instanceof Error ? err.message : String(err);
@@ -332,30 +349,18 @@ export async function run(args) {
     return;
   }
 
-  // Resolve mode-specific S3 config + the chosen backup source.
-  const s3 = await resolveS3({ isCompose, envName, projectName });
-  const useS3 = Boolean(s3?.secretKey);
-
-  // `-source latest` is a non-interactive sentinel that routes through the
-  // same auto-pick path the interactive prompt uses under `-y` — the newest
-  // S3 backup wins. Lets scripted callers (e2e, post-incident
-  // restores) ask for "the most recent" without first listing + parsing
-  // names from `vibecarbon backup -l`.
+  // Resolve the chosen backup source. Restore is wal-g-native (compose + k8s):
+  // wal-g runs server-side and reads its own S3 config from the db container —
+  // the operator does NOT need local S3 credentials to restore.
+  //
+  // `-source latest` (e2e, post-incident scripts) and `-y` both resolve to the
+  // LATEST base backup; `-source <ISO-8601>` is a point-in-time target. A bare
+  // interactive run opens the restore-point chooser.
   const wantsLatest = values.source === 'latest';
   let chosenSource;
   if (!wantsLatest && values.source) {
     chosenSource = classifySource(/** @type {string} */ (values.source));
   } else if (wantsLatest) {
-    // BOTH compose and k8s restore are now wal-g-native: `latest` resolves to
-    // the LATEST base backup that wal-g pushed to S3 — k8s via the db pod's
-    // walg-restore init container, compose via `restoreCompose(..., 'latest')`
-    // → `wal-g backup-fetch LATEST` (see runK8sRestore / runComposeRestore).
-    // pickInteractiveSource lists legacy pg_dump `*_full.tar.gz` backups via
-    // listS3Backups, which CANNOT see wal-g `basebackups_005/base_*` objects, so
-    // routing `-source latest` through it wrongly exits "No backups found in S3"
-    // even though a wal-g base backup exists. Hand the `latest` sentinel
-    // straight to the restore runner and let wal-g resolve it. (RCA 2026-05-31:
-    // e2e k8s/k8s-ha restore step; compose found via kept-rig manual restore.)
     chosenSource = { kind: 's3', name: 'latest' };
   } else {
     chosenSource = await pickInteractiveSource({
@@ -364,9 +369,7 @@ export async function run(args) {
       projectName,
       serverIp,
       sshKeyPath,
-      s3,
-      useS3,
-      yes: wantsLatest || !!values.y,
+      yes: !!values.y,
     });
   }
 
@@ -446,181 +449,98 @@ export async function run(args) {
 // ORCHESTRATION HELPERS
 // ============================================================================
 
-async function resolveS3({ isCompose, envName, projectName }) {
-  if (isCompose) {
-    const backupS3 = loadBackupS3Config(envName);
-    if (!backupS3) return null;
-    const creds = await getS3Credentials(projectName, { save: false });
-    if (!creds) return null;
-    return { ...backupS3, accessKey: creds.accessKey, secretKey: creds.secretKey };
-  }
-  const backupS3 = loadBackupS3Config(envName);
-  const storageS3 = loadS3Config(envName);
-  let s3 = backupS3 || storageS3;
-  if (s3 && !s3.secretKey) {
-    const creds = await getS3Credentials(projectName, { save: false });
-    if (creds) {
-      s3 = { ...s3, accessKey: creds.accessKey, secretKey: creds.secretKey };
-    }
-  }
-  return s3;
-}
-
 async function runList({ isCompose, envName, projectName, serverIp, sshKeyPath }) {
-  const s3 = await resolveS3({ isCompose, envName, projectName });
-  const useS3 = Boolean(s3?.secretKey);
-
-  if (useS3) {
-    try {
-      const backups = await listS3Backups(s3);
-      printBackupList(backups, envName);
-    } catch (error) {
-      p.log.error(`Failed to list S3 backups: ${error.message}`);
-      process.exit(1);
-    }
-    return;
-  }
-
-  if (isCompose) {
-    try {
-      const output = sshRunScript(
-        serverIp,
-        sshKeyPath,
-        `ls -lt /opt/${projectName}/backups/*_full.tar.gz 2>/dev/null || echo NO_BACKUPS`,
-      );
-      if (output === 'NO_BACKUPS' || !output.trim()) {
-        p.log.info('No backups found.');
-        p.log.info(`Create one with: ${c.info(`vibecarbon backup ${envName}`)}`);
-        return;
-      }
-      const lines = output.trim().split('\n').filter(Boolean);
-      p.log.info(`${c.bold(`Backups for ${envName}`)} (${lines.length} found):`);
-      for (const line of lines) {
-        p.log.message(`  ${line}`);
-      }
-    } catch (error) {
-      p.log.error(`Failed to list backups: ${error.message}`);
-    }
-    return;
-  }
+  const s = p.spinner();
+  s.start('Reading wal-g backups');
+  const backups = await listWalgBackups({ serverIp, sshKeyPath, projectName, isCompose });
+  s.stop('Backups read');
 
-  // K8s pod fallback
-  const backups = listPodBackups(serverIp, sshKeyPath);
-  printBackupList(backups, envName);
-}
-
-function printBackupList(backups, envName) {
-  if (!backups || backups.length === 0) {
-    p.log.info('No backups found.');
+  if (backups.length === 0) {
+    p.log.info('No wal-g base backups found.');
     p.log.info(`Create one with: ${c.info(`vibecarbon backup ${envName}`)}`);
     return;
   }
-  p.log.info(`${c.bold(`Backups for ${envName}`)} (${backups.length} found):`);
-  for (const backup of backups) {
-    p.log.message(`  ${c.dim(backup.date.padEnd(22))} ${backup.size.padStart(10)}  ${backup.name}`);
+  p.log.info(
+    `${c.bold(`Backups for ${envName}`)} (${backups.length} base backup(s), newest first):`,
+  );
+  for (const b of backups) {
+    p.log.message(`  ${formatInstant(b.time).padEnd(22)} ${c.dim(b.name)}`);
   }
 }
 
+// ISO-8601 datetime for point-in-time recovery. MUST stay in sync with
+// composeRestoreScript's ISO_DATETIME_RE (compose/index.js) and the k8s
+// walg-restore init container, which reject any other target format.
+const RESTORE_PITR_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(Z|[+-]\d{2}:\d{2})$/;
+
 async function pickInteractiveSource({
   isCompose,
   envName,
   projectName,
   serverIp,
   sshKeyPath,
-  s3,
-  useS3,
   yes,
 }) {
-  const tracker = createTracker('restore.pickSource', { environment: envName });
-  const s = tracker.spinner();
-
-  if (useS3) {
-    s.start('Fetching available backups from S3');
-    const backups = await listS3Backups(s3);
-    s.stop('Backups retrieved');
-    if (backups.length === 0) {
-      p.log.error('No backups found in S3.');
-      p.log.info(`Create one with: ${c.info(`vibecarbon backup ${envName}`)}`);
-      process.exit(1);
-    }
-    if (yes) {
-      const latest = backups[0].name;
-      p.log.info(`Auto-selected latest backup: ${c.bold(latest)}`);
-      return { kind: 's3', name: latest };
-    }
-    const selected = await p.select({
-      message: 'Select backup to restore:',
-      options: backups.map((b) => ({
-        value: b.name,
-        label: b.name,
-        hint: `${b.size} — ${b.date}`,
-      })),
-    });
-    if (p.isCancel(selected)) {
-      p.cancel('Operation cancelled.');
-      process.exit(0);
-    }
-    return { kind: 's3', name: /** @type {string} */ (selected) };
+  // Restore is wal-g-native for both compose and k8s: it ALWAYS fetches the
+  // LATEST base backup and replays WAL — either to the present ("latest") or to
+  // a point-in-time target. There is no "restore a specific older base backup",
+  // so this is a restore-POINT chooser, not a backup-file picker. (The legacy
+  // backups/*_full.tar.gz S3 objects are NOT wal-g backups — composeRestoreScript
+  // and the k8s walg-restore init container reject any target that isn't
+  // "latest" or an ISO-8601 datetime.)
+  if (yes) {
+    return { kind: 's3', name: 'latest' };
   }
 
-  // Non-S3 fallback: list from server filesystem (compose) or pod (k8s).
-  if (isCompose) {
-    s.start('Listing available backups');
-    const output = sshRunScript(
-      serverIp,
-      sshKeyPath,
-      `ls -t /opt/${projectName}/backups/*_full.tar.gz 2>/dev/null || echo NO_BACKUPS`,
+  // Best-effort recovery-window context so point-in-time is meaningful. Never
+  // blocks the chooser: if wal-g listing fails (db down, no --json), omit it.
+  const tracker = createTracker('restore.window', { environment: envName });
+  const s = tracker.spinner();
+  s.start('Reading available backups');
+  const backups = await listWalgBackups({ serverIp, sshKeyPath, projectName, isCompose });
+  if (backups.length > 0) {
+    const newest = formatInstant(backups[0].time);
+    const oldest = formatInstant(backups[backups.length - 1].time);
+    s.stop(
+      backups.length === 1
+        ? `1 base backup available (${newest})`
+        : `${backups.length} base backups — recovery window ${oldest} → ${newest}`,
     );
-    s.stop('');
-    if (output === 'NO_BACKUPS' || !output.trim()) {
-      p.log.error('No backups found on the server.');
-      p.log.info(`Create one with: ${c.info(`vibecarbon backup ${envName}`)}`);
-      process.exit(1);
-    }
-    const names = output
-      .trim()
-      .split('\n')
-      .filter(Boolean)
-      .map((f) => basename(f));
-    if (yes) {
-      const latest = names[0];
-      p.log.info(`Auto-selected latest backup: ${c.bold(latest)}`);
-      return { kind: 's3', name: latest };
-    }
-    const selected = await p.select({
-      message: 'Select backup to restore:',
-      options: names.map((b) => ({ value: b, label: b })),
-    });
-    if (p.isCancel(selected)) {
-      p.cancel('Operation cancelled.');
-      process.exit(0);
-    }
-    return { kind: 's3', name: /** @type {string} */ (selected) };
+  } else {
+    s.stop('Backups read');
   }
 
-  // K8s pod fallback
-  s.start('Fetching available backups');
-  const backups = listPodBackups(serverIp, sshKeyPath);
-  s.stop('Backups retrieved');
-  if (backups.length === 0) {
-    p.log.error('No backups found on the server.');
-    p.log.info(`Create one with: ${c.info(`vibecarbon backup ${envName}`)}`);
-    process.exit(1);
+  const choice = await p.select({
+    message: 'Restore point:',
+    options: [
+      { value: 'latest', label: 'Latest', hint: 'most recent backup + all WAL (recommended)' },
+      { value: 'pitr', label: 'Point in time…', hint: 'recover to a specific timestamp' },
+    ],
+  });
+  if (p.isCancel(choice)) {
+    p.cancel('Operation cancelled.');
+    process.exit(0);
   }
-  if (yes) {
-    const latest = backups[0].name;
-    p.log.info(`Auto-selected latest backup: ${c.bold(latest)}`);
-    return { kind: 's3', name: latest };
+  if (choice === 'latest') {
+    return { kind: 's3', name: 'latest' };
   }
-  const selected = await p.select({
-    message: 'Select backup to restore:',
-    options: backups.map((b) => ({ value: b.name, label: b.name, hint: `${b.size} — ${b.date}` })),
+
+  // Point-in-time: wal-g fetches the latest base backup and replays WAL up to
+  // this instant. Must match the ISO-8601 target validation in
+  // composeRestoreScript / the k8s walg-restore init container.
+  const ts = await p.text({
+    message: 'Recover to (ISO-8601 timestamp):',
+    placeholder: '2026-06-22T14:30:00Z',
+    validate: (v) =>
+      RESTORE_PITR_RE.test((v || '').trim())
+        ? undefined
+        : 'Enter an ISO-8601 datetime, e.g. 2026-06-22T14:30:00Z',
   });
-  if (p.isCancel(selected)) {
+  if (p.isCancel(ts)) {
     p.cancel('Operation cancelled.');
     process.exit(0);
   }
-  return { kind: 's3', name: /** @type {string} */ (selected) };
+  return { kind: 's3', name: /** @type {string} */ (ts).trim() };
 }
 
 // compose restore is wal-g-based (S3 pull, no file transfer). Mirrors
@@ -712,8 +632,8 @@ export async function runComposeRestore({
 const DB_STATEFULSET = 'supabase-supabase-db';
 
 /** Set or clear the RESTORE_TARGET marker the init container reads. */
-function setRestoreMarker(ip, sshKeyPath, value) {
-  sshKubectl(ip, sshKeyPath, [
+async function setRestoreMarker(ip, sshKeyPath, value) {
+  await sshKubectl(ip, sshKeyPath, [
     'patch',
     'secret',
     'vibecarbon-secrets',
@@ -738,7 +658,7 @@ async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath })
 
   s.start('Restoring database via wal-g (app will be temporarily unavailable)');
   // 1. Mark the restore so the db pod's init container fetches on next boot.
-  setRestoreMarker(serverIp, sshKeyPath, target);
+  await setRestoreMarker(serverIp, sshKeyPath, target);
   // 2. Quiesce the app so it isn't querying mid-swap.
   await perfAsync('restore.scaleDownApp', async () => scaleDownApp(serverIp, sshKeyPath));
   try {
@@ -746,14 +666,14 @@ async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath })
     //    and runs `wal-g backup-fetch` before postgres starts.
     s.message('Fetching from S3 + recovering (wal-g)');
     await perfAsync('restore.walgFetch', async () => {
-      sshKubectl(serverIp, sshKeyPath, [
+      await sshKubectl(serverIp, sshKeyPath, [
         'rollout',
         'restart',
         `statefulset/${DB_STATEFULSET}`,
         '-n',
         'vibecarbon',
       ]);
-      sshKubectl(serverIp, sshKeyPath, [
+      await sshKubectl(serverIp, sshKeyPath, [
         'rollout',
         'status',
         `statefulset/${DB_STATEFULSET}`,
@@ -767,7 +687,7 @@ async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath })
   } finally {
     // 5. Always clear the marker so an unrelated future pod restart does NOT
     //    re-fetch and wipe live data. Runs even if the restore failed.
-    setRestoreMarker(serverIp, sshKeyPath, '');
+    await setRestoreMarker(serverIp, sshKeyPath, '');
   }
   // 6. Bring the app back.
   await perfAsync('restore.scaleUpApp', async () => scaleUpApp(serverIp, sshKeyPath));

package/src/scale.js

@@ -23,8 +23,8 @@ import { requireTTYOrFlags } from './lib/cli/tty-guard.js';
 import { c, printBanner } from './lib/colors.js';
 import { runCommand } from './lib/command.js';
 import { loadCredentials, saveProjectConfig } from './lib/config.js';
-import { buildCostBreakdown, formatCostLines } from './lib/cost.js';
 import { useDnsChallenge } from './lib/deploy/acme.js';
+import { collectComposeBuildArgs } from './lib/deploy/compose/build-args.js';
 import {
   backupCompose,
   dockerLoginOnServer,
@@ -45,7 +45,7 @@ import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
 import { assertInProjectDir } from './lib/project-guard.js';
-import { HetznerProvider } from './lib/providers/hetzner.js';
+import { HETZNER_PRICING_URL, HetznerProvider } from './lib/providers/hetzner.js';
 import { buildComposeTypeOptions, buildSimpleTypeOptions } from './lib/server-types.js';
 import { parseDotenv } from './lib/shell.js';
 import { sshRun, sshRunScript } from './lib/ssh.js';
@@ -149,8 +149,11 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
     process.exit(1);
   }
 
-  // Fetch live server types for accurate pricing
+  // Fetch live server types (drives the per-region type/profile options below)
+  const typesSpinner = p.spinner();
+  typesSpinner.start('Fetching available server types...');
   await HetznerProvider.fetchServerTypes(apiToken);
+  typesSpinner.stop('Server types loaded');
 
   const region = envConfig.region || 'fsn1';
   const currentType = envConfig.serverType || 'cpx21';
@@ -230,17 +233,9 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
     return;
   }
 
-  // Cost comparison
   const ha = envConfig.deployMode === 'compose-ha';
   const services = projectConfig.services || {};
-  const costBreakdown = buildCostBreakdown({
-    isComposeDeploy: true,
-    ha,
-    serverType: newType,
-    region,
-    services,
-  });
-  p.note(formatCostLines(costBreakdown), 'New Estimated Cost');
+  p.note(`Current Hetzner pricing: ${HETZNER_PRICING_URL}`, 'Cost');
 
   // Confirmation
   const serverLabel =
@@ -280,7 +275,10 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
   // name, so the `name` we pass is mostly cosmetic — keep it aligned with
   // the rest of the codebase.
   const sshKeyName = `${projectName}-${environment}-key`;
+  const prep = p.spinner();
+  prep.start('Registering SSH key with Hetzner...');
   const sshKeyId = await provider.createSSHKey(sshKeyName, sshPubKey);
+  prep.stop('SSH key ready');
 
   // Blue-green replacement for each target server. For compose-ha we run
   // primary + standby in parallel — every per-server step (backup, create,
@@ -371,7 +369,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       // other keys flow through transparently.
       let oldEnv = {};
       try {
-        const envText = sshRun(server.ip, sshKeyPath, ['cat', `/opt/${projectName}/.env`]);
+        const envText = await sshRun(server.ip, sshKeyPath, ['cat', `/opt/${projectName}/.env`]);
         oldEnv = parseDotenv(envText);
       } catch {
         // Old server may be unreachable; renderBundle will fall back to the
@@ -454,8 +452,14 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       // Reuses the same code that does direct-mode deploy builds.
       if (oldAppImage && isLocalOnlyImageTag(oldAppImage)) {
         s.start(`Building image ${oldAppImage} on new server...`);
+        // Pass the VITE_* build args (same as deploy/HA). Vite inlines
+        // import.meta.env.VITE_* at build time, so without these the new
+        // server's frontend bundle ships empty VITE_SUPABASE_URL/ANON_KEY and
+        // the browser throws "Missing Supabase environment variables". Deploy
+        // (orchestrator.js) and HA (ha.js) already do this — scale did not.
+        const scaleBuildArgs = collectComposeBuildArgs(process.cwd(), { projectName, domain });
         const built = await perfAsync('scale.sideloadImage', () =>
-          buildRemote(newIp, sshKeyPath, oldAppImage, process.cwd()),
+          buildRemote(newIp, sshKeyPath, oldAppImage, process.cwd(), scaleBuildArgs),
         );
         // buildRemote returns false on failure (after its own retries). The app
         // image is local-only, so if it isn't built on the new server, the
@@ -534,7 +538,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       // would force a needless re-issue), so skip it.
       // Uses an SCP'd script so quoting/redirection stay intact without local shell.
       if (!dnsChallenge) {
-        sshRunScript(
+        await sshRunScript(
           newIp,
           sshKeyPath,
           `cd ${remoteDir} && docker compose exec -T traefik sh -c 'echo "{}" > /letsencrypt/acme.json && chmod 600 /letsencrypt/acme.json'`,
@@ -568,7 +572,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       const replOverlayFlag =
         "$([ -f docker-compose.replication.yml ] && echo '-f docker-compose.replication.yml')";
       s.start('Recreating all services after restore...');
-      sshRunScript(
+      await sshRunScript(
         newIp,
         sshKeyPath,
         `cd ${remoteDir} && docker compose ${composeFlags} ${replOverlayFlag} up -d --force-recreate 2>&1`,
@@ -580,7 +584,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       //     the db container's env (rendered into .env at deploy), so the cron
       //     just runs compose-backup.sh on schedule — no separate S3 plumbing.
       if (envConfig.backup) {
-        setupComposeBackupCron(newIp, sshKeyPath, projectName, envConfig.backup);
+        await setupComposeBackupCron(newIp, sshKeyPath, projectName, envConfig.backup);
         p.log.info('Backup cron restored on new server');
       }
 
@@ -1001,19 +1005,8 @@ export async function run(args) {
     (c) => c === 'workerType' || c === 'masterType' || c === 'supabaseType',
   );
 
-  // Cost breakdown with new values applied
-  const services = projectConfig.services || {};
   const isHA = envConfig.ha?.enabled && envConfig.secondaryRegion;
-  const costBreakdown = buildCostBreakdown({
-    isComposeDeploy: false,
-    ha: !!isHA,
-    masterServerType: newValues.masterType || currentMasterType,
-    supabaseServerType: newValues.supabaseType || currentSupabaseType,
-    workerServerType: newValues.workerType || currentWorkerType,
-    region,
-    services,
-  });
-  p.note(formatCostLines(costBreakdown), 'New Estimated Cost');
+  p.note(`Current Hetzner pricing: ${HETZNER_PRICING_URL}`, 'Cost');
 
   // 6. Require API token if infra changes (server type swap) needed
   let apiToken = null;
@@ -1205,6 +1198,8 @@ export async function run(args) {
       // unit tests for this seam (see tests/unit/iac/probe-classify.test.ts).
       let probeOutputs = null;
       let probeError = null;
+      const probeSpinner = p.spinner();
+      probeSpinner.start(`Reading prior cluster state (${label})...`);
       try {
         const probeProgram = buildHetznerK8sProgram(programConfig);
         probeOutputs = await perfAsync(`scale.k8s.${clusterEnv}.probeOutputs`, () =>
@@ -1216,6 +1211,7 @@ export async function run(args) {
       } catch (err) {
         probeError = err instanceof Error ? err : new Error(String(err));
       }
+      probeSpinner.stop(`Prior cluster state read (${label})`);
       const probe = classifyK3sTokenProbe({ outputs: probeOutputs, error: probeError });
       const priorK3sToken = probe.priorK3sToken;
       switch (probe.status) {