vibecarbon 0.5.1 → 0.6.1

package/src/lib/deploy/compose/index.js

@@ -16,7 +16,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as p from '@clack/prompts';
-import { runCommand, runCommandAsync } from '../../command.js';
+import { runCommandAsync } from '../../command.js';
 import { perfAsync, perfTimer } from '../../perf.js';
 import { parseDotenv, shEscape } from '../../shell.js';
 import { NO_PIN_SSH_OPTS, sshRunScript } from '../../ssh.js';
@@ -54,14 +54,19 @@ const SSH_OPTS = NO_PIN_SSH_OPTS;
  * Shared with compose/ha.js (imported, not re-copied) so both halves of the
  * compose path use identical, single-sourced SSH options.
  */
-export function sshRun(ip, sshKeyPath, command, options = {}) {
-  const { timeout = 120_000 } = options;
-  return runCommand(['ssh', ...SSH_OPTS.split(' '), '-i', sshKeyPath, `root@${ip}`, command], {
-    stdio: 'pipe',
-    timeout,
-    encoding: 'utf-8',
-    ...options,
-  });
+export async function sshRun(ip, sshKeyPath, command, options = {}) {
+  const { timeout = 120_000, ...rest } = options;
+  try {
+    return await runCommandAsync(
+      ['ssh', ...SSH_OPTS.split(' '), '-i', sshKeyPath, `root@${ip}`, command],
+      { silent: true, timeout, ...rest },
+    );
+  } catch {
+    // Preserve the legacy stdio:'pipe' contract: this runner returned `false`
+    // on remote non-zero exit (silent was unset, so runCommand never threw).
+    // ha.js callers + retry loops depend on false-not-throw — keep it identical.
+    return false;
+  }
 }
 
 /**
@@ -129,7 +134,11 @@ export async function sshRunAsync(ip, sshKeyPath, command, options = {}) {
 export async function waitForSSH(host, sshKeyPath, maxAttempts = 30) {
   for (let i = 0; i < maxAttempts; i++) {
     try {
-      runCommand(
+      // silent:true makes runCommandAsync REJECT on a non-zero/connection
+      // failure, so the catch below actually engages the retry loop. (The old
+      // sync runCommand with stdio:'pipe' returned false without throwing, so
+      // this returned true on the very first probe regardless of SSH state.)
+      await runCommandAsync(
         [
           'ssh',
           ...SSH_OPTS.split(' '),
@@ -141,7 +150,7 @@ export async function waitForSSH(host, sshKeyPath, maxAttempts = 30) {
           'echo',
           'ok',
         ],
-        { stdio: 'pipe', timeout: 10_000 },
+        { silent: true, timeout: 10_000 },
       );
       return true;
     } catch {
@@ -809,11 +818,11 @@ export async function runMigrations(ip, sshKeyPath, projectName) {
 /**
  * Destroy a Docker Compose deployment
  */
-export function destroyCompose(ip, sshKeyPath, projectName) {
+export async function destroyCompose(ip, sshKeyPath, projectName) {
   const remoteDir = `/opt/${projectName}`;
 
   // Stop and remove containers + volumes
-  sshRun(
+  await sshRun(
     ip,
     sshKeyPath,
     `cd ${remoteDir} && docker compose down -v --remove-orphans 2>/dev/null; rm -rf ${remoteDir}`,
@@ -862,10 +871,12 @@ export function composeBackupCmd(remoteDir, retain = 7) {
  * @param {object} [options]
  * @param {number} [options.retain]  Full base backups to keep (default 7).
  */
-export function backupCompose(ip, sshKeyPath, projectName, options = {}) {
+export async function backupCompose(ip, sshKeyPath, projectName, options = {}) {
   const remoteDir = `/opt/${projectName}`;
   const t = perfTimer('backup.walgPush');
-  sshRun(ip, sshKeyPath, composeBackupCmd(remoteDir, options.retain ?? 7), { timeout: 900_000 });
+  await sshRun(ip, sshKeyPath, composeBackupCmd(remoteDir, options.retain ?? 7), {
+    timeout: 900_000,
+  });
   t.end();
 }
 
@@ -891,7 +902,7 @@ export function backupCompose(ip, sshKeyPath, projectName, options = {}) {
  * @param {(ip: string, key: string, script: string, o: object) => unknown} [opts.runScript=sshRunScript]
  *   Injectable script runner — defaults to the real SSH runner; overridden in unit tests.
  */
-export function setupComposeBackupCron(ip, sshKeyPath, projectName, backupConfig, opts = {}) {
+export async function setupComposeBackupCron(ip, sshKeyPath, projectName, backupConfig, opts = {}) {
   const { runScript = sshRunScript } = opts;
   const remoteDir = `/opt/${projectName}`;
   const schedule = backupConfig?.schedule || '0 2 * * *';
@@ -918,7 +929,7 @@ export function setupComposeBackupCron(ip, sshKeyPath, projectName, backupConfig
     'rm -f "$TMP_CRON"',
   ].join('\n');
 
-  runScript(ip, sshKeyPath, installScript, { timeout: 60_000 });
+  await runScript(ip, sshKeyPath, installScript, { timeout: 60_000 });
 }
 
 // ISO-8601 datetime: YYYY-MM-DDTHH:MM:SS followed by Z or ±HH:MM
@@ -1041,7 +1052,7 @@ export async function restoreCompose(ip, sshKeyPath, projectName, target = 'late
   //    quotes (restore_command = 'wal-g wal-fetch ...') so it MUST go via a
   //    file rather than a nested bash -c '...' invocation. The script clears
   //    PGDATA, runs wal-g backup-fetch, and writes the archive-recovery config.
-  sshRunScript(
+  await sshRunScript(
     ip,
     sshKeyPath,
     [

package/src/lib/deploy/k8s/gitops-deploy.js

@@ -22,6 +22,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import * as p from '@clack/prompts';
+import { featureConfigKeys, featureSecretKeys } from '../../config-registry.js';
 import {
   seedEnvironmentSecrets,
   seedOrgSecrets,
@@ -240,20 +241,7 @@ export async function deployK8sGitOps(args) {
   await seedOrgSecrets(creds);
 
   const envLocal = parseEnvLocal(projectDir);
-  const perEnvSecrets = {
-    DB_PASSWORD: envLocal.DB_PASSWORD,
-    JWT_SECRET: envLocal.JWT_SECRET,
-    SUPABASE_ANON_KEY: envLocal.SUPABASE_ANON_KEY || envLocal.ANON_KEY,
-    SUPABASE_SERVICE_ROLE_KEY: envLocal.SUPABASE_SERVICE_ROLE_KEY || envLocal.SERVICE_ROLE_KEY,
-    REALTIME_SECRET: envLocal.REALTIME_SECRET,
-    DB_ENC_KEY: envLocal.DB_ENC_KEY,
-    VAULT_ENC_KEY: envLocal.VAULT_ENC_KEY,
-    PG_META_CRYPTO_KEY: envLocal.PG_META_CRYPTO_KEY,
-    LOGFLARE_API_KEY: envLocal.LOGFLARE_API_KEY,
-    ADMIN_EMAIL: envLocal.ADMIN_EMAIL,
-    ADMIN_PASSWORD: envLocal.ADMIN_PASSWORD,
-    SMTP_PASSWORD: envLocal.SMTP_PASS,
-  };
+  const perEnvSecrets = buildPerEnvSecrets(envLocal);
   const perEnvVars = {
     SITE_URL: domain ? `https://${domain}` : '',
     DNS_PROVIDER: dnsProvider || '',
@@ -284,6 +272,42 @@ export async function deployK8sGitOps(args) {
  * to avoid a cross-module import dependency that forces bringing the
  * full k8s deploy module into GitOps flow.
  */
+/**
+ * Build the per-environment GitHub Environment secret map from a parsed
+ * .env.local. Generated infra secrets are enumerated here (they carry the
+ * Supabase ANON_KEY/SERVICE_ROLE_KEY alias logic); every configure-managed
+ * feature key (billing/OAuth/SMTP — secret and non-secret) is folded in from
+ * the config-registry so a new feature secret propagates with no edit here.
+ *
+ * Values that are undefined/empty are dropped by setSecretFromBodyFile, so
+ * unconfigured features upload nothing. Canonical SMTP key is SMTP_PASS (no
+ * SMTP_PASSWORD rename — the app and manifests read SMTP_PASS).
+ *
+ * @param {Record<string,string>} envLocal
+ * @returns {Record<string,string|undefined>}
+ */
+export function buildPerEnvSecrets(envLocal) {
+  const infra = {
+    DB_PASSWORD: envLocal.DB_PASSWORD,
+    JWT_SECRET: envLocal.JWT_SECRET,
+    SUPABASE_ANON_KEY: envLocal.SUPABASE_ANON_KEY || envLocal.ANON_KEY,
+    SUPABASE_SERVICE_ROLE_KEY: envLocal.SUPABASE_SERVICE_ROLE_KEY || envLocal.SERVICE_ROLE_KEY,
+    REALTIME_SECRET: envLocal.REALTIME_SECRET,
+    DB_ENC_KEY: envLocal.DB_ENC_KEY,
+    VAULT_ENC_KEY: envLocal.VAULT_ENC_KEY,
+    PG_META_CRYPTO_KEY: envLocal.PG_META_CRYPTO_KEY,
+    LOGFLARE_API_KEY: envLocal.LOGFLARE_API_KEY,
+    ADMIN_EMAIL: envLocal.ADMIN_EMAIL,
+    ADMIN_PASSWORD: envLocal.ADMIN_PASSWORD,
+  };
+  /** @type {Record<string,string|undefined>} */
+  const features = {};
+  for (const key of [...featureSecretKeys(), ...featureConfigKeys()]) {
+    features[key] = envLocal[key];
+  }
+  return { ...infra, ...features };
+}
+
 function parseEnvLocal(projectDir) {
   const path = join(projectDir, '.env.local');
   if (!existsSync(path)) return {};

package/src/lib/deploy/k8s/k3s.js

@@ -38,6 +38,7 @@ import { join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import * as p from '@clack/prompts';
 import { runCommandAsync } from '../../command.js';
+import { featureConfigKeys, featureSecretKeys } from '../../config-registry.js';
 import { knownHostsPath } from '../../host-keys.js';
 import { loadCloudInit, renderScript } from '../../iac/cloud-init.js';
 import { dbImageRef } from '../../images.js';
@@ -1179,16 +1180,15 @@ export async function pushImageToLocalRegistry({
 }
 
 /**
- * Subset of .env.local keys that must land in the in-cluster
- * vibecarbon-secrets Secret. The Supabase Helm chart reads JWT_SECRET +
- * ANON_KEY + SERVICE_ROLE_KEY via secretRef from this Secret; the app
- * Deployment reads DB_PASSWORD + the rest via envFrom.
- *
- * Defined as an explicit allowlist (not "everything in .env.local")
- * because .env.local also carries client-side VITE_* values that don't
- * belong in a Secret.
+ * Generated infra secrets that must land in the in-cluster vibecarbon-secrets
+ * Secret. The Supabase Helm chart reads JWT_SECRET + ANON_KEY +
+ * SERVICE_ROLE_KEY via secretRef from this Secret; the app Deployment reads
+ * DB_PASSWORD + the rest via envFrom.
+ *
+ * These are generated at deploy time (not user-configured), so they stay
+ * local here rather than in the config-registry.
  */
-const SECRET_KEYS = [
+const INFRA_SECRET_KEYS = [
   'DB_PASSWORD',
   'JWT_SECRET',
   'ANON_KEY',
@@ -1204,6 +1204,16 @@ const SECRET_KEYS = [
   'ADMIN_PASSWORD_HASH',
 ];
 
+/**
+ * Full allowlist of .env.local keys that land in vibecarbon-secrets: generated
+ * infra secrets plus every configure-managed runtime key (billing/OAuth/SMTP,
+ * both secret and non-secret) from the config-registry. The app Deployment
+ * pulls the whole Secret via `envFrom`, so feature config reaches the pod
+ * without a second per-key list here. Client-side VITE_* keys are deliberately
+ * excluded — they're baked into the image at build time, not runtime env.
+ */
+export const SECRET_KEYS = [...INFRA_SECRET_KEYS, ...featureSecretKeys(), ...featureConfigKeys()];
+
 /**
  * Apply the in-cluster `vibecarbon-secrets` Secret from the project's
  * `.env.local`. Idempotent: rendered as a Secret manifest and piped to

package/src/lib/deploy/orchestrator.js

@@ -425,8 +425,17 @@ export async function executeDeployment(args, gatheredConfig) {
   } else {
     // CI path: ensureCIImageReady performs the workflow dispatch + GHA-build
     // wait. On a cold push deploy this is the dominant cost (~10 min).
+    // Pass the VITE_* build args so ensureCIImageReady can seed them as repo
+    // variables — the CI image bakes them at build time (Vite inlines them).
+    // Without this the GHCR image ships empty VITE_SUPABASE_* and the SPA
+    // crashes at page load. Mirrors the compose-local build-args path above.
+    const { collectComposeBuildArgs } = await import('./compose/build-args.js');
+    const ciBuildArgs = collectComposeBuildArgs(process.cwd(), {
+      projectName: projectConfig.projectName,
+      domain,
+    });
     imageReadyPromise = perfAsync('deploy.image.ciWait', () =>
-      ensureCIImageReady({ yes: args.yes, tracker }),
+      ensureCIImageReady({ yes: args.yes, tracker, buildArgs: ciBuildArgs }),
     );
   }
 
@@ -634,7 +643,15 @@ export async function executeDeployment(args, gatheredConfig) {
         // Await the promise (cheap if already settled) then sideload the
         // image tarball over SSH. Sideload uses docker save | gzip | ssh
         // | docker load — gzip drops ~600MB → ~150-200MB on the wire.
+        //
+        // Both run silently (build is silent:true; sideload streams no stdout),
+        // so without a spinner this is a 15-30s dead pause right after "Proceed"
+        // on warm redeploys (where the upStack spinner that normally overlaps
+        // the build was skipped). Drive a spinner so the operator sees progress.
+        const imageSpinner = p.spinner();
+        imageSpinner.start('Building app image');
         await composeLocalBuildPromise;
+        imageSpinner.message('Sideloading app image to the server');
         await perfAsync('deploy.image.sideload', async () =>
           sideloadCompose({
             tag: localImageTag,
@@ -642,6 +659,7 @@ export async function executeDeployment(args, gatheredConfig) {
             sshKey: sshKeyPath,
           }),
         );
+        imageSpinner.stop('App image built and sideloaded');
       } else if (isDirectDeploy) {
         // Direct path: build the image on the server via DOCKER_HOST=ssh://.
         // BuildKit caches aggressively, so unchanged source rebuilds in 1-3s.
@@ -764,7 +782,10 @@ export async function executeDeployment(args, gatheredConfig) {
               : await import('../hetzner-dns.js');
           const token = dnsProvider === 'cloudflare' ? cloudflareApiToken : apiToken;
           const zoneId = dnsProvider === 'cloudflare' ? cloudflareZoneId : hetznerDnsZoneId;
+          const dnsSpinner = p.spinner();
+          dnsSpinner.start(`Pointing ${domain} → ${serverIp}...`);
           await perfAsync('deploy.dns.create', () => updateDnsIp(token, zoneId, domain, serverIp));
+          dnsSpinner.stop(`DNS A record set: ${domain} → ${serverIp}`);
           state.completeStep('compose-dns-update', { serverIp });
         }
         // HTTP-01 only: block compose-up until public resolvers see the real

package/src/lib/deploy/prompts.js

@@ -273,8 +273,27 @@ export async function gatherDeploymentConfig(args) {
 
   let secondaryRegion = null;
   if (ha) {
-    secondaryRegion =
-      args.secondaryRegion || envConfig.secondaryRegion || (region === 'nbg1' ? 'fsn1' : 'nbg1');
+    const standbyDefault = HetznerProvider.getDefaultStandbyRegion(region);
+    secondaryRegion = args.secondaryRegion || envConfig.secondaryRegion || standbyDefault;
+    // HA spans TWO regions, but the prompt above only picks the primary. Ask
+    // for the standby too (same-continent partner pre-selected, so the common
+    // case is one Enter) — otherwise a non-EU primary like `ash` silently fails
+    // over across the Atlantic to `nbg1`. Skipped when set via -standby-region,
+    // saved config, or -y.
+    if (!args.secondaryRegion && !envConfig.secondaryRegion && !args.yes) {
+      const standbyOptions = Object.entries(providerConfig.regions)
+        .filter(([id]) => id !== region)
+        .map(([id, name]) => ({ value: id, label: `${id} - ${name}` }));
+      secondaryRegion = await p.select({
+        message: 'Standby region (HA failover target):',
+        options: standbyOptions,
+        initialValue: standbyDefault,
+      });
+      if (p.isCancel(secondaryRegion)) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+    }
   }
 
   const apiToken = await getApiToken(projectConfig.projectName);

package/src/lib/deploy/utils.js

@@ -15,7 +15,7 @@ import {
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { runCommand } from '../command.js';
+import { runCommand, runCommandAsync } from '../command.js';
 import { getProviderClass } from '../providers/index.js';
 import { escapeDotenv } from '../shell.js';
 
@@ -71,15 +71,18 @@ export function getBranchName(envName) {
  * @param {string} remoteDir - absolute path to the remote deployment directory
  * @param {Record<string, string>} updates - key/value pairs to set in .env
  */
-export function mergeRemoteDotenv(host, sshOpts, remoteDir, updates) {
+export async function mergeRemoteDotenv(host, sshOpts, remoteDir, updates) {
   const dir = mkdtempSync(join(tmpdir(), 'vibecarbon-envmerge-'));
   const local = join(dir, '.env');
   try {
     // Pull remote .env
     try {
-      runCommand(['scp', ...sshOpts.split(' '), `root@${host}:${remoteDir}/.env`, local], {
-        silent: true,
-      });
+      await runCommandAsync(
+        ['scp', ...sshOpts.split(' '), `root@${host}:${remoteDir}/.env`, local],
+        {
+          silent: true,
+        },
+      );
     } catch (e) {
       throw new Error(
         `Failed to pull ${remoteDir}/.env from ${host} — is the remote file present and SSH reachable? Underlying error: ${e?.message ?? e}`,
@@ -101,9 +104,12 @@ export function mergeRemoteDotenv(host, sshOpts, remoteDir, updates) {
     writeFileSync(local, merged.join('\n'));
     // Push merged .env back
     try {
-      runCommand(['scp', ...sshOpts.split(' '), local, `root@${host}:${remoteDir}/.env`], {
-        silent: true,
-      });
+      await runCommandAsync(
+        ['scp', ...sshOpts.split(' '), local, `root@${host}:${remoteDir}/.env`],
+        {
+          silent: true,
+        },
+      );
     } catch (e) {
       throw new Error(
         `Failed to push merged .env back to ${host}:${remoteDir}/.env — remote still has the previous contents. Underlying error: ${e?.message ?? e}`,
@@ -170,10 +176,13 @@ export async function waitForSSH(host, sshKeyPath, maxAttempts = 30) {
   const sshOpts = `-i "${sshKeyPath}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes`;
   for (let i = 0; i < maxAttempts; i++) {
     try {
-      runCommand(
+      // silent:true → runCommandAsync rejects on failure so the retry loop
+      // actually engages (the old sync runCommand returned false without
+      // throwing, so this returned true on the first probe regardless).
+      await runCommandAsync(
         ['ssh', ...sshOpts.split(' '), '-o', 'ConnectTimeout=5', `root@${host}`, 'echo', 'ok'],
         {
-          stdio: 'pipe',
+          silent: true,
           timeout: 10000,
         },
       );
@@ -198,7 +207,7 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
   const sshOpts = `-i "${sshKeyPath}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes`;
 
   // Create remote directory and required subdirectories
-  runCommand(
+  await runCommandAsync(
     [
       'ssh',
       ...sshOpts.split(' '),
@@ -209,7 +218,7 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
       `${remoteDir}/volumes/kong`,
       `${remoteDir}/supabase/migrations`,
     ],
-    { stdio: 'pipe' },
+    { silent: true, ignoreError: true },
   );
 
   // List of files to copy
@@ -235,9 +244,13 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
   for (const file of filesToCopy) {
     const localPath = join(cwd, file);
     if (existsSync(localPath)) {
-      runCommand(['scp', ...sshOpts.split(' '), localPath, `root@${host}:${remoteDir}/`], {
-        stdio: 'pipe',
-      });
+      await runCommandAsync(
+        ['scp', ...sshOpts.split(' '), localPath, `root@${host}:${remoteDir}/`],
+        {
+          silent: true,
+          ignoreError: true,
+        },
+      );
     }
   }
 
@@ -247,10 +260,11 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
     for (const file of readdirSync(volumesDbDir)) {
       const filePath = join(volumesDbDir, file);
       if (existsSync(filePath)) {
-        runCommand(
+        await runCommandAsync(
           ['scp', ...sshOpts.split(' '), filePath, `root@${host}:${remoteDir}/volumes/db/`],
           {
-            stdio: 'pipe',
+            silent: true,
+            ignoreError: true,
           },
         );
       }
@@ -260,7 +274,7 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
   // Copy supabase migrations directory
   const migrationsDir = join(cwd, 'supabase', 'migrations');
   if (existsSync(migrationsDir)) {
-    runCommand(
+    await runCommandAsync(
       [
         'scp',
         ...sshOpts.split(' '),
@@ -269,7 +283,7 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
         `root@${host}:${remoteDir}/supabase/migrations/`,
       ],
       {
-        stdio: 'pipe',
+        silent: true,
         ignoreError: true, // handle the 2>/dev/null || true semantics
       },
     );
@@ -281,10 +295,11 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
     for (const file of readdirSync(volumesKongDir)) {
       const filePath = join(volumesKongDir, file);
       if (existsSync(filePath)) {
-        runCommand(
+        await runCommandAsync(
           ['scp', ...sshOpts.split(' '), filePath, `root@${host}:${remoteDir}/volumes/kong/`],
           {
-            stdio: 'pipe',
+            silent: true,
+            ignoreError: true,
           },
         );
       }
@@ -294,9 +309,13 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
   // Copy local .env file if it exists
   const localEnvPath = join(cwd, '.env');
   if (existsSync(localEnvPath)) {
-    runCommand(['scp', ...sshOpts.split(' '), localEnvPath, `root@${host}:${remoteDir}/`], {
-      stdio: 'pipe',
-    });
+    await runCommandAsync(
+      ['scp', ...sshOpts.split(' '), localEnvPath, `root@${host}:${remoteDir}/`],
+      {
+        silent: true,
+        ignoreError: true,
+      },
+    );
   }
 
   // Override/append production env vars
@@ -312,17 +331,17 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
   }
 
   if (Object.keys(envOverrides).length > 0) {
-    mergeRemoteDotenv(host, sshOpts, remoteDir, envOverrides);
+    await mergeRemoteDotenv(host, sshOpts, remoteDir, envOverrides);
   }
 
   // Copy prometheus config
   const prometheusDir = join(cwd, 'prometheus');
   if (options.observability && existsSync(prometheusDir)) {
-    runCommand(
+    await runCommandAsync(
       ['ssh', ...sshOpts.split(' '), `root@${host}`, 'mkdir', '-p', `${remoteDir}/prometheus`],
-      { stdio: 'pipe' },
+      { silent: true, ignoreError: true },
     );
-    runCommand(
+    await runCommandAsync(
       [
         'scp',
         ...sshOpts.split(' '),
@@ -331,7 +350,8 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
         `root@${host}:${remoteDir}/prometheus/`,
       ],
       {
-        stdio: 'pipe',
+        silent: true,
+        ignoreError: true,
       },
     );
   }
@@ -339,9 +359,13 @@ export async function setupServerFiles(host, sshKeyPath, projectName, options =
   // Copy grafana provisioning
   const grafanaDir = join(cwd, 'grafana');
   if (options.observability && existsSync(grafanaDir)) {
-    runCommand(['scp', ...sshOpts.split(' '), '-r', grafanaDir, `root@${host}:${remoteDir}/`], {
-      stdio: 'pipe',
-    });
+    await runCommandAsync(
+      ['scp', ...sshOpts.split(' '), '-r', grafanaDir, `root@${host}:${remoteDir}/`],
+      {
+        silent: true,
+        ignoreError: true,
+      },
+    );
   }
 
   return true;

package/src/lib/github-environments.js

@@ -105,6 +105,35 @@ export async function seedOrgSecrets(creds) {
   return applied;
 }
 
+/**
+ * Seed repo-level GitHub Actions variables that the build workflow
+ * (vibecarbon-build.yml) reads as `--build-arg` inputs. Vite inlines these
+ * VITE_* values into the browser bundle at image-build time; without them the
+ * CI-built GHCR image ships empty VITE_SUPABASE_* and crashes at page load
+ * ("Missing Supabase environment variables").
+ *
+ * These are non-secret build inputs (VITE_SUPABASE_ANON_KEY is a publishable
+ * client key shipped to browsers), so they go to repo VARIABLES, not secrets.
+ * Repo-level (not per-environment) because vibecarbon-build.yml builds one
+ * push-triggered image per repo — it reflects the most recent push-mode
+ * deploy's domain/config. Multi-domain setups should use local-build deploys
+ * for non-canonical environments.
+ *
+ * Empty values are skipped (setVariable returns false) so optional VITE_*
+ * (e.g. unconfigured analytics) don't create blank variables.
+ *
+ * @param {Record<string,string>} viteArgs - VITE_* build args (from collectComposeBuildArgs).
+ * @returns {Promise<string[]>} applied variable names.
+ */
+export async function seedBuildVars(viteArgs) {
+  const applied = [];
+  for (const [key, value] of Object.entries(viteArgs)) {
+    if (!key.startsWith('VITE_')) continue;
+    if (await setVariable(key, value)) applied.push(key);
+  }
+  return applied;
+}
+
 /**
  * Seed the per-environment secrets + variables. `envVars` are sourced from
  * .env.local (read by the caller) so we can re-use the same values as the

package/src/lib/licensing/index.js

@@ -189,11 +189,16 @@ export function requireLicense(commandName) {
     `  ${c.bold('Vibecarbon Fullerene')} — ${c.success('$499 lifetime')} ${c.dim('— deploy for clients & agencies, commercial use rights')}`,
   );
   console.log('');
-  console.log(`  ${c.dim('Purchase:')} ${c.info('https://vibecarbon.dev/pricing')}`);
+  console.log(`  ${c.dim('Purchase:')} ${c.info('https://vibecarbon.com/#pricing')}`);
   console.log(`  ${c.dim('Activate:')} ${c.info('vibecarbon activate <key>')}`);
-  console.log(`  ${c.dim('Terms:')}    ${c.dim('TERMS.md or https://vibecarbon.dev/terms')}`);
+  console.log(`  ${c.dim('Terms:')}    ${c.dim('TERMS.md or https://vibecarbon.com/terms')}`);
   console.log('');
-  process.exit(0);
+  // Exit non-zero: a gated command run without a license is a failed
+  // invocation, not a success. Exiting 0 made scripted/CI `deploy`, `scale`,
+  // `backup`, etc. look like they succeeded while doing nothing (the test
+  // harnesses had to activate a license to dodge this). Callers and CI now
+  // see a real failure.
+  process.exit(1);
 }
 
 // Re-export tier utilities

package/src/lib/licensing/tiers.js

@@ -19,7 +19,6 @@ export const TIERS = {
     price: 0,
     originalPrice: 0,
     discountPercent: 0,
-    hostingCost: '$0',
     // Marketing
     marketingFeatures: [
       'Create projects',
@@ -51,7 +50,6 @@ export const TIERS = {
     price: 149,
     originalPrice: 299,
     discountPercent: 50,
-    hostingCost: '~$5-100/mo',
     badge: 'Lifetime Access',
     // Marketing
     marketingFeatures: [
@@ -89,7 +87,6 @@ export const TIERS = {
     price: 499,
     originalPrice: 999,
     discountPercent: 50,
-    hostingCost: '~$5-100/mo',
     badge: 'Lifetime Access',
     // Marketing
     marketingFeatures: [

package/src/lib/pod-backups.js

@@ -16,12 +16,12 @@ import { getPostgresPod, sshKubectl } from './ssh.js';
  * @returns {Array<{ size: string, date: string, name: string }>} parsed entries
  *   (empty array if the pod is unreachable or holds no backups)
  */
-export function listPodBackups(ip, sshKeyPath, { sort = 'recent' } = {}) {
-  const pod = getPostgresPod(ip, sshKeyPath);
+export async function listPodBackups(ip, sshKeyPath, { sort = 'recent' } = {}) {
+  const pod = await getPostgresPod(ip, sshKeyPath);
   const lsFlags = sort === 'largest' ? '-lhS' : '-lt';
 
   try {
-    const output = sshKubectl(ip, sshKeyPath, [
+    const output = await sshKubectl(ip, sshKeyPath, [
       'exec',
       '-n',
       'vibecarbon',

package/src/lib/providers/base.js

@@ -271,6 +271,6 @@ export class BaseProvider {
   formatServerType(serverType) {
     const type = this.constructor.SERVER_TYPES[serverType];
     if (!type) return serverType;
-    return `${serverType} (${type.vcpu} vCPU, ${type.ram}GB RAM, ${type.disk}GB SSD, ${type.price})`;
+    return `${serverType} (${type.vcpu} vCPU, ${type.ram}GB RAM, ${type.disk}GB SSD)`;
   }
 }