vibecarbon 0.6.1 → 0.8.0

package/carbon/biome.json

@@ -1,9 +1,10 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "root": false,
+  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "complexity": {
         "noUselessFragments": "warn"
       },

package/carbon/package.json

@@ -39,7 +39,7 @@
     "docker:reset:all": "node scripts/docker-down.js -v --rmi --all",
     "docker:prod:up": "node scripts/docker-up.js --prod",
     "docker:prod:down": "node scripts/docker-down.js --prod",
-    "db:migrate": "docker compose exec db bash -c 'for f in /migrations/*.sql; do psql -U postgres -d postgres -f \"$f\" || exit 1; done' && docker compose exec db psql -U postgres -d postgres -f /tmp/super-admin.sql",
+    "db:migrate": "node scripts/db-migrate.js",
     "db:reset": "node scripts/docker-down.js -v && node scripts/docker-up.js",
     "k8s:apply": "node scripts/k8s-apply.js",
     "k8s:delete": "node scripts/k8s-delete.js",
@@ -50,7 +50,7 @@
     "stripe:listen": "stripe listen --forward-to localhost:3000/api/webhooks/stripe"
   },
   "dependencies": {
-    "@base-ui/react": "^1.5.0",
+    "@base-ui/react": "^1.6.0",
     "@fontsource-variable/noto-sans": "^5.2.10",
     "@fontsource/jetbrains-mono": "^5.2.8",
     "@hono/node-server": "^2.0.6",
@@ -58,39 +58,39 @@
     "@hookform/resolvers": "^5.4.0",
     "@mdx-js/react": "^3.1.1",
     "@mdx-js/rollup": "^3.1.1",
-    "@scalar/api-reference-react": "^0.9.49",
-    "@supabase/supabase-js": "^2.108.2",
-    "@tanstack/react-query": "^5.100.14",
+    "@scalar/api-reference-react": "^0.9.50",
+    "@supabase/supabase-js": "^2.110.0",
+    "@tanstack/react-query": "^5.101.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.4.0",
     "embla-carousel-react": "^8.6.0",
-    "framer-motion": "^12.40.0",
+    "framer-motion": "^12.42.2",
     "hono": "^4.12.27",
-    "i18next": "^26.3.3",
+    "i18next": "^26.3.4",
     "i18next-browser-languagedetector": "^8.2.1",
     "input-otp": "^1.4.2",
     "ioredis": "^5.11.1",
     "lenis": "^1.3.25",
-    "lucide-react": "^1.17.0",
+    "lucide-react": "^1.22.0",
     "next-themes": "^0.4.6",
-    "nodemailer": "^8.0.10",
+    "nodemailer": "^9.0.3",
     "pino": "^10.3.1",
     "react": "^19.2.7",
     "react-day-picker": "^10.0.1",
     "react-dom": "^19.2.7",
-    "react-hook-form": "^7.77.0",
+    "react-hook-form": "^7.80.0",
     "react-i18next": "^17.0.8",
-    "react-resizable-panels": "^4.11.2",
-    "react-router-dom": "^7.16.0",
-    "recharts": "^3.8.1",
+    "react-resizable-panels": "^4.12.0",
+    "react-router-dom": "^7.18.1",
+    "recharts": "^3.9.1",
     "rehype-autolink-headings": "^7.1.0",
     "rehype-slug": "^6.0.0",
     "remark-frontmatter": "^5.0.0",
     "remark-mdx-frontmatter": "^5.2.0",
     "sonner": "^2.0.7",
-    "stripe": "^22.2.0",
+    "stripe": "^22.3.0",
     "tailwind-merge": "^3.6.0",
     "vaul": "^1.1.2",
     "zod": "^4.4.3"
@@ -122,16 +122,16 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.16",
+    "@biomejs/biome": "^2.5.1",
     "@hono/swagger-ui": "^0.6.1",
-    "@scalar/hono-api-reference": "^0.10.19",
+    "@scalar/hono-api-reference": "^0.11.7",
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^25.9.1",
-    "@types/nodemailer": "^8.0.0",
+    "@types/node": "^26.0.1",
+    "@types/nodemailer": "^8.0.1",
     "@types/pg": "^8.20.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -139,15 +139,15 @@
     "@vitest/coverage-v8": "^4.1.9",
     "esbuild": "^0.28.1",
     "jsdom": "^29.1.1",
-    "pg": "^8.21.0",
+    "pg": "^8.22.0",
     "pino-pretty": "^13.1.3",
     "remark-gfm": "^4.0.1",
-    "shadcn": "^4.10.0",
+    "shadcn": "^4.12.0",
     "tailwindcss": "^4.3.2",
     "tsx": "^4.22.4",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16",
+    "vite": "^8.1.2",
     "vitest": "^4.1.9"
   }
 }

package/carbon/scripts/db-migrate.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * Quiet database migration runner for local dev (`pnpm db:migrate`).
+ *
+ * Applies every /migrations/*.sql (lexical order) then /tmp/super-admin.sql
+ * inside the running `db` compose service. psql runs with notices suppressed
+ * (client_min_messages=warning), command tags silenced (-q), and stdout
+ * discarded (>/dev/null), so a normal idempotent re-run prints ~one line per
+ * file instead of ~200. Real WARNING/ERROR text is preserved on stderr and the
+ * first error aborts the run (ON_ERROR_STOP + set -e).
+ */
+import { spawnSync } from 'node:child_process';
+
+/** The bash program run inside the db container. Exported for unit testing. */
+export function buildMigrateScript() {
+  // Single quiet psql invocation, parameterised by the shell var "$f" / a path.
+  const psql = (file) =>
+    `PGOPTIONS="-c client_min_messages=warning" ` +
+    `psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -f ${file} >/dev/null`;
+
+  return [
+    'set -e',
+    'for f in /migrations/*.sql; do',
+    `  ${psql('"$f"')}`,
+    '  echo "  ✓ $(basename "$f")"',
+    'done',
+    psql('/tmp/super-admin.sql'),
+    'echo "  ✓ super-admin"',
+  ].join('\n');
+}
+
+function main() {
+  console.log('Running database migrations…');
+  const res = spawnSync(
+    'docker',
+    ['compose', 'exec', '-T', 'db', 'bash', '-c', buildMigrateScript()],
+    { stdio: 'inherit' },
+  );
+  if (res.error) {
+    console.error(res.error.message);
+    process.exit(1);
+  }
+  process.exit(res.status ?? 0);
+}
+
+// Run only when invoked directly, not when imported by the test.
+if (process.argv[1] && process.argv[1].endsWith('db-migrate.js')) {
+  main();
+}

package/carbon/scripts/dev-init.js

@@ -95,6 +95,10 @@ ADMIN_PASSWORD="${DEV.ADMIN_PASSWORD}"
 # Site URL (base port — offset applied dynamically, see above)
 SITE_URL="http://localhost:5173"
 
+# Public URL — substituted into index.html's og:/twitter: meta tags by Vite's
+# %VITE_PUBLIC_URL% replacement. Must be defined or Vite warns on every reload.
+VITE_PUBLIC_URL="http://localhost:5173"
+
 # OAuth (disabled for dev)
 GOOGLE_ENABLED="false"
 GOOGLE_CLIENT_ID=""

package/carbon/scripts/dev.js

@@ -109,22 +109,53 @@ if (conflicts.length > 0) {
   process.exit(1);
 }
 
-console.log(`
-  ${cyan('✦')}  Starting ${projectName} services...
+// The service-URL banner is printed *after* both dev servers are listening (see
+// announceWhenReady below) rather than up-front. Otherwise Vite's "ready in Xms"
+// and the API's startup logs print afterward and scroll the URLs off-screen.
+function printBanner() {
+  console.log(`
+  ${cyan('✦')}  ${bold(projectName)} is ready
 
   ${cyan('→')}  ${bold('Frontend:')}  ${cyan(`http://localhost:${ports.vite}`)}
   ${cyan('→')}  ${bold('API:')}       ${cyan(`http://localhost:${ports.api}`)}
-  ${cyan('→')}  ${bold('Studio:')}    ${cyan('http://studio.localhost')} (requires login)
-  ${cyan('→')}  ${bold('Traefik:')}   ${cyan('http://traefik.localhost')} (requires login)
+  ${cyan('→')}  ${bold('Studio:')}    ${cyan('http://studio.localhost')} (no auth in dev)
+  ${cyan('→')}  ${bold('Traefik:')}   ${cyan('http://traefik.localhost')} (no auth in dev)
 `);
+}
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Poll until both dev servers hold their ports (i.e. are listening), then print
+// the URL banner so it lands as the last thing on screen. We watch the ports
+// instead of piping child stdout because `stdio: 'inherit'` keeps Vite's TTY
+// (colours + interactive `h+enter` shortcuts); piping would forfeit both.
+async function announceWhenReady() {
+  const deadline = Date.now() + 30_000; // print anyway after 30s, don't hang
+  while (Date.now() < deadline) {
+    if (shuttingDown) return;
+    const free = await Promise.all([isPortFree(ports.vite), isPortFree(ports.api)]);
+    if (free.every((isFree) => !isFree)) break; // both ports in use → listening
+    await delay(200);
+  }
+  if (shuttingDown) return;
+  // Let the servers' own "ready"/"Starting server" lines flush first.
+  await delay(400);
+  if (!shuttingDown) printBanner();
+}
 
 const children = [];
 
+// pnpm exports its own config as npm_config_* env vars; the nested `npx`
+// (real npm) then warns "Unknown env config …". Silence npm's own warnings
+// for these dev tool processes — tsx/vite write their own logs, not via npm.
+const childEnv = { ...process.env, npm_config_loglevel: 'error' };
+
 // Spawn server process with its own process group for clean shutdown
 const server = spawn('npx', ['tsx', 'watch', '--env-file=.env.local', 'src/server/index.ts'], {
   stdio: 'inherit',
   shell: isWindows,
   detached: !isWindows, // Create process group on Unix for clean group kill
+  env: childEnv,
 });
 children.push(server);
 
@@ -133,12 +164,16 @@ const client = spawn('npx', ['vite'], {
   stdio: 'inherit',
   shell: isWindows,
   detached: !isWindows,
+  env: childEnv,
 });
 children.push(client);
 
 // Track if we're shutting down
 let shuttingDown = false;
 
+// Print the URL banner once both servers are up (fire-and-forget).
+announceWhenReady();
+
 function shutdown(exitCode = 0) {
   if (shuttingDown) return;
   shuttingDown = true;

package/carbon/scripts/lib/vite-log-filter.js

@@ -0,0 +1,29 @@
+// Matches ANSI SGR escape sequences (colour/style codes). In a TTY, Vite wraps
+// the banner labels in colour codes — and crucially places the reset *between*
+// the word and its colon (e.g. `bold("Local") + ":"` → "Local\x1b[22m:"), so the
+// raw line never contains the literal substring "Local:". We strip the escapes
+// before matching. Built from String.fromCharCode(27) rather than a control-char
+// regex literal, which Biome forbids.
+const ANSI_RE = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g');
+
+/**
+ * True when a Vite log line is the dev-server URL banner that our own dev.js
+ * banner already prints (so vite.config.ts's customLogger can drop it). Keeps
+ * the "ready in Xms" header, HMR/reload info, warnings, and errors.
+ *
+ * @param {unknown} msg
+ * @returns {boolean}
+ */
+export function isViteUrlBannerLine(msg) {
+  if (typeof msg !== 'string') return false;
+  // Strip colour codes so matches work the same in a TTY (coloured) and when
+  // piped/CI (plain). Vite splits labels and their colons into separate escape
+  // wrappers, so substring checks must run against the de-coloured text.
+  const plain = msg.replace(ANSI_RE, '');
+  const hasUrl = plain.includes('http://') || plain.includes('https://');
+  // Vite's startup banner: "➜  Local:  <url>" / "➜  Network: <url>".
+  if (hasUrl && (plain.includes('Local:') || plain.includes('Network:'))) return true;
+  // The interactive shortcuts hint printed right after the URLs.
+  if (plain.includes('press h + enter')) return true;
+  return false;
+}

package/carbon/src/client/locales/en.json

@@ -274,7 +274,7 @@
     "hero": {
       "badge": "Fully Automated · Self-Hosted",
       "headline1": "Professional Grade",
-      "subheading": "Full-stack SaaS architecture with auth, billing, infrastructure, and deployment — built for AI-driven development.",
+      "subheading": "Full-stack SaaS starter kit with automated everything — built for AI-driven development.",
       "getUpdates": "Get Updates"
     },
     "logoStrip": {

package/carbon/src/server/lib/env.ts

@@ -102,7 +102,7 @@ if (process.env.NODE_ENV !== 'production' && portOffset !== 0) {
 // makes "" mean "not set", matching operator intent (and how the k8s Secret
 // path already skips empty values).
 const cleanedEnv = Object.fromEntries(
-  Object.entries(process.env).filter(([, value]) => value !== ''),
+  Object.entries(process.env).filter(([, value]) => value !== '')
 );
 
 // Validate environment variables

package/carbon/supabase/migrations/00001_init.sql

@@ -82,7 +82,8 @@ CREATE TABLE IF NOT EXISTS customers (
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_user_id ON customers(user_id) WHERE user_id IS NOT NULL;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_organization_id ON customers(organization_id) WHERE organization_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS idx_customers_stripe_customer_id ON customers(stripe_customer_id);
+-- stripe_customer_id is UNIQUE (see column def), which already creates an index;
+-- a separate idx_ would be a duplicate.
 
 CREATE TABLE IF NOT EXISTS subscriptions (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -99,7 +100,8 @@ CREATE TABLE IF NOT EXISTS subscriptions (
 );
 
 CREATE INDEX IF NOT EXISTS idx_subscriptions_customer_id ON subscriptions(customer_id);
-CREATE INDEX IF NOT EXISTS idx_subscriptions_stripe_subscription_id ON subscriptions(stripe_subscription_id);
+-- stripe_subscription_id is UNIQUE (see column def), which already creates an
+-- index; a separate idx_ would be a duplicate.
 CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);
 
 -- ============================================================================
@@ -132,6 +134,11 @@ CREATE INDEX IF NOT EXISTS idx_notifications_org
   ON notifications(organization_id)
   WHERE organization_id IS NOT NULL;
 
+-- Covering index for the created_by FK (avoids seq scans on auth.users deletes).
+CREATE INDEX IF NOT EXISTS idx_notifications_created_by
+  ON notifications(created_by)
+  WHERE created_by IS NOT NULL;
+
 CREATE TABLE IF NOT EXISTS notification_dismissals (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   notification_id UUID NOT NULL REFERENCES notifications(id) ON DELETE CASCADE,
@@ -167,6 +174,11 @@ CREATE TABLE IF NOT EXISTS app_settings (
   updated_at TIMESTAMPTZ DEFAULT NOW() NOT NULL
 );
 
+-- Covering index for the updated_by FK (avoids seq scans on auth.users deletes).
+CREATE INDEX IF NOT EXISTS idx_app_settings_updated_by
+  ON app_settings(updated_by)
+  WHERE updated_by IS NOT NULL;
+
 -- WARNING: This table is publicly readable by the anonymous role to support
 -- pre-authentication flows (e.g. checking if MFA is enforced).
 -- DO NOT STORE SECRETS, TOKENS, OR SENSITIVE ENVIRONMENT VARIABLES HERE.

package/carbon/supabase/migrations/00003_pg_cron.sql

@@ -48,6 +48,10 @@ CREATE OR REPLACE FUNCTION public.log_cron_job(
 RETURNS void
 LANGUAGE plpgsql
 SECURITY DEFINER
+-- Pin search_path so this SECURITY DEFINER function can't be hijacked by a
+-- malicious object in an attacker-controlled schema. All refs below are already
+-- schema-qualified (public.cron_job_history), so an empty path is safe.
+SET search_path = ''
 AS $$
 BEGIN
   INSERT INTO public.cron_job_history (job_name, status, finished_at, result, error)

package/carbon/supabase/migrations/00004_contact_newsletter.sql

@@ -52,7 +52,8 @@ CREATE TABLE IF NOT EXISTS public.newsletter_subscribers (
 );
 
 CREATE INDEX IF NOT EXISTS idx_newsletter_subscribers_status ON public.newsletter_subscribers (status);
-CREATE INDEX IF NOT EXISTS idx_newsletter_subscribers_email ON public.newsletter_subscribers (email);
+-- email is UNIQUE (see column def), which already creates an index; a separate
+-- idx_ would be a duplicate.
 
 ALTER TABLE public.newsletter_subscribers ENABLE ROW LEVEL SECURITY;
 

package/carbon/vite.config.ts

@@ -7,7 +7,8 @@ import rehypeSlug from 'rehype-slug';
 import remarkFrontmatter from 'remark-frontmatter';
 import remarkGfm from 'remark-gfm';
 import remarkMdxFrontmatter from 'remark-mdx-frontmatter';
-import { defineConfig, loadEnv } from 'vite';
+import { createLogger, defineConfig, loadEnv } from 'vite';
+import { isViteUrlBannerLine } from './scripts/lib/vite-log-filter.js';
 
 // Calculate ports based on offset and overrides
 function getPort(envVarName: string, defaultPort: number, offset: number): number {
@@ -36,7 +37,19 @@ export default defineConfig(({ mode }) => {
         }
       : {};
 
+  const logger = createLogger();
+  const baseInfo = logger.info.bind(logger);
+  // Our dev.js banner is the single source of truth for service URLs; drop
+  // Vite's redundant Local/Network/"press h" lines but keep readiness, HMR,
+  // warnings, and errors.
+  logger.info = (msg, options) => {
+    if (isViteUrlBannerLine(msg)) return;
+    baseInfo(msg, options);
+  };
+
   return {
+    customLogger: logger,
+
     plugins: [
       mdx({
         remarkPlugins: [remarkFrontmatter, remarkGfm, remarkMdxFrontmatter],

package/carbon/volumes/db/super-admin.dev.sql

@@ -8,7 +8,11 @@ DECLARE
   new_user_id UUID;
 BEGIN
   -- Only create if admin email is provided and not empty
-  IF admin_email IS NOT NULL AND admin_email != '' THEN
+  -- Skip when the email is still an unreplaced "{{ADMIN_EMAIL}}" template token
+  -- (e.g. the raw dev template mounted at /tmp/super-admin.sql): the existence
+  -- check could never match, so it would always attempt a duplicate INSERT and
+  -- collide on UNIQUE(phone) with the admin created at container init.
+  IF admin_email IS NOT NULL AND admin_email != '' AND admin_email NOT LIKE '{{%' THEN
 
     -- Check if user already exists
     IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN

package/carbon/volumes/db/super-admin.sql

@@ -9,7 +9,10 @@ DECLARE
   new_user_id UUID;
 BEGIN
   -- Only create if admin email is provided and not empty
-  IF admin_email IS NOT NULL AND admin_email != '' THEN
+  -- Skip when the email is still an unreplaced "{{ADMIN_EMAIL}}" template token:
+  -- the existence check could never match, so it would always attempt a
+  -- duplicate INSERT and collide on UNIQUE(phone) with an existing admin.
+  IF admin_email IS NOT NULL AND admin_email != '' AND admin_email NOT LIKE '{{%' THEN
 
     -- Check if user already exists
     IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -57,12 +57,12 @@
     "url": "https://github.com/hyperformant/vibecarbon.git"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1058.0",
-    "@clack/prompts": "^1.5.0",
-    "@pulumi/hcloud": "^1.38.0",
-    "@pulumi/pulumi": "^3.244.0",
+    "@aws-sdk/client-s3": "^3.1077.0",
+    "@clack/prompts": "^1.6.0",
+    "@pulumi/hcloud": "^1.39.0",
+    "@pulumi/pulumi": "^3.248.0",
     "bcryptjs": "^3.0.3",
-    "undici": "^8.3.0",
+    "undici": "^8.5.0",
     "which": "^7.0.0"
   },
   "pnpm": {
@@ -81,18 +81,18 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.16",
+    "@biomejs/biome": "^2.5.1",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
     "@types/better-sqlite3": "^7.6.13",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.9",
     "autocannon": "^8.0.0",
-    "better-sqlite3": "^12.10.0",
-    "conventional-changelog-conventionalcommits": "^9.3.1",
-    "semantic-release": "^25.0.3",
+    "better-sqlite3": "^12.11.1",
+    "conventional-changelog-conventionalcommits": "^10.2.0",
+    "semantic-release": "^25.0.5",
     "tsx": "^4.22.4",
-    "vite": "^8.0.16",
-    "vitest": "^4.1.8",
+    "vite": "^8.1.2",
+    "vitest": "^4.1.9",
     "zod": "^4.4.3"
   }
 }

package/src/create.js

@@ -1165,6 +1165,64 @@ ${runCmd} test:prepush
   );
   await tick();
 
+  // Create the initial commit so the user starts from a clean, tracked
+  // template baseline (not a pile of untracked files). Guarded by the same
+  // `gitAvailable` flag as `git init` above — if git isn't on PATH we already
+  // logged the skip note and there's no repo to commit into.
+  if (gitAvailable) {
+    s.message('Creating initial commit');
+
+    // The pre-commit hook we just installed runs `${pm} lint` under `set -e`,
+    // and node_modules is absent by default (install is opt-in via -install),
+    // so a verified commit would fail. The template is vibecarbon-authored and
+    // already clean; the hooks exist to gate the user's *future* commits.
+    const commitArgs = ['git', 'commit', '--no-verify', '-m', 'Initial commit from vibecarbon'];
+
+    // `git commit` aborts when no author identity is configured. If neither
+    // user.name nor user.email is set, prepend fallback identity via `-c`
+    // (command-line `-c` only overrides config files, and is itself overridden
+    // by any GIT_AUTHOR_* env — so a real identity, by config or env, always
+    // wins; the fallback only fills a total void).
+    const name = runCommand(['git', 'config', 'user.name'], {
+      cwd: projectDir,
+      cleanEnv: true,
+      silent: true,
+      ignoreError: true,
+    });
+    const email = runCommand(['git', 'config', 'user.email'], {
+      cwd: projectDir,
+      cleanEnv: true,
+      silent: true,
+      ignoreError: true,
+    });
+    if (!name || !email || !String(name).trim() || !String(email).trim()) {
+      commitArgs.splice(
+        1,
+        0,
+        '-c',
+        'user.name=vibecarbon',
+        '-c',
+        'user.email=vibecarbon@users.noreply.github.com',
+      );
+    }
+
+    const staged = runCommand(['git', 'add', '-A'], {
+      cwd: projectDir,
+      cleanEnv: true,
+      ignoreError: true,
+    });
+    const committed =
+      staged !== null &&
+      runCommand(commitArgs, { cwd: projectDir, cleanEnv: true, ignoreError: true }) !== null;
+
+    if (!committed) {
+      p.log.warn(
+        "Couldn't create the initial commit — run `git add -A && git commit` in the project to capture the baseline.",
+      );
+    }
+    await tick();
+  }
+
   s.stop('Project created successfully');
   registerProject(projectName, projectDir);
   tracker.finish();

package/src/lib/orphan.js

@@ -0,0 +1,221 @@
+/**
+ * Orphan dev-session reclaim helpers for `vibecarbon up`.
+ *
+ * When a project port is in use, the most common cause is an orphaned dev
+ * session belonging to the SAME project — a previous `node scripts/dev.js`
+ * tree (its child Vite + tsx API servers) that outlived its parent and was
+ * reparented to init while still holding the port. Rather than dodge the
+ * conflict by bumping DEV_PORT_OFFSET (which leaves the runaway alive and
+ * drifts the project onto a new port band), we identify the process actually
+ * listening on the port and, if it belongs to this project's working
+ * directory, kill its whole process group so a clean restart can reuse the
+ * normal ports.
+ *
+ * Strict scoping is the safety contract: we kill a process only when its
+ * working directory resolves to the project dir (or a subdir). A process we
+ * can't introspect (different user → EACCES) is treated as foreign and never
+ * touched. On non-Unix platforms, or when `lsof`/`ps` are unavailable, the
+ * helpers degrade to no-ops and the caller falls back to offset-bumping.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { readlinkSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+
+const isUnix = () => process.platform !== 'win32';
+
+const RUN_OPTS = { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] };
+
+/**
+ * PIDs listening on the given TCP port. Returns deduped positive integers,
+ * or [] on non-Unix, missing `lsof`, or any error.
+ * @param {number} port
+ * @returns {number[]}
+ */
+export function findPortListeners(port) {
+  if (!isUnix()) return [];
+  try {
+    const out = execFileSync('lsof', ['-t', `-iTCP:${port}`, '-sTCP:LISTEN'], RUN_OPTS);
+    const pids = out
+      .trim()
+      .split('\n')
+      .map((line) => Number(line.trim()))
+      .filter((n) => Number.isInteger(n) && n > 0);
+    return [...new Set(pids)];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Resolved working directory of a process, or null if it can't be read
+ * (gone, foreign user / EACCES, or unsupported platform). Linux reads
+ * /proc/<pid>/cwd; other Unixes fall back to `lsof`.
+ * @param {number} pid
+ * @returns {string | null}
+ */
+export function getProcessCwd(pid) {
+  if (!isUnix()) return null;
+  try {
+    return readlinkSync(`/proc/${pid}/cwd`);
+  } catch (err) {
+    // Different user owns the process — treat as foreign, never kill.
+    if (err && err.code === 'EACCES') return null;
+    // ENOENT (no /proc, e.g. macOS) → try lsof; other errors → null below.
+  }
+  try {
+    const out = execFileSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], RUN_OPTS);
+    const nameLine = out.split('\n').find((line) => line.startsWith('n'));
+    return nameLine ? nameLine.slice(1) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Process group id (pgid) of a process, or null on failure.
+ * @param {number} pid
+ * @returns {number | null}
+ */
+export function getProcessGroup(pid) {
+  if (!isUnix()) return null;
+  try {
+    const out = execFileSync('ps', ['-o', 'pgid=', '-p', String(pid)], RUN_OPTS);
+    const pgid = Number(out.trim());
+    return Number.isInteger(pgid) && pgid > 0 ? pgid : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True iff the process's working directory resolves to `projectCwd` or a
+ * subdirectory of it.
+ * @param {number} pid
+ * @param {string} projectCwd
+ * @returns {boolean}
+ */
+export function isOwnedByProject(pid, projectCwd) {
+  const cwd = getProcessCwd(pid);
+  if (!cwd) return false;
+  const proc = resolve(cwd);
+  const root = resolve(projectCwd);
+  return proc === root || proc.startsWith(root + sep);
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** True if the process is still alive (signal 0 probe). */
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // ESRCH → gone. EPERM → alive but not ours (shouldn't happen for an
+    // owned orphan) — report alive so we don't claim a false reclaim.
+    return !!err && err.code !== 'ESRCH';
+  }
+}
+
+/** Best-effort signal to a target; swallows ESRCH/EPERM races. */
+function signal(target, sig) {
+  try {
+    process.kill(target, sig);
+  } catch {
+    // Already gone or not permitted — nothing more we can do.
+  }
+}
+
+/**
+ * Reclaim a port held by this project's own orphaned dev session.
+ *
+ * Finds the listeners on `port`, keeps only those whose working directory
+ * belongs to `projectCwd`, and kills each owned holder's process group
+ * (SIGTERM, then SIGKILL after a grace period). Foreign holders are reported
+ * but never touched.
+ *
+ * @param {number} port
+ * @param {string} projectCwd
+ * @param {{ graceMs?: number, intervalMs?: number }} [opts]
+ * @returns {Promise<{ killed: number[], foreign: number[], freed: boolean }>}
+ */
+export async function reclaimPort(port, projectCwd, { graceMs = 2000, intervalMs = 100 } = {}) {
+  const listeners = findPortListeners(port);
+  if (listeners.length === 0) return { killed: [], foreign: [], freed: false };
+
+  const owned = [];
+  const foreign = [];
+  for (const pid of listeners) {
+    if (isOwnedByProject(pid, projectCwd)) owned.push(pid);
+    else foreign.push(pid);
+  }
+  if (owned.length === 0) return { killed: [], foreign, freed: false };
+
+  // Prefer group-targeted kills so the whole dev.js → vite/tsx tree dies in
+  // one shot; fall back to the bare pid if we can't resolve a pgid.
+  const seenGroups = new Set();
+  const targets = [];
+  for (const pid of owned) {
+    const pgid = getProcessGroup(pid);
+    if (pgid) {
+      if (!seenGroups.has(pgid)) {
+        seenGroups.add(pgid);
+        targets.push(-pgid);
+      }
+    } else {
+      targets.push(pid);
+    }
+  }
+
+  for (const target of targets) signal(target, 'SIGTERM');
+
+  const deadline = Date.now() + graceMs;
+  while (owned.some(isAlive) && Date.now() < deadline) {
+    await sleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())));
+  }
+
+  if (owned.some(isAlive)) {
+    for (const target of targets) signal(target, 'SIGKILL');
+    await sleep(intervalMs);
+  }
+
+  const killed = owned.filter((pid) => !isAlive(pid));
+  const freed = !findPortListeners(port).length;
+  return { killed, foreign, freed };
+}
+
+/**
+ * @typedef {{ name: string, port: number }} PortConflict
+ */
+
+/**
+ * Reclaim each conflicting port held by this project's orphaned dev session,
+ * then report which conflicts remain (foreign or otherwise unrecoverable) so
+ * the caller can fall back to offset-bumping for just those.
+ *
+ * Each port is re-checked after reclaim because killing one orphan's process
+ * group can free a sibling port in the same dev tree.
+ *
+ * @param {PortConflict[]} conflicts
+ * @param {string} projectCwd
+ * @param {{
+ *   reclaim?: (port: number, cwd: string) => Promise<{ killed: number[], foreign: number[], freed: boolean }>,
+ *   recheck: (port: number) => Promise<boolean>,
+ *   onReclaim?: (conflict: PortConflict, result: { killed: number[] }) => void,
+ * }} deps
+ * @returns {Promise<{ reclaimed: Array<PortConflict & { killed: number[] }>, remaining: PortConflict[] }>}
+ */
+export async function reclaimOrphanPorts(conflicts, projectCwd, deps) {
+  const { reclaim = reclaimPort, recheck, onReclaim } = deps;
+  const reclaimed = [];
+  const remaining = [];
+  for (const conflict of conflicts) {
+    const result = await reclaim(conflict.port, projectCwd);
+    if (result.killed.length > 0) {
+      reclaimed.push({ ...conflict, killed: result.killed });
+      onReclaim?.(conflict, result);
+    }
+    if (await recheck(conflict.port)) remaining.push(conflict);
+  }
+  return { reclaimed, remaining };
+}

package/src/up.js

@@ -14,6 +14,7 @@ import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
 import { c, printBanner } from './lib/colors.js';
 import { runCommandThroughTaskLog } from './lib/command.js';
+import { reclaimOrphanPorts } from './lib/orphan.js';
 import { detectPackageManager } from './lib/project.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { VERSION } from './lib/version.js';
@@ -219,14 +220,28 @@ export async function run(args = []) {
   }
 
   if (conflicts.length > 0) {
-    p.log.warn('Port conflicts detected:');
-    for (const { name, port } of conflicts) {
-      p.log.message(`  ${c.dim(name.padEnd(20))} port ${c.bold(String(port))} is in use`);
-    }
+    // First reclaim any ports held by THIS project's own orphaned dev session
+    // (a previous `dev.js` tree that outlived its parent and kept squatting on
+    // the ports). Killing the orphan lets us reuse the normal port band; only
+    // genuinely foreign conflicts fall through to offset-bumping.
+    const { remaining } = await reclaimOrphanPorts(conflicts, cwd, {
+      recheck: isPortInUse,
+      onReclaim: ({ name, port }, { killed }) =>
+        p.log.success(
+          `Reclaimed ${name} port ${c.bold(String(port))} from orphaned dev session (PID ${killed.join(', ')})`,
+        ),
+    });
 
-    const offset = await findFreeOffset(cwd);
-    setPortOffset(offset, cwd);
-    p.log.success(`Applied DEV_PORT_OFFSET=${offset} to .env.local`);
+    if (remaining.length > 0) {
+      p.log.warn('Port conflicts detected (not owned by this project):');
+      for (const { name, port } of remaining) {
+        p.log.message(`  ${c.dim(name.padEnd(20))} port ${c.bold(String(port))} is in use`);
+      }
+
+      const offset = await findFreeOffset(cwd);
+      setPortOffset(offset, cwd);
+      p.log.success(`Applied DEV_PORT_OFFSET=${offset} to .env.local`);
+    }
   }
 
   const pm = detectPackageManager(cwd);