vibecarbon 0.7.0 → 0.8.0

package/carbon/biome.json

@@ -1,9 +1,10 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "root": false,
+  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "complexity": {
         "noUselessFragments": "warn"
       },

package/carbon/package.json

@@ -50,7 +50,7 @@
     "stripe:listen": "stripe listen --forward-to localhost:3000/api/webhooks/stripe"
   },
   "dependencies": {
-    "@base-ui/react": "^1.5.0",
+    "@base-ui/react": "^1.6.0",
     "@fontsource-variable/noto-sans": "^5.2.10",
     "@fontsource/jetbrains-mono": "^5.2.8",
     "@hono/node-server": "^2.0.6",
@@ -58,39 +58,39 @@
     "@hookform/resolvers": "^5.4.0",
     "@mdx-js/react": "^3.1.1",
     "@mdx-js/rollup": "^3.1.1",
-    "@scalar/api-reference-react": "^0.9.49",
-    "@supabase/supabase-js": "^2.108.2",
-    "@tanstack/react-query": "^5.100.14",
+    "@scalar/api-reference-react": "^0.9.50",
+    "@supabase/supabase-js": "^2.110.0",
+    "@tanstack/react-query": "^5.101.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.4.0",
     "embla-carousel-react": "^8.6.0",
-    "framer-motion": "^12.40.0",
+    "framer-motion": "^12.42.2",
     "hono": "^4.12.27",
-    "i18next": "^26.3.3",
+    "i18next": "^26.3.4",
     "i18next-browser-languagedetector": "^8.2.1",
     "input-otp": "^1.4.2",
     "ioredis": "^5.11.1",
     "lenis": "^1.3.25",
-    "lucide-react": "^1.17.0",
+    "lucide-react": "^1.22.0",
     "next-themes": "^0.4.6",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^9.0.3",
     "pino": "^10.3.1",
     "react": "^19.2.7",
     "react-day-picker": "^10.0.1",
     "react-dom": "^19.2.7",
-    "react-hook-form": "^7.77.0",
+    "react-hook-form": "^7.80.0",
     "react-i18next": "^17.0.8",
-    "react-resizable-panels": "^4.11.2",
-    "react-router-dom": "^7.16.0",
-    "recharts": "^3.8.1",
+    "react-resizable-panels": "^4.12.0",
+    "react-router-dom": "^7.18.1",
+    "recharts": "^3.9.1",
     "rehype-autolink-headings": "^7.1.0",
     "rehype-slug": "^6.0.0",
     "remark-frontmatter": "^5.0.0",
     "remark-mdx-frontmatter": "^5.2.0",
     "sonner": "^2.0.7",
-    "stripe": "^22.2.0",
+    "stripe": "^22.3.0",
     "tailwind-merge": "^3.6.0",
     "vaul": "^1.1.2",
     "zod": "^4.4.3"
@@ -122,16 +122,16 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.16",
+    "@biomejs/biome": "^2.5.1",
     "@hono/swagger-ui": "^0.6.1",
-    "@scalar/hono-api-reference": "^0.10.19",
+    "@scalar/hono-api-reference": "^0.11.7",
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^25.9.1",
-    "@types/nodemailer": "^8.0.0",
+    "@types/node": "^26.0.1",
+    "@types/nodemailer": "^8.0.1",
     "@types/pg": "^8.20.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -139,15 +139,15 @@
     "@vitest/coverage-v8": "^4.1.9",
     "esbuild": "^0.28.1",
     "jsdom": "^29.1.1",
-    "pg": "^8.21.0",
+    "pg": "^8.22.0",
     "pino-pretty": "^13.1.3",
     "remark-gfm": "^4.0.1",
-    "shadcn": "^4.10.0",
+    "shadcn": "^4.12.0",
     "tailwindcss": "^4.3.2",
     "tsx": "^4.22.4",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16",
+    "vite": "^8.1.2",
     "vitest": "^4.1.9"
   }
 }

package/carbon/src/server/lib/env.ts

@@ -102,7 +102,7 @@ if (process.env.NODE_ENV !== 'production' && portOffset !== 0) {
 // makes "" mean "not set", matching operator intent (and how the k8s Secret
 // path already skips empty values).
 const cleanedEnv = Object.fromEntries(
-  Object.entries(process.env).filter(([, value]) => value !== ''),
+  Object.entries(process.env).filter(([, value]) => value !== '')
 );
 
 // Validate environment variables

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -57,12 +57,12 @@
     "url": "https://github.com/hyperformant/vibecarbon.git"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1058.0",
-    "@clack/prompts": "^1.5.0",
-    "@pulumi/hcloud": "^1.38.0",
-    "@pulumi/pulumi": "^3.244.0",
+    "@aws-sdk/client-s3": "^3.1077.0",
+    "@clack/prompts": "^1.6.0",
+    "@pulumi/hcloud": "^1.39.0",
+    "@pulumi/pulumi": "^3.248.0",
     "bcryptjs": "^3.0.3",
-    "undici": "^8.3.0",
+    "undici": "^8.5.0",
     "which": "^7.0.0"
   },
   "pnpm": {
@@ -81,18 +81,18 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.16",
+    "@biomejs/biome": "^2.5.1",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
     "@types/better-sqlite3": "^7.6.13",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.9",
     "autocannon": "^8.0.0",
-    "better-sqlite3": "^12.10.0",
-    "conventional-changelog-conventionalcommits": "^9.3.1",
-    "semantic-release": "^25.0.3",
+    "better-sqlite3": "^12.11.1",
+    "conventional-changelog-conventionalcommits": "^10.2.0",
+    "semantic-release": "^25.0.5",
     "tsx": "^4.22.4",
-    "vite": "^8.0.16",
-    "vitest": "^4.1.8",
+    "vite": "^8.1.2",
+    "vitest": "^4.1.9",
     "zod": "^4.4.3"
   }
 }

package/src/lib/orphan.js

@@ -0,0 +1,221 @@
+/**
+ * Orphan dev-session reclaim helpers for `vibecarbon up`.
+ *
+ * When a project port is in use, the most common cause is an orphaned dev
+ * session belonging to the SAME project — a previous `node scripts/dev.js`
+ * tree (its child Vite + tsx API servers) that outlived its parent and was
+ * reparented to init while still holding the port. Rather than dodge the
+ * conflict by bumping DEV_PORT_OFFSET (which leaves the runaway alive and
+ * drifts the project onto a new port band), we identify the process actually
+ * listening on the port and, if it belongs to this project's working
+ * directory, kill its whole process group so a clean restart can reuse the
+ * normal ports.
+ *
+ * Strict scoping is the safety contract: we kill a process only when its
+ * working directory resolves to the project dir (or a subdir). A process we
+ * can't introspect (different user → EACCES) is treated as foreign and never
+ * touched. On non-Unix platforms, or when `lsof`/`ps` are unavailable, the
+ * helpers degrade to no-ops and the caller falls back to offset-bumping.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { readlinkSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+
+const isUnix = () => process.platform !== 'win32';
+
+const RUN_OPTS = { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] };
+
+/**
+ * PIDs listening on the given TCP port. Returns deduped positive integers,
+ * or [] on non-Unix, missing `lsof`, or any error.
+ * @param {number} port
+ * @returns {number[]}
+ */
+export function findPortListeners(port) {
+  if (!isUnix()) return [];
+  try {
+    const out = execFileSync('lsof', ['-t', `-iTCP:${port}`, '-sTCP:LISTEN'], RUN_OPTS);
+    const pids = out
+      .trim()
+      .split('\n')
+      .map((line) => Number(line.trim()))
+      .filter((n) => Number.isInteger(n) && n > 0);
+    return [...new Set(pids)];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Resolved working directory of a process, or null if it can't be read
+ * (gone, foreign user / EACCES, or unsupported platform). Linux reads
+ * /proc/<pid>/cwd; other Unixes fall back to `lsof`.
+ * @param {number} pid
+ * @returns {string | null}
+ */
+export function getProcessCwd(pid) {
+  if (!isUnix()) return null;
+  try {
+    return readlinkSync(`/proc/${pid}/cwd`);
+  } catch (err) {
+    // Different user owns the process — treat as foreign, never kill.
+    if (err && err.code === 'EACCES') return null;
+    // ENOENT (no /proc, e.g. macOS) → try lsof; other errors → null below.
+  }
+  try {
+    const out = execFileSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], RUN_OPTS);
+    const nameLine = out.split('\n').find((line) => line.startsWith('n'));
+    return nameLine ? nameLine.slice(1) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Process group id (pgid) of a process, or null on failure.
+ * @param {number} pid
+ * @returns {number | null}
+ */
+export function getProcessGroup(pid) {
+  if (!isUnix()) return null;
+  try {
+    const out = execFileSync('ps', ['-o', 'pgid=', '-p', String(pid)], RUN_OPTS);
+    const pgid = Number(out.trim());
+    return Number.isInteger(pgid) && pgid > 0 ? pgid : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True iff the process's working directory resolves to `projectCwd` or a
+ * subdirectory of it.
+ * @param {number} pid
+ * @param {string} projectCwd
+ * @returns {boolean}
+ */
+export function isOwnedByProject(pid, projectCwd) {
+  const cwd = getProcessCwd(pid);
+  if (!cwd) return false;
+  const proc = resolve(cwd);
+  const root = resolve(projectCwd);
+  return proc === root || proc.startsWith(root + sep);
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** True if the process is still alive (signal 0 probe). */
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // ESRCH → gone. EPERM → alive but not ours (shouldn't happen for an
+    // owned orphan) — report alive so we don't claim a false reclaim.
+    return !!err && err.code !== 'ESRCH';
+  }
+}
+
+/** Best-effort signal to a target; swallows ESRCH/EPERM races. */
+function signal(target, sig) {
+  try {
+    process.kill(target, sig);
+  } catch {
+    // Already gone or not permitted — nothing more we can do.
+  }
+}
+
+/**
+ * Reclaim a port held by this project's own orphaned dev session.
+ *
+ * Finds the listeners on `port`, keeps only those whose working directory
+ * belongs to `projectCwd`, and kills each owned holder's process group
+ * (SIGTERM, then SIGKILL after a grace period). Foreign holders are reported
+ * but never touched.
+ *
+ * @param {number} port
+ * @param {string} projectCwd
+ * @param {{ graceMs?: number, intervalMs?: number }} [opts]
+ * @returns {Promise<{ killed: number[], foreign: number[], freed: boolean }>}
+ */
+export async function reclaimPort(port, projectCwd, { graceMs = 2000, intervalMs = 100 } = {}) {
+  const listeners = findPortListeners(port);
+  if (listeners.length === 0) return { killed: [], foreign: [], freed: false };
+
+  const owned = [];
+  const foreign = [];
+  for (const pid of listeners) {
+    if (isOwnedByProject(pid, projectCwd)) owned.push(pid);
+    else foreign.push(pid);
+  }
+  if (owned.length === 0) return { killed: [], foreign, freed: false };
+
+  // Prefer group-targeted kills so the whole dev.js → vite/tsx tree dies in
+  // one shot; fall back to the bare pid if we can't resolve a pgid.
+  const seenGroups = new Set();
+  const targets = [];
+  for (const pid of owned) {
+    const pgid = getProcessGroup(pid);
+    if (pgid) {
+      if (!seenGroups.has(pgid)) {
+        seenGroups.add(pgid);
+        targets.push(-pgid);
+      }
+    } else {
+      targets.push(pid);
+    }
+  }
+
+  for (const target of targets) signal(target, 'SIGTERM');
+
+  const deadline = Date.now() + graceMs;
+  while (owned.some(isAlive) && Date.now() < deadline) {
+    await sleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())));
+  }
+
+  if (owned.some(isAlive)) {
+    for (const target of targets) signal(target, 'SIGKILL');
+    await sleep(intervalMs);
+  }
+
+  const killed = owned.filter((pid) => !isAlive(pid));
+  const freed = !findPortListeners(port).length;
+  return { killed, foreign, freed };
+}
+
+/**
+ * @typedef {{ name: string, port: number }} PortConflict
+ */
+
+/**
+ * Reclaim each conflicting port held by this project's orphaned dev session,
+ * then report which conflicts remain (foreign or otherwise unrecoverable) so
+ * the caller can fall back to offset-bumping for just those.
+ *
+ * Each port is re-checked after reclaim because killing one orphan's process
+ * group can free a sibling port in the same dev tree.
+ *
+ * @param {PortConflict[]} conflicts
+ * @param {string} projectCwd
+ * @param {{
+ *   reclaim?: (port: number, cwd: string) => Promise<{ killed: number[], foreign: number[], freed: boolean }>,
+ *   recheck: (port: number) => Promise<boolean>,
+ *   onReclaim?: (conflict: PortConflict, result: { killed: number[] }) => void,
+ * }} deps
+ * @returns {Promise<{ reclaimed: Array<PortConflict & { killed: number[] }>, remaining: PortConflict[] }>}
+ */
+export async function reclaimOrphanPorts(conflicts, projectCwd, deps) {
+  const { reclaim = reclaimPort, recheck, onReclaim } = deps;
+  const reclaimed = [];
+  const remaining = [];
+  for (const conflict of conflicts) {
+    const result = await reclaim(conflict.port, projectCwd);
+    if (result.killed.length > 0) {
+      reclaimed.push({ ...conflict, killed: result.killed });
+      onReclaim?.(conflict, result);
+    }
+    if (await recheck(conflict.port)) remaining.push(conflict);
+  }
+  return { reclaimed, remaining };
+}

package/src/up.js

@@ -14,6 +14,7 @@ import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
 import { c, printBanner } from './lib/colors.js';
 import { runCommandThroughTaskLog } from './lib/command.js';
+import { reclaimOrphanPorts } from './lib/orphan.js';
 import { detectPackageManager } from './lib/project.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { VERSION } from './lib/version.js';
@@ -219,14 +220,28 @@ export async function run(args = []) {
   }
 
   if (conflicts.length > 0) {
-    p.log.warn('Port conflicts detected:');
-    for (const { name, port } of conflicts) {
-      p.log.message(`  ${c.dim(name.padEnd(20))} port ${c.bold(String(port))} is in use`);
-    }
+    // First reclaim any ports held by THIS project's own orphaned dev session
+    // (a previous `dev.js` tree that outlived its parent and kept squatting on
+    // the ports). Killing the orphan lets us reuse the normal port band; only
+    // genuinely foreign conflicts fall through to offset-bumping.
+    const { remaining } = await reclaimOrphanPorts(conflicts, cwd, {
+      recheck: isPortInUse,
+      onReclaim: ({ name, port }, { killed }) =>
+        p.log.success(
+          `Reclaimed ${name} port ${c.bold(String(port))} from orphaned dev session (PID ${killed.join(', ')})`,
+        ),
+    });
 
-    const offset = await findFreeOffset(cwd);
-    setPortOffset(offset, cwd);
-    p.log.success(`Applied DEV_PORT_OFFSET=${offset} to .env.local`);
+    if (remaining.length > 0) {
+      p.log.warn('Port conflicts detected (not owned by this project):');
+      for (const { name, port } of remaining) {
+        p.log.message(`  ${c.dim(name.padEnd(20))} port ${c.bold(String(port))} is in use`);
+      }
+
+      const offset = await findFreeOffset(cwd);
+      setPortOffset(offset, cwd);
+      p.log.success(`Applied DEV_PORT_OFFSET=${offset} to .env.local`);
+    }
   }
 
   const pm = detectPackageManager(cwd);