vibecarbon 0.9.0 → 0.11.0

package/src/lib/deploy/image.js

@@ -13,6 +13,9 @@
  */
 
 import { execFileSync } from 'node:child_process';
+import { runCommandAsync } from '../command.js';
+import { knownHostsPathForKey } from '../host-keys.js';
+import { shEscape } from '../shell.js';
 
 const LOCAL_REGISTRY_PREFIX = 'vibecarbon-local';
 
@@ -93,9 +96,9 @@ export function inspectGitState(cwd) {
  *
  * @param {string} projectDir - Project root with the Dockerfile.
  * @param {{projectName: string, timestamp?: string, rebuild?: boolean, tagPrefix?: string, buildArgs?: Record<string,string>}} options
- * @returns {{tag: string, gitSha: string, isDirty: boolean}}
+ * @returns {Promise<{tag: string, gitSha: string, isDirty: boolean}>}
  */
-export function buildLocalImage(projectDir, options) {
+export async function buildLocalImage(projectDir, options) {
   const { projectName, rebuild = false, tagPrefix, buildArgs = {} } = options;
   if (!projectName) {
     throw new Error('buildLocalImage: projectName is required');
@@ -122,7 +125,15 @@ export function buildLocalImage(projectDir, options) {
   }
   args.push('-t', tag, projectDir);
 
-  execFileSync('docker', args, { stdio: 'inherit' });
+  // silent: false (the default) inherits stdio so the operator sees layer
+  // progress — but runCommandAsync only *rejects* on nonzero exit when
+  // silent:true; with inherited stdio it resolves `false` instead (see
+  // global constraints). The old execFileSync({stdio:'inherit'}) threw on
+  // its own, so we must replicate "fail loudly" by hand here.
+  const ok = await runCommandAsync(['docker', ...args], {});
+  if (ok === false) {
+    throw new Error(`buildLocalImage: docker build failed for ${tag}`);
+  }
   return { tag, gitSha, isDirty };
 }
 
@@ -146,50 +157,47 @@ function defaultTimestamp() {
  * `gzip -1` is universally present and dominant cost is network, not CPU.
  *
  * `pipefail` so a docker-save / gzip failure isn't masked by ssh's exit code.
- * `StrictHostKeyChecking=accept-new` matches the convention used elsewhere
- * in vibecarbon's ssh paths: trust-on-first-use, error on host-key change.
  *
  * @param {{tag: string, sshTarget: string, sshKey?: string}} args
+ * @returns {Promise<void>}
  */
-export function sideloadCompose({ tag, sshTarget, sshKey }) {
-  // SSH options mirror remote-build.js's wrapper script — same tradeoffs:
-  //   * StrictHostKeyChecking=no + UserKnownHostsFile=/dev/null: ephemeral
-  //     VPS IPs get recycled across e2e runs (and across customer
-  //     redeploys after destroy). accept-new + the operator's real
-  //     ~/.ssh/known_hosts would fail with "host key verification failed"
-  //     whenever a recycled IP shows up with a new host key, even with
-  //     BatchMode=yes (in fact especially then, since ssh can't prompt to
-  //     update the entry). iter-perfwave4 hit exactly this on first run.
+export async function sideloadCompose({ tag, sshTarget, sshKey }) {
+  // SSH options mirror remote-build.js's wrapper + the compose deploy path:
+  //   * Host-key pinned per-env (knownHostsPathForKey), NOT /dev/null + no.
+  //     accept-new TOFU's an ephemeral/recycled Hetzner IP but rejects a
+  //     changed key for an already-pinned host (MITM on an established env
+  //     fails). GlobalKnownHostsFile=/dev/null ignores the system file; the
+  //     operator's ~/.ssh/known_hosts is never touched (a stale entry there
+  //     would otherwise reject a recycled IP — iter-perfwave4 hit this).
   //   * BatchMode=yes per feedback_ssh_batchmode_required.md (PR 1T):
-  //     fast-fail rather than hang on interactive password prompt if the
-  //     key fails.
+  //     fast-fail rather than hang on interactive password prompt.
   //   * ConnectTimeout=30: bound the network half of dial; sideload's own
   //     stream is unbounded (limited by docker save throughput).
-  const sshFlags = [
-    '-o',
-    'StrictHostKeyChecking=no',
-    '-o',
-    'UserKnownHostsFile=/dev/null',
-    '-o',
-    'BatchMode=yes',
-    '-o',
-    'ConnectTimeout=30',
-  ];
-  if (sshKey) sshFlags.unshift('-i', sshKey);
+  const sshFlags = ['-o', 'StrictHostKeyChecking=accept-new'];
+  if (sshKey) {
+    // shEscape the known_hosts assignment so a project dir with spaces can't
+    // split the argument in the bash -c string below.
+    sshFlags.push('-o', shEscape(`UserKnownHostsFile=${knownHostsPathForKey(sshKey)}`));
+    sshFlags.push('-o', 'GlobalKnownHostsFile=/dev/null');
+  }
+  sshFlags.push('-o', 'BatchMode=yes', '-o', 'ConnectTimeout=30');
+  if (sshKey) sshFlags.unshift('-i', shEscape(sshKey));
   const cmd = `set -o pipefail && docker save ${tag} | gzip -1 | ssh ${sshFlags.join(' ')} ${sshTarget} 'gunzip | docker load'`;
   // Capture stdio rather than inheriting it: ssh's "Permanently added" host-
   // key warning + `docker load`'s "Loaded image:" success line both bypass
   // the clack gutter when inherited and print flush-left, breaking the
   // visual flow. On success we don't need either; on failure we surface
-  // the captured stderr for debugging via the thrown Error.
+  // the captured stderr for debugging via the thrown Error. silent:true is
+  // required both to get the capture and because runCommandAsync only
+  // rejects (rather than resolving `false`) on nonzero exit in that mode.
   try {
-    execFileSync('bash', ['-c', cmd], { stdio: ['ignore', 'pipe', 'pipe'] });
+    await runCommandAsync(['bash', '-c', cmd], { silent: true });
   } catch (err) {
     const stderr = err.stderr?.toString().trim() || '';
     const stdout = err.stdout?.toString().trim() || '';
     // Surface whatever signal the operator can act on: child stderr first
     // (real ssh / docker errors), then stdout, then the wrapping error's
-    // message (preserves "Connection refused" when execFileSync's own
+    // message (preserves "Connection refused" when runCommandAsync's own
     // error string is the only thing we have).
     const detail = [stderr, stdout, err.message].filter(Boolean).join('\n').trim();
     const wrapped = new Error(`sideloadCompose failed (exit ${err.status ?? '?'}): ${detail}`);