fix(setup): pin kube context, keep secrets out of argv, validate reused keys

Review findings from #5911:
- helm/kubectl now run against the validated context instead of the ambient one
- helm values are piped on stdin rather than passed as --set arguments
- ENCRYPTION_KEY/API_ENCRYPTION_KEY are checked for the 64-hex format the app
  requires, not just length, so an unusable key is replaced rather than kept
- the managed Redis container's published port is read back instead of assumed

Author: TheodoreSpeaks

scripts/setup/modes/k8s.ts

@@ -11,8 +11,12 @@ const RELEASE = 'sim-dev'
 const NAMESPACE = 'sim-dev'
 const LOCAL_CONTEXT_PREFIXES = ['kind-', 'docker-desktop', 'minikube', 'orbstack']
 
-function run(command: string, args: string[], failMessage: string): string {
-  const result = spawnSync(command, args, { encoding: 'utf8' })
+/**
+ * `input` is piped on stdin rather than passed as arguments — argv is readable
+ * by any process on the machine, so secrets must never travel that way.
+ */
+function run(command: string, args: string[], failMessage: string, input?: string): string {
+  const result = spawnSync(command, args, { encoding: 'utf8', input })
   if (result.status !== 0) {
     throw new Error(`${failMessage}: ${result.stderr.trim() || result.stdout.trim()}`)
   }
@@ -65,11 +69,12 @@ async function ensureLocalContext(detection: Detection): Promise<string> {
   return 'kind-sim'
 }
 
-function existingReleaseSecrets(): Record<string, string> | null {
-  const status = spawnSync('helm', ['status', RELEASE, '-n', NAMESPACE], { stdio: 'ignore' })
+function existingReleaseSecrets(context: string): Record<string, string> | null {
+  const scope = ['--kube-context', context, '-n', NAMESPACE]
+  const status = spawnSync('helm', ['status', RELEASE, ...scope], { stdio: 'ignore' })
   if (status.status !== 0) return null
   const values = JSON.parse(
-    run('helm', ['get', 'values', RELEASE, '-n', NAMESPACE, '-o', 'json'], 'helm get values failed')
+    run('helm', ['get', 'values', RELEASE, ...scope, '-o', 'json'], 'helm get values failed')
   ) as { app?: { env?: Record<string, string> }; postgresql?: { auth?: { password?: string } } }
   const env = values.app?.env ?? {}
   const password = values.postgresql?.auth?.password
@@ -91,10 +96,27 @@ function existingReleaseSecrets(): Record<string, string> | null {
   }
 }
 
+/**
+ * Values document piped to helm on stdin instead of `--set`. `JSON.stringify`
+ * quotes and escapes each value — JSON is a subset of YAML, so a secret
+ * containing `#`, `:`, or a leading `*` can neither break the document nor be
+ * reinterpreted as YAML syntax.
+ */
+function secretValues(secrets: Record<string, string>): string {
+  const { POSTGRES_PASSWORD, ...appEnv } = secrets
+  const env = Object.entries(appEnv)
+    .map(([key, value]) => `    ${key}: ${JSON.stringify(value)}`)
+    .join('\n')
+  return `app:\n  env:\n${env}\npostgresql:\n  auth:\n    password: ${JSON.stringify(POSTGRES_PASSWORD)}\n`
+}
+
 export async function runK8sMode(detection: Detection): Promise<void> {
-  await ensureLocalContext(detection)
+  // Pin every subsequent call to the context we validated: the ambient context
+  // can change between detection and deploy, which would send generated
+  // credentials to an unintended cluster.
+  const context = await ensureLocalContext(detection)
 
-  const reused = existingReleaseSecrets()
+  const reused = existingReleaseSecrets(context)
   const secrets = reused ?? {
     BETTER_AUTH_SECRET: generateSecret(),
     ENCRYPTION_KEY: generateSecret(),
@@ -114,26 +136,21 @@ export async function runK8sMode(detection: Detection): Promise<void> {
         '--install',
         RELEASE,
         './helm/sim',
+        '--kube-context',
+        context,
         '--namespace',
         NAMESPACE,
         '--create-namespace',
         '--values',
         './helm/sim/examples/values-development.yaml',
-        '--set',
-        `app.env.BETTER_AUTH_SECRET=${secrets.BETTER_AUTH_SECRET}`,
-        '--set',
-        `app.env.ENCRYPTION_KEY=${secrets.ENCRYPTION_KEY}`,
-        '--set',
-        `app.env.INTERNAL_API_SECRET=${secrets.INTERNAL_API_SECRET}`,
-        '--set',
-        `app.env.CRON_SECRET=${secrets.CRON_SECRET}`,
-        '--set',
-        `postgresql.auth.password=${secrets.POSTGRES_PASSWORD}`,
+        '--values',
+        '-',
         '--wait',
         '--timeout',
         '15m',
       ],
-      'helm upgrade --install failed'
+      'helm upgrade --install failed',
+      secretValues(secrets)
     )
   } catch (error) {
     spin.stop(`${theme.error('✗')} helm install failed`)
@@ -147,7 +164,7 @@ export async function runK8sMode(detection: Detection): Promise<void> {
 
   const testSpin = p.spinner()
   testSpin.start('Running helm test…')
-  const test = spawnSync('helm', ['test', RELEASE, '-n', NAMESPACE], {
+  const test = spawnSync('helm', ['test', RELEASE, '--kube-context', context, '-n', NAMESPACE], {
     encoding: 'utf8',
     cwd: ROOT,
   })
@@ -162,9 +179,9 @@ export async function runK8sMode(detection: Detection): Promise<void> {
 
   p.note(
     [
-      `kubectl -n ${NAMESPACE} port-forward svc/${RELEASE}-app 3000:3000`,
-      `kubectl -n ${NAMESPACE} get pods`,
-      `helm uninstall ${RELEASE} -n ${NAMESPACE}   # tear down`,
+      `kubectl --context ${context} -n ${NAMESPACE} port-forward svc/${RELEASE}-app 3000:3000`,
+      `kubectl --context ${context} -n ${NAMESPACE} get pods`,
+      `helm uninstall ${RELEASE} --kube-context ${context} -n ${NAMESPACE}   # tear down`,
     ].join('\n'),
     'Reach your cluster'
   )

scripts/setup/redis.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from 'node:child_process'
 import { docker } from './db.ts'
 import { type Detection, REDIS_CONTAINER } from './detect.ts'
 import { ensureDocker } from './docker.ts'
@@ -8,6 +9,18 @@ import { theme } from './theme.ts'
 
 const LOCAL_URL = 'redis://localhost:6379'
 
+/**
+ * Host port the managed container actually publishes. `startManagedRedis` falls
+ * back to 6380 when 6379 is taken, so assuming the default adopts the wrong
+ * Redis — or fails the ping and then collides on the container name.
+ */
+function managedRedisUrl(): string | null {
+  const result = spawnSync('docker', ['port', REDIS_CONTAINER, '6379/tcp'], { encoding: 'utf8' })
+  if (result.status !== 0) return null
+  const port = result.stdout.trim().split('\n')[0]?.split(':').pop()
+  return port ? `redis://localhost:${port}` : null
+}
+
 async function pingWithSpinner(url: string, label: string): Promise<boolean> {
   const spin = p.spinner()
   spin.start(label)
@@ -67,6 +80,17 @@ async function promptRedisUrl(existing?: string): Promise<string> {
  * consent), restart/start a wizard-managed container, or take a URL.
  */
 export async function resolveRedis(detection: Detection, existing?: string): Promise<string> {
+  // A configured REDIS_URL wins over the port scan: it may point at a non-default
+  // port, or at a host that isn't this machine at all.
+  if (
+    existing &&
+    existing !== LOCAL_URL &&
+    (await pingWithSpinner(existing, `Pinging ${existing}…`))
+  ) {
+    const keep = await p.confirm({ message: `Keep using ${existing}?`, initialValue: true })
+    if (keep) return existing
+  }
+
   if (
     detection.redisPortOpen &&
     (await pingWithSpinner(LOCAL_URL, 'Redis found on :6379 — pinging…'))
@@ -78,11 +102,19 @@ export async function resolveRedis(detection: Detection, existing?: string): Pro
     if (adopt) return LOCAL_URL
   }
 
-  if (detection.redisContainer?.managed && detection.redisContainer.state === 'stopped') {
-    docker(['start', REDIS_CONTAINER])
-    if (await pingWithSpinner(LOCAL_URL, `Starting existing ${REDIS_CONTAINER} container…`)) {
-      return LOCAL_URL
+  if (detection.redisContainer?.managed) {
+    if (detection.redisContainer.state === 'stopped') docker(['start', REDIS_CONTAINER])
+    // Read the published port back rather than assuming the default.
+    const managedUrl = managedRedisUrl()
+    if (
+      managedUrl &&
+      (await pingWithSpinner(managedUrl, `Starting existing ${REDIS_CONTAINER} container…`))
+    ) {
+      return managedUrl
     }
+    p.log.warn(
+      `${REDIS_CONTAINER} exists but is not answering — remove it with ${theme.command(`docker rm -f ${REDIS_CONTAINER}`)} before starting a new one.`
+    )
   }
 
   const dockerAvailable = await ensureDocker(false)

scripts/setup/steps.ts

@@ -5,19 +5,43 @@ import * as p from './prompter.ts'
 import { link, theme } from './theme.ts'
 import { FLAG_TWINS, hasMailProvider, LOGIN_PROVIDERS, SELF_HOST_UNLOCKS } from './twins.ts'
 
+/**
+ * `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` are read as raw AES-256 material,
+ * so the app requires exactly 64 hex characters and throws on anything else
+ * (`lib/core/security/encryption.ts`, `lib/api-key/crypto.ts`). A merely-long
+ * passphrase passes a length check here and then fails every encryption path at
+ * runtime, so those two are validated on format rather than length.
+ */
+const HEX_KEY_PATTERN = /^[0-9a-f]{64}$/i
+const HEX_SECRET_KEYS = new Set(['ENCRYPTION_KEY', 'API_ENCRYPTION_KEY'])
+
+function isUsableSecret(key: string, value: string): boolean {
+  if (isPlaceholder(value)) return false
+  return HEX_SECRET_KEYS.has(key) ? HEX_KEY_PATTERN.test(value) : value.length >= 32
+}
+
 /** Reuses existing valid secrets (never regenerates them) and generates the rest. */
 export function collectSecrets(existing: EnvFile): Record<string, string> {
   const secrets: Record<string, string> = {}
   const generated: string[] = []
+  const replaced: string[] = []
   for (const key of SECRET_KEYS) {
     const current = existing.vars.get(key)
-    if (current && !isPlaceholder(current) && current.length >= 32) {
+    if (current && isUsableSecret(key, current)) {
       secrets[key] = current
     } else {
       secrets[key] = generateSecret()
-      generated.push(key)
+      // A key the app would reject never successfully encrypted anything, so
+      // replacing it cannot orphan existing ciphertext.
+      if (current && !isPlaceholder(current)) replaced.push(key)
+      else generated.push(key)
     }
   }
+  if (replaced.length > 0) {
+    p.log.warn(
+      `Replaced ${replaced.join(', ')} — the existing value is not a 64-character hex key, which the app rejects at runtime.`
+    )
+  }
   if (generated.length > 0) {
     p.log.step(`Generated ${generated.join(', ')}`)
   }