Safely inspects the current state of your VPS server via SSH and checks local project runbook existence and deployment history.

Inspects remote directory and system commands via SSH to detect lockfiles, package managers, Docker, PM2, Nginx, application ports, WebSockets, deployment strategy, and missing dependencies.

Reads .env.example from the VPS project directory dynamically via SSH. If not present, returns a generic environment template prompt.

Executes curl on remote server via SSH to verify HTTP endpoint status. Returns success only if HTTP 200 is received.

Retrieves recent application log lines via PM2 or Docker Compose on remote server.

Executes read-only migration status command via SSH to check if database migrations are pending on remote server.

Gathers server IP, SSH credentials, OS info, build scripts, Nginx/SSL configuration, and remote path to generate a local DEPLOYMENT_RUNBOOK.md markdown file for manual ops and handovers.

Checks server disk usage with safety threshold (>70% disk usage requirement) and performs non-destructive pruning of dangling Docker images and stale git tracking branches.

Generates a multi-OS provisioning plan to update system packages and install core build utilities (curl, git, compiler tools, firewall) based on detected OS distribution (Ubuntu, Debian, RHEL, CentOS, Alpine).

Generates an idempotent provisioning plan to install Node.js (dynamic version), PM2, Docker Engine, and Docker Compose plugin across Debian, RHEL, and Alpine Linux distributions.

Configures UFW firewall rules safely. CRITICAL SAFETY: Always verifies OpenSSH (port 22) is allowed BEFORE enabling firewall to prevent SSH lockout.

Configures adaptive Nginx reverse proxy or static web server block after verifying domain A-record against the server's public IP address.

Generates a 2-step execution plan to install Certbot and configure Let's Encrypt SSL/HTTPS certificate for Nginx. Uses OS-specific package mapping and tests auto-renewal.

Writes environment variables to a .env file on the remote server via SSH after path normalization.

Security guarantees:

• Path validation using path.resolve normalization to prevent path traversal

• Heredoc writing to prevent shell expansion

• Zero-knowledge output (never returns or echoes secret values back)

• Blocks write attempts to system paths (/etc, /root, etc.)

Analyzes git diffs, dependency changes, schema updates, and pending migrations to generate a production-first conditional deployment plan.

Plans a safe Docker Compose deployment by generating the exact commands. Does NOT execute anything without confirm_execution.

Executes a deployment plan step-by-step. If a step fails, pauses execution into PAUSED_AWAITING_FIX state for diagnosis instead of rolling back immediately.

Executes a diagnostic fix command via SSH for a paused deployment without breaking deployment state or resetting git commit status.

Resumes execution of a paused deployment plan, skipping previously completed steps and executing remaining steps to completion.

Explicitly aborts a paused or failed deployment plan and triggers automated server rollback (git reset, service reload).