fix(setup): verify kube-context is really local; lengthen CLI handoff wait

- k8s: a context named like a local cluster (kind-*, docker-desktop) can actually point at a remote API server. Verify the server host is loopback/docker-internal before defaulting the 'use this context?' confirm to yes; otherwise warn and default to no, so generated secrets can't ship to a remote cluster on a blind Enter.
- cli-auth: bump the device-flow wait from 3 to 15 minutes so first-time users have time to sign up, wait for the email OTP, and approve before the terminal stops polling. The server-side approval record keeps its own short TTL, so a longer client wait only costs cheap rate-limited polls.

Author: TheodoreSpeaks

scripts/setup/cli-auth.ts

@@ -6,7 +6,11 @@ import { generateShortId } from '@sim/utils/id'
 import * as p from './prompter.ts'
 import { link, theme } from './theme.ts'
 
-const WAIT_MS = 180_000
+// Generous enough for a first-time user to create an account, wait for the email
+// OTP, land back on /cli/auth, and approve — a few minutes is routine. The
+// server-side approval record has its own short TTL, so a long client wait only
+// costs cheap, rate-limited polls.
+const WAIT_MS = 900_000
 const POLL_INTERVAL_MS = 2000
 
 function openBrowser(url: string): void {

scripts/setup/modes/k8s.ts

@@ -29,6 +29,38 @@ function isLocalContext(context: string): boolean {
   return LOCAL_CONTEXT_PREFIXES.some((prefix) => context === prefix || context.startsWith(prefix))
 }
 
+const LOCAL_SERVER_HOSTS = new Set([
+  '127.0.0.1',
+  'localhost',
+  '0.0.0.0',
+  '::1',
+  'kubernetes.docker.internal',
+  'host.docker.internal',
+])
+
+/** The API server host a context points at, or null if kubectl can't resolve it. */
+function contextServerHost(context: string): string | null {
+  const result = spawnSync(
+    'kubectl',
+    [
+      'config',
+      'view',
+      '--minify',
+      '--context',
+      context,
+      '-o',
+      'jsonpath={.clusters[0].cluster.server}',
+    ],
+    { encoding: 'utf8' }
+  )
+  if (result.status !== 0) return null
+  try {
+    return new URL(result.stdout.trim()).hostname
+  } catch {
+    return null
+  }
+}
+
 /**
  * POSIX-quote a value for a copyable shell hint. A kube-context passes only a
  * prefix check, so it can still contain whitespace or shell metacharacters that
@@ -48,13 +80,28 @@ async function ensureLocalContext(detection: Detection): Promise<string> {
   }
   const context = detection.kubeContext
   if (context && isLocalContext(context)) {
-    const useIt = await p.confirm({
-      message: `Use current kube context "${context}"?`,
-      initialValue: true,
-    })
-    if (useIt) return context
-  }
-  if (context && !isLocalContext(context)) {
+    // The name is only a hint — a remote cluster can be named like a local one
+    // (e.g. "kind-prod"). Verify the API server is a loopback/host address before
+    // defaulting to "yes", so generated secrets can't silently ship to a remote
+    // cluster on a blind Enter.
+    const server = contextServerHost(context)
+    if (server && LOCAL_SERVER_HOSTS.has(server)) {
+      const useIt = await p.confirm({
+        message: `Use current kube context "${context}"?`,
+        initialValue: true,
+      })
+      if (useIt) return context
+    } else {
+      p.log.warn(
+        `Context "${context}" is named like a local cluster, but its API server${server ? ` (${server})` : ''} does not look local. Continuing would deploy the generated secrets there.`
+      )
+      const useIt = await p.confirm({
+        message: `Deploy to "${context}" anyway?`,
+        initialValue: false,
+      })
+      if (useIt) return context
+    }
+  } else if (context) {
     p.log.warn(
       `Current context "${context}" does not look like a local cluster. Deploying to remote clusters is not supported by the wizard yet — switch to a kind/docker-desktop context, or drive helm directly (see helm/sim/examples/values-production.yaml).`
     )