@marcusrbrown/infra 0.10.1 → 0.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/__snapshots__/cli.test.ts.snap

@@ -162,7 +162,7 @@ Commands:
     --key [key]                        Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.
 
 
-  vpn client add <name>                Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, and writes the client .conf to apps/vpn/clients/.
+  vpn client add <name>                Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).
 
     --split-tunnel [cidrs]             Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).
     --dns [dns]                        DNS server for the client config.
@@ -173,7 +173,7 @@ Commands:
   vpn client list                      List all VPN client peers from peers.json.
 
 
-  vpn client remove <name>             Remove a VPN client peer from peers.json. Run \`infra vpn deploy\` to revoke access.
+  vpn client remove <name>             Remove a VPN client peer from peers.json and sync the roster to the VPN_PEERS GitHub secret (best-effort). Run \`infra vpn deploy\` to revoke access.
 
 
   status                               Show status of all deployments

package/src/commands/vpn/client.test.ts

@@ -1,10 +1,10 @@
 import {mkdirSync, mkdtempSync, rmSync, writeFileSync} from 'node:fs'
-import {readFile} from 'node:fs/promises'
+import {readFile, stat} from 'node:fs/promises'
 import {tmpdir} from 'node:os'
 import {join, resolve} from 'node:path'
 import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
 
-import {vpnClientAdd, vpnClientList, vpnClientRemove, type KeypairGenFn} from './client'
+import {vpnClientAdd, vpnClientList, vpnClientRemove, type KeypairGenFn, type SpawnFn} from './client'
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -16,6 +16,33 @@ function makePeersJson(peers: {name: string; publicKey: string; tunnelIp: string
   return `${JSON.stringify({peers}, null, 2)}\n`
 }
 
+/**
+ * Inert spawn stub — never touches real processes.
+ * Returns a mock proc: stdin {write, end}, exited resolves 0, empty stdout/stderr.
+ * Inject this into every call that doesn't explicitly test sync behavior.
+ */
+function makeNoopSpawnFn(): SpawnFn {
+  return (_cmd, _opts) => ({
+    stdout: new ReadableStream({
+      start(c) {
+        c.enqueue(new TextEncoder().encode(''))
+        c.close()
+      },
+    }),
+    stderr: new ReadableStream({
+      start(c) {
+        c.enqueue(new TextEncoder().encode(''))
+        c.close()
+      },
+    }),
+    stdin: {
+      write: (_data: Uint8Array) => {},
+      end: () => {},
+    },
+    exited: Promise.resolve(0),
+  })
+}
+
 // ─── generateKeypair ─────────────────────────────────────────────────────────
 
 describe('generateKeypair', () => {
@@ -59,6 +86,7 @@ describe('generateKeypair', () => {
         serverPublicKey: 'SERVERPUBKEY==',
         endpoint: '1.2.3.4',
         keypairGen,
+        spawnFn: makeNoopSpawnFn(),
       })
 
       // The result must use the injected keypair values
@@ -109,6 +137,7 @@ describe('vpnClientAdd', () => {
       serverPublicKey: 'SERVERPUBKEY==',
       endpoint: '1.2.3.4',
       keypairGen,
+      spawnFn: makeNoopSpawnFn(),
     })
 
     // Check result
@@ -142,6 +171,7 @@ describe('vpnClientAdd', () => {
       serverPublicKey: 'SERVERPUBKEY==',
       endpoint: '1.2.3.4',
       keypairGen: keypairGen1,
+      spawnFn: makeNoopSpawnFn(),
     })
 
     const result2 = await vpnClientAdd('phone', {
@@ -150,6 +180,7 @@ describe('vpnClientAdd', () => {
       serverPublicKey: 'SERVERPUBKEY==',
       endpoint: '1.2.3.4',
       keypairGen: keypairGen2,
+      spawnFn: makeNoopSpawnFn(),
     })
 
     expect(result2.tunnelIp).toBe('10.8.0.3')
@@ -165,6 +196,7 @@ describe('vpnClientAdd', () => {
       endpoint: '1.2.3.4',
       keypairGen,
       allowedIps: '10.0.0.0/8,192.168.0.0/16',
+      spawnFn: makeNoopSpawnFn(),
     })
 
     const confContent = await readFile(result.confPath, 'utf-8')
@@ -180,6 +212,7 @@ describe('vpnClientAdd', () => {
       serverPublicKey: 'SERVERPUBKEY==',
       endpoint: '1.2.3.4',
       keypairGen,
+      spawnFn: makeNoopSpawnFn(),
     })
 
     await expect(
@@ -189,6 +222,7 @@ describe('vpnClientAdd', () => {
         serverPublicKey: 'SERVERPUBKEY==',
         endpoint: '1.2.3.4',
         keypairGen,
+        spawnFn: makeNoopSpawnFn(),
       }),
     ).rejects.toThrow('already exists')
   })
@@ -204,6 +238,7 @@ describe('vpnClientAdd', () => {
         serverPublicKey: 'SERVERPUBKEY==',
         endpoint: '1.2.3.4',
         keypairGen,
+        spawnFn: makeNoopSpawnFn(),
       }),
     ).rejects.toThrow()
   })
@@ -217,6 +252,7 @@ describe('vpnClientAdd', () => {
       serverPublicKey: 'SERVERPUBKEY==',
       endpoint: '1.2.3.4',
       keypairGen,
+      spawnFn: makeNoopSpawnFn(),
     })
 
     // peers.json must NOT contain the private key
@@ -228,6 +264,76 @@ describe('vpnClientAdd', () => {
     const confContent = await readFile(result.confPath, 'utf-8')
     expect(confContent).toContain('SECRETPRIVATEKEY==')
   })
+
+  // Fix #2: ENOENT bootstrap on fresh checkout
+  it('succeeds on fresh checkout (no peers.json) — creates first peer', async () => {
+    // Do NOT write peers.json — simulate fresh checkout
+    const freshDir = mkdtempSync(join(tmpdir(), 'vpn-fresh-test-'))
+    const freshPeersJsonPath = join(freshDir, 'peers.json')
+    const freshClientsDir = join(freshDir, 'clients')
+    mkdirSync(freshClientsDir, {recursive: true})
+
+    try {
+      const keypairGen = makeKeypairGen('PRIV==', 'PUB==')
+      const result = await vpnClientAdd('firstpeer', {
+        peersJsonPath: freshPeersJsonPath,
+        clientsDir: freshClientsDir,
+        serverPublicKey: 'SERVERPUBKEY==',
+        endpoint: '1.2.3.4',
+        keypairGen,
+        spawnFn: makeNoopSpawnFn(),
+      })
+
+      expect(result.tunnelIp).toBe('10.8.0.2')
+
+      // peers.json must now exist with the new peer
+      const peersContent = await readFile(freshPeersJsonPath, 'utf-8')
+      const peersData = JSON.parse(peersContent) as {peers: {name: string}[]}
+      expect(peersData.peers).toHaveLength(1)
+      expect(peersData.peers[0]?.name).toBe('firstpeer')
+
+      // client .conf must exist with private key
+      const confContent = await readFile(result.confPath, 'utf-8')
+      expect(confContent).toContain('PRIV==')
+    } finally {
+      rmSync(freshDir, {recursive: true, force: true})
+    }
+  })
+
+  // Fix #4: write client .conf BEFORE gh sync
+  it('client .conf exists even when spawnFn throws (conf written before sync)', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'PUB==')
+    const throwingSpawnFn: SpawnFn = () => {
+      throw new Error('gh not found')
+    }
+
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    try {
+      const result = await vpnClientAdd('laptop', {
+        peersJsonPath,
+        clientsDir,
+        serverPublicKey: 'SERVERPUBKEY==',
+        endpoint: '1.2.3.4',
+        keypairGen,
+        spawnFn: throwingSpawnFn,
+      })
+
+      // .conf must exist with the private key
+      const confContent = await readFile(result.confPath, 'utf-8')
+      expect(confContent).toContain('PRIV==')
+
+      // A warning must have been printed (not a throw)
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toMatch(/VPN_PEERS|stale|warning/i)
+    } finally {
+      console.warn = originalWarn
+    }
+  })
 })
 
 // ─── vpnClientList ────────────────────────────────────────────────────────────
@@ -270,6 +376,13 @@ describe('vpnClientList', () => {
     expect(peers[0]?.tunnelIp).toBe('10.8.0.2')
     expect(peers[1]?.name).toBe('phone')
   })
+
+  // Fix #2: list on fresh checkout (no peers.json) returns empty
+  it('returns empty array when peers.json does not exist (fresh checkout)', async () => {
+    // Do NOT write peers.json
+    const peers = await vpnClientList(peersJsonPath)
+    expect(peers).toHaveLength(0)
+  })
 })
 
 // ─── vpnClientRemove ──────────────────────────────────────────────────────────
@@ -296,7 +409,7 @@ describe('vpnClientRemove', () => {
       ]),
     )
 
-    await vpnClientRemove('laptop', peersJsonPath)
+    await vpnClientRemove('laptop', peersJsonPath, {spawnFn: makeNoopSpawnFn()})
 
     const peersContent = await readFile(peersJsonPath, 'utf-8')
     const peersData = JSON.parse(peersContent) as {peers: {name: string}[]}
@@ -307,7 +420,9 @@ describe('vpnClientRemove', () => {
   it('throws when removing a non-existent peer', async () => {
     writeFileSync(peersJsonPath, makePeersJson([]))
 
-    await expect(vpnClientRemove('nonexistent', peersJsonPath)).rejects.toThrow('not found')
+    await expect(vpnClientRemove('nonexistent', peersJsonPath, {spawnFn: makeNoopSpawnFn()})).rejects.toThrow(
+      'not found',
+    )
   })
 
   it('after remove, list reflects the removal', async () => {
@@ -319,12 +434,428 @@ describe('vpnClientRemove', () => {
       ]),
     )
 
-    await vpnClientRemove('laptop', peersJsonPath)
+    await vpnClientRemove('laptop', peersJsonPath, {spawnFn: makeNoopSpawnFn()})
     const peers = await vpnClientList(peersJsonPath)
 
     expect(peers).toHaveLength(1)
     expect(peers[0]?.name).toBe('phone')
   })
+
+  // Fix #2: remove of nonexistent peer on fresh checkout gives not-found error, not ENOENT
+  it('throws not-found (not ENOENT) when removing from a nonexistent peers.json', async () => {
+    // Do NOT write peers.json — simulate fresh checkout
+    await expect(vpnClientRemove('nonexistent', peersJsonPath, {spawnFn: makeNoopSpawnFn()})).rejects.toThrow(
+      'not found',
+    )
+  })
+})
+
+// ─── gh secret sync after vpnClientAdd ───────────────────────────────────────
+
+describe('vpnClientAdd: gh secret sync', () => {
+  let tmpDir: string
+  let peersJsonPath: string
+  let clientsDir: string
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'vpn-client-sync-test-'))
+    peersJsonPath = join(tmpDir, 'peers.json')
+    clientsDir = join(tmpDir, 'clients')
+    mkdirSync(clientsDir, {recursive: true})
+    writeFileSync(peersJsonPath, makePeersJson([]))
+  })
+
+  afterEach(() => {
+    rmSync(tmpDir, {recursive: true, force: true})
+  })
+
+  it('spawns gh secret set with roster on STDIN after successful add', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'NEWPUBKEY==')
+    const spawnCalls: {cmd: string[]; stdin: string}[] = []
+
+    const mockSpawnFn: SpawnFn = (cmd, _opts) => {
+      let stdinContent = ''
+      const stdinPipe = {
+        write: (data: Uint8Array) => {
+          stdinContent += new TextDecoder().decode(data)
+        },
+        end: () => {
+          spawnCalls.push({cmd, stdin: stdinContent})
+        },
+      }
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode(''))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode(''))
+            c.close()
+          },
+        }),
+        stdin: stdinPipe,
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await vpnClientAdd('newpeer', {
+      peersJsonPath,
+      clientsDir,
+      serverPublicKey: 'SERVERPUBKEY==',
+      endpoint: '1.2.3.4',
+      keypairGen,
+      spawnFn: mockSpawnFn,
+    })
+
+    // Must have spawned gh secret set
+    const ghCall = spawnCalls.find(c => c.cmd.includes('gh') && c.cmd.includes('secret') && c.cmd.includes('set'))
+    expect(ghCall).toBeDefined()
+
+    // The new peer's public key must appear in STDIN, not in argv
+    expect(ghCall?.stdin).toContain('NEWPUBKEY==')
+    const argvContainsPubkey = ghCall?.cmd.some(arg => arg.includes('NEWPUBKEY=='))
+    expect(argvContainsPubkey).toBe(false)
+
+    // Must pass --env vpn and --repo marcusrbrown/infra
+    expect(ghCall?.cmd).toContain('--env')
+    expect(ghCall?.cmd).toContain('vpn')
+    expect(ghCall?.cmd).toContain('--repo')
+    expect(ghCall?.cmd).toContain('marcusrbrown/infra')
+  })
+
+  it('gh failure → command still succeeds, warning printed with remediation', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'NEWPUBKEY==')
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    const mockSpawnFn: SpawnFn = (_cmd, _opts) => {
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode(''))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode('auth error'))
+            c.close()
+          },
+        }),
+        stdin: {
+          write: (_data: Uint8Array) => {},
+          end: () => {},
+        },
+        exited: Promise.resolve(1), // gh fails
+      }
+    }
+
+    try {
+      // Must NOT throw even though gh fails
+      const result = await vpnClientAdd('newpeer', {
+        peersJsonPath,
+        clientsDir,
+        serverPublicKey: 'SERVERPUBKEY==',
+        endpoint: '1.2.3.4',
+        keypairGen,
+        spawnFn: mockSpawnFn,
+      })
+
+      // The add itself must succeed
+      expect(result.tunnelIp).toBe('10.8.0.2')
+
+      // A warning must have been printed with remediation
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toMatch(/VPN_PEERS|stale|warning/i)
+      expect(allWarnings).toMatch(/gh secret set/)
+    } finally {
+      console.warn = originalWarn
+    }
+  })
+
+  // Fix #3: spawnFn throws synchronously → command still succeeds + warning printed
+  it('spawnFn throws synchronously → command still succeeds, warning printed with remediation', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'PUB==')
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    const throwingSpawnFn: SpawnFn = () => {
+      throw new Error('ENOENT: gh not found')
+    }
+
+    try {
+      const result = await vpnClientAdd('newpeer', {
+        peersJsonPath,
+        clientsDir,
+        serverPublicKey: 'SERVERPUBKEY==',
+        endpoint: '1.2.3.4',
+        keypairGen,
+        spawnFn: throwingSpawnFn,
+      })
+
+      // Command must succeed
+      expect(result.tunnelIp).toBe('10.8.0.2')
+
+      // Warning must be printed with remediation
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toMatch(/VPN_PEERS|stale|warning/i)
+      expect(allWarnings).toMatch(/gh secret set/)
+    } finally {
+      console.warn = originalWarn
+    }
+  })
+
+  // Fix #3: timeout — spawnFn whose exited never resolves → warning after timeout
+  it('spawnFn whose exited never resolves → warning after timeout (injectable timeoutMs)', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'PUB==')
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    const hangingSpawnFn: SpawnFn = (_cmd, _opts) => ({
+      stdout: new ReadableStream({
+        start(c) {
+          c.enqueue(new TextEncoder().encode(''))
+          c.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(c) {
+          c.enqueue(new TextEncoder().encode(''))
+          c.close()
+        },
+      }),
+      stdin: {
+        write: (_data: Uint8Array) => {},
+        end: () => {},
+      },
+      // Never resolves
+      exited: new Promise<number>(() => {}),
+    })
+
+    try {
+      // Use a very short timeout (50ms) so the test doesn't hang
+      const result = await vpnClientAdd('newpeer', {
+        peersJsonPath,
+        clientsDir,
+        serverPublicKey: 'SERVERPUBKEY==',
+        endpoint: '1.2.3.4',
+        keypairGen,
+        spawnFn: hangingSpawnFn,
+        syncTimeoutMs: 50,
+      })
+
+      // Command must succeed
+      expect(result.tunnelIp).toBe('10.8.0.2')
+
+      // Warning must be printed
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toMatch(/VPN_PEERS|stale|warning|timeout/i)
+    } finally {
+      console.warn = originalWarn
+    }
+  })
+
+  // Fix #5: remediation message must include --repo marcusrbrown/infra
+  it('remediation message includes --repo marcusrbrown/infra', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'PUB==')
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    const failingSpawnFn: SpawnFn = (_cmd, _opts) => ({
+      stdout: new ReadableStream({
+        start(c) {
+          c.enqueue(new TextEncoder().encode(''))
+          c.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(c) {
+          c.enqueue(new TextEncoder().encode('error'))
+          c.close()
+        },
+      }),
+      stdin: {write: (_data: Uint8Array) => {}, end: () => {}},
+      exited: Promise.resolve(1),
+    })
+
+    try {
+      await vpnClientAdd('newpeer', {
+        peersJsonPath,
+        clientsDir,
+        serverPublicKey: 'SERVERPUBKEY==',
+        endpoint: '1.2.3.4',
+        keypairGen,
+        spawnFn: failingSpawnFn,
+      })
+
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toContain('--repo marcusrbrown/infra')
+    } finally {
+      console.warn = originalWarn
+    }
+  })
+})
+
+// ─── gh secret sync after vpnClientRemove ────────────────────────────────────
+
+describe('vpnClientRemove: gh secret sync', () => {
+  let tmpDir: string
+  let peersJsonPath: string
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'vpn-client-remove-sync-test-'))
+    peersJsonPath = join(tmpDir, 'peers.json')
+    writeFileSync(
+      peersJsonPath,
+      makePeersJson([
+        {name: 'laptop', publicKey: 'PUB1==', tunnelIp: '10.8.0.2'},
+        {name: 'phone', publicKey: 'PUB2==', tunnelIp: '10.8.0.3'},
+      ]),
+    )
+  })
+
+  afterEach(() => {
+    rmSync(tmpDir, {recursive: true, force: true})
+  })
+
+  it('spawns gh secret set with updated roster on STDIN after successful remove', async () => {
+    const spawnCalls: {cmd: string[]; stdin: string}[] = []
+
+    const mockSpawnFn: SpawnFn = (cmd, _opts) => {
+      let stdinContent = ''
+      const stdinPipe = {
+        write: (data: Uint8Array) => {
+          stdinContent += new TextDecoder().decode(data)
+        },
+        end: () => {
+          spawnCalls.push({cmd, stdin: stdinContent})
+        },
+      }
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode(''))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode(''))
+            c.close()
+          },
+        }),
+        stdin: stdinPipe,
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await vpnClientRemove('laptop', peersJsonPath, {spawnFn: mockSpawnFn})
+
+    // Must have spawned gh secret set
+    const ghCall = spawnCalls.find(c => c.cmd.includes('gh') && c.cmd.includes('secret') && c.cmd.includes('set'))
+    expect(ghCall).toBeDefined()
+
+    // Removed peer must NOT appear in STDIN
+    expect(ghCall?.stdin).not.toContain('PUB1==')
+    // Remaining peer must appear in STDIN
+    expect(ghCall?.stdin).toContain('PUB2==')
+
+    // Roster bytes must not appear in argv
+    const argvContainsRoster = ghCall?.cmd.some(arg => arg.includes('PUB1==') || arg.includes('PUB2=='))
+    expect(argvContainsRoster).toBe(false)
+  })
+
+  it('gh failure on remove → command still succeeds, warning printed', async () => {
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    const mockSpawnFn: SpawnFn = (_cmd, _opts) => {
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode(''))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(new TextEncoder().encode('network error'))
+            c.close()
+          },
+        }),
+        stdin: {
+          write: (_data: Uint8Array) => {},
+          end: () => {},
+        },
+        exited: Promise.resolve(1), // gh fails
+      }
+    }
+
+    try {
+      // Must NOT throw even though gh fails
+      await vpnClientRemove('laptop', peersJsonPath, {spawnFn: mockSpawnFn})
+
+      // A warning must have been printed with remediation
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toMatch(/VPN_PEERS|stale|warning/i)
+      expect(allWarnings).toMatch(/gh secret set/)
+    } finally {
+      console.warn = originalWarn
+    }
+  })
+
+  // Fix #5: remediation message must include --repo marcusrbrown/infra
+  it('remediation message on remove failure includes --repo marcusrbrown/infra', async () => {
+    const warnMessages: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnMessages.push(args.join(' '))
+    }
+
+    const failingSpawnFn: SpawnFn = (_cmd, _opts) => ({
+      stdout: new ReadableStream({
+        start(c) {
+          c.enqueue(new TextEncoder().encode(''))
+          c.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(c) {
+          c.enqueue(new TextEncoder().encode('error'))
+          c.close()
+        },
+      }),
+      stdin: {write: (_data: Uint8Array) => {}, end: () => {}},
+      exited: Promise.resolve(1),
+    })
+
+    try {
+      await vpnClientRemove('laptop', peersJsonPath, {spawnFn: failingSpawnFn})
+
+      const allWarnings = warnMessages.join('\n')
+      expect(allWarnings).toContain('--repo marcusrbrown/infra')
+    } finally {
+      console.warn = originalWarn
+    }
+  })
 })
 
 // ─── Write-guard: client .conf must stay in clients/ ─────────────────────────
@@ -355,6 +886,7 @@ describe('write-guard: client .conf path safety', () => {
       serverPublicKey: 'SERVERPUBKEY==',
       endpoint: '1.2.3.4',
       keypairGen,
+      spawnFn: makeNoopSpawnFn(),
     })
 
     // The resolved path must be under clientsDir
@@ -373,7 +905,45 @@ describe('write-guard: client .conf path safety', () => {
         serverPublicKey: 'SERVERPUBKEY==',
         endpoint: '1.2.3.4',
         keypairGen,
+        spawnFn: makeNoopSpawnFn(),
       }),
     ).rejects.toThrow()
   })
 })
+
+// ─── client .conf file permissions ───────────────────────────────────────────
+
+describe('vpnClientAdd: client .conf file permissions', () => {
+  let tmpDir: string
+  let peersJsonPath: string
+  let clientsDir: string
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'vpn-client-perm-test-'))
+    peersJsonPath = join(tmpDir, 'peers.json')
+    clientsDir = join(tmpDir, 'clients')
+    mkdirSync(clientsDir, {recursive: true})
+    writeFileSync(peersJsonPath, makePeersJson([]))
+  })
+
+  afterEach(() => {
+    rmSync(tmpDir, {recursive: true, force: true})
+  })
+
+  it('writes client .conf with mode 0o600 (owner read/write only)', async () => {
+    const keypairGen = makeKeypairGen('PRIV==', 'PUB==')
+
+    const result = await vpnClientAdd('laptop', {
+      peersJsonPath,
+      clientsDir,
+      serverPublicKey: 'SERVERPUBKEY==',
+      endpoint: '1.2.3.4',
+      keypairGen,
+      spawnFn: makeNoopSpawnFn(),
+    })
+
+    const fileStat = await stat(result.confPath)
+    const permBits = fileStat.mode & 0o777
+    expect(permBits).toBe(0o600)
+  })
+})

package/src/commands/vpn/client.ts

@@ -4,7 +4,7 @@ import {mkdir, writeFile} from 'node:fs/promises'
 import {resolve} from 'node:path'
 
 import {z} from 'zod'
-import {addPeer, readPeers, removePeer, renderClientConfig, writePeers, type Peer} from './peers'
+import {addPeer, readPeersOrEmpty, removePeer, renderClientConfig, writePeers, type Peer} from './peers'
 
 declare const process: {
   env: Record<string, string | undefined>
@@ -20,14 +20,34 @@ export interface Keypair {
 
 export type KeypairGenFn = () => Promise<Keypair>
 
+/** Minimal subset of Bun.Subprocess used for gh secret sync. */
+export interface SyncSpawnResult {
+  stdout: ReadableStream<Uint8Array>
+  stderr: ReadableStream<Uint8Array>
+  stdin?: {write: (data: Uint8Array) => void; end: () => void}
+  exited: Promise<number>
+}
+
+export interface SyncSpawnOpts {
+  stdout: 'pipe'
+  stderr: 'pipe'
+  stdin: 'pipe'
+}
+
+/** Injectable spawn function for gh secret sync — defaults to Bun.spawn. */
+export type SpawnFn = (cmd: string[], opts: SyncSpawnOpts) => SyncSpawnResult
+
 export interface VpnClientAddOpts {
   peersJsonPath: string
   clientsDir: string
   serverPublicKey: string
   endpoint: string
   keypairGen?: KeypairGenFn
+  spawnFn?: SpawnFn
   allowedIps?: string
   dns?: string
+  /** Timeout in ms for gh secret sync. Defaults to 15000. Injectable for tests. */
+  syncTimeoutMs?: number
 }
 
 export interface VpnClientAddResult {
@@ -92,6 +112,112 @@ export async function generateKeypair(): Promise<Keypair> {
   }
 }
 
+// ─── gh secret sync ───────────────────────────────────────────────────────────
+
+const GH_SYNC_REPO = 'marcusrbrown/infra'
+const GH_SYNC_ENV = 'vpn'
+const GH_SYNC_SECRET = 'VPN_PEERS'
+
+/**
+ * The exact remediation command — mirrors the real spawn command exactly.
+ * Includes --repo so the operator can run it from any directory.
+ */
+const GH_SYNC_REMEDIATION = `gh secret set ${GH_SYNC_SECRET} --env ${GH_SYNC_ENV} --repo ${GH_SYNC_REPO} < apps/vpn/config/peers.json`
+
+function defaultSpawnFn(cmd: string[], opts: SyncSpawnOpts): SyncSpawnResult {
+  return Bun.spawn(cmd, opts)
+}
+
+/**
+ * Sync the updated peer roster to the VPN_PEERS GitHub Environment secret.
+ *
+ * Pipes the JSON via stdin to `gh secret set VPN_PEERS --env vpn --repo marcusrbrown/infra`.
+ * The roster bytes NEVER appear in argv — stdin only.
+ *
+ * On failure: prints a warning with the exact remediation command. Does NOT throw.
+ * The local peers.json write has already succeeded; the secret being stale is recoverable.
+ *
+ * Hardening:
+ * - Wraps the entire spawn + stdin write + exited await in try/catch.
+ *   If spawnFn throws synchronously (e.g. ENOENT for missing gh), prints warning and returns.
+ * - Races proc.exited against timeoutMs (default 15s). On timeout, kills the proc and warns.
+ * - Drains stdout to avoid pipe-buffer deadlock.
+ */
+async function syncPeersSecret(peersJson: string, spawnFn: SpawnFn, timeoutMs = 15_000): Promise<void> {
+  const cmd = ['gh', 'secret', 'set', GH_SYNC_SECRET, '--env', GH_SYNC_ENV, '--repo', GH_SYNC_REPO]
+
+  let proc: SyncSpawnResult
+  try {
+    proc = spawnFn(cmd, {stdout: 'pipe', stderr: 'pipe', stdin: 'pipe'})
+  } catch {
+    console.warn(
+      `[warn] VPN_PEERS secret sync failed: could not spawn gh. ` +
+        `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
+        `Remediation: ${GH_SYNC_REMEDIATION}`,
+    )
+    return
+  }
+
+  if (!proc.stdin) {
+    console.warn(
+      `[warn] VPN_PEERS secret sync skipped: spawn did not provide stdin pipe. ` +
+        `Remediation: ${GH_SYNC_REMEDIATION}`,
+    )
+    return
+  }
+
+  try {
+    proc.stdin.write(new TextEncoder().encode(peersJson))
+    proc.stdin.end()
+
+    // Race proc.exited against timeout to avoid hanging indefinitely.
+    // Drain stdout concurrently to avoid pipe-buffer deadlock.
+    let timedOut = false
+    const timeoutHandle = {kill: () => {}}
+
+    const timeoutPromise = new Promise<number>(resolveTimeout => {
+      const id = setTimeout(() => {
+        timedOut = true
+        resolveTimeout(-1)
+      }, timeoutMs)
+      timeoutHandle.kill = () => clearTimeout(id)
+    })
+
+    const [exitCode] = await Promise.all([
+      Promise.race([proc.exited, timeoutPromise]),
+      // Drain stdout to prevent pipe-buffer deadlock
+      new Response(proc.stdout).text().catch(() => ''),
+    ])
+
+    timeoutHandle.kill()
+
+    if (timedOut) {
+      console.warn(
+        `[warn] VPN_PEERS secret sync timed out after ${timeoutMs}ms. ` +
+          `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
+          `Remediation: ${GH_SYNC_REMEDIATION}`,
+      )
+      return
+    }
+
+    const stderr = await new Response(proc.stderr).text().catch(() => '')
+
+    if (exitCode !== 0) {
+      console.warn(
+        `[warn] VPN_PEERS secret sync failed (gh exited ${exitCode}${stderr.trim() ? `: ${stderr.trim()}` : ''}). ` +
+          `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
+          `Remediation: ${GH_SYNC_REMEDIATION}`,
+      )
+    }
+  } catch {
+    console.warn(
+      `[warn] VPN_PEERS secret sync failed unexpectedly. ` +
+        `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
+        `Remediation: ${GH_SYNC_REMEDIATION}`,
+    )
+  }
+}
+
 // ─── Write-guard ──────────────────────────────────────────────────────────────
 
 /**
@@ -124,15 +250,22 @@ function assertPathUnderClientsDir(confPath: string, clientsDir: string): void {
  * 2. Assigns the next available tunnel IP via addPeer.
  * 3. Appends the PUBLIC key + tunnel IP to peers.json.
  * 4. Writes the client .conf (with PRIVATE key) to clients/<name>.conf.
+ * 5. Best-effort syncs the updated roster to the VPN_PEERS GitHub secret.
  *
  * Security invariants:
  * - The client PRIVATE key is written ONLY to the gitignored clients/ directory.
  * - peers.json contains ONLY the public key — never the private key.
  * - The output path is validated before writing (runtime guard, not gitignore-only).
+ *
+ * Ordering: local peers.json write → client .conf write → THEN best-effort sync.
+ * The .conf holds the user's ONLY copy of the private key; it must be written
+ * before the best-effort sync so a sync failure never loses the private key.
  */
 export async function vpnClientAdd(name: string, opts: VpnClientAddOpts): Promise<VpnClientAddResult> {
   const {peersJsonPath, clientsDir, serverPublicKey, endpoint, allowedIps, dns} = opts
   const keypairGen = opts.keypairGen ?? generateKeypair
+  const spawnFn = opts.spawnFn ?? defaultSpawnFn
+  const syncTimeoutMs = opts.syncTimeoutMs ?? 15_000
 
   // Validate the output path before doing any work
   const confPath = resolve(clientsDir, `${name}.conf`)
@@ -141,8 +274,8 @@ export async function vpnClientAdd(name: string, opts: VpnClientAddOpts): Promis
   // Generate keypair
   const keypair = await keypairGen()
 
-  // Read current peers
-  const peersFile = await readPeers(peersJsonPath)
+  // Read current peers — returns {peers: []} on fresh checkout (ENOENT)
+  const peersFile = await readPeersOrEmpty(peersJsonPath)
 
   // Add peer (throws if duplicate name)
   const {peers: updatedPeers, tunnelIp} = addPeer(peersFile.peers, {
@@ -151,7 +284,8 @@ export async function vpnClientAdd(name: string, opts: VpnClientAddOpts): Promis
   })
 
   // Write updated peers.json (PUBLIC key only — never private key)
-  await writePeers(peersJsonPath, {peers: updatedPeers})
+  const updatedPeersFile = {peers: updatedPeers}
+  await writePeers(peersJsonPath, updatedPeersFile)
 
   // Render client .conf (contains PRIVATE key)
   const confContent = renderClientConfig({
@@ -167,30 +301,57 @@ export async function vpnClientAdd(name: string, opts: VpnClientAddOpts): Promis
   await mkdir(clientsDir, {recursive: true})
 
   // Write client .conf to the gitignored clients/ directory
+  // MUST happen BEFORE gh sync — this is the user's ONLY copy of the private key.
   await writeFile(confPath, confContent, {mode: 0o600})
 
+  // Sync updated roster to VPN_PEERS GitHub secret (best-effort — failure is a warning, not fatal)
+  const peersJson = `${JSON.stringify(updatedPeersFile, null, 2)}\n`
+  await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs)
+
   return {tunnelIp, confPath}
 }
 
 /**
  * List all VPN client peers from peers.json.
+ * Returns an empty array when peers.json does not exist (fresh checkout).
  */
 export async function vpnClientList(peersJsonPath: string): Promise<Peer[]> {
-  const peersFile = await readPeers(peersJsonPath)
+  const peersFile = await readPeersOrEmpty(peersJsonPath)
   return peersFile.peers
 }
 
+export interface VpnClientRemoveOpts {
+  spawnFn?: SpawnFn
+  syncTimeoutMs?: number
+}
+
 /**
  * Remove a VPN client peer from peers.json.
  *
  * Note: The client .conf file in clients/ is NOT deleted — the operator
  * should delete it manually. The peer is removed from peers.json so the
  * next deploy will revoke access.
+ *
+ * After a successful local write, syncs the updated roster to the VPN_PEERS
+ * GitHub Environment secret (best-effort — failure is a warning, not fatal).
  */
-export async function vpnClientRemove(name: string, peersJsonPath: string): Promise<void> {
-  const peersFile = await readPeers(peersJsonPath)
+export async function vpnClientRemove(
+  name: string,
+  peersJsonPath: string,
+  opts: VpnClientRemoveOpts = {},
+): Promise<void> {
+  const spawnFn = opts.spawnFn ?? defaultSpawnFn
+  const syncTimeoutMs = opts.syncTimeoutMs ?? 15_000
+
+  // Read current peers — returns {peers: []} on fresh checkout (ENOENT)
+  const peersFile = await readPeersOrEmpty(peersJsonPath)
   const {peers: updatedPeers} = removePeer(peersFile.peers, name)
-  await writePeers(peersJsonPath, {peers: updatedPeers})
+  const updatedPeersFile = {peers: updatedPeers}
+  await writePeers(peersJsonPath, updatedPeersFile)
+
+  // Sync updated roster to VPN_PEERS GitHub secret (best-effort — failure is a warning, not fatal)
+  const peersJson = `${JSON.stringify(updatedPeersFile, null, 2)}\n`
+  await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs)
 }
 
 // ─── Default paths ────────────────────────────────────────────────────────────
@@ -211,7 +372,7 @@ export function registerVpnClient(cli: ReturnType<typeof goke>): void {
   cli
     .command(
       'vpn client add <name>',
-      'Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, and writes the client .conf to apps/vpn/clients/.',
+      'Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).',
     )
     .option(
       '--split-tunnel [cidrs]',
@@ -289,7 +450,7 @@ export function registerVpnClient(cli: ReturnType<typeof goke>): void {
   cli
     .command(
       'vpn client remove <name>',
-      'Remove a VPN client peer from peers.json. Run `infra vpn deploy` to revoke access.',
+      'Remove a VPN client peer from peers.json and sync the roster to the VPN_PEERS GitHub secret (best-effort). Run `infra vpn deploy` to revoke access.',
     )
     .example('# Remove a client named "laptop"')
     .example('infra vpn client remove laptop')

package/src/commands/vpn/peers.test.ts

@@ -1,14 +1,19 @@
 /// <reference types="bun" />
 
+import {mkdtempSync, rmSync, statSync, writeFileSync} from 'node:fs'
+import {tmpdir} from 'node:os'
+import {join} from 'node:path'
 import {describe, expect, it} from 'bun:test'
 
 import {
   addPeer,
   nextTunnelIp,
   parsePeersJson,
+  readPeersOrEmpty,
   removePeer,
   renderClientConfig,
   renderServerConfig,
+  writePeers,
   type Peer,
   type PeersFile,
 } from './peers'
@@ -364,4 +369,110 @@ describe('parsePeersJson', () => {
     expect(result.peers).toHaveLength(1)
     expect(result.peers[0]?.name).toBe('laptop')
   })
+
+  // Fix #7: duplicate tunnelIp / duplicate name validation
+  it('rejects a roster with duplicate tunnelIp values', () => {
+    expect(() =>
+      parsePeersJson({
+        peers: [
+          {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+          {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.2'},
+        ],
+      }),
+    ).toThrow(/duplicate.*tunnel|tunnel.*duplicate/i)
+  })
+
+  it('rejects a roster with duplicate name values', () => {
+    expect(() =>
+      parsePeersJson({
+        peers: [
+          {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+          {name: 'laptop', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+        ],
+      }),
+    ).toThrow(/duplicate.*name|name.*duplicate/i)
+  })
+
+  it('accepts a valid roster with unique names and tunnel IPs', () => {
+    const result: PeersFile = parsePeersJson({
+      peers: [
+        {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+        {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+      ],
+    })
+    expect(result.peers).toHaveLength(2)
+  })
+})
+
+// ── readPeersOrEmpty ──────────────────────────────────────────────────────────
+
+describe('readPeersOrEmpty', () => {
+  it('returns {peers: []} when the file does not exist (ENOENT)', async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), 'vpn-peers-test-'))
+    try {
+      const nonExistentPath = join(tmpDir, 'peers.json')
+      const result = await readPeersOrEmpty(nonExistentPath)
+      expect(result).toEqual({peers: []})
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns parsed file when the file exists and is valid', async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), 'vpn-peers-test-'))
+    try {
+      const filePath = join(tmpDir, 'peers.json')
+      writeFileSync(
+        filePath,
+        JSON.stringify({peers: [{name: 'laptop', publicKey: 'pk==', tunnelIp: '10.8.0.2'}]}, null, 2),
+      )
+      const result = await readPeersOrEmpty(filePath)
+      expect(result.peers).toHaveLength(1)
+      expect(result.peers[0]?.name).toBe('laptop')
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('throws on corrupt JSON (not ENOENT — corrupt file must NOT silently become empty roster)', async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), 'vpn-peers-test-'))
+    try {
+      const filePath = join(tmpDir, 'peers.json')
+      writeFileSync(filePath, 'not valid json {{{')
+      await expect(readPeersOrEmpty(filePath)).rejects.toThrow()
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('throws on schema-invalid JSON (not ENOENT — schema errors must not silently become empty roster)', async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), 'vpn-peers-test-'))
+    try {
+      const filePath = join(tmpDir, 'peers.json')
+      writeFileSync(filePath, JSON.stringify({peers: [{name: 'laptop'}]}))
+      await expect(readPeersOrEmpty(filePath)).rejects.toThrow()
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ── writePeers: restrictive permissions ──────────────────────────────────────
+
+describe('writePeers: file permissions', () => {
+  it('writes peers.json with mode 0o600 (owner read/write only)', async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), 'vpn-peers-perm-test-'))
+    try {
+      const filePath = join(tmpDir, 'peers.json')
+      await writePeers(filePath, {peers: []})
+
+      const stat = statSync(filePath)
+      // On macOS/Linux: check that mode is 0o600 (owner rw, no group/other)
+      // stat.mode includes file type bits; mask with 0o777 for permission bits
+      const permBits = stat.mode & 0o777
+      expect(permBits).toBe(0o600)
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
 })

package/src/commands/vpn/peers.ts

@@ -10,9 +10,39 @@ const peerSchema = z.object({
   tunnelIp: z.string(),
 })
 
-const peersFileSchema = z.object({
-  peers: z.array(peerSchema),
-})
+const peersFileSchema = z
+  .object({
+    peers: z.array(peerSchema),
+  })
+  .superRefine((data, ctx) => {
+    // Reject duplicate tunnelIp values — duplicated tunnel IPs break WireGuard routing silently
+    const seenIps = new Set<string>()
+    for (const peer of data.peers) {
+      if (seenIps.has(peer.tunnelIp)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Duplicate tunnel IP "${peer.tunnelIp}" — each peer must have a unique tunnel IP.`,
+          path: ['peers'],
+        })
+        return
+      }
+      seenIps.add(peer.tunnelIp)
+    }
+
+    // Reject duplicate name values
+    const seenNames = new Set<string>()
+    for (const peer of data.peers) {
+      if (seenNames.has(peer.name)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Duplicate name "${peer.name}" — each peer must have a unique name.`,
+          path: ['peers'],
+        })
+        return
+      }
+      seenNames.add(peer.name)
+    }
+  })
 
 export type Peer = z.infer<typeof peerSchema>
 export type PeersFile = z.infer<typeof peersFileSchema>
@@ -35,9 +65,29 @@ export async function readPeers(filePath: string): Promise<PeersFile> {
   return parsePeersJson(raw)
 }
 
+/**
+ * Read peers from filePath, returning {peers: []} when the file is absent (ENOENT).
+ *
+ * ENOENT is the only error that is silently treated as an empty roster — this
+ * supports fresh checkouts where peers.json is gitignored and does not exist yet.
+ *
+ * All other errors (corrupt JSON, schema violations, permission errors) still throw
+ * so that a corrupt file is never silently treated as an empty roster.
+ */
+export async function readPeersOrEmpty(filePath: string): Promise<PeersFile> {
+  try {
+    return await readPeers(filePath)
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && (error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return {peers: []}
+    }
+    throw error
+  }
+}
+
 export async function writePeers(filePath: string, peersFile: PeersFile): Promise<void> {
   const content = `${JSON.stringify(peersFile, null, 2)}\n`
-  await writeFile(filePath, content, 'utf-8')
+  await writeFile(filePath, content, {mode: 0o600})
 }
 
 // ── IP allocation ─────────────────────────────────────────────────────────────