@marcusrbrown/infra 0.11.4 → 0.12.1

package/src/commands/dashboard/status.ts

@@ -0,0 +1,293 @@
+import type {goke} from 'goke'
+import type {ActionCtx} from '../../lib/action-ctx'
+import type {StatusSummary} from '../status'
+import {z} from 'zod'
+
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
+import {redactHost} from '../../lib/redact'
+import {buildIdentityArgs} from '../../lib/ssh-identity'
+import {validateDashboardHost} from './host'
+
+declare const process: {
+  env: Record<string, string | undefined>
+  exitCode?: number
+}
+
+const COMPOSE_PROJECT_DIR = '/opt/dashboard'
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+export interface ComposePsEntry {
+  Name: string
+  State: string
+  Health: string
+}
+
+export type HealthStatus = 'healthy' | 'unhealthy' | 'starting' | 'n-a'
+
+export interface ServiceRow {
+  service: string
+  state: string
+  health: HealthStatus
+}
+
+export interface DashboardStatusResult {
+  ok: boolean
+  services: ServiceRow[]
+  error?: string
+}
+
+export type SpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+) => {
+  stdout: ReadableStream<Uint8Array>
+  stderr: ReadableStream<Uint8Array>
+  exited: Promise<number>
+}
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+export function parseComposePsOutput(stdoutText: string): ComposePsEntry[] {
+  const trimmed = stdoutText.trim()
+  if (trimmed.length === 0) return []
+
+  // Legacy compose may emit a single JSON array; current versions emit NDJSON.
+  if (trimmed.startsWith('[')) {
+    const parsed: unknown = JSON.parse(trimmed)
+    return Array.isArray(parsed) ? (parsed as ComposePsEntry[]) : []
+  }
+
+  // NDJSON: one JSON object per non-empty line.
+  return trimmed
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line.length > 0)
+    .map(line => JSON.parse(line) as ComposePsEntry)
+}
+
+function normalizeHealth(raw: string): HealthStatus {
+  if (raw === 'healthy' || raw === 'unhealthy' || raw === 'starting') {
+    return raw
+  }
+
+  return 'n-a'
+}
+
+export function parseComposePs(entries: ComposePsEntry[]): ServiceRow[] {
+  return entries.map(entry => ({
+    service: entry.Name,
+    state: entry.State,
+    health: normalizeHealth(entry.Health),
+  }))
+}
+
+export function isAllRunning(rows: ServiceRow[]): boolean {
+  return rows.every(row => row.state === 'running' && (row.health === 'healthy' || row.health === 'n-a'))
+}
+
+// ─── SSH-backed status fetch ──────────────────────────────────────────────────
+
+function defaultSpawn(
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+): ReturnType<SpawnFn> {
+  return Bun.spawn(cmd, opts) as ReturnType<SpawnFn>
+}
+
+export async function getDashboardComposeStatus(
+  host: string,
+  spawn: SpawnFn = defaultSpawn,
+): Promise<DashboardStatusResult> {
+  validateDashboardHost(host)
+
+  const knownHostsArgs = buildKnownHostsArgs()
+  const {args: identityArgs, cleanup} = buildIdentityArgs(process.env.DASHBOARD_SSH_KEY)
+
+  const sshCmd = [
+    'ssh',
+    '-o',
+    'BatchMode=yes',
+    '-o',
+    'ConnectTimeout=10',
+    '-o',
+    'StrictHostKeyChecking=yes',
+    ...knownHostsArgs,
+    ...identityArgs,
+    `root@${host}`,
+    `docker compose --project-directory ${COMPOSE_PROJECT_DIR} ps --format json`,
+  ]
+
+  const env: Record<string, string> = {
+    PATH: process.env.PATH ?? '/usr/bin:/bin',
+    HOME: process.env.HOME ?? '/tmp',
+    ...(process.env.SSH_AUTH_SOCK ? {SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK} : {}),
+  }
+
+  let stdoutText: string
+  let stderrText: string
+  let exitCode: number
+
+  try {
+    const child = spawn(sshCmd, {env, stdout: 'pipe', stderr: 'pipe'})
+    ;[stdoutText, stderrText, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited,
+    ])
+  } finally {
+    cleanup()
+  }
+
+  if (exitCode !== 0) {
+    return {
+      ok: false,
+      services: [],
+      error: `SSH command failed (exit ${exitCode}): ${redactHost(stderrText.trim(), host) || 'unknown error'}`,
+    }
+  }
+
+  let entries: ComposePsEntry[]
+
+  try {
+    entries = parseComposePsOutput(stdoutText)
+  } catch {
+    return {
+      ok: false,
+      services: [],
+      error: `Failed to parse docker compose ps output: ${redactHost(stdoutText.slice(0, 200), host)}`,
+    }
+  }
+
+  const services = parseComposePs(entries)
+  const ok = isAllRunning(services)
+
+  return {ok, services}
+}
+
+// ─── Unified status aggregator export ────────────────────────────────────────
+
+export async function getDashboardStatusSummary(host: string, spawn?: SpawnFn): Promise<StatusSummary> {
+  let result: DashboardStatusResult
+
+  try {
+    result = await getDashboardComposeStatus(host, spawn)
+  } catch (error) {
+    const errorMsg = error instanceof Error ? error.message : String(error)
+    return {
+      app: 'dashboard',
+      http: `ERROR: ${errorMsg}`,
+      lastDeploy: '—',
+      version: '—',
+      contentHash: '—',
+      usageStats: '—',
+    }
+  }
+
+  // Three-way split: no services → ERROR, services present but degraded → DEGRADED, all healthy → OK
+  if (result.services.length === 0) {
+    const errorMsg = result.error ?? 'No services reported'
+    return {
+      app: 'dashboard',
+      http: `ERROR: ${errorMsg}`,
+      lastDeploy: '—',
+      version: '—',
+      contentHash: '—',
+      usageStats: '—',
+    }
+  }
+
+  const rows = result.services.map(s => `${s.service}:${s.state}/${s.health}`).join(', ')
+
+  if (!result.ok) {
+    return {
+      app: 'dashboard',
+      http: `DEGRADED: ${rows}`,
+      lastDeploy: '—',
+      version: '—',
+      contentHash: '—',
+      usageStats: '—',
+    }
+  }
+
+  return {
+    app: 'dashboard',
+    http: `OK: ${rows}`,
+    lastDeploy: '—',
+    version: '—',
+    contentHash: '—',
+    usageStats: '—',
+  }
+}
+
+// ─── Action (exported for direct testing) ────────────────────────────────────
+
+export async function dashboardStatusAction(
+  options: {key?: string | undefined},
+  ctx: ActionCtx,
+  spawn?: SpawnFn,
+): Promise<void> {
+  const hostEnvKey = options.key ?? 'DASHBOARD_DOMAIN'
+  const host = process.env[hostEnvKey]
+
+  if (!host) {
+    ctx.console.error(
+      'Dashboard host not set. Export DASHBOARD_DOMAIN or pass --key <env-name> pointing to a set variable.',
+    )
+    ctx.process.exit(1)
+    return
+  }
+
+  ctx.console.log('Dashboard status')
+  ctx.console.log('')
+
+  let result: DashboardStatusResult
+
+  try {
+    result = await getDashboardComposeStatus(host, spawn)
+  } catch (error) {
+    ctx.console.error(`Error: ${error instanceof Error ? error.message : String(error)}`)
+    ctx.process.exit(1)
+    return
+  }
+
+  if (result.services.length === 0) {
+    const msg = result.error ?? 'No services reported by docker compose ps'
+    ctx.console.error(`Error: ${msg}`)
+    ctx.process.exit(1)
+    return
+  }
+
+  ctx.console.log('Service          State      Health')
+  ctx.console.log('─────────────────────────────────────')
+
+  for (const row of result.services) {
+    const svc = row.service.padEnd(16)
+    const state = row.state.padEnd(10)
+    ctx.console.log(`${svc} ${state} ${row.health}`)
+  }
+
+  ctx.console.log('')
+
+  if (result.ok) {
+    ctx.console.log('Status: OK')
+  } else {
+    ctx.console.log('Status: DEGRADED (one or more services not running)')
+    ctx.process.exit(1)
+  }
+}
+
+// ─── Command registration ─────────────────────────────────────────────────────
+
+export function registerDashboardStatus(cli: ReturnType<typeof goke>): void {
+  cli
+    .command('dashboard status', 'Show operational health of the dashboard deployment via docker compose ps.')
+    .option(
+      '--key [key]',
+      z
+        .string()
+        .optional()
+        .describe('Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.'),
+    )
+    .action((options, ctx) => dashboardStatusAction(options, ctx))
+}

package/src/commands/mcp.test.ts

@@ -30,6 +30,7 @@ import {afterAll, afterEach, beforeAll, beforeEach, describe, expect, test} from
 import {goke} from 'goke'
 
 import {registerCliproxyCommands} from './cliproxy'
+import {registerDashboardCommands} from './dashboard'
 import {registerGatewayCommands} from './gateway'
 import {registerKeewebCommands} from './keeweb'
 import {MCP_ALLOWLIST, registerMcp} from './mcp'
@@ -47,6 +48,7 @@ import {registerVpnCommands} from './vpn'
 const EXPECTED_TOOLS = [
   'cliproxy_models',
   'cliproxy_status',
+  'dashboard_status',
   'gateway_status',
   'keeweb_status',
   'status',
@@ -65,6 +67,8 @@ const CLI_ONLY_TOOLS = [
   'cliproxy_login',
   'cliproxy_open',
   'cliproxy_setup',
+  'dashboard_deploy',
+  'dashboard_logs',
   'gateway_deploy',
   'gateway_logs',
   'gateway_restore',
@@ -96,6 +100,7 @@ function buildTestCli(): ReturnType<typeof goke> {
   registerCliproxyCommands(cli)
   registerGatewayCommands(cli)
   registerUmamiCommands(cli)
+  registerDashboardCommands(cli)
   registerVpnCommands(cli)
   registerStatus(cli)
   registerMcp(cli)

package/src/commands/mcp.ts

@@ -16,6 +16,8 @@ import {createMcpAction} from '@goke/mcp'
  * - `keeweb open`      — host-machine side effect (spawns local browser, requires user intent)
  * - `umami deploy`     — intentionally CLI-only: mutates live deployment and requires environment approval
  * - `umami logs`       — intentionally CLI-only: streams logs that may emit sensitive data (DB passwords, app secrets)
+ * - `dashboard deploy` — intentionally CLI-only: mutates live deployment and requires environment approval
+ * - `dashboard logs`   — intentionally CLI-only: streams logs that may emit sensitive data (DB passwords, app secrets)
  *
  * Source-gated sensitive commands (security — CLI-only, never MCP-exposed):
  * - `gateway backup`       — secret-bearing: writes CA private key material to a tarball; CLI-only
@@ -41,6 +43,7 @@ export const MCP_ALLOWLIST: ReadonlySet<string> = new Set([
   'cliproxy models',
   'keeweb status',
   'umami status',
+  'dashboard status',
   'vpn status',
   'status',
 ])

package/src/commands/status.test.ts

@@ -4,6 +4,8 @@ import {goke} from 'goke'
 import {createCapturedCtx, expectCapturedToInclude} from '../__test__/mcp-ctx-fixture'
 import {registerStatus, unifiedStatusAction} from './status'
 
+// NOTE: dashboard is included in the unified status table alongside the other apps.
+
 const healthyKeeweb: StatusSummary = {
   app: 'keeweb',
   http: 'OK',
@@ -49,12 +51,22 @@ const healthyVpn: StatusSummary = {
   usageStats: '—',
 }
 
+const healthyDashboard: StatusSummary = {
+  app: 'dashboard',
+  http: 'OK: dashboard:running/healthy',
+  lastDeploy: '—',
+  version: '—',
+  contentHash: '—',
+  usageStats: '—',
+}
+
 function makeDeps(overrides?: Partial<Parameters<typeof registerStatus>[1]>): Parameters<typeof registerStatus>[1] {
   return {
     getKeewebStatusSummary: async () => healthyKeeweb,
     getCliproxyStatusSummary: async () => healthyCliproxy,
     getGatewayStatusSummary: async () => healthyGateway,
     getUmamiStatusSummary: async () => healthyUmami,
+    getDashboardStatusSummary: async () => healthyDashboard,
     getVpnStatusSummary: async () => healthyVpn,
     ...overrides,
   }
@@ -73,6 +85,9 @@ describe('top-level status command (Tier-2 ctx capture)', () => {
     expect(expectCapturedToInclude(captured, '| cliproxy | OK | — | v1.2.3 | — | 12 req / 0 fail |')).toBe(true)
     expect(expectCapturedToInclude(captured, '| gateway | OK: gateway:running/healthy | — | — | — | — |')).toBe(true)
     expect(expectCapturedToInclude(captured, '| umami | OK: umami:running/healthy | — | — | — | — |')).toBe(true)
+    expect(expectCapturedToInclude(captured, '| dashboard | OK: dashboard:running/healthy | — | — | — | — |')).toBe(
+      true,
+    )
     expect(expectCapturedToInclude(captured, '| vpn | OK: wg0 up, pubkey:TESTKEY== 1 peer(s) | — | — | — | — |')).toBe(
       true,
     )
@@ -171,6 +186,7 @@ describe('top-level status command (Tier-2 ctx capture)', () => {
       cliproxy: {version: string}
       gateway: {http: string}
       umami: {http: string}
+      dashboard: {http: string}
       vpn: {http: string}
     }
 
@@ -178,6 +194,7 @@ describe('top-level status command (Tier-2 ctx capture)', () => {
     expect(parsed.cliproxy.version).toBe('v1.2.3')
     expect(parsed.gateway.http).toBe('OK: gateway:running/healthy')
     expect(parsed.umami.http).toBe('OK: umami:running/healthy')
+    expect(parsed.dashboard.http).toBe('OK: dashboard:running/healthy')
     expect(parsed.vpn.http).toBe('OK: wg0 up, pubkey:TESTKEY== 1 peer(s)')
   })
 

package/src/commands/status.ts

@@ -5,6 +5,7 @@ import type {ActionCtx} from '../lib/action-ctx'
 import {z} from 'zod'
 
 import {getCliproxyStatusSummary} from './cliproxy/status'
+import {getDashboardStatusSummary} from './dashboard'
 import {getGatewayStatusSummary} from './gateway'
 import {getKeewebStatusSummary} from './keeweb/status'
 import {getUmamiStatusSummary} from './umami'
@@ -15,7 +16,7 @@ declare const process: {
 }
 
 export interface StatusSummary {
-  app: 'keeweb' | 'cliproxy' | 'gateway' | 'umami' | 'vpn'
+  app: 'keeweb' | 'cliproxy' | 'gateway' | 'umami' | 'dashboard' | 'vpn'
   http: string
   lastDeploy: string
   version: string
@@ -30,6 +31,7 @@ interface StatusDependencies {
   getCliproxyStatusSummary: (baseUrl: string, key: string, verbose: boolean) => Promise<StatusSummary>
   getGatewayStatusSummary: (host: string) => Promise<StatusSummary>
   getUmamiStatusSummary: (host: string) => Promise<StatusSummary>
+  getDashboardStatusSummary: (host: string) => Promise<StatusSummary>
   getVpnStatusSummary: (host: string) => Promise<StatusSummary>
 }
 
@@ -68,6 +70,7 @@ function toJsonPayload(rows: StatusSummary[]): Record<AppName, StatusSummary> {
     cliproxy: rows.find(row => row.app === 'cliproxy') ?? errorSummary('cliproxy', 'missing result'),
     gateway: rows.find(row => row.app === 'gateway') ?? errorSummary('gateway', 'missing result'),
     umami: rows.find(row => row.app === 'umami') ?? errorSummary('umami', 'missing result'),
+    dashboard: rows.find(row => row.app === 'dashboard') ?? errorSummary('dashboard', 'missing result'),
     vpn: rows.find(row => row.app === 'vpn') ?? errorSummary('vpn', 'missing result'),
   }
 }
@@ -85,6 +88,7 @@ export async function unifiedStatusAction(
     getCliproxyStatusSummary,
     getGatewayStatusSummary,
     getUmamiStatusSummary,
+    getDashboardStatusSummary,
     getVpnStatusSummary,
   },
 ): Promise<void> {
@@ -93,6 +97,7 @@ export async function unifiedStatusAction(
   const cliproxyKey = process.env.CLIPROXY_MANAGEMENT_KEY ?? ''
   const gatewayHost = process.env.GATEWAY_HOST ?? ''
   const umamiHost = process.env.UMAMI_DOMAIN ?? ''
+  const dashboardHost = process.env.DASHBOARD_DOMAIN ?? ''
   const vpnHost = process.env.VPN_HOST ?? ''
 
   const results = await Promise.allSettled([
@@ -100,10 +105,11 @@ export async function unifiedStatusAction(
     dependencies.getCliproxyStatusSummary(cliproxyBaseUrl, cliproxyKey, verbose),
     dependencies.getGatewayStatusSummary(gatewayHost),
     dependencies.getUmamiStatusSummary(umamiHost),
+    dependencies.getDashboardStatusSummary(dashboardHost),
     dependencies.getVpnStatusSummary(vpnHost),
   ])
 
-  const appNames: AppName[] = ['keeweb', 'cliproxy', 'gateway', 'umami', 'vpn']
+  const appNames: AppName[] = ['keeweb', 'cliproxy', 'gateway', 'umami', 'dashboard', 'vpn']
   const rows: StatusSummary[] = results.map((result, index) => {
     const app = appNames[index] ?? 'keeweb'
     if (result.status === 'fulfilled') {
@@ -133,6 +139,7 @@ export function registerStatus(
     getCliproxyStatusSummary,
     getGatewayStatusSummary,
     getUmamiStatusSummary,
+    getDashboardStatusSummary,
     getVpnStatusSummary,
   },
 ): void {
@@ -142,7 +149,9 @@ export function registerStatus(
       '--json',
       z
         .boolean()
-        .describe('Output machine-readable JSON with keeweb, cliproxy, gateway, umami, and vpn summary objects.'),
+        .describe(
+          'Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, and vpn summary objects.',
+        ),
     )
     .option(
       '--verbose',

package/src/resources/known_hosts

@@ -44,3 +44,11 @@ metrics.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy
 |1|6g8lttzHI3BCW6rIf1/Bteo1KcM=|bNbGP2QK2pUdPmhplw6eVzspe5g= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILA4LGgnvBjq/yoOKLjzFefGzo9gAspxwfbY8aACj/3q
 # 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
 # 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+
+# dashboard droplet (206.189.198.47 / dashboard.fro.bot)
+dashboard.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDOO1TZlem4z3y9QPJ5GNYT+uwH1rkPQzBNC4GFM3pmFpQrikJSKNsB8m6ugvT30BChVPI2bOKmPUAfdstCQks2Creql9yYYkmo2PHnICNuj66saoOr6O+aACZYMJzjyLr3hcpxxFlLCYiu3fWkCoR8U+Zej3Fd+rjkSSm35jiAH/9y6pzLYO0HeIWGnDqg/qkTfQPwdGzlp+/PtWdClgECWO/dv2Op55cnoXBw9V3+DTvi9Dz8SqHs61InonZIkbGhleOF+JYzMinFkn9zcLTqZsnLhJwqF/xnhqjBGIpKUfL+cHAge5S2BVkudULQ93T/s7Ef6i0NyWNs3355D1XlaXPqIKQX7wZ95pfnAfdaMtHBNmb87YjzhFmyjjK+WewMDREPkYCmK5sP+CGgZTesFvEBM3R/3KbrHwqctFkZmjYVMhQ+AjYOCcXrqQNbqRbhYxKjQxJ4+JOIEmrvkO7/sN+2Ln/ieUeiNNwHQI3u2y3gh/86+b5hkkSfiM36Guk=
+dashboard.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIbi0QIPYdxKt7NyZaQqRzqybeLaLWGpRz0HmJ/LlqCZvDyMKpgRPBbXdrX4VLJ7yjHMMPTE3c6AuESPaREAskQ=
+dashboard.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICfh7XC2RI9+cjSQYilRUuTJ6LyYNemiqwpIrrtuGem4
+|1|BE8EGlm+K9zcHciIkmp8myb/qaI=|Q8zNDhvS1r7zKIGzI54O/v9ev1I= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDOO1TZlem4z3y9QPJ5GNYT+uwH1rkPQzBNC4GFM3pmFpQrikJSKNsB8m6ugvT30BChVPI2bOKmPUAfdstCQks2Creql9yYYkmo2PHnICNuj66saoOr6O+aACZYMJzjyLr3hcpxxFlLCYiu3fWkCoR8U+Zej3Fd+rjkSSm35jiAH/9y6pzLYO0HeIWGnDqg/qkTfQPwdGzlp+/PtWdClgECWO/dv2Op55cnoXBw9V3+DTvi9Dz8SqHs61InonZIkbGhleOF+JYzMinFkn9zcLTqZsnLhJwqF/xnhqjBGIpKUfL+cHAge5S2BVkudULQ93T/s7Ef6i0NyWNs3355D1XlaXPqIKQX7wZ95pfnAfdaMtHBNmb87YjzhFmyjjK+WewMDREPkYCmK5sP+CGgZTesFvEBM3R/3KbrHwqctFkZmjYVMhQ+AjYOCcXrqQNbqRbhYxKjQxJ4+JOIEmrvkO7/sN+2Ln/ieUeiNNwHQI3u2y3gh/86+b5hkkSfiM36Guk=
+|1|ecn8h6NS6U7O4Trw2TYxOU/NRBA=|reMYqISi8FjcMseG/m8hL2gZeh8= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIbi0QIPYdxKt7NyZaQqRzqybeLaLWGpRz0HmJ/LlqCZvDyMKpgRPBbXdrX4VLJ7yjHMMPTE3c6AuESPaREAskQ=
+|1|MDYlzZB3WsZTegoHcaekI74yObo=|/l2M4GVvjP43mFxedVBB2aBkTQk= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICfh7XC2RI9+cjSQYilRUuTJ6LyYNemiqwpIrrtuGem4