@marcusrbrown/infra 0.13.0 → 0.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",
@@ -22,13 +22,16 @@
     "./vpn/peers": "./src/commands/vpn/peers.ts"
   },
   "bin": {
-    "infra": "src/cli.ts"
+    "infra": "./dist/cli.js"
   },
   "files": [
-    "src/"
+    "dist",
+    "src/commands/vpn/peers.ts"
   ],
   "scripts": {
+    "build": "bun run scripts/build.ts",
     "cli": "bun run src/cli.ts",
+    "prepack": "bun run build",
     "test": "bun test"
   },
   "dependencies": {
@@ -39,6 +42,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@marcusrbrown/infra-shared": "workspace:*",
     "@modelcontextprotocol/sdk": "1.29.0",
     "yaml": "2.9.0"
   },

package/src/__snapshots__/cli.test.ts.snap

@@ -1,219 +0,0 @@
-// Bun Snapshot v1, https://bun.sh/docs/test/snapshots
-
-exports[`infra CLI shows root help with registered top-level commands 1`] = `
-"infra/x.x.x
-
-
-Usage:
-  $ infra <command> [options]
-
-
-Commands:
-  keeweb status                        Show operational health of the KeeWeb deployment
-
-    --verbose                          Enable verbose output for all commands
-
-
-  keeweb deploy                        Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.
-
-    --local                            Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions. (default: false)
-    --nginx                            Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx. (default: false)
-    --dry-run                          Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions. (default: false)
-
-
-  keeweb open                          Open KeeWeb in the default browser
-
-
-  cliproxy status                      Show operational health of CLIProxyAPI and its management endpoints.
-
-    --url [url]                        Base URL for CLIProxyAPI health checks. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
-    --api-key [key]                    Downstream API key (bearer) for the upstream provider-auth probe. Falls back to CLIPROXY_API_KEY. Skipped when absent.
-    --verbose                          Enable verbose output for all commands
-
-
-  cliproxy deploy                      Deploy CLIProxyAPI. Default mode triggers the GitHub Deploy CLIProxy workflow, while --local runs apps/cliproxy/src/deploy.ts directly with Bun.
-
-    --local                            Run local deployment with Bun using apps/cliproxy/src/deploy.ts instead of triggering GitHub Actions. (default: false)
-    --force-config                     Force upload config.yaml even if it exists on the server. WARNING: overwrites runtime API keys and settings. (default: false)
-    --dry-run                          Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow. (default: false)
-
-
-  cliproxy config get                  Fetch current CLIProxyAPI config as JSON.
-
-    --url [url]                        Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
-    --output [file]                    Write config JSON to a file instead of stdout. File permissions set to 0600 (owner-read-only).
-    --json                             Output raw JSON instead of aligned key: value columns.
-
-
-  cliproxy config set <field> <value>  Update a mutable CLIProxyAPI config field via its dedicated management endpoint.
-
-    --url [url]                        Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
-
-
-  cliproxy keys list                   List CLIProxyAPI API keys from the management API.
-
-    --url [url]                        Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
-    --json                             Output raw JSON array instead of a numbered list.
-
-
-  cliproxy keys add <key>              Add an API key by fetching current keys, appending the value, and replacing full key set.
-
-    --url [url]                        Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
-
-
-  cliproxy keys remove <key>           Remove an API key via management API endpoint query parameter.
-
-    --url [url]                        Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
-
-
-  cliproxy login <provider>            Run provider login on the remote CLIProxyAPI host. Supported providers: claude, codex.
-
-    --host [host]                      CLIProxyAPI droplet host for SSH execution. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.
-
-
-  cliproxy models [provider]           List the models CLIProxyAPI serves.
-
-    --url [url]                        Base URL for CLIProxyAPI. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
-    --key [key]                        API key (bearer). Falls back to CLIPROXY_API_KEY when omitted.
-    --verbose                          Show owned_by and created date for each model.
-
-
-  cliproxy open                        Launch CLIProxyAPI TUI dashboard via SSH.
-
-    --host [host]                      SSH host for CLIProxyAPI server. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.
-
-
-  cliproxy setup                       Interactively onboard a GitHub repository to CLIProxyAPI by creating or reusing a key and wiring the required GitHub secrets and variables.
-
-    --key [key]                        Existing CLIProxyAPI API key value. When provided, setup skips key creation and reuses this key for GitHub secrets.
-    --repo [repo]                      Target GitHub repository in owner/repo format. Skips the repository prompt when provided.
-    --harness [harness]                Harness template to configure. Choose opencode, claude-code, or generic. Generic remains interactive-only.
-    --providers [providers]            Comma-separated list of providers to enable. Default: anthropic. Supported values: anthropic, openai. Example: --providers anthropic,openai
-    --model [model]                    Override the default model. Must be provider-prefixed and lowercase. Required when multiple providers selected. Examples: anthropic/claude-sonnet-4-6, openai/gpt-4o
-    --force                            Overwrite existing GitHub secrets and variables without prompting.
-    --dry-run                          Print the plan without applying any changes.
-    --verify-smoke                     Run a smoke test against the proxy after setup completes.
-    --ack-key-reuse                    Acknowledge that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON. Required in non-interactive mode when --key is supplied for a repo with existing OPENCODE_AUTH_JSON. (default: false)
-
-
-  gateway status                       Show operational health of the gateway deployment via docker compose ps.
-
-    --key [key]                        Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.
-
-
-  gateway deploy                       Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.
-
-    --local                            Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions. (default: false)
-    --dry-run                          Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow. (default: false)
-    --force-recreate                   Force recreate containers. Forwarded only in local mode. (default: false)
-
-
-  gateway logs [service]               Stream logs from a gateway service via SSH and docker compose.
-
-    --tail [n]                         Number of log lines to tail from each service. (default: 100)
-    --allow-ci                         Allow log streaming in CI environments. Logs may contain sensitive credentials. (default: false)
-    --key [key]                        Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.
-
-
-  gateway backup                       Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor — treat it as sensitive material.
-
-    --output [file]                    Local path to write the CA tarball. File permissions are set to 0600 after writing. (default: apps/gateway/.local/mitmproxy-ca.tar)
-    --include-ca                       Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target. (default: true)
-
-
-  gateway restore                      Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.
-
-    --input <file>                     Path to the tarball produced by \`gateway backup --include-ca\`. Required.
-    --include-ca                       Restore the mitmproxy CA certificate and private key. Currently the only supported restore target. (default: true)
-
-
-  umami status                         Show operational health of the Umami analytics deployment via docker compose ps.
-
-    --key [key]                        Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.
-
-
-  umami deploy                         Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.
-
-    --local                            Run local deployment with Bun using apps/umami instead of triggering GitHub Actions. (default: false)
-    --dry-run                          Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow. (default: false)
-
-
-  umami logs [service]                 Stream logs from an Umami service via SSH and docker compose.
-
-    --tail [n]                         Number of log lines to tail from each service. (default: 100)
-    --allow-ci                         Allow log streaming in CI environments. Logs may contain sensitive credentials. (default: false)
-    --key [key]                        Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.
-
-
-  dashboard status                     Show operational health of the dashboard deployment via docker compose ps.
-
-    --key [key]                        Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.
-
-
-  dashboard deploy                     Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.
-
-    --local                            Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions. (default: false)
-    --dry-run                          Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow. (default: false)
-
-
-  dashboard logs [service]             Stream logs from a dashboard service via SSH and docker compose.
-
-    --tail [n]                         Number of log lines to tail from each service. (default: 100)
-    --allow-ci                         Allow log streaming in CI environments. Logs may contain sensitive credentials. (default: false)
-    --key [key]                        Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.
-
-
-  vpn status                           Show operational health of the VPN box via SSH and wg show.
-
-    --key [key]                        Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.
-
-
-  vpn deploy                           Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.
-
-    --local                            Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions. (default: false)
-    --dry-run                          Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow. (default: false)
-    --force-server-key                 Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs. (default: false)
-
-
-  vpn logs                             Stream WireGuard VPN logs via SSH and journalctl.
-
-    --tail [n]                         Number of log lines to tail. (default: 100)
-    --allow-ci                         Allow log streaming in CI environments. Logs may contain sensitive VPN data. (default: false)
-    --key [key]                        Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.
-
-
-  vpn client add <name>                Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).
-
-    --split-tunnel [cidrs]             Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).
-    --dns [dns]                        DNS server for the client config.
-    --server-pubkey [key]              Server public key. Falls back to VPN_SERVER_PUBKEY env var.
-    --endpoint [host]                  VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.
-
-
-  vpn client list                      List all VPN client peers from peers.json.
-
-
-  vpn client remove <name>             Remove a VPN client peer from peers.json and sync the roster to the VPN_PEERS GitHub secret (best-effort). Run \`infra vpn deploy\` to revoke access.
-
-
-  status                               Show status of all deployments
-
-    --json                             Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, and vpn summary objects.
-    --verbose                          Include verbose per-app health check details when building the summary rows.
-
-
-  mcp                                  Start a stdio MCP server exposing all CLI commands as tools for coding agents
-
-
-Options:
-  --verbose      Enable verbose output for all commands
-  -h, --help     Display this message
-  -v, --version  Display version number
-"
-`;

package/src/__test__/mcp-ctx-fixture.test.ts

@@ -1,108 +0,0 @@
-import {describe, expect, it} from 'bun:test'
-
-import {createCapturedCtx, expectCapturedToInclude} from './mcp-ctx-fixture'
-
-describe('createCapturedCtx', () => {
-  describe('ctx.console.log', () => {
-    it('populates captured.stdout with a single string arg', () => {
-      const {ctx, captured} = createCapturedCtx()
-      ctx.console.log('hello')
-      expect(captured.stdout).toEqual(['hello'])
-    })
-
-    it('space-joins multiple args matching console.log behavior', () => {
-      const {ctx, captured} = createCapturedCtx()
-      ctx.console.log('foo', 'bar', 42)
-      expect(captured.stdout).toEqual(['foo bar 42'])
-    })
-  })
-
-  describe('ctx.process.stdout.write', () => {
-    it('pushes a string chunk to captured.stdout', () => {
-      const {ctx, captured} = createCapturedCtx()
-      ctx.process.stdout.write('chunk')
-      expect(captured.stdout).toEqual(['chunk'])
-    })
-
-    it('decodes a Uint8Array chunk as utf-8 and pushes to captured.stdout', () => {
-      const {ctx, captured} = createCapturedCtx()
-      ctx.process.stdout.write(new TextEncoder().encode('buf'))
-      expect(captured.stdout).toEqual(['buf'])
-    })
-  })
-
-  describe('ctx.process.stderr.write', () => {
-    it('pushes a string chunk to captured.stderr', () => {
-      const {ctx, captured} = createCapturedCtx()
-      ctx.process.stderr.write('err-chunk')
-      expect(captured.stderr).toEqual(['err-chunk'])
-    })
-  })
-
-  describe('ctx.console.error', () => {
-    it('pushes formatted string to captured.stderr', () => {
-      const {ctx, captured} = createCapturedCtx()
-      ctx.console.error('oops', 99)
-      expect(captured.stderr).toEqual(['oops 99'])
-    })
-  })
-
-  describe('ctx.process.exit', () => {
-    it('throws after populating captured.exit with code 1', () => {
-      const {ctx, captured} = createCapturedCtx()
-      let threw = false
-      try {
-        ctx.process.exit(1)
-      } catch {
-        threw = true
-      }
-      expect(threw).toBe(true)
-      expect(captured.exit).toEqual({code: 1})
-    })
-
-    it('also throws for exit code 0', () => {
-      const {ctx, captured} = createCapturedCtx()
-      let threw = false
-      try {
-        ctx.process.exit(0)
-      } catch {
-        threw = true
-      }
-      expect(threw).toBe(true)
-      expect(captured.exit).toEqual({code: 0})
-    })
-  })
-
-  it('starts with empty stdout, stderr, and null exit', () => {
-    const {captured} = createCapturedCtx()
-    expect(captured.stdout).toEqual([])
-    expect(captured.stderr).toEqual([])
-    expect(captured.exit).toBeNull()
-  })
-})
-
-describe('expectCapturedToInclude', () => {
-  it('returns true when stdout contains the string marker', () => {
-    const {ctx, captured} = createCapturedCtx()
-    ctx.console.log('hello world')
-    expect(expectCapturedToInclude(captured, 'hello')).toBe(true)
-  })
-
-  it('returns false when stdout does not contain the string marker', () => {
-    const {ctx, captured} = createCapturedCtx()
-    ctx.console.log('goodbye')
-    expect(expectCapturedToInclude(captured, 'hello')).toBe(false)
-  })
-
-  it('returns true when stdout matches a regex marker', () => {
-    const {ctx, captured} = createCapturedCtx()
-    ctx.console.log('hello world')
-    expect(expectCapturedToInclude(captured, /^hello/)).toBe(true)
-  })
-
-  it('returns false when stdout does not match a regex marker', () => {
-    const {ctx, captured} = createCapturedCtx()
-    ctx.console.log('hello world')
-    expect(expectCapturedToInclude(captured, /^world/)).toBe(false)
-  })
-})

package/src/__test__/mcp-ctx-fixture.ts

@@ -1,104 +0,0 @@
-import {format} from 'node:util'
-
-export type {ActionCtx} from '../lib/action-ctx'
-
-/**
- * Captured output from a `createCapturedCtx()` invocation.
- */
-export interface CapturedOutput {
-  stdout: string[]
-  stderr: string[]
-  exit: {code: number} | null
-}
-
-/**
- * Error thrown by `ctx.process.exit()` in the mock context.
- * Mirrors the `GokeProcessExit` pattern from goke — exit always throws
- * so action code cannot silently swallow it.
- */
-export class MockProcessExit extends Error {
-  readonly code: number
-
-  constructor(code: number) {
-    super(`MockProcessExit: process.exit(${code})`)
-    this.name = 'MockProcessExit'
-    this.code = code
-  }
-}
-
-/**
- * Minimal surface of `GokeExecutionContext` that the capture fixture provides.
- * Matches `ctx.console.{log,error}`, `ctx.process.{stdout,stderr}.write`,
- * and `ctx.process.exit` — the same shape produced by
- * `createCallToolExecutionContext` in `@goke/mcp`.
- */
-export interface CapturedCtx {
-  console: {
-    log: (...args: unknown[]) => void
-    error: (...args: unknown[]) => void
-  }
-  process: {
-    stdout: {write: (chunk: string | Uint8Array) => void}
-    stderr: {write: (chunk: string | Uint8Array) => void}
-    exit: (code: number) => never
-  }
-}
-
-function decodeChunk(chunk: string | Uint8Array): string {
-  if (typeof chunk === 'string') return chunk
-  return new TextDecoder().decode(chunk)
-}
-
-/**
- * Create a fresh mock `GokeExecutionContext` with output capture.
- *
- * Each call returns an independent `{ctx, captured}` pair — no shared state.
- * Use one call per test to keep tests isolated.
- */
-export function createCapturedCtx(): {ctx: CapturedCtx; captured: CapturedOutput} {
-  const captured: CapturedOutput = {
-    stdout: [],
-    stderr: [],
-    exit: null,
-  }
-
-  const ctx: CapturedCtx = {
-    console: {
-      log(...args: unknown[]) {
-        captured.stdout.push(format(...args))
-      },
-      error(...args: unknown[]) {
-        captured.stderr.push(format(...args))
-      },
-    },
-    process: {
-      stdout: {
-        write(chunk: string | Uint8Array) {
-          captured.stdout.push(decodeChunk(chunk))
-        },
-      },
-      stderr: {
-        write(chunk: string | Uint8Array) {
-          captured.stderr.push(decodeChunk(chunk))
-        },
-      },
-      exit(code: number): never {
-        captured.exit = {code}
-        throw new MockProcessExit(code)
-      },
-    },
-  }
-
-  return {ctx, captured}
-}
-
-/**
- * Returns `true` when the concatenated stdout contains `marker`.
- *
- * Composable — does not throw. Use with `expect(...).toBe(true)`.
- */
-export function expectCapturedToInclude(captured: CapturedOutput, marker: string | RegExp): boolean {
-  const text = captured.stdout.join('')
-  if (typeof marker === 'string') return text.includes(marker)
-  return marker.test(text)
-}

package/src/cli.test.ts

@@ -1,66 +0,0 @@
-import {resolve} from 'node:path'
-import {describe, expect, it} from 'bun:test'
-
-declare const process: {
-  env: Record<string, string | undefined>
-}
-
-const cliDir = resolve(import.meta.dir, '..')
-
-async function runCli(...args: string[]) {
-  const proc = Bun.spawn(['bun', 'src/cli.ts', ...args], {
-    cwd: cliDir,
-    env: {...process.env, NO_COLOR: '1'},
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited,
-  ])
-
-  return {stdout, stderr, exitCode}
-}
-
-describe('infra CLI', () => {
-  it('shows root help with registered top-level commands', async () => {
-    const {stdout, stderr, exitCode} = await runCli('--help')
-
-    expect(exitCode).toBe(0)
-    expect(stderr).toBe('')
-    expect(stdout).toContain('keeweb')
-    expect(stdout).toContain('status')
-    expect(stdout).toContain('mcp')
-    // Normalize version so snapshot survives changeset bumps
-    const stableOutput = stdout.replace(/infra\/\d+\.\d+\.\d+/, 'infra/x.x.x')
-    expect(stableOutput).toMatchSnapshot()
-  })
-
-  it('shows keeweb deploy help with expected flags', async () => {
-    const {stdout, stderr, exitCode} = await runCli('keeweb', 'deploy', '--help')
-
-    expect(exitCode).toBe(0)
-    expect(stderr).toBe('')
-    expect(stdout).toContain('--local')
-    expect(stdout).toContain('--nginx')
-    expect(stdout).toContain('--dry-run')
-  })
-
-  it('falls back to root help for an unknown command', async () => {
-    const {stdout, stderr, exitCode} = await runCli('nonexistent')
-
-    expect(exitCode).toBe(0)
-    expect(stderr).toBe('')
-    expect(stdout).toContain('Usage:')
-  })
-
-  it('exits non-zero and prints an error for an invalid option', async () => {
-    const {stdout, stderr, exitCode} = await runCli('keeweb', 'deploy', '--bogus')
-
-    expect(exitCode).not.toBe(0)
-    expect(stdout).toBe('')
-    expect(stderr).toContain('--bogus')
-  })
-})

package/src/cli.ts

@@ -1,43 +0,0 @@
-#!/usr/bin/env bun
-
-import {goke} from 'goke'
-import pkg from '../package.json' with {type: 'json'}
-import {registerCliproxyCommands} from './commands/cliproxy'
-import {registerDashboardCommands} from './commands/dashboard'
-import {registerGatewayCommands} from './commands/gateway'
-import {registerKeewebCommands} from './commands/keeweb'
-import {registerMcp} from './commands/mcp'
-import {registerStatus} from './commands/status'
-import {registerUmamiCommands} from './commands/umami'
-import {registerVpnCommands} from './commands/vpn'
-
-declare const process: {
-  argv: string[]
-  exit: (code?: number) => never
-}
-
-const cli = goke('infra')
-
-cli.option('--verbose', 'Enable verbose output for all commands')
-
-registerKeewebCommands(cli)
-registerCliproxyCommands(cli)
-registerGatewayCommands(cli)
-registerUmamiCommands(cli)
-registerDashboardCommands(cli)
-registerVpnCommands(cli)
-registerStatus(cli)
-registerMcp(cli)
-
-cli.help()
-cli.version(pkg.version)
-
-try {
-  cli.parse(process.argv, {run: false})
-  await cli.runMatchedCommand()
-} catch (error) {
-  if (error instanceof Error) {
-    console.error(error.message)
-  }
-  process.exit(1)
-}