@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/commands/vpn/client.ts

@@ -1,467 +0,0 @@
-import type {goke} from 'goke'
-
-import {mkdir, writeFile} from 'node:fs/promises'
-import {resolve} from 'node:path'
-
-import {z} from 'zod'
-import {addPeer, readPeersOrEmpty, removePeer, renderClientConfig, writePeers, type Peer} from './peers'
-
-declare const process: {
-  env: Record<string, string | undefined>
-  exitCode?: number
-}
-
-// ─── Types ────────────────────────────────────────────────────────────────────
-
-export interface Keypair {
-  privateKey: string
-  publicKey: string
-}
-
-export type KeypairGenFn = () => Promise<Keypair>
-
-/** Minimal subset of Bun.Subprocess used for gh secret sync. */
-export interface SyncSpawnResult {
-  stdout: ReadableStream<Uint8Array>
-  stderr: ReadableStream<Uint8Array>
-  stdin?: {write: (data: Uint8Array) => void; end: () => void}
-  exited: Promise<number>
-}
-
-export interface SyncSpawnOpts {
-  stdout: 'pipe'
-  stderr: 'pipe'
-  stdin: 'pipe'
-}
-
-/** Injectable spawn function for gh secret sync — defaults to Bun.spawn. */
-export type SpawnFn = (cmd: string[], opts: SyncSpawnOpts) => SyncSpawnResult
-
-export interface VpnClientAddOpts {
-  peersJsonPath: string
-  clientsDir: string
-  serverPublicKey: string
-  endpoint: string
-  keypairGen?: KeypairGenFn
-  spawnFn?: SpawnFn
-  allowedIps?: string
-  dns?: string
-  /** Timeout in ms for gh secret sync. Defaults to 15000. Injectable for tests. */
-  syncTimeoutMs?: number
-}
-
-export interface VpnClientAddResult {
-  tunnelIp: string
-  confPath: string
-}
-
-// ─── WireGuard keypair generation ─────────────────────────────────────────────
-
-/**
- * Generate a WireGuard keypair using the local `wg` binary.
- *
- * Assumption: `wg` is installed locally (wireguard-tools package).
- * The private key is generated locally and written ONLY to the gitignored
- * clients/ directory — it never leaves the local machine.
- */
-export async function generateKeypair(): Promise<Keypair> {
-  // Step 1: generate private key
-  const genkeyProc = Bun.spawn(['wg', 'genkey'], {
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-
-  const [privateKeyRaw, genkeyStderr, genkeyExit] = await Promise.all([
-    new Response(genkeyProc.stdout).text(),
-    new Response(genkeyProc.stderr).text(),
-    genkeyProc.exited,
-  ])
-
-  if (genkeyExit !== 0) {
-    throw new Error(`wg genkey failed (exit ${genkeyExit}): ${genkeyStderr.trim()}`)
-  }
-
-  const privateKey = privateKeyRaw.trim()
-
-  // Step 2: derive public key from private key
-  const encoder = new TextEncoder()
-  const pubkeyProc = Bun.spawn(['wg', 'pubkey'], {
-    stdin: new ReadableStream({
-      start(controller) {
-        controller.enqueue(encoder.encode(`${privateKey}\n`))
-        controller.close()
-      },
-    }),
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-
-  const [publicKeyRaw, pubkeyStderr, pubkeyExit] = await Promise.all([
-    new Response(pubkeyProc.stdout).text(),
-    new Response(pubkeyProc.stderr).text(),
-    pubkeyProc.exited,
-  ])
-
-  if (pubkeyExit !== 0) {
-    throw new Error(`wg pubkey failed (exit ${pubkeyExit}): ${pubkeyStderr.trim()}`)
-  }
-
-  return {
-    privateKey,
-    publicKey: publicKeyRaw.trim(),
-  }
-}
-
-// ─── gh secret sync ───────────────────────────────────────────────────────────
-
-const GH_SYNC_REPO = 'marcusrbrown/infra'
-const GH_SYNC_ENV = 'vpn'
-const GH_SYNC_SECRET = 'VPN_PEERS'
-
-/**
- * The exact remediation command — mirrors the real spawn command exactly.
- * Includes --repo so the operator can run it from any directory.
- */
-const GH_SYNC_REMEDIATION = `gh secret set ${GH_SYNC_SECRET} --env ${GH_SYNC_ENV} --repo ${GH_SYNC_REPO} < apps/vpn/config/peers.json`
-
-function defaultSpawnFn(cmd: string[], opts: SyncSpawnOpts): SyncSpawnResult {
-  return Bun.spawn(cmd, opts)
-}
-
-/**
- * Sync the updated peer roster to the VPN_PEERS GitHub Environment secret.
- *
- * Pipes the JSON via stdin to `gh secret set VPN_PEERS --env vpn --repo marcusrbrown/infra`.
- * The roster bytes NEVER appear in argv — stdin only.
- *
- * On failure: prints a warning with the exact remediation command. Does NOT throw.
- * The local peers.json write has already succeeded; the secret being stale is recoverable.
- *
- * Hardening:
- * - Wraps the entire spawn + stdin write + exited await in try/catch.
- *   If spawnFn throws synchronously (e.g. ENOENT for missing gh), prints warning and returns.
- * - Races proc.exited against timeoutMs (default 15s). On timeout, kills the proc and warns.
- * - Drains stdout to avoid pipe-buffer deadlock.
- */
-async function syncPeersSecret(peersJson: string, spawnFn: SpawnFn, timeoutMs = 15_000): Promise<void> {
-  const cmd = ['gh', 'secret', 'set', GH_SYNC_SECRET, '--env', GH_SYNC_ENV, '--repo', GH_SYNC_REPO]
-
-  let proc: SyncSpawnResult
-  try {
-    proc = spawnFn(cmd, {stdout: 'pipe', stderr: 'pipe', stdin: 'pipe'})
-  } catch {
-    console.warn(
-      `[warn] VPN_PEERS secret sync failed: could not spawn gh. ` +
-        `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
-        `Remediation: ${GH_SYNC_REMEDIATION}`,
-    )
-    return
-  }
-
-  if (!proc.stdin) {
-    console.warn(
-      `[warn] VPN_PEERS secret sync skipped: spawn did not provide stdin pipe. ` +
-        `Remediation: ${GH_SYNC_REMEDIATION}`,
-    )
-    return
-  }
-
-  try {
-    proc.stdin.write(new TextEncoder().encode(peersJson))
-    proc.stdin.end()
-
-    // Race proc.exited against timeout to avoid hanging indefinitely.
-    // Drain stdout concurrently to avoid pipe-buffer deadlock.
-    let timedOut = false
-    const timeoutHandle = {kill: () => {}}
-
-    const timeoutPromise = new Promise<number>(resolveTimeout => {
-      const id = setTimeout(() => {
-        timedOut = true
-        resolveTimeout(-1)
-      }, timeoutMs)
-      timeoutHandle.kill = () => clearTimeout(id)
-    })
-
-    const [exitCode] = await Promise.all([
-      Promise.race([proc.exited, timeoutPromise]),
-      // Drain stdout to prevent pipe-buffer deadlock
-      new Response(proc.stdout).text().catch(() => ''),
-    ])
-
-    timeoutHandle.kill()
-
-    if (timedOut) {
-      console.warn(
-        `[warn] VPN_PEERS secret sync timed out after ${timeoutMs}ms. ` +
-          `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
-          `Remediation: ${GH_SYNC_REMEDIATION}`,
-      )
-      return
-    }
-
-    const stderr = await new Response(proc.stderr).text().catch(() => '')
-
-    if (exitCode !== 0) {
-      console.warn(
-        `[warn] VPN_PEERS secret sync failed (gh exited ${exitCode}${stderr.trim() ? `: ${stderr.trim()}` : ''}). ` +
-          `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
-          `Remediation: ${GH_SYNC_REMEDIATION}`,
-      )
-    }
-  } catch {
-    console.warn(
-      `[warn] VPN_PEERS secret sync failed unexpectedly. ` +
-        `The local peers.json was updated but the VPN_PEERS secret is stale. ` +
-        `Remediation: ${GH_SYNC_REMEDIATION}`,
-    )
-  }
-}
-
-// ─── Write-guard ──────────────────────────────────────────────────────────────
-
-/**
- * Validate that the resolved output path is under the expected clients directory.
- *
- * This is a runtime guard (not gitignore-only) that refuses to write client
- * .conf files (which contain private keys) outside the gitignored clients/ dir.
- *
- * @throws {Error} if the resolved path escapes the clients directory.
- */
-function assertPathUnderClientsDir(confPath: string, clientsDir: string): void {
-  const resolvedClientsDir = resolve(clientsDir)
-  const resolvedConfPath = resolve(confPath)
-
-  if (!resolvedConfPath.startsWith(`${resolvedClientsDir}/`) && resolvedConfPath !== resolvedClientsDir) {
-    throw new Error(
-      `Security: refusing to write client .conf outside the clients directory. ` +
-        `Resolved path "${resolvedConfPath}" is not under "${resolvedClientsDir}". ` +
-        `Client private keys must only be written to the gitignored clients/ directory.`,
-    )
-  }
-}
-
-// ─── Core operations ──────────────────────────────────────────────────────────
-
-/**
- * Add a new VPN client peer.
- *
- * 1. Generates a WireGuard keypair locally (via `wg genkey` / `wg pubkey`).
- * 2. Assigns the next available tunnel IP via addPeer.
- * 3. Appends the PUBLIC key + tunnel IP to peers.json.
- * 4. Writes the client .conf (with PRIVATE key) to clients/<name>.conf.
- * 5. Best-effort syncs the updated roster to the VPN_PEERS GitHub secret.
- *
- * Security invariants:
- * - The client PRIVATE key is written ONLY to the gitignored clients/ directory.
- * - peers.json contains ONLY the public key — never the private key.
- * - The output path is validated before writing (runtime guard, not gitignore-only).
- *
- * Ordering: local peers.json write → client .conf write → THEN best-effort sync.
- * The .conf holds the user's ONLY copy of the private key; it must be written
- * before the best-effort sync so a sync failure never loses the private key.
- */
-export async function vpnClientAdd(name: string, opts: VpnClientAddOpts): Promise<VpnClientAddResult> {
-  const {peersJsonPath, clientsDir, serverPublicKey, endpoint, allowedIps, dns} = opts
-  const keypairGen = opts.keypairGen ?? generateKeypair
-  const spawnFn = opts.spawnFn ?? defaultSpawnFn
-  const syncTimeoutMs = opts.syncTimeoutMs ?? 15_000
-
-  // Validate the output path before doing any work
-  const confPath = resolve(clientsDir, `${name}.conf`)
-  assertPathUnderClientsDir(confPath, clientsDir)
-
-  // Generate keypair
-  const keypair = await keypairGen()
-
-  // Read current peers — returns {peers: []} on fresh checkout (ENOENT)
-  const peersFile = await readPeersOrEmpty(peersJsonPath)
-
-  // Add peer (throws if duplicate name)
-  const {peers: updatedPeers, tunnelIp} = addPeer(peersFile.peers, {
-    name,
-    publicKey: keypair.publicKey,
-  })
-
-  // Write updated peers.json (PUBLIC key only — never private key)
-  const updatedPeersFile = {peers: updatedPeers}
-  await writePeers(peersJsonPath, updatedPeersFile)
-
-  // Render client .conf (contains PRIVATE key)
-  const confContent = renderClientConfig({
-    clientPrivateKey: keypair.privateKey,
-    serverPublicKey,
-    endpoint,
-    tunnelIp,
-    allowedIps,
-    dns,
-  })
-
-  // Ensure clients directory exists
-  await mkdir(clientsDir, {recursive: true})
-
-  // Write client .conf to the gitignored clients/ directory
-  // MUST happen BEFORE gh sync — this is the user's ONLY copy of the private key.
-  await writeFile(confPath, confContent, {mode: 0o600})
-
-  // Sync updated roster to VPN_PEERS GitHub secret (best-effort — failure is a warning, not fatal)
-  const peersJson = `${JSON.stringify(updatedPeersFile, null, 2)}\n`
-  await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs)
-
-  return {tunnelIp, confPath}
-}
-
-/**
- * List all VPN client peers from peers.json.
- * Returns an empty array when peers.json does not exist (fresh checkout).
- */
-export async function vpnClientList(peersJsonPath: string): Promise<Peer[]> {
-  const peersFile = await readPeersOrEmpty(peersJsonPath)
-  return peersFile.peers
-}
-
-export interface VpnClientRemoveOpts {
-  spawnFn?: SpawnFn
-  syncTimeoutMs?: number
-}
-
-/**
- * Remove a VPN client peer from peers.json.
- *
- * Note: The client .conf file in clients/ is NOT deleted — the operator
- * should delete it manually. The peer is removed from peers.json so the
- * next deploy will revoke access.
- *
- * After a successful local write, syncs the updated roster to the VPN_PEERS
- * GitHub Environment secret (best-effort — failure is a warning, not fatal).
- */
-export async function vpnClientRemove(
-  name: string,
-  peersJsonPath: string,
-  opts: VpnClientRemoveOpts = {},
-): Promise<void> {
-  const spawnFn = opts.spawnFn ?? defaultSpawnFn
-  const syncTimeoutMs = opts.syncTimeoutMs ?? 15_000
-
-  // Read current peers — returns {peers: []} on fresh checkout (ENOENT)
-  const peersFile = await readPeersOrEmpty(peersJsonPath)
-  const {peers: updatedPeers} = removePeer(peersFile.peers, name)
-  const updatedPeersFile = {peers: updatedPeers}
-  await writePeers(peersJsonPath, updatedPeersFile)
-
-  // Sync updated roster to VPN_PEERS GitHub secret (best-effort — failure is a warning, not fatal)
-  const peersJson = `${JSON.stringify(updatedPeersFile, null, 2)}\n`
-  await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs)
-}
-
-// ─── Default paths ────────────────────────────────────────────────────────────
-
-function resolveDefaultPeersJsonPath(): string {
-  // packages/cli/src/commands/vpn/ → repo root → apps/vpn/config/peers.json
-  return resolve(import.meta.dir, '..', '..', '..', '..', '..', 'apps', 'vpn', 'config', 'peers.json')
-}
-
-function resolveDefaultClientsDir(): string {
-  // packages/cli/src/commands/vpn/ → repo root → apps/vpn/clients/
-  return resolve(import.meta.dir, '..', '..', '..', '..', '..', 'apps', 'vpn', 'clients')
-}
-
-// ─── Command registration ─────────────────────────────────────────────────────
-
-export function registerVpnClient(cli: ReturnType<typeof goke>): void {
-  cli
-    .command(
-      'vpn client add <name>',
-      'Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).',
-    )
-    .option(
-      '--split-tunnel [cidrs]',
-      z.string().describe('Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).'),
-    )
-    .option('--dns [dns]', z.string().describe('DNS server for the client config.'))
-    .option('--server-pubkey [key]', z.string().describe('Server public key. Falls back to VPN_SERVER_PUBKEY env var.'))
-    .option(
-      '--endpoint [host]',
-      z.string().describe('VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.'),
-    )
-    .example('# Add a new client named "laptop"')
-    .example('infra vpn client add laptop')
-    .example('# Add a split-tunnel client')
-    .example('infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16')
-    .action(async (name, options) => {
-      const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY
-      const endpoint = options.endpoint ?? process.env.VPN_HOST
-
-      if (!serverPublicKey) {
-        console.error('Server public key is required. Pass --server-pubkey or set VPN_SERVER_PUBKEY.')
-        process.exitCode = 1
-        return
-      }
-
-      if (!endpoint) {
-        console.error('VPN endpoint is required. Pass --endpoint or set VPN_HOST.')
-        process.exitCode = 1
-        return
-      }
-
-      try {
-        const result = await vpnClientAdd(name as string, {
-          peersJsonPath: resolveDefaultPeersJsonPath(),
-          clientsDir: resolveDefaultClientsDir(),
-          serverPublicKey,
-          endpoint,
-          allowedIps: options.splitTunnel ?? undefined,
-          dns: options.dns ?? undefined,
-        })
-
-        console.log(`Client "${name as string}" added.`)
-        console.log(`  Tunnel IP: ${result.tunnelIp}`)
-        console.log(`  Config:    ${result.confPath}`)
-        console.log('')
-        console.log('Next step: run `infra vpn deploy` to apply the new peer to the VPN box.')
-      } catch (error) {
-        console.error(error instanceof Error ? error.message : String(error))
-        process.exitCode = 1
-      }
-    })
-
-  cli.command('vpn client list', 'List all VPN client peers from peers.json.').action(async () => {
-    try {
-      const peers = await vpnClientList(resolveDefaultPeersJsonPath())
-
-      if (peers.length === 0) {
-        console.log('No peers configured.')
-        return
-      }
-
-      console.log('Name             Tunnel IP       Public Key')
-      console.log('─────────────────────────────────────────────────────────')
-      for (const peer of peers) {
-        const name = peer.name.padEnd(16)
-        const ip = peer.tunnelIp.padEnd(15)
-        console.log(`${name} ${ip} ${peer.publicKey}`)
-      }
-    } catch (error) {
-      console.error(error instanceof Error ? error.message : String(error))
-      process.exitCode = 1
-    }
-  })
-
-  cli
-    .command(
-      'vpn client remove <name>',
-      'Remove a VPN client peer from peers.json and sync the roster to the VPN_PEERS GitHub secret (best-effort). Run `infra vpn deploy` to revoke access.',
-    )
-    .example('# Remove a client named "laptop"')
-    .example('infra vpn client remove laptop')
-    .action(async name => {
-      try {
-        await vpnClientRemove(name as string, resolveDefaultPeersJsonPath())
-        console.log(`Peer "${name as string}" removed from peers.json.`)
-        console.log('Next step: run `infra vpn deploy` to revoke access on the VPN box.')
-      } catch (error) {
-        console.error(error instanceof Error ? error.message : String(error))
-        process.exitCode = 1
-      }
-    })
-}

package/src/commands/vpn/deploy.test.ts

@@ -1,208 +0,0 @@
-import {resolve} from 'node:path'
-import {afterEach, beforeEach, describe, expect, it, spyOn} from 'bun:test'
-
-import {getVpnDeployEnv, validateVpnRemotePreconditions} from './deploy'
-
-const cliDir = resolve(import.meta.dir, '../../..')
-
-const envKeys = ['HOME', 'PATH', 'SSH_AUTH_SOCK', 'VPN_HOST'] as const
-
-type ManagedEnvKey = (typeof envKeys)[number]
-
-let originalEnv: Partial<Record<ManagedEnvKey, string | undefined>>
-
-function restoreManagedEnv(): void {
-  for (const key of envKeys) {
-    const value = originalEnv[key]
-    if (value === undefined) {
-      delete process.env[key]
-      continue
-    }
-    process.env[key] = value
-  }
-}
-
-function setManagedEnv(overrides: Partial<Record<ManagedEnvKey, string | undefined>>): void {
-  restoreManagedEnv()
-  for (const [key, value] of Object.entries(overrides)) {
-    if (value === undefined) {
-      delete process.env[key]
-      continue
-    }
-    process.env[key as ManagedEnvKey] = value
-  }
-}
-
-async function runDeployCommand(
-  args: string[],
-  envOverrides: Partial<Record<ManagedEnvKey, string | undefined>> = {},
-): Promise<{stdout: string; stderr: string; exitCode: number}> {
-  const env: Record<string, string> = {}
-
-  for (const [key, value] of Object.entries(process.env)) {
-    if (value !== undefined) {
-      env[key] = value
-    }
-  }
-
-  for (const [key, value] of Object.entries(envOverrides)) {
-    if (value === undefined) {
-      delete env[key]
-    } else {
-      env[key] = value
-    }
-  }
-
-  if (!Object.prototype.hasOwnProperty.call(envOverrides, 'HOME') && !env.HOME) {
-    env.HOME = '/tmp/test-home'
-  }
-
-  if (!Object.prototype.hasOwnProperty.call(envOverrides, 'PATH') && !env.PATH) {
-    env.PATH = '/usr/bin:/bin'
-  }
-
-  if (!Object.prototype.hasOwnProperty.call(envOverrides, 'SSH_AUTH_SOCK') && !env.SSH_AUTH_SOCK) {
-    env.SSH_AUTH_SOCK = '/tmp/test-sock'
-  }
-
-  env.NO_COLOR = '1'
-
-  const proc = Bun.spawn(['bun', 'src/cli.ts', 'vpn', 'deploy', ...args], {
-    cwd: cliDir,
-    env,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited,
-  ])
-
-  return {stdout, stderr, exitCode}
-}
-
-describe('vpn deploy', () => {
-  beforeEach(() => {
-    originalEnv = Object.fromEntries(envKeys.map(key => [key, process.env[key]]))
-  })
-
-  afterEach(() => {
-    restoreManagedEnv()
-  })
-
-  describe('getVpnDeployEnv', () => {
-    it('returns the expected deploy environment when required variables are present', () => {
-      setManagedEnv({
-        VPN_HOST: '1.2.3.4',
-        HOME: '/tmp/test-home',
-        PATH: '/usr/bin:/bin',
-        SSH_AUTH_SOCK: '/tmp/test-sock',
-      })
-
-      const env = getVpnDeployEnv()
-
-      expect(env.VPN_HOST).toBe('1.2.3.4')
-      expect(env.HOME).toBe('/tmp/test-home')
-      expect(env.PATH).toBe('/usr/bin:/bin')
-      expect(env.SSH_AUTH_SOCK).toBe('/tmp/test-sock')
-    })
-
-    it('throws when SSH_AUTH_SOCK is missing', () => {
-      setManagedEnv({
-        VPN_HOST: '1.2.3.4',
-        HOME: '/tmp/test-home',
-        PATH: '/usr/bin:/bin',
-        SSH_AUTH_SOCK: undefined,
-      })
-
-      expect(() => getVpnDeployEnv()).toThrow('SSH_AUTH_SOCK')
-    })
-
-    it('throws when PATH is missing', () => {
-      setManagedEnv({
-        VPN_HOST: '1.2.3.4',
-        HOME: '/tmp/test-home',
-        PATH: undefined,
-        SSH_AUTH_SOCK: '/tmp/test-sock',
-      })
-
-      expect(() => getVpnDeployEnv()).toThrow('PATH')
-    })
-  })
-
-  describe('validateVpnRemotePreconditions', () => {
-    it('throws when gh is not available', () => {
-      const spy = spyOn(Bun, 'which').mockReturnValue(null)
-
-      try {
-        expect(() => validateVpnRemotePreconditions()).toThrow('gh')
-      } finally {
-        spy.mockRestore()
-      }
-    })
-
-    it('does not throw when gh is available', () => {
-      const spy = spyOn(Bun, 'which').mockReturnValue('/usr/bin/gh')
-
-      try {
-        expect(() => validateVpnRemotePreconditions()).not.toThrow()
-      } finally {
-        spy.mockRestore()
-      }
-    })
-  })
-
-  describe('--remote (default) dry-run', () => {
-    it('prints planned actions without invoking gh', async () => {
-      const {stdout, exitCode} = await runDeployCommand(['--dry-run'], {
-        HOME: '/tmp/test-home',
-        PATH: process.env.PATH ?? '/usr/bin:/bin',
-        SSH_AUTH_SOCK: '/tmp/test-sock',
-      })
-
-      expect(exitCode).toBe(0)
-      expect(stdout).toContain('Dry run')
-      expect(stdout).toContain('Deploy VPN')
-    })
-  })
-
-  describe('--local --dry-run', () => {
-    it('prints planned local actions without spawning bun run', async () => {
-      const {stdout, exitCode} = await runDeployCommand(['--local', '--dry-run'], {
-        HOME: '/tmp/test-home',
-        PATH: process.env.PATH ?? '/usr/bin:/bin',
-        SSH_AUTH_SOCK: '/tmp/test-sock',
-      })
-
-      expect(exitCode).toBe(0)
-      expect(stdout).toContain('Dry run')
-      expect(stdout).toContain('local')
-    })
-
-    it('succeeds even when SSH_AUTH_SOCK is unset', async () => {
-      const {stdout, exitCode} = await runDeployCommand(['--local', '--dry-run'], {
-        HOME: '/tmp/test-home',
-        PATH: process.env.PATH ?? '/usr/bin:/bin',
-        SSH_AUTH_SOCK: undefined,
-      })
-
-      expect(exitCode).toBe(0)
-      expect(stdout).toContain('Dry run')
-    })
-  })
-
-  describe('--force-server-key --dry-run', () => {
-    it('includes --force-server-key in the planned command', async () => {
-      const {stdout, exitCode} = await runDeployCommand(['--local', '--force-server-key', '--dry-run'], {
-        HOME: '/tmp/test-home',
-        PATH: process.env.PATH ?? '/usr/bin:/bin',
-        SSH_AUTH_SOCK: '/tmp/test-sock',
-      })
-
-      expect(exitCode).toBe(0)
-      expect(stdout).toContain('--force-server-key')
-    })
-  })
-})