@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/lib/action-ctx.ts

@@ -1,25 +0,0 @@
-/**
- * Minimal `ctx` interface every MCP-capturable action accepts.
- *
- * Structural subtype of goke's real `GokeExecutionContext` — actions
- * consume only `console.{log,error}`, `process.{stdout,stderr}.write`,
- * and `process.exit`, never the `fs` surface. Source files import this
- * shape from this module so the action contract is defined in one place.
- *
- * The `write` parameter is `string` (narrower than goke's real
- * `string | Uint8Array`) because every action passes string values;
- * `CapturedCtx.write(string | Uint8Array)` is still assignable to
- * `ActionCtx.write(string)` via contravariance, so tests using
- * `CapturedCtx` satisfy this interface.
- */
-export interface ActionCtx {
-  console: {
-    log: (...args: unknown[]) => void
-    error: (...args: unknown[]) => void
-  }
-  process: {
-    stdout: {write: (chunk: string) => void}
-    stderr: {write: (chunk: string) => void}
-    exit: (code: number) => never | void
-  }
-}

package/src/lib/known-hosts.test.ts

@@ -1,192 +0,0 @@
-import {existsSync, mkdirSync, rmSync, writeFileSync} from 'node:fs'
-import {tmpdir} from 'node:os'
-import {join, resolve} from 'node:path'
-
-import {describe, expect, it} from 'bun:test'
-
-import {buildKnownHostsArgs, resolveKnownHostsPath, resolveRepoKnownHostsPath} from './known-hosts'
-
-// ─── resolveRepoKnownHostsPath ────────────────────────────────────────────────
-
-describe('resolveRepoKnownHostsPath', () => {
-  it('returns the path to .github/known_hosts when it exists at the repo root', () => {
-    // The actual repo has .github/known_hosts — this test runs from the repo root
-    const result = resolveRepoKnownHostsPath()
-
-    expect(result).not.toBeNull()
-    expect(result).toMatch(/\.github[/\\]known_hosts$/)
-    if (result) expect(existsSync(result)).toBe(true)
-  })
-
-  it('returns null when a custom base path has no .github/known_hosts', () => {
-    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
-    mkdirSync(tmpDir, {recursive: true})
-
-    try {
-      const result = resolveRepoKnownHostsPath(tmpDir)
-      expect(result).toBeNull()
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-
-  it('returns the path when a custom base path has .github/known_hosts', () => {
-    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
-    const githubDir = join(tmpDir, '.github')
-    mkdirSync(githubDir, {recursive: true})
-    writeFileSync(join(githubDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
-
-    try {
-      const result = resolveRepoKnownHostsPath(tmpDir)
-      expect(result).not.toBeNull()
-      expect(result).toBe(join(tmpDir, '.github', 'known_hosts'))
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-})
-
-// ─── resolveKnownHostsPath (new: multi-layout resolution) ────────────────────
-
-describe('resolveKnownHostsPath', () => {
-  it('returns the packaged resource path when only src/resources/known_hosts exists (installed package layout)', () => {
-    // Simulate: node_modules/@marcusrbrown/infra/src/lib/known-hosts.ts
-    // Only src/resources/known_hosts exists; no .github/known_hosts at any ancestor.
-    const tmpDir = join(tmpdir(), `known-hosts-installed-${Date.now()}`)
-    const libDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'lib')
-    const resourcesDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'resources')
-    mkdirSync(libDir, {recursive: true})
-    mkdirSync(resourcesDir, {recursive: true})
-    writeFileSync(join(resourcesDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
-
-    try {
-      // Pass the simulated import.meta.dir (the lib dir inside the package)
-      const result = resolveKnownHostsPath(libDir)
-      expect(result).not.toBeNull()
-      expect(result).toBe(join(resourcesDir, 'known_hosts'))
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-
-  it('prefers .github/known_hosts over packaged resource when both exist (repo checkout layout)', () => {
-    // Mirror the real layout: packages/cli/src/lib is 4 levels deep from repo root.
-    // tmpDir is the "repo root"; libDir is tmpDir/packages/cli/src/lib.
-    const tmpDir = join(tmpdir(), `known-hosts-both-${Date.now()}`)
-    const libDir = join(tmpDir, 'packages', 'cli', 'src', 'lib')
-    const githubDir = join(tmpDir, '.github')
-    const resourcesDir = join(tmpDir, 'packages', 'cli', 'src', 'resources')
-    mkdirSync(libDir, {recursive: true})
-    mkdirSync(githubDir, {recursive: true})
-    mkdirSync(resourcesDir, {recursive: true})
-    writeFileSync(join(githubDir, 'known_hosts'), 'repo.example.com ssh-ed25519 AAAA...\n')
-    writeFileSync(join(resourcesDir, 'known_hosts'), 'packaged.example.com ssh-ed25519 AAAA...\n')
-
-    try {
-      // lib is at tmpDir/packages/cli/src/lib — 4 levels up is tmpDir (the "repo root")
-      const result = resolveKnownHostsPath(libDir)
-      expect(result).not.toBeNull()
-      // Should prefer .github/known_hosts (repo checkout)
-      expect(result).toBe(join(githubDir, 'known_hosts'))
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-
-  it('throws a clear error when neither .github/known_hosts nor packaged resource exists', () => {
-    const tmpDir = join(tmpdir(), `known-hosts-none-${Date.now()}`)
-    const libDir = join(tmpDir, 'src', 'lib')
-    mkdirSync(libDir, {recursive: true})
-
-    try {
-      expect(() => resolveKnownHostsPath(libDir)).toThrow(
-        'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout',
-      )
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-})
-
-// ─── buildKnownHostsArgs ──────────────────────────────────────────────────────
-
-describe('buildKnownHostsArgs', () => {
-  it('returns UserKnownHostsFile args when .github/known_hosts exists at repo root', () => {
-    const args = buildKnownHostsArgs()
-
-    // The actual repo has .github/known_hosts
-    expect(args).toHaveLength(2)
-    expect(args[0]).toBe('-o')
-    expect(args[1]).toMatch(/^UserKnownHostsFile=/)
-    expect(args[1]).toMatch(/\.github[/\\]known_hosts$/)
-  })
-
-  it('throws when no known_hosts file exists (fail-closed behavior)', () => {
-    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
-    const libDir = join(tmpDir, 'src', 'lib')
-    mkdirSync(libDir, {recursive: true})
-
-    try {
-      expect(() => buildKnownHostsArgs(libDir)).toThrow(
-        'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout',
-      )
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-
-  it('returns UserKnownHostsFile args pointing to the packaged resource in installed layout', () => {
-    const tmpDir = join(tmpdir(), `known-hosts-installed-${Date.now()}`)
-    const libDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'lib')
-    const resourcesDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'resources')
-    mkdirSync(libDir, {recursive: true})
-    mkdirSync(resourcesDir, {recursive: true})
-    writeFileSync(join(resourcesDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
-
-    try {
-      const args = buildKnownHostsArgs(libDir)
-      expect(args).toHaveLength(2)
-      expect(args[0]).toBe('-o')
-      expect(args[1]).toBe(`UserKnownHostsFile=${join(resourcesDir, 'known_hosts')}`)
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-
-  it('returns UserKnownHostsFile args pointing to the custom base path (repo checkout)', () => {
-    // Mirror the real layout: packages/cli/src/lib is 4 levels deep from repo root.
-    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
-    const libDir = join(tmpDir, 'packages', 'cli', 'src', 'lib')
-    const githubDir = join(tmpDir, '.github')
-    mkdirSync(libDir, {recursive: true})
-    mkdirSync(githubDir, {recursive: true})
-    writeFileSync(join(githubDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
-
-    try {
-      const args = buildKnownHostsArgs(libDir)
-      expect(args).toHaveLength(2)
-      expect(args[0]).toBe('-o')
-      expect(args[1]).toBe(`UserKnownHostsFile=${join(githubDir, 'known_hosts')}`)
-    } finally {
-      rmSync(tmpDir, {recursive: true, force: true})
-    }
-  })
-})
-
-// ─── Drift guard: packaged resource matches .github/known_hosts ───────────────
-
-describe('packaged known_hosts resource drift guard', () => {
-  const REPO_ROOT = resolve(import.meta.dir, '..', '..', '..', '..')
-  const REPO_KNOWN_HOSTS = join(REPO_ROOT, '.github', 'known_hosts')
-  const PACKAGED_RESOURCE = resolve(import.meta.dir, '..', 'resources', 'known_hosts')
-
-  it('src/resources/known_hosts exists in the package source tree', () => {
-    expect(existsSync(PACKAGED_RESOURCE)).toBe(true)
-  })
-
-  it('src/resources/known_hosts matches .github/known_hosts (no drift)', async () => {
-    const repoContent = await Bun.file(REPO_KNOWN_HOSTS).text()
-    const packagedContent = await Bun.file(PACKAGED_RESOURCE).text()
-    expect(packagedContent).toBe(repoContent)
-  })
-})

package/src/lib/known-hosts.ts

@@ -1,76 +0,0 @@
-import {existsSync} from 'node:fs'
-import {join, resolve} from 'node:path'
-
-const FAIL_CLOSED_ERROR =
-  'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout'
-
-/**
- * Resolve the path to the repo-pinned `.github/known_hosts` file.
- *
- * SSH commands in this CLI use `StrictHostKeyChecking=yes` but the invoking
- * user's `~/.ssh/known_hosts` may not contain the pinned host keys for
- * `metrics.fro.bot`, `gateway.fro.bot`, etc. The repo ships authoritative
- * host keys in `.github/known_hosts`. When that file exists, SSH commands
- * should use it via `UserKnownHostsFile=<path>` so host verification succeeds
- * without weakening `StrictHostKeyChecking`.
- *
- * @param repoRoot - Optional override for the repo root directory. Defaults to
- *   the actual repo root resolved relative to this file's location. Pass a
- *   custom path in tests to avoid touching the real filesystem.
- * @returns Absolute path to `.github/known_hosts` if it exists, otherwise null.
- */
-export function resolveRepoKnownHostsPath(repoRoot?: string): string | null {
-  // This file lives at packages/cli/src/lib/known-hosts.ts
-  // Repo root is 4 levels up: lib → src → cli → packages → repo root
-  const base = repoRoot ?? resolve(import.meta.dir, '..', '..', '..', '..')
-  const candidate = join(base, '.github', 'known_hosts')
-  return existsSync(candidate) ? candidate : null
-}
-
-/**
- * Resolve the pinned known_hosts file from either layout:
- *
- * 1. Repo checkout: `.github/known_hosts` at the monorepo root (4 levels up
- *    from `src/lib/`).
- * 2. Installed package: `src/resources/known_hosts` bundled alongside the
- *    source (1 level up from `src/lib/`, then into `resources/`).
- *
- * Prefers the repo checkout layout when both exist. Throws a clear error if
- * neither is found — fail-closed, never silently falls back to user
- * `~/.ssh/known_hosts`.
- *
- * @param libDir - Override for the directory containing this file (for tests).
- *   Defaults to `import.meta.dir`.
- * @returns Absolute path to the pinned known_hosts file.
- * @throws Error if no pinned known_hosts file is found.
- */
-export function resolveKnownHostsPath(libDir?: string): string {
-  const dir = libDir ?? import.meta.dir
-
-  // Layout 1: repo checkout — walk up 4 levels from src/lib to repo root
-  const repoRoot = resolve(dir, '..', '..', '..', '..')
-  const repoCandidate = join(repoRoot, '.github', 'known_hosts')
-  if (existsSync(repoCandidate)) return repoCandidate
-
-  // Layout 2: installed package — src/resources/known_hosts is 1 level up from src/lib
-  const packagedCandidate = resolve(dir, '..', 'resources', 'known_hosts')
-  if (existsSync(packagedCandidate)) return packagedCandidate
-
-  throw new Error(FAIL_CLOSED_ERROR)
-}
-
-/**
- * Build the SSH `-o UserKnownHostsFile=<path>` argument pair for the
- * repo-pinned known_hosts file.
- *
- * Returns `['-o', 'UserKnownHostsFile=<path>']` when the file is found.
- * Throws a clear error if no pinned known_hosts file is available — fail-closed,
- * never silently omits `UserKnownHostsFile` for SSH commands that rely on
- * pinned verification.
- *
- * @param libDir - Override for the directory containing this file (for tests).
- */
-export function buildKnownHostsArgs(libDir?: string): string[] {
-  const path = resolveKnownHostsPath(libDir)
-  return ['-o', `UserKnownHostsFile=${path}`]
-}

package/src/lib/redact.ts

@@ -1,21 +0,0 @@
-/**
- * Redact every occurrence of a host value from text, case-insensitively.
- *
- * Used to scrub a resolved SSH host out of error output before it surfaces to an
- * MCP consumer. The host can be a misdirected secret (an agent may point the
- * `--key` env-var selector at, e.g., `AWS_SECRET_ACCESS_KEY`), so its value must
- * never appear in returned errors.
- *
- * Two subtleties this handles that a plain `replaceAll(host, ...)` does not:
- *   1. OpenSSH lowercases the hostname in "Could not resolve hostname <name>"
- *      stderr, so the match must be case-insensitive.
- *   2. Validated hosts contain `.` and `-`, which are regex-significant, so the
- *      host is escaped before building the matcher (no over-redaction).
- *
- * An empty/falsy host is a no-op (an empty matcher would match everywhere).
- */
-export function redactHost(text: string, host: string): string {
-  if (!host) return text
-  const escaped = host.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
-  return text.replaceAll(new RegExp(escaped, 'gi'), '<host>')
-}

package/src/lib/ssh-identity.test.ts

@@ -1,134 +0,0 @@
-import {readFileSync, statSync} from 'node:fs'
-import {describe, expect, it} from 'bun:test'
-
-import {buildIdentityArgs, materializeIdentityFile} from './ssh-identity'
-
-// ─── materializeIdentityFile ──────────────────────────────────────────────────
-
-describe('materializeIdentityFile', () => {
-  it('writes the key to a temp file and returns a path', () => {
-    const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {path, cleanup} = materializeIdentityFile(key)
-
-    try {
-      expect(path).toBeTruthy()
-      const stat = statSync(path)
-      expect(stat.isFile()).toBe(true)
-    } finally {
-      cleanup()
-    }
-  })
-
-  it('writes the file with mode 0600', () => {
-    const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {path, cleanup} = materializeIdentityFile(key)
-
-    try {
-      const stat = statSync(path)
-      const mode = stat.mode & 0o777
-      expect(mode).toBe(0o600)
-    } finally {
-      cleanup()
-    }
-  })
-
-  it('ensures the key file ends with a newline', () => {
-    const keyWithoutNewline = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----'
-    const {path, cleanup} = materializeIdentityFile(keyWithoutNewline)
-
-    try {
-      const text = readFileSync(path, 'utf8')
-      expect(text.endsWith('\n')).toBe(true)
-    } finally {
-      cleanup()
-    }
-  })
-
-  it('does not double-add a newline when key already ends with one', () => {
-    const keyWithNewline = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {path, cleanup} = materializeIdentityFile(keyWithNewline)
-
-    try {
-      const text = readFileSync(path, 'utf8')
-      expect(text.endsWith('\n\n')).toBe(false)
-      expect(text.endsWith('\n')).toBe(true)
-    } finally {
-      cleanup()
-    }
-  })
-
-  it('cleanup removes the temp file and directory', () => {
-    const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {path, cleanup} = materializeIdentityFile(key)
-    const dir = path.slice(0, path.lastIndexOf('/'))
-
-    cleanup()
-
-    // Both the key file and its containing temp dir must be gone.
-    expect(() => statSync(path)).toThrow()
-    expect(() => statSync(dir)).toThrow()
-  })
-
-  it('cleanup is idempotent (calling twice does not throw)', () => {
-    const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {cleanup} = materializeIdentityFile(key)
-
-    cleanup()
-    expect(() => cleanup()).not.toThrow()
-  })
-})
-
-// ─── buildIdentityArgs ────────────────────────────────────────────────────────
-
-describe('buildIdentityArgs', () => {
-  it('returns [-i, <path>, -o, IdentitiesOnly=yes] when a key is provided', () => {
-    const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {args, cleanup} = buildIdentityArgs(key)
-
-    try {
-      expect(args).toHaveLength(4)
-      expect(args[0]).toBe('-i')
-      expect(args[1]).toBeTruthy() // path to temp file
-      expect(args[2]).toBe('-o')
-      expect(args[3]).toBe('IdentitiesOnly=yes')
-    } finally {
-      cleanup()
-    }
-  })
-
-  it('returns empty args and a no-op cleanup when key is empty string', () => {
-    const {args, cleanup} = buildIdentityArgs('')
-
-    expect(args).toHaveLength(0)
-    expect(() => cleanup()).not.toThrow()
-  })
-
-  it('returns empty args and a no-op cleanup when key is whitespace-only', () => {
-    const {args, cleanup} = buildIdentityArgs('   \n  ')
-
-    expect(args).toHaveLength(0)
-    expect(() => cleanup()).not.toThrow()
-  })
-
-  it('returns empty args and a no-op cleanup when key is undefined', () => {
-    const {args, cleanup} = buildIdentityArgs(undefined)
-
-    expect(args).toHaveLength(0)
-    expect(() => cleanup()).not.toThrow()
-  })
-
-  it('the -i path points to a real 0600 file', () => {
-    const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-    const {args, cleanup} = buildIdentityArgs(key)
-
-    try {
-      const keyPath = args[1]
-      expect(keyPath).toBeTruthy()
-      const stat = statSync(keyPath as string)
-      const mode = stat.mode & 0o777
-      expect(mode).toBe(0o600)
-    } finally {
-      cleanup()
-    }
-  })
-})

package/src/lib/ssh-identity.ts

@@ -1,76 +0,0 @@
-import {chmodSync, mkdtempSync, rmSync, writeFileSync} from 'node:fs'
-import {tmpdir} from 'node:os'
-import {join} from 'node:path'
-
-/**
- * A materialized private-key file plus a best-effort cleanup callback.
- * The cleanup removes the temp directory containing the key file.
- */
-export interface MaterializedIdentity {
-  path: string
-  cleanup: () => void
-}
-
-// NOTE: This intentionally duplicates the key-materialization logic in
-// packages/shared/server/droplet-helpers.ts. The published CLI must not depend
-// on @marcusrbrown/infra-shared (that dep breaks npm install for external users).
-
-/**
- * Writes a private key to a 0600 temp file (with a guaranteed single trailing
- * newline) and returns its path plus an idempotent best-effort cleanup callback.
- *
- * The trailing newline guards against env/secret injection stripping it
- * (OpenSSH rejects keys without it). Empty/whitespace-key guards live in
- * `buildIdentityArgs`; this function materializes whatever key bytes it receives.
- */
-export function materializeIdentityFile(privateKey: string): MaterializedIdentity {
-  const dir = mkdtempSync(join(tmpdir(), 'infra-ssh-key-'))
-  const path = join(dir, 'id')
-
-  const cleanup = (): void => {
-    try {
-      rmSync(dir, {recursive: true, force: true})
-    } catch {
-      // Best-effort: a missing temp dir (already cleaned) is fine.
-    }
-  }
-
-  try {
-    const contents = privateKey.endsWith('\n') ? privateKey : `${privateKey}\n`
-    writeFileSync(path, contents, {mode: 0o600})
-    chmodSync(path, 0o600)
-  } catch (error) {
-    // Don't leave a partial 0600 key (or its temp dir) behind on write failure.
-    cleanup()
-    throw error
-  }
-
-  return {path, cleanup}
-}
-
-/**
- * Result of `buildIdentityArgs` — the SSH argv fragment plus a cleanup callback.
- * When the key is absent/empty, `args` is empty and `cleanup` is a no-op.
- */
-export interface IdentityArgs {
-  /** SSH argv fragment: `['-i', '<path>', '-o', 'IdentitiesOnly=yes']` or `[]`. */
-  args: string[]
-  /** Removes the temp key file. Idempotent and safe to call multiple times. */
-  cleanup: () => void
-}
-
-/**
- * Builds the `-i <keyfile> -o IdentitiesOnly=yes` SSH argv fragment from an
- * optional private key string.
- *
- * When `privateKey` is absent, empty, or whitespace-only, returns empty args
- * and a no-op cleanup so callers fall back to ssh-agent behaviour unchanged.
- */
-export function buildIdentityArgs(privateKey: string | undefined): IdentityArgs {
-  if (!privateKey?.trim()) {
-    return {args: [], cleanup: () => undefined}
-  }
-
-  const {path, cleanup} = materializeIdentityFile(privateKey)
-  return {args: ['-i', path, '-o', 'IdentitiesOnly=yes'], cleanup}
-}