@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/commands/cliproxy/models.ts

@@ -1,237 +0,0 @@
-import type {goke} from 'goke'
-import type {ActionCtx} from '../../lib/action-ctx'
-
-import {z} from 'zod'
-
-import {requestJson} from './shared'
-
-declare const process: {
-  env: Record<string, string | undefined>
-}
-
-const DEFAULT_CLIPROXY_URL = 'https://cliproxy.fro.bot'
-
-function stripTrailingSlash(value: string): string {
-  return value.endsWith('/') ? value.slice(0, -1) : value
-}
-
-// Permissive schema: unknown fields preserved via passthrough().
-// owned_by is optional — CLIProxyAPI v7 may omit it; provider is inferred from id instead.
-const modelEntrySchema = z
-  .object({
-    id: z.string(),
-    owned_by: z.string().optional(),
-    created: z.number().optional(),
-  })
-  .passthrough()
-
-const modelsResponseSchema = z
-  .object({
-    data: z.array(modelEntrySchema),
-  })
-  .passthrough()
-
-type ModelEntry = z.infer<typeof modelEntrySchema>
-
-// Known bare-id patterns per provider, used only when owned_by is absent
-// (e.g. CLIProxyAPI v7 omits owned_by from /v1/models entries).
-const PROVIDER_ID_PATTERNS: Record<string, RegExp> = {
-  openai: /^(?:gpt-|o1-|o3-|codex)/i,
-  anthropic: /^claude-/i,
-}
-
-const VALID_PROVIDERS = ['anthropic', 'openai'] as const
-type ValidProvider = (typeof VALID_PROVIDERS)[number]
-
-function isValidProvider(value: string): value is ValidProvider {
-  return (VALID_PROVIDERS as readonly string[]).includes(value)
-}
-
-/**
- * Derives the provider string for a model entry.
- * Prefers owned_by when present and non-empty; falls back to PROVIDER_ID_PATTERNS
- * matching against the bare id; falls back to 'unknown'.
- * Display/validation-only — never an auth or trust signal.
- */
-function deriveProvider(entry: ModelEntry): string {
-  if (entry.owned_by !== undefined && entry.owned_by.trim() !== '') {
-    return entry.owned_by
-  }
-  // Strip any existing provider/ prefix before pattern matching
-  const bareId = stripProviderPrefix(entry.id)
-  for (const [provider, pattern] of Object.entries(PROVIDER_ID_PATTERNS)) {
-    if (pattern.test(bareId)) return provider
-  }
-  return 'unknown'
-}
-
-/**
- * Strips an existing `provider/` prefix from a raw id, if present.
- * Defensive: handles entries that already have a prefix so we don't double-prefix.
- */
-function stripProviderPrefix(id: string): string {
-  const slashIdx = id.indexOf('/')
-  if (slashIdx === -1) return id
-  // Only strip if the prefix looks like a known provider or 'unknown'
-  const prefix = id.slice(0, slashIdx)
-  if (prefix === 'unknown' || isValidProvider(prefix)) {
-    return id.slice(slashIdx + 1)
-  }
-  return id
-}
-
-/**
- * Decides whether a /v1/models entry belongs to a provider.
- * Prefers owned_by when present; falls back to id prefix / known bare-id
- * patterns when absent. Display/validation-only — never an auth or trust signal.
- */
-function entryMatchesProvider(entry: ModelEntry, provider: string): boolean {
-  return deriveProvider(entry) === provider
-}
-
-/**
- * Sort entries: grouped by provider (ascending), within each group by created asc.
- * Entries with missing/non-number created sort last within their group.
- */
-function sortEntries(entries: ModelEntry[]): ModelEntry[] {
-  // Annotate with derived provider for stable grouping
-  const annotated = entries.map(e => ({entry: e, provider: deriveProvider(e)}))
-
-  // Sort: provider asc, then created asc (missing created → Infinity → sorts last)
-  annotated.sort((a, b) => {
-    const providerCmp = a.provider.localeCompare(b.provider)
-    if (providerCmp !== 0) return providerCmp
-    const aCreated = typeof a.entry.created === 'number' ? a.entry.created : Infinity
-    const bCreated = typeof b.entry.created === 'number' ? b.entry.created : Infinity
-    return aCreated - bCreated
-  })
-
-  return annotated.map(a => a.entry)
-}
-
-/**
- * Formats a model entry for plain output: `provider/raw_id`.
- */
-function formatPlainLine(entry: ModelEntry): string {
-  const provider = deriveProvider(entry)
-  const rawId = stripProviderPrefix(entry.id)
-  return `${provider}/${rawId}`
-}
-
-interface VerboseEntry {
-  id: string
-  provider: string
-  raw_id: string
-  created: string | null
-}
-
-/**
- * Formats a model entry for verbose JSON output.
- */
-function formatVerboseEntry(entry: ModelEntry): VerboseEntry {
-  const provider = deriveProvider(entry)
-  const rawId = stripProviderPrefix(entry.id)
-  return {
-    id: `${provider}/${rawId}`,
-    provider,
-    raw_id: rawId,
-    created: typeof entry.created === 'number' ? new Date(entry.created * 1000).toISOString() : null,
-  }
-}
-
-export interface ModelsOptions {
-  url?: string
-  key?: string
-  verbose?: boolean
-  provider?: string
-}
-
-export async function cliproxyModelsAction(options: ModelsOptions, ctx: ActionCtx): Promise<void> {
-  try {
-    const baseUrl = stripTrailingSlash(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
-
-    // Trusted URL: the canonical configured/default host, trailing-slash-normalized.
-    // Ambient env keys must ONLY follow to this trusted destination to prevent
-    // secret exfiltration when an agent passes an attacker-controlled --url.
-    const trustedUrl = stripTrailingSlash(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
-    const urlIsExplicitlyOverridden = options.url !== undefined && baseUrl !== trustedUrl
-
-    // An explicit --key is always honored (operator knows what they're doing).
-    // An ambient env key is only forwarded when the resolved baseUrl is trusted.
-    const key = options.key ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_API_KEY)
-
-    if (!key) {
-      throw new Error('No API key. Provide --key or set CLIPROXY_API_KEY.')
-    }
-
-    // Validate provider before any HTTP call
-    if (options.provider !== undefined && !isValidProvider(options.provider)) {
-      throw new Error(`Unknown provider "${options.provider}". Use anthropic or openai.`)
-    }
-
-    const endpoint = `${baseUrl}/v1/models`
-    const raw = await requestJson(endpoint, {
-      headers: {Authorization: `Bearer ${key}`},
-    })
-
-    const parseResult = modelsResponseSchema.safeParse(raw)
-    if (!parseResult.success) {
-      const message = parseResult.error.issues.map(issue => `${issue.path.join('.')}: ${issue.message}`).join('; ')
-      throw new Error(`Malformed /v1/models response: ${message}`)
-    }
-
-    let entries = parseResult.data.data
-
-    if (options.provider !== undefined) {
-      entries = entries.filter(e => entryMatchesProvider(e, options.provider as string))
-    }
-
-    // Sort: provider-grouped (asc), date-asc within each group
-    entries = sortEntries(entries)
-
-    if (options.verbose) {
-      // --verbose: emit a single JSON array (pretty-printed) of the fields we have.
-      // Always valid JSON — empty/zero-match → [].
-      const verboseEntries = entries.map(formatVerboseEntry)
-      ctx.console.log(JSON.stringify(verboseEntries, null, 2))
-      return
-    }
-
-    if (entries.length === 0) {
-      ctx.console.log(
-        options.provider === undefined ? 'No models.' : `No models found for provider ${options.provider}.`,
-      )
-      return
-    }
-
-    for (const entry of entries) {
-      ctx.console.log(formatPlainLine(entry))
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
-    ctx.console.error(message)
-    ctx.process.exit(1)
-  }
-}
-
-export function registerCliproxyModels(cli: ReturnType<typeof goke>): void {
-  cli
-    .command('cliproxy models [provider]', 'List the models CLIProxyAPI serves.')
-    .option(
-      '--url [url]',
-      z.string().describe('Base URL for CLIProxyAPI. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.'),
-    )
-    .option('--key [key]', z.string().describe('API key (bearer). Falls back to CLIPROXY_API_KEY when omitted.'))
-    .option('--verbose', 'Show owned_by and created date for each model.')
-    .example('# List all models served by CLIProxyAPI')
-    .example('infra cliproxy models')
-    .example('# Filter to Anthropic models only')
-    .example('infra cliproxy models anthropic')
-    .example('# Show verbose output with owned_by and created date')
-    .example('infra cliproxy models --verbose')
-    .example('# Filter to OpenAI models with verbose output')
-    .example('infra cliproxy models openai --verbose')
-    .action((provider, options, ctx) =>
-      cliproxyModelsAction({...options, provider: provider as string | undefined}, ctx),
-    )
-}

package/src/commands/cliproxy/open.test.ts

@@ -1,132 +0,0 @@
-import {resolve} from 'node:path'
-import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
-
-const cliDir = resolve(import.meta.dir, '../../..')
-
-const envKeys = ['CLIPROXY_DOMAIN', 'HOME', 'PATH'] as const
-
-type ManagedEnvKey = (typeof envKeys)[number]
-
-let originalEnv: Partial<Record<ManagedEnvKey, string | undefined>>
-
-function restoreManagedEnv(): void {
-  for (const key of envKeys) {
-    const value = originalEnv[key]
-
-    if (value === undefined) {
-      delete process.env[key]
-      continue
-    }
-
-    process.env[key] = value
-  }
-}
-
-async function runOpenCommand(
-  args: string[],
-  envOverrides: Partial<Record<ManagedEnvKey, string | undefined>> = {},
-): Promise<{stdout: string; stderr: string; exitCode: number}> {
-  const env = {...process.env}
-
-  for (const [key, value] of Object.entries(envOverrides)) {
-    if (value === undefined) {
-      delete env[key]
-      continue
-    }
-
-    env[key] = value
-  }
-
-  const proc = Bun.spawn(['bun', 'src/cli.ts', 'cliproxy', 'open', ...args], {
-    cwd: cliDir,
-    env: {
-      ...env,
-      HOME: env.HOME ?? '/tmp/test-home',
-      NO_COLOR: '1',
-      PATH: env.PATH ?? '/usr/bin:/bin',
-    },
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited,
-  ])
-
-  return {stdout, stderr, exitCode}
-}
-
-describe('cliproxy open', () => {
-  beforeEach(() => {
-    originalEnv = Object.fromEntries(envKeys.map(key => [key, process.env[key]]))
-  })
-
-  afterEach(() => {
-    restoreManagedEnv()
-  })
-
-  describe('validation', () => {
-    it('requires interactive terminal', async () => {
-      const {stderr, exitCode} = await runOpenCommand([])
-      expect(exitCode).not.toBe(0)
-      expect(stderr).toContain('interactive terminal')
-    })
-  })
-
-  describe('host resolution', () => {
-    it('uses --host flag', async () => {
-      const {stderr, exitCode} = await runOpenCommand(['--host', 'custom.host.example'])
-      expect(exitCode).not.toBe(0)
-      expect(stderr).toContain('interactive terminal')
-    })
-
-    it('uses CLIPROXY_DOMAIN env var', async () => {
-      const {stderr, exitCode} = await runOpenCommand([], {
-        CLIPROXY_DOMAIN: 'custom.host.example',
-      })
-      expect(exitCode).not.toBe(0)
-      expect(stderr).toContain('interactive terminal')
-    })
-  })
-
-  describe('host validation', () => {
-    it('rejects CLIPROXY_DOMAIN env with a leading dash (ProxyCommand injection vector)', async () => {
-      const {stderr, exitCode} = await runOpenCommand([], {CLIPROXY_DOMAIN: '-oProxyCommand=evil'})
-      expect(exitCode).not.toBe(0)
-      expect(stderr).toContain('Invalid CLIPROXY_DOMAIN')
-    })
-
-    it('rejects CLIPROXY_DOMAIN env with shell metacharacters (semicolon)', async () => {
-      const {stderr, exitCode} = await runOpenCommand([], {CLIPROXY_DOMAIN: 'gateway.example.com;rm -rf'})
-      expect(exitCode).not.toBe(0)
-      expect(stderr).toContain('Invalid CLIPROXY_DOMAIN')
-    })
-
-    it('rejects CLIPROXY_DOMAIN env with an at-sign', async () => {
-      const {stderr, exitCode} = await runOpenCommand([], {CLIPROXY_DOMAIN: 'user@cliproxy.fro.bot'})
-      expect(exitCode).not.toBe(0)
-      expect(stderr).toContain('Invalid CLIPROXY_DOMAIN')
-    })
-  })
-
-  describe('unit: resolveHost', () => {
-    it('returns input when provided', async () => {
-      const {resolveHost} = await import('./open')
-      expect(resolveHost('test.example.com')).toBe('test.example.com')
-    })
-
-    it('falls back to CLIPROXY_DOMAIN', async () => {
-      process.env.CLIPROXY_DOMAIN = 'env.example.com'
-      const {resolveHost} = await import('./open')
-      expect(resolveHost()).toBe('env.example.com')
-    })
-
-    it('falls back to default host', async () => {
-      delete process.env.CLIPROXY_DOMAIN
-      const {resolveHost} = await import('./open')
-      expect(resolveHost()).toBe('cliproxy.fro.bot')
-    })
-  })
-})

package/src/commands/cliproxy/open.ts

@@ -1,78 +0,0 @@
-import type {goke} from 'goke'
-
-import {z} from 'zod'
-
-import {validateCliproxyHost} from './host'
-
-const DEFAULT_HOST = 'cliproxy.fro.bot'
-const DEFAULT_REMOTE_USER = 'root'
-
-export function resolveHost(input?: string): string {
-  const host = input ?? process.env.CLIPROXY_DOMAIN ?? DEFAULT_HOST
-
-  if (!host) {
-    throw new Error('CLIPROXY_DOMAIN is required. Pass --host or set CLIPROXY_DOMAIN.')
-  }
-
-  return host
-}
-
-export function registerCliproxyOpen(cli: ReturnType<typeof goke>): void {
-  cli
-    .command('cliproxy open', 'Launch CLIProxyAPI TUI dashboard via SSH.')
-    .option(
-      '--host [host]',
-      z.string().describe('SSH host for CLIProxyAPI server. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.'),
-    )
-    .example('# Open the TUI dashboard on the remote CLIProxyAPI instance')
-    .example('infra cliproxy open')
-    .example('# Open on a custom host')
-    .example('infra cliproxy open --host custom.example.com')
-    .action(async options => {
-      const host = validateCliproxyHost(resolveHost(options.host))
-
-      if (!process.stdin.isTTY) {
-        throw new Error('cliproxy open requires an interactive terminal. Run from a shell with TTY attached.')
-      }
-
-      const path = process.env.PATH
-      const home = process.env.HOME
-
-      if (!path) {
-        throw new Error('PATH is required to invoke ssh')
-      }
-
-      if (!home) {
-        throw new Error('HOME is required to invoke ssh')
-      }
-
-      const remoteCommand = 'cd /opt/cliproxy && docker compose exec cli-proxy-api /CLIProxyAPI/CLIProxyAPI --tui'
-
-      const child = Bun.spawn(
-        [
-          'ssh',
-          '-tt',
-          '-o',
-          'BatchMode=yes',
-          '-o',
-          'ConnectTimeout=10',
-          `${DEFAULT_REMOTE_USER}@${host}`,
-          remoteCommand,
-        ],
-        {
-          env: {
-            PATH: path,
-            HOME: home,
-          },
-          stdin: 'inherit',
-          stdout: 'inherit',
-          stderr: 'inherit',
-        },
-      )
-
-      const exitCode = await child.exited
-      if (exitCode !== 0) {
-        throw new Error(`Remote TUI command failed with exit code ${exitCode}`)
-      }
-    })
-}

package/src/commands/cliproxy/setup/gh.test.ts

@@ -1,218 +0,0 @@
-/// <reference types="bun" />
-
-import {afterEach, describe, expect, it, mock, spyOn} from 'bun:test'
-
-import {isGhRateLimitError, withGhRetry} from './gh'
-
-// ─── isGhRateLimitError ──────────────────────────────────────────────────────
-
-describe('isGhRateLimitError', () => {
-  it('returns true when text contains "rate limit"', () => {
-    expect(isGhRateLimitError('API rate limit exceeded')).toBe(true)
-  })
-
-  it('is case-insensitive', () => {
-    expect(isGhRateLimitError('You have exceeded a secondary RATE LIMIT')).toBe(true)
-  })
-
-  it('returns false for unrelated error messages', () => {
-    expect(isGhRateLimitError('Not Found (HTTP 404)')).toBe(false)
-  })
-
-  it('returns false for an empty string', () => {
-    expect(isGhRateLimitError('')).toBe(false)
-  })
-
-  it('returns false for a connection timeout', () => {
-    expect(isGhRateLimitError('connection timeout')).toBe(false)
-  })
-})
-
-// ─── withGhRetry ─────────────────────────────────────────────────────────────
-
-describe('withGhRetry', () => {
-  it('returns the value when fn succeeds immediately', async () => {
-    const result = await withGhRetry('test label', async () => 'ok', false)
-
-    expect(result).toBe('ok')
-  })
-
-  it('re-throws non-rate-limit errors without querying the reset time', async () => {
-    const queryReset = async (): Promise<string> => {
-      throw new Error('queryReset should not have been called')
-    }
-    const err = new Error('some other error')
-
-    await expect(withGhRetry('test label', async () => Promise.reject(err), false, queryReset)).rejects.toThrow(
-      'some other error',
-    )
-  })
-
-  it('re-throws with reset time appended in non-interactive mode on rate limit', async () => {
-    const queryReset = async (): Promise<string> => '2:30 PM'
-
-    await expect(
-      withGhRetry(
-        'test label',
-        async () => {
-          throw new Error('API rate limit exceeded for url')
-        },
-        false,
-        queryReset,
-      ),
-    ).rejects.toThrow('resets at 2:30 PM')
-  })
-})
-
-// ─── applyGhValue stdin-pipe-not-body invariant (PR #102) ────────────────────
-
-describe('applyGhValue', () => {
-  afterEach(() => {
-    mock.restore()
-  })
-
-  it('pipes secret value via stdin — never uses --body flag', async () => {
-    const {applyGhValue} = await import('./gh')
-
-    let capturedArgs: string[] = []
-    let capturedStdin: ReadableStream<Uint8Array> | undefined
-
-    const spawnSpy = spyOn(Bun, 'spawn').mockImplementation(((cmds: string[], opts?: {stdin?: unknown}) => {
-      capturedArgs = cmds
-      capturedStdin = opts?.stdin as ReadableStream<Uint8Array> | undefined
-      // Return a minimal fake child process
-      return {
-        stdout: new Response('').body,
-        stderr: new Response('').body,
-        exited: Promise.resolve(0),
-        stdin: null,
-        pid: 0,
-        killed: false,
-        exitCode: 0,
-        signalCode: null,
-        kill: () => {},
-        ref: () => {},
-        unref: () => {},
-        readable: new Response('').body,
-      }
-    }) as unknown as typeof Bun.spawn)
-
-    await applyGhValue('secret', 'MY_SECRET', 'owner/repo', 'my-value')
-
-    expect(capturedArgs).toContain('gh')
-    expect(capturedArgs).toContain('secret')
-    expect(capturedArgs).toContain('set')
-    expect(capturedArgs).toContain('MY_SECRET')
-    expect(capturedArgs).toContain('--repo')
-    expect(capturedArgs).toContain('owner/repo')
-    // The critical invariant: --body must NOT be in the args
-    expect(capturedArgs).not.toContain('--body')
-    // stdin must be provided (value piped via stdin)
-    expect(capturedStdin).toBeDefined()
-
-    spawnSpy.mockRestore()
-  })
-})
-
-// ─── createManagementApiKey / deleteManagementApiKey toStringArray parity ─────
-
-describe('management API key helpers — response shape handling', () => {
-  afterEach(() => {
-    mock.restore()
-  })
-
-  it('createManagementApiKey handles top-level array response from GET', async () => {
-    const {createManagementApiKey} = await import('./gh')
-
-    const calls: {method: string; body?: string}[] = []
-    globalThis.fetch = mock(async (_url: string, init?: RequestInit) => {
-      const method = init?.method ?? 'GET'
-      calls.push({method, body: init?.body as string | undefined})
-      if (method === 'GET') {
-        // Top-level array response
-        return new Response(JSON.stringify(['existing-key']), {status: 200})
-      }
-      return new Response('{}', {status: 200})
-    }) as unknown as typeof fetch
-
-    await createManagementApiKey('https://cliproxy.fro.bot', 'mgmt-key', 'new-key')
-
-    const putCall = calls.find(c => c.method === 'PUT')
-    expect(putCall).toBeDefined()
-    const body = JSON.parse(putCall?.body ?? '[]') as string[]
-    expect(body).toContain('existing-key')
-    expect(body).toContain('new-key')
-  })
-
-  it('createManagementApiKey handles object-shaped {api-keys:[...]} response from GET', async () => {
-    const {createManagementApiKey} = await import('./gh')
-
-    const calls: {method: string; body?: string}[] = []
-    globalThis.fetch = mock(async (_url: string, init?: RequestInit) => {
-      const method = init?.method ?? 'GET'
-      calls.push({method, body: init?.body as string | undefined})
-      if (method === 'GET') {
-        // Object-shaped response — the form CLIProxyAPI actually returns
-        return new Response(JSON.stringify({'api-keys': ['existing-key']}), {status: 200})
-      }
-      return new Response('{}', {status: 200})
-    }) as unknown as typeof fetch
-
-    await createManagementApiKey('https://cliproxy.fro.bot', 'mgmt-key', 'new-key')
-
-    const putCall = calls.find(c => c.method === 'PUT')
-    expect(putCall).toBeDefined()
-    const body = JSON.parse(putCall?.body ?? '[]') as string[]
-    expect(body).toContain('existing-key')
-    expect(body).toContain('new-key')
-  })
-
-  it('createManagementApiKey THROWS without making a destructive PUT when GET returns unexpected payload shape', async () => {
-    const {createManagementApiKey} = await import('./gh')
-
-    // Mock fetch: GET returns 200 with payload `null` (valid JSON but unexpected shape).
-    // Pre-fix silent-failure path: requestJson would have returned null, toStringArray(null)
-    // would have collapsed to [], the PUT would have replaced the entire key list with
-    // just the new key — deleting all existing repo keys.
-    // Post-fix: parseManagementKeyList throws on null, the PUT is never made.
-    let putCallCount = 0
-    globalThis.fetch = mock(async (_url: string, init?: RequestInit) => {
-      const method = init?.method ?? 'GET'
-      if (method === 'PUT') putCallCount++
-      if (method === 'GET') {
-        return new Response(JSON.stringify(null), {
-          status: 200,
-          headers: {'content-type': 'application/json'},
-        })
-      }
-      return new Response('{}', {status: 200})
-    }) as unknown as typeof fetch
-
-    await expect(createManagementApiKey('https://cliproxy.fro.bot', 'mgmt-key', 'new-key')).rejects.toThrow(
-      /Unexpected management key-list shape/,
-    )
-    expect(putCallCount).toBe(0)
-  })
-
-  it('createManagementApiKey THROWS without PUT when GET returns malformed JSON', async () => {
-    const {createManagementApiKey} = await import('./gh')
-
-    let putCallCount = 0
-    globalThis.fetch = mock(async (_url: string, init?: RequestInit) => {
-      const method = init?.method ?? 'GET'
-      if (method === 'PUT') putCallCount++
-      if (method === 'GET') {
-        return new Response('not-json-content', {
-          status: 200,
-          headers: {'content-type': 'text/plain'},
-        })
-      }
-      return new Response('{}', {status: 200})
-    }) as unknown as typeof fetch
-
-    await expect(createManagementApiKey('https://cliproxy.fro.bot', 'mgmt-key', 'new-key')).rejects.toThrow(
-      /returned malformed JSON/,
-    )
-    expect(putCallCount).toBe(0)
-  })
-})