@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/commands/cliproxy/setup/gh.ts

@@ -1,250 +0,0 @@
-/// <reference types="bun" />
-
-import type {SpinnerResult} from '@clack/prompts'
-
-import {confirm, log, spinner} from '@clack/prompts'
-
-import {managementHeaders, parseManagementKeyList, requestJson} from '../shared'
-import {cancelAndExit, promptValue} from './prompts'
-
-// ─── Types ────────────────────────────────────────────────────────────────────
-
-export interface CommandResult {
-  stdout: string
-  stderr: string
-  exitCode: number
-}
-
-// ─── Local helpers ────────────────────────────────────────────────────────────
-
-/** Local copy — avoids a circular import with setup.ts (gh → setup → gh). */
-function extractErrorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error)
-}
-
-// ─── Spawn helpers ────────────────────────────────────────────────────────────
-
-export async function withSpinner<T>(message: string, run: (spinnerInstance: SpinnerResult) => Promise<T>): Promise<T> {
-  const spinnerInstance = spinner()
-  spinnerInstance.start(message)
-
-  try {
-    const result = await run(spinnerInstance)
-    spinnerInstance.stop(message)
-    return result
-  } catch (error) {
-    spinnerInstance.error(`${message} failed`)
-    throw error
-  }
-}
-
-async function runCommand(command: string, args: string[]): Promise<CommandResult> {
-  const child = Bun.spawn([command, ...args], {
-    stdout: 'pipe',
-    stderr: 'pipe',
-    env: process.env,
-  })
-
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text(),
-    child.exited,
-  ])
-
-  return {stdout, stderr, exitCode}
-}
-
-export async function runGh(args: string[]): Promise<CommandResult> {
-  return runCommand('gh', args)
-}
-
-// ─── Rate-limit helpers ───────────────────────────────────────────────────────
-
-export function isGhRateLimitError(text: string): boolean {
-  return /rate limit/i.test(text)
-}
-
-/**
- * Query the GitHub API rate limit reset time. The `rate_limit` endpoint is
- * exempt from rate limiting itself, so this should succeed even when the
- * primary GraphQL limit is exhausted. Returns a formatted local time string
- * or a fallback phrase when the endpoint is unreachable.
- */
-async function queryRateLimitReset(): Promise<string> {
-  try {
-    const result = await runGh(['api', 'rate_limit'])
-    if (result.exitCode === 0) {
-      const parsed = JSON.parse(result.stdout) as {
-        resources?: {graphql?: {reset?: number}; core?: {reset?: number}}
-      }
-      const reset = parsed.resources?.graphql?.reset ?? parsed.resources?.core?.reset
-      if (reset) {
-        return new Date(reset * 1000).toLocaleTimeString([], {hour: '2-digit', minute: '2-digit'})
-      }
-    }
-  } catch {
-    // Fall through to generic phrase
-  }
-  return 'an unknown time'
-}
-
-/**
- * Run a GitHub API operation wrapped in a spinner, retrying indefinitely on
- * rate-limit errors when in interactive mode. In non-interactive mode the
- * error is re-thrown with the reset time appended so the caller can surface
- * it without prompting.
- */
-export async function withGhRetry<T>(
-  label: string,
-  fn: (spinnerInstance: SpinnerResult) => Promise<T>,
-  interactive: boolean,
-  queryReset: () => Promise<string> = queryRateLimitReset,
-): Promise<T> {
-  for (;;) {
-    try {
-      return await withSpinner(label, fn)
-    } catch (error) {
-      const message = extractErrorMessage(error)
-      if (!isGhRateLimitError(message)) {
-        throw error
-      }
-      const reset = await queryReset()
-      if (!interactive) {
-        throw new Error(`${message} — GitHub API rate limit resets at ${reset}. Re-run when ready.`)
-      }
-      log.warn(`GitHub API rate limit exceeded. Resets at ${reset}.`)
-      const retry = await promptValue(
-        confirm({
-          message: 'Retry this step when ready?',
-          active: 'retry',
-          inactive: 'abort',
-          initialValue: true,
-        }),
-        'Setup aborted after rate limit.',
-      )
-      if (!retry) {
-        cancelAndExit('Setup aborted after GitHub API rate limit.')
-      }
-    }
-  }
-}
-
-// ─── Preflight assertions ─────────────────────────────────────────────────────
-
-export async function assertGhInstalled(): Promise<void> {
-  if (!Bun.which('gh')) {
-    throw new Error('GitHub CLI is required for cliproxy setup. Install gh first: https://cli.github.com/')
-  }
-}
-
-export async function assertGhAuthenticated(): Promise<void> {
-  const result = await runGh(['auth', 'status'])
-  if (result.exitCode !== 0) {
-    throw new Error(`GitHub CLI is not authenticated. Run "gh auth login" first. ${result.stderr.trim()}`.trim())
-  }
-}
-
-export async function assertRepoAccess(repo: string): Promise<void> {
-  const {z} = await import('zod')
-  const ghRepoViewSchema = z.object({
-    nameWithOwner: z.string(),
-    viewerPermission: z.string(),
-  })
-
-  const result = await runGh(['repo', 'view', repo, '--json', 'nameWithOwner,viewerPermission'])
-  if (result.exitCode !== 0) {
-    throw new Error(`Unable to access ${repo}. ${result.stderr.trim()}`.trim())
-  }
-
-  const parsed = ghRepoViewSchema.parse(JSON.parse(result.stdout))
-  const writePermissions = new Set(['ADMIN', 'MAINTAIN', 'WRITE'])
-
-  if (!writePermissions.has(parsed.viewerPermission)) {
-    throw new Error(
-      `GitHub CLI does not have write access to ${parsed.nameWithOwner}. Current permission: ${parsed.viewerPermission}.`,
-    )
-  }
-}
-
-export async function listExistingGhNames(repo: string, kind: 'secret' | 'variable'): Promise<string[]> {
-  const {z} = await import('zod')
-  const ghNameListSchema = z.array(z.object({name: z.string()}))
-
-  const result = await runGh([kind, 'list', '--repo', repo, '--json', 'name'])
-  if (result.exitCode !== 0) {
-    throw new Error(`Unable to list existing GitHub ${kind}s for ${repo}. ${result.stderr.trim()}`.trim())
-  }
-
-  return ghNameListSchema.parse(JSON.parse(result.stdout)).map(entry => entry.name)
-}
-
-// ─── Management API key helpers ───────────────────────────────────────────────
-
-export async function createManagementApiKey(baseUrl: string, managementKey: string, keyValue: string): Promise<void> {
-  const endpoint = `${baseUrl}/v0/management/api-keys`
-  const currentPayload = await requestJson(endpoint, {
-    method: 'GET',
-    headers: managementHeaders(managementKey),
-  })
-  const currentKeys = parseManagementKeyList(currentPayload)
-
-  if (currentKeys.includes(keyValue)) {
-    return
-  }
-
-  await requestJson(endpoint, {
-    method: 'PUT',
-    headers: managementHeaders(managementKey),
-    body: JSON.stringify([...currentKeys, keyValue]),
-  })
-}
-
-export async function deleteManagementApiKey(baseUrl: string, managementKey: string, keyValue: string): Promise<void> {
-  const endpoint = `${baseUrl}/v0/management/api-keys`
-  const currentPayload = await requestJson(endpoint, {
-    method: 'GET',
-    headers: managementHeaders(managementKey),
-  })
-  const currentKeys = parseManagementKeyList(currentPayload)
-  const filtered = currentKeys.filter(k => k !== keyValue)
-
-  if (filtered.length === currentKeys.length) {
-    return
-  }
-
-  await requestJson(endpoint, {
-    method: 'PUT',
-    headers: managementHeaders(managementKey),
-    body: JSON.stringify(filtered),
-  })
-}
-
-// ─── GitHub value application ─────────────────────────────────────────────────
-
-export async function applyGhValue(
-  kind: 'secret' | 'variable',
-  name: string,
-  repo: string,
-  value: string,
-): Promise<void> {
-  if (kind === 'secret') {
-    const child = Bun.spawn(['gh', 'secret', 'set', name, '--repo', repo], {
-      stdin: new Blob([value]).stream(),
-      stdout: 'pipe',
-      stderr: 'pipe',
-      env: process.env,
-    })
-
-    const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited])
-
-    if (exitCode !== 0) {
-      throw new Error(`gh secret set ${name} failed: ${stderr.trim()}`.trim())
-    }
-    return
-  }
-
-  const result = await runGh([kind, 'set', name, '--repo', repo, '--body', value])
-  if (result.exitCode !== 0) {
-    throw new Error(`gh ${kind} set ${name} failed: ${result.stderr.trim()}`.trim())
-  }
-}

package/src/commands/cliproxy/setup/preview.test.ts

@@ -1,159 +0,0 @@
-/// <reference types="bun" />
-
-import {describe, expect, it} from 'bun:test'
-
-import {formatDryRunPreview} from './preview'
-import {getHarnessTemplate} from './templates'
-
-const KEY = 'sk-placeholder'
-const BASE_URL = 'https://cliproxy.fro.bot'
-
-describe('formatDryRunPreview', () => {
-  it('renders the dry-run header with repo and providers', () => {
-    const template = getHarnessTemplate('opencode', {keyValue: KEY, baseUrl: BASE_URL})
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('Dry run: cliproxy setup --harness opencode')
-    expect(preview).toContain('Repository: owner/repo')
-    expect(preview).toContain('Providers: anthropic')
-  })
-
-  it('renders planned secrets with byte sizes', () => {
-    const template = getHarnessTemplate('opencode', {keyValue: KEY, baseUrl: BASE_URL})
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('Planned secrets:')
-    expect(preview).toContain('OPENCODE_AUTH_JSON')
-    expect(preview).toContain('OPENCODE_CONFIG')
-    expect(preview).not.toContain('OMO_PROVIDERS')
-  })
-
-  it('renders planned variables', () => {
-    const template = getHarnessTemplate('opencode', {keyValue: KEY, baseUrl: BASE_URL})
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('Planned variables:')
-    expect(preview).toContain('FRO_BOT_MODEL')
-  })
-
-  it('renders proxy key as <proxy-key> placeholder, NOT the actual key value', () => {
-    const template = getHarnessTemplate('opencode', {keyValue: KEY, baseUrl: BASE_URL})
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('<proxy-key>')
-    expect(preview).not.toContain(KEY)
-  })
-
-  it('renders "No mutations will be performed." footer', () => {
-    const template = getHarnessTemplate('opencode', {keyValue: KEY, baseUrl: BASE_URL})
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('No mutations will be performed.')
-  })
-
-  it('dual-provider preview lists both providers', () => {
-    const template = getHarnessTemplate('opencode', {
-      keyValue: KEY,
-      baseUrl: BASE_URL,
-      providers: ['anthropic', 'openai'],
-      model: 'openai/gpt-5.4-mini',
-    })
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic', 'openai'],
-      model: 'openai/gpt-5.4-mini',
-      template,
-    })
-
-    expect(preview).toContain('anthropic')
-    expect(preview).toContain('openai')
-    expect(preview).not.toContain(KEY)
-  })
-
-  it('secret values in preview do NOT contain the actual key value', () => {
-    // Even if the template has the key embedded in JSON, the preview must redact it
-    const template = getHarnessTemplate('opencode', {keyValue: KEY, baseUrl: BASE_URL})
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    // The actual key must not appear anywhere in the preview output
-    expect(preview).not.toContain(KEY)
-  })
-
-  // ── byte-count contract tests ────────────────────
-
-  it('anthropic-only: OPENCODE_AUTH_JSON is 51 bytes with sk-placeholder key', () => {
-    const template = getHarnessTemplate('opencode', {
-      keyValue: KEY,
-      baseUrl: BASE_URL,
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-    })
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('Providers: anthropic')
-    expect(preview).toContain('OPENCODE_AUTH_JSON (51 bytes)')
-    expect(preview).toContain('<proxy-key>')
-  })
-
-  it('dual-provider: OPENCODE_AUTH_JSON is 98 bytes with sk-placeholder key', () => {
-    const template = getHarnessTemplate('opencode', {
-      keyValue: KEY,
-      baseUrl: BASE_URL,
-      providers: ['anthropic', 'openai'],
-      model: 'anthropic/claude-sonnet-4-6',
-    })
-    const preview = formatDryRunPreview({
-      repo: 'owner/repo',
-      harness: 'opencode',
-      providers: ['anthropic', 'openai'],
-      model: 'anthropic/claude-sonnet-4-6',
-      template,
-    })
-
-    expect(preview).toContain('Providers: anthropic, openai')
-    expect(preview).toContain('OPENCODE_AUTH_JSON (98 bytes)')
-  })
-})

package/src/commands/cliproxy/setup/preview.ts

@@ -1,41 +0,0 @@
-import type {ProviderId} from './providers'
-import type {Harness, HarnessTemplate} from './templates'
-
-export interface DryRunPreviewOptions {
-  repo: string
-  harness: Harness
-  providers: ProviderId[]
-  model: string
-  template: HarnessTemplate
-}
-
-/**
- * Format a dry-run preview string. The proxy key value is NEVER included —
- * it is rendered as `<proxy-key>` in all positions.
- */
-export function formatDryRunPreview(opts: DryRunPreviewOptions): string {
-  const {repo, harness, providers, model, template} = opts
-
-  const lines: string[] = [
-    `Dry run: cliproxy setup --harness ${harness}`,
-    `Repository: ${repo}`,
-    `Providers: ${providers.join(', ')}`,
-    `Model: ${model}`,
-    'Planned secrets:',
-  ]
-
-  for (const secret of template.secrets) {
-    const size = new TextEncoder().encode(secret.value).byteLength
-    lines.push(`  - ${secret.name} (${size} bytes)`)
-  }
-
-  lines.push('Planned variables:')
-  for (const variable of template.variables) {
-    lines.push(`  - ${variable.name} = ${variable.value}`)
-  }
-
-  lines.push('Proxy key (redacted): <proxy-key>')
-  lines.push('No mutations will be performed.')
-
-  return lines.join('\n')
-}

package/src/commands/cliproxy/setup/prompts.test.ts

@@ -1,58 +0,0 @@
-/// <reference types="bun" />
-
-import {describe, expect, it} from 'bun:test'
-
-import {buildApiKeyValue, ensureRepoFormat, ensureSecretName} from './prompts'
-
-describe('ensureRepoFormat', () => {
-  it('happy path: returns owner/repo unchanged', () => {
-    expect(ensureRepoFormat('owner/repo')).toBe('owner/repo')
-  })
-
-  it('error path: throws on whitespace in value', () => {
-    expect(() => ensureRepoFormat('owner repo')).toThrow()
-  })
-
-  it('error path: throws on extra slash', () => {
-    expect(() => ensureRepoFormat('owner/repo/extra')).toThrow()
-  })
-
-  it('error path: throws on empty string', () => {
-    expect(() => ensureRepoFormat('')).toThrow()
-  })
-})
-
-describe('ensureSecretName', () => {
-  it('happy path: returns VALID_NAME unchanged', () => {
-    expect(ensureSecretName('VALID_NAME', 'secret')).toBe('VALID_NAME')
-  })
-
-  it('error path: throws on lowercase name', () => {
-    expect(() => ensureSecretName('lower_case', 'secret')).toThrow()
-  })
-
-  it('error path: throws on name with hyphens', () => {
-    expect(() => ensureSecretName('with-dash', 'secret')).toThrow()
-  })
-
-  it('error path: throws when name starts with a digit', () => {
-    expect(() => ensureSecretName('123_START_DIGIT', 'secret')).toThrow()
-  })
-})
-
-describe('buildApiKeyValue', () => {
-  it('happy path: slugifies key name and appends uuid suffix', () => {
-    const result = buildApiKeyValue('my repo ci!')
-    expect(result).toMatch(/^sk-my-repo-ci-[a-f0-9]+$/)
-  })
-
-  it('edge case: empty string falls back to cliproxy slug', () => {
-    const result = buildApiKeyValue('')
-    expect(result).toMatch(/^sk-cliproxy-[a-f0-9]+$/)
-  })
-
-  it('edge case: uppercased input is lowercased in slug', () => {
-    const result = buildApiKeyValue('UPPERCASE')
-    expect(result).toMatch(/^sk-uppercase-[a-f0-9]+$/)
-  })
-})

package/src/commands/cliproxy/setup/prompts.ts

@@ -1,99 +0,0 @@
-/// <reference types="bun" />
-
-import * as clack from '@clack/prompts'
-
-export interface GenericSecretNames {
-  apiKeySecretName: string
-  baseUrlSecretName: string
-}
-
-export function ensureRepoFormat(value: string): string {
-  const trimmed = value.trim()
-  if (!/^[^/\s]+\/[^/\s]+$/.test(trimmed)) {
-    throw new Error('Repository must be in owner/repo format.')
-  }
-  return trimmed
-}
-
-export function ensureSecretName(value: string, label: string): string {
-  const trimmed = value.trim()
-  if (!/^[A-Z][A-Z0-9_]*$/.test(trimmed)) {
-    throw new Error(`${label} must be SCREAMING_SNAKE_CASE.`)
-  }
-  return trimmed
-}
-
-export function cancelAndExit(message = 'Setup cancelled.'): never {
-  clack.cancel(message)
-  process.exit(0)
-}
-
-export async function promptValue<T extends string | boolean>(
-  promise: Promise<T | symbol>,
-  cancelMessage?: string,
-): Promise<T> {
-  const value = await promise
-  if (clack.isCancel(value)) {
-    cancelAndExit(cancelMessage)
-  }
-  return value
-}
-
-export function buildApiKeyValue(keyName: string): string {
-  const slug = (
-    keyName
-      .trim()
-      .toLowerCase()
-      .match(/[a-z0-9]+/g) ?? []
-  )
-    .join('-')
-    .slice(0, 24)
-  const random = crypto.randomUUID().split('-').join('')
-  return `sk-${slug || 'cliproxy'}-${random}`
-}
-
-function extractErrorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error)
-}
-
-export async function promptGenericSecretNames(): Promise<GenericSecretNames> {
-  const apiKeySecretName = ensureSecretName(
-    await promptValue(
-      clack.text({
-        message: 'Name for the API key secret',
-        placeholder: 'CLIPROXY_API_KEY',
-        validate: value => {
-          try {
-            ensureSecretName(value ?? '', 'API key secret name')
-            return undefined
-          } catch (error) {
-            return extractErrorMessage(error)
-          }
-        },
-      }),
-      'Setup cancelled before choosing the generic API key secret name.',
-    ),
-    'API key secret name',
-  )
-
-  const baseUrlSecretName = ensureSecretName(
-    await promptValue(
-      clack.text({
-        message: 'Name for the proxy base URL secret',
-        placeholder: 'CLIPROXY_BASE_URL',
-        validate: value => {
-          try {
-            ensureSecretName(value ?? '', 'Base URL secret name')
-            return undefined
-          } catch (error) {
-            return extractErrorMessage(error)
-          }
-        },
-      }),
-      'Setup cancelled before choosing the generic base URL secret name.',
-    ),
-    'Base URL secret name',
-  )
-
-  return {apiKeySecretName, baseUrlSecretName}
-}