@marcusrbrown/infra 0.13.21 → 0.14.0

package/dist/cli.js

@@ -6949,7 +6949,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.13.21",
+  version: "0.14.0",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -7126,7 +7126,7 @@ import { z as z2 } from "zod";
 
 // src/lib/known-hosts.ts
 import { existsSync as existsSync3 } from "fs";
-import { join as join3, resolve } from "path";
+import { isAbsolute, join as join3, resolve } from "path";
 
 // src/resources/known_hosts
 var known_hosts_default = "./known_hosts-c3ns9jne.";
@@ -7139,8 +7139,9 @@ function resolveKnownHostsPath(libDir) {
   const repoCandidate = join3(repoRoot, ".github", "known_hosts");
   if (existsSync3(repoCandidate))
     return repoCandidate;
-  if (existsSync3(known_hosts_default))
-    return known_hosts_default;
+  const assetPath = isAbsolute(known_hosts_default) ? known_hosts_default : resolve(import.meta.dir, known_hosts_default);
+  if (existsSync3(assetPath))
+    return assetPath;
   throw new Error(FAIL_CLOSED_ERROR);
 }
 function buildKnownHostsArgs(libDir) {
@@ -7964,1675 +7965,2084 @@ function registerCliproxyModels(cli) {
   cli.command("cliproxy models [provider]", "List the models CLIProxyAPI serves.").option("--url [url]", z8.string().describe("Base URL for CLIProxyAPI. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z8.string().describe("API key (bearer). Falls back to CLIPROXY_API_KEY when omitted.")).option("--verbose", "Show owned_by and created date for each model.").example("# List all models served by CLIProxyAPI").example("infra cliproxy models").example("# Filter to Anthropic models only").example("infra cliproxy models anthropic").example("# Show verbose output with owned_by and created date").example("infra cliproxy models --verbose").example("# Filter to OpenAI models with verbose output").example("infra cliproxy models openai --verbose").action((provider, options, ctx) => cliproxyModelsAction({ ...options, provider }, ctx));
 }
 
-// src/commands/cliproxy/open.ts
+// src/commands/cliproxy/monitor.ts
+import { z as z10 } from "zod";
+
+// src/commands/cliproxy/status.ts
 import { z as z9 } from "zod";
-var DEFAULT_HOST2 = "cliproxy.fro.bot";
-var DEFAULT_REMOTE_USER2 = "root";
-function resolveHost2(input) {
-  const host = input ?? process.env.CLIPROXY_DOMAIN ?? DEFAULT_HOST2;
-  if (!host) {
-    throw new Error("CLIPROXY_DOMAIN is required. Pass --host or set CLIPROXY_DOMAIN.");
+var DEFAULT_CLIPROXY_URL4 = "https://cliproxy.fro.bot";
+function levelLabel(level) {
+  if (level === "ok") {
+    return "OK";
   }
-  return host;
-}
-function registerCliproxyOpen(cli) {
-  cli.command("cliproxy open", "Launch CLIProxyAPI TUI dashboard via SSH.").option("--host [host]", z9.string().describe("SSH host for CLIProxyAPI server. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.")).example("# Open the TUI dashboard on the remote CLIProxyAPI instance").example("infra cliproxy open").example("# Open on a custom host").example("infra cliproxy open --host custom.example.com").action(async (options) => {
-    const host = validateCliproxyHost(resolveHost2(options.host));
-    if (!process.stdin.isTTY) {
-      throw new Error("cliproxy open requires an interactive terminal. Run from a shell with TTY attached.");
-    }
-    const path = process.env.PATH;
-    const home = process.env.HOME;
-    if (!path) {
-      throw new Error("PATH is required to invoke ssh");
-    }
-    if (!home) {
-      throw new Error("HOME is required to invoke ssh");
-    }
-    const remoteCommand = "cd /opt/cliproxy && docker compose exec cli-proxy-api /CLIProxyAPI/CLIProxyAPI --tui";
-    const child = Bun.spawn([
-      "ssh",
-      "-tt",
-      "-o",
-      "BatchMode=yes",
-      "-o",
-      "ConnectTimeout=10",
-      `${DEFAULT_REMOTE_USER2}@${host}`,
-      remoteCommand
-    ], {
-      env: {
-        PATH: path,
-        HOME: home
-      },
-      stdin: "inherit",
-      stdout: "inherit",
-      stderr: "inherit"
-    });
-    const exitCode = await child.exited;
-    if (exitCode !== 0) {
-      throw new Error(`Remote TUI command failed with exit code ${exitCode}`);
-    }
-  });
-}
-
-// src/commands/cliproxy/setup.ts
-import { cancel as cancel2, confirm as confirm2, intro, log as log2, note, outro, select as select2, text as text3 } from "@clack/prompts";
-import { z as z14 } from "zod";
-
-// src/commands/cliproxy/setup/gh.ts
-import { confirm, log, spinner } from "@clack/prompts";
-
-// src/commands/cliproxy/setup/prompts.ts
-import * as clack from "@clack/prompts";
-function ensureRepoFormat(value) {
-  const trimmed = value.trim();
-  if (!/^[^/\s]+\/[^/\s]+$/.test(trimmed)) {
-    throw new Error("Repository must be in owner/repo format.");
+  if (level === "warning") {
+    return "WARN";
   }
-  return trimmed;
+  return "ERROR";
 }
-function ensureSecretName(value, label) {
-  const trimmed = value.trim();
-  if (!/^[A-Z][A-Z0-9_]*$/.test(trimmed)) {
-    throw new Error(`${label} must be SCREAMING_SNAKE_CASE.`);
-  }
-  return trimmed;
+function formatDurationMs(durationMs) {
+  return `${Math.max(0, Math.round(durationMs))}ms`;
 }
-function cancelAndExit(message = "Setup cancelled.") {
-  clack.cancel(message);
-  process.exit(0);
+function stripTrailingSlash4(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
 }
-async function promptValue(promise, cancelMessage) {
-  const value = await promise;
-  if (clack.isCancel(value)) {
-    cancelAndExit(cancelMessage);
+async function parseJsonResponse(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
   }
-  return value;
-}
-function buildApiKeyValue(keyName) {
-  const slug = (keyName.trim().toLowerCase().match(/[a-z0-9]+/g) ?? []).join("-").slice(0, 24);
-  const random = crypto.randomUUID().split("-").join("");
-  return `sk-${slug || "cliproxy"}-${random}`;
 }
-function extractErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+function toNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
-async function promptGenericSecretNames() {
-  const apiKeySecretName = ensureSecretName(await promptValue(clack.text({
-    message: "Name for the API key secret",
-    placeholder: "CLIPROXY_API_KEY",
-    validate: (value) => {
-      try {
-        ensureSecretName(value ?? "", "API key secret name");
-        return;
-      } catch (error) {
-        return extractErrorMessage(error);
-      }
-    }
-  }), "Setup cancelled before choosing the generic API key secret name."), "API key secret name");
-  const baseUrlSecretName = ensureSecretName(await promptValue(clack.text({
-    message: "Name for the proxy base URL secret",
-    placeholder: "CLIPROXY_BASE_URL",
-    validate: (value) => {
-      try {
-        ensureSecretName(value ?? "", "Base URL secret name");
-        return;
-      } catch (error) {
-        return extractErrorMessage(error);
+async function checkHttpReachability(url, verbose) {
+  const startedAt = performance.now();
+  try {
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+    });
+    const elapsedMs = performance.now() - startedAt;
+    const details = [];
+    if (verbose) {
+      details.push(`URL: ${url}`);
+      details.push(`Status text: ${response.statusText || "(none)"}`);
+      if (response.headers.get("content-type")) {
+        details.push(`Content-Type: ${response.headers.get("content-type")}`);
       }
     }
-  }), "Setup cancelled before choosing the generic base URL secret name."), "Base URL secret name");
-  return { apiKeySecretName, baseUrlSecretName };
-}
-
-// src/commands/cliproxy/setup/gh.ts
-function extractErrorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-async function withSpinner(message, run) {
-  const spinnerInstance = spinner();
-  spinnerInstance.start(message);
-  try {
-    const result = await run(spinnerInstance);
-    spinnerInstance.stop(message);
-    return result;
+    return {
+      title: "HTTP reachability",
+      level: response.ok ? "ok" : "error",
+      summary: `GET ${url} \u2192 ${response.status} (${formatDurationMs(elapsedMs)})`,
+      details
+    };
   } catch (error) {
-    spinnerInstance.error(`${message} failed`);
-    throw error;
+    const elapsedMs = performance.now() - startedAt;
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      title: "HTTP reachability",
+      level: "error",
+      summary: `Request failed after ${formatDurationMs(elapsedMs)}: ${message}`,
+      details: verbose ? [`URL: ${url}`, `Timeout: ${HTTP_TIMEOUT_MS2}ms`] : undefined
+    };
   }
 }
-async function runCommand(command, args) {
-  const child = Bun.spawn([command, ...args], {
-    stdout: "pipe",
-    stderr: "pipe",
-    env: process.env
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text(),
-    child.exited
-  ]);
-  return { stdout, stderr, exitCode };
-}
-async function runGh(args) {
-  return runCommand("gh", args);
-}
-function isGhRateLimitError(text2) {
-  return /rate limit/i.test(text2);
-}
-async function queryRateLimitReset() {
-  try {
-    const result = await runGh(["api", "rate_limit"]);
-    if (result.exitCode === 0) {
-      const parsed = JSON.parse(result.stdout);
-      const reset = parsed.resources?.graphql?.reset ?? parsed.resources?.core?.reset;
-      if (reset) {
-        return new Date(reset * 1000).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
-      }
+function countQueueErrors(records) {
+  let count = 0;
+  for (const record of records) {
+    if (record === null || typeof record !== "object") {
+      continue;
     }
-  } catch {}
-  return "an unknown time";
-}
-async function withGhRetry(label, fn, interactive, queryReset = queryRateLimitReset) {
-  for (;; ) {
-    try {
-      return await withSpinner(label, fn);
-    } catch (error) {
-      const message = extractErrorMessage2(error);
-      if (!isGhRateLimitError(message)) {
-        throw error;
-      }
-      const reset = await queryReset();
-      if (!interactive) {
-        throw new Error(`${message} \u2014 GitHub API rate limit resets at ${reset}. Re-run when ready.`);
-      }
-      log.warn(`GitHub API rate limit exceeded. Resets at ${reset}.`);
-      const retry = await promptValue(confirm({
-        message: "Retry this step when ready?",
-        active: "retry",
-        inactive: "abort",
-        initialValue: true
-      }), "Setup aborted after rate limit.");
-      if (!retry) {
-        cancelAndExit("Setup aborted after GitHub API rate limit.");
-      }
+    const rec = record;
+    const status = toNumber(rec.status);
+    if (status !== null && status >= 400) {
+      count++;
+      continue;
+    }
+    if (rec.error !== undefined || rec.failed === true || rec.failure === true) {
+      count++;
     }
   }
+  return count;
 }
-async function assertGhInstalled() {
-  if (!Bun.which("gh")) {
-    throw new Error("GitHub CLI is required for cliproxy setup. Install gh first: https://cli.github.com/");
-  }
-}
-async function assertGhAuthenticated() {
-  const result = await runGh(["auth", "status"]);
-  if (result.exitCode !== 0) {
-    throw new Error(`GitHub CLI is not authenticated. Run "gh auth login" first. ${result.stderr.trim()}`.trim());
-  }
-}
-async function assertRepoAccess(repo) {
-  const { z: z10 } = await import("zod");
-  const ghRepoViewSchema = z10.object({
-    nameWithOwner: z10.string(),
-    viewerPermission: z10.string()
-  });
-  const result = await runGh(["repo", "view", repo, "--json", "nameWithOwner,viewerPermission"]);
-  if (result.exitCode !== 0) {
-    throw new Error(`Unable to access ${repo}. ${result.stderr.trim()}`.trim());
-  }
-  const parsed = ghRepoViewSchema.parse(JSON.parse(result.stdout));
-  const writePermissions = new Set(["ADMIN", "MAINTAIN", "WRITE"]);
-  if (!writePermissions.has(parsed.viewerPermission)) {
-    throw new Error(`GitHub CLI does not have write access to ${parsed.nameWithOwner}. Current permission: ${parsed.viewerPermission}.`);
-  }
-}
-async function listExistingGhNames(repo, kind) {
-  const { z: z10 } = await import("zod");
-  const ghNameListSchema = z10.array(z10.object({ name: z10.string() }));
-  const result = await runGh([kind, "list", "--repo", repo, "--json", "name"]);
-  if (result.exitCode !== 0) {
-    throw new Error(`Unable to list existing GitHub ${kind}s for ${repo}. ${result.stderr.trim()}`.trim());
-  }
-  return ghNameListSchema.parse(JSON.parse(result.stdout)).map((entry) => entry.name);
-}
-async function createManagementApiKey(baseUrl, managementKey, keyValue) {
-  const endpoint = `${baseUrl}/v0/management/api-keys`;
-  const currentPayload = await requestJson(endpoint, {
-    method: "GET",
-    headers: managementHeaders(managementKey)
-  });
-  const currentKeys = parseManagementKeyList(currentPayload);
-  if (currentKeys.includes(keyValue)) {
-    return;
-  }
-  await requestJson(endpoint, {
-    method: "PUT",
-    headers: managementHeaders(managementKey),
-    body: JSON.stringify([...currentKeys, keyValue])
-  });
-}
-async function deleteManagementApiKey(baseUrl, managementKey, keyValue) {
-  const endpoint = `${baseUrl}/v0/management/api-keys`;
-  const currentPayload = await requestJson(endpoint, {
-    method: "GET",
-    headers: managementHeaders(managementKey)
-  });
-  const currentKeys = parseManagementKeyList(currentPayload);
-  const filtered = currentKeys.filter((k) => k !== keyValue);
-  if (filtered.length === currentKeys.length) {
-    return;
-  }
-  await requestJson(endpoint, {
-    method: "PUT",
-    headers: managementHeaders(managementKey),
-    body: JSON.stringify(filtered)
-  });
-}
-async function applyGhValue(kind, name, repo, value) {
-  if (kind === "secret") {
-    const child = Bun.spawn(["gh", "secret", "set", name, "--repo", repo], {
-      stdin: new Blob([value]).stream(),
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
+async function checkUsageStats(baseUrl, key) {
+  const endpoint = `${baseUrl}/v0/management/usage-queue?count=50`;
+  try {
+    const response = await fetch(endpoint, {
+      headers: managementHeaders(key),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
-    const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited]);
-    if (exitCode !== 0) {
-      throw new Error(`gh secret set ${name} failed: ${stderr.trim()}`.trim());
+    if (response.status === 429) {
+      return {
+        title: "Usage stats",
+        level: "warning",
+        summary: "Rate limited by management API (HTTP 429). Retry in a few moments."
+      };
     }
-    return;
-  }
-  const result = await runGh([kind, "set", name, "--repo", repo, "--body", value]);
-  if (result.exitCode !== 0) {
-    throw new Error(`gh ${kind} set ${name} failed: ${result.stderr.trim()}`.trim());
-  }
-}
-
-// src/commands/cliproxy/setup/preview.ts
-function formatDryRunPreview(opts) {
-  const { repo, harness, providers, model, template } = opts;
-  const lines = [
-    `Dry run: cliproxy setup --harness ${harness}`,
-    `Repository: ${repo}`,
-    `Providers: ${providers.join(", ")}`,
-    `Model: ${model}`,
-    "Planned secrets:"
-  ];
-  for (const secret of template.secrets) {
-    const size = new TextEncoder().encode(secret.value).byteLength;
-    lines.push(`  - ${secret.name} (${size} bytes)`);
-  }
-  lines.push("Planned variables:");
-  for (const variable of template.variables) {
-    lines.push(`  - ${variable.name} = ${variable.value}`);
-  }
-  lines.push("Proxy key (redacted): <proxy-key>");
-  lines.push("No mutations will be performed.");
-  return lines.join(`
-`);
-}
-
-// src/commands/cliproxy/setup/providers.ts
-import { isCancel as isCancel2, multiselect, select, text as text2 } from "@clack/prompts";
-import { z as z10 } from "zod";
-var providerIdSchema = z10.enum(["anthropic", "openai"]);
-var MODEL_ID_RE = /^(?:anthropic|openai)\/[a-z\d](?:[a-z\d.\-]*[a-z\d])?$/;
-function parseProviders(input) {
-  const parts = input.split(",").map((p) => p.trim()).filter(Boolean);
-  if (parts.length === 0) {
-    throw new Error("--providers must not be empty. Supported values: anthropic, openai");
-  }
-  const parsed = parts.map((p) => {
-    const result = providerIdSchema.safeParse(p);
-    if (!result.success) {
-      throw new Error(`Unknown provider "${p}". Supported values: anthropic, openai`);
+    if (!response.ok) {
+      return {
+        title: "Usage stats",
+        level: "error",
+        summary: `GET /v0/management/usage-queue failed with HTTP ${response.status}`
+      };
     }
-    return result.data;
-  });
-  const deduped = new Set(parsed);
-  if (deduped.size < parsed.length) {
-    throw new Error(`--providers contains duplicate values: ${parsed.join(",")}`);
-  }
-  return parsed;
-}
-var PROVIDER_DEFAULTS = {
-  anthropic: "anthropic/claude-sonnet-4-6",
-  openai: "openai/gpt-5.4-mini"
-};
-var CUSTOM_MODEL_SENTINEL = "__custom__";
-async function promptForProviders() {
-  let providers = [];
-  do {
-    const result = await multiselect({
-      message: "Select providers to configure",
-      options: [
-        { value: "anthropic", label: "Anthropic" },
-        { value: "openai", label: "OpenAI" }
-      ],
-      initialValues: ["anthropic"],
-      required: false
-    });
-    if (isCancel2(result)) {
-      cancelAndExit("Setup cancelled before selecting providers.");
+    const payload = await parseJsonResponse(response);
+    if (!Array.isArray(payload)) {
+      return {
+        title: "Usage stats",
+        level: "warning",
+        summary: "Usage-queue response was not an array \u2014 cannot parse recent activity."
+      };
     }
-    providers = result;
-  } while (providers.length === 0);
-  return providers;
-}
-async function promptForModel(providers) {
-  if (providers.length === 1) {
-    return PROVIDER_DEFAULTS[providers[0]];
-  }
-  const chosen = await select({
-    message: "Choose a default model",
-    options: [
-      { value: "openai/gpt-5.4-mini", label: "openai/gpt-5.4-mini" },
-      { value: "anthropic/claude-sonnet-4-6", label: "anthropic/claude-sonnet-4-6" },
-      { value: CUSTOM_MODEL_SENTINEL, label: "Enter custom model ID..." }
-    ]
-  });
-  if (isCancel2(chosen)) {
-    cancelAndExit("Setup cancelled before selecting a model.");
-  }
-  if (chosen === CUSTOM_MODEL_SENTINEL) {
-    return promptForCustomModel();
+    const total = payload.length;
+    const errors2 = countQueueErrors(payload);
+    if (total === 0) {
+      return {
+        title: "Usage stats",
+        level: "ok",
+        summary: "recent: 0 (idle)"
+      };
+    }
+    return {
+      title: "Usage stats",
+      level: errors2 > 0 ? "warning" : "ok",
+      summary: errors2 > 0 ? `recent: ${total}, errors: ${errors2}` : `recent: ${total}`
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      title: "Usage stats",
+      level: "error",
+      summary: `Unable to read usage stats: ${message}`
+    };
   }
-  return chosen;
 }
-async function promptForCustomModel() {
-  let modelId;
-  do {
-    const result = await text2({
-      message: "Enter a custom model ID (e.g. openai/gpt-5.4-mini)",
-      placeholder: "provider/model-name",
-      validate: (value) => {
-        if (!MODEL_ID_RE.test(value ?? "")) {
-          return "Model ID must match provider/model-name (lowercase, digits, dots, hyphens only)";
-        }
-        return;
-      }
+async function checkVersion(baseUrl, key) {
+  const endpoint = `${baseUrl}/v0/management/latest-version`;
+  try {
+    const response = await fetch(endpoint, {
+      headers: managementHeaders(key),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
-    if (isCancel2(result)) {
-      cancelAndExit("Setup cancelled before entering a custom model ID.");
+    if (response.status === 429) {
+      return {
+        title: "Latest version",
+        level: "warning",
+        summary: "Rate limited by management API (HTTP 429). Retry in a few moments."
+      };
     }
-    const candidate = result;
-    if (MODEL_ID_RE.test(candidate)) {
-      modelId = candidate;
+    if (!response.ok) {
+      return {
+        title: "Latest version",
+        level: "error",
+        summary: `GET /v0/management/latest-version failed with HTTP ${response.status}`
+      };
     }
-  } while (!modelId);
-  return modelId;
-}
-
-// src/commands/cliproxy/setup/smoke-test.ts
-import { z as z11 } from "zod";
-var baselineRunSchema = z11.array(z11.object({ databaseId: z11.number() }));
-var ghRunEntrySchema = z11.object({
-  databaseId: z11.number(),
-  status: z11.string(),
-  conclusion: z11.string().nullable(),
-  url: z11.string(),
-  createdAt: z11.string()
-});
-async function runSmokeTest(repo, _model, internals = {}) {
-  const BACKOFF_MS = [5000, 15000, 30000, 60000, 60000];
-  const delayFn = async (ms) => {
-    if (internals._testDelayMs !== undefined) {
-      if (internals._testDelayMs > 0) {
-        await new Promise((resolve2) => setTimeout(resolve2, internals._testDelayMs));
+    const payload = await parseJsonResponse(response);
+    if (payload && typeof payload === "object") {
+      const version = payload["latest-version"];
+      if (typeof version === "string" && version.length > 0) {
+        return { title: "Latest version", level: "ok", summary: version };
       }
-      return;
     }
-    await new Promise((resolve2) => setTimeout(resolve2, ms));
-  };
-  const repoUrl = `https://github.com/${repo}`;
-  let baselineId = null;
-  try {
-    const baselineChild = Bun.spawn(["gh", "run", "list", "--workflow=fro-bot.yaml", "--repo", repo, "--limit", "1", "--json", "databaseId"], { stdout: "pipe", stderr: "pipe", env: process.env });
-    const [baselineStdout, , baselineExit] = await Promise.all([
-      new Response(baselineChild.stdout).text(),
-      new Response(baselineChild.stderr).text(),
-      baselineChild.exited
-    ]);
-    if (baselineExit === 0) {
-      const parseResult = baselineRunSchema.safeParse(JSON.parse(baselineStdout));
-      if (parseResult.success && parseResult.data.length > 0 && parseResult.data[0]) {
-        baselineId = parseResult.data[0].databaseId;
-      }
-    }
-  } catch {}
-  const triggerTime = internals._testTriggerTime ?? new Date;
-  const triggerChild = Bun.spawn(["gh", "workflow", "run", "fro-bot.yaml", "--repo", repo, "-f", "prompt=reply with exactly: ack"], { stdout: "pipe", stderr: "pipe", env: process.env });
-  const [, triggerStderr, triggerExit] = await Promise.all([
-    new Response(triggerChild.stdout).text(),
-    new Response(triggerChild.stderr).text(),
-    triggerChild.exited
-  ]);
-  if (triggerExit !== 0) {
-    const redacted = triggerStderr.slice(0, 200);
-    return { kind: "unverified", message: `gh workflow run failed: ${redacted}` };
+    return {
+      title: "Latest version",
+      level: "warning",
+      summary: "Response did not include a latest-version string."
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { title: "Latest version", level: "error", summary: `Unable to check latest version: ${message}` };
   }
-  let latestMatchedRun;
-  for (const BACKOFF_M of BACKOFF_MS) {
-    await delayFn(BACKOFF_M ?? 60000);
-    let pollRuns = [];
-    try {
-      const pollChild = Bun.spawn([
-        "gh",
-        "run",
-        "list",
-        "--workflow=fro-bot.yaml",
-        "--repo",
-        repo,
-        "--limit",
-        "5",
-        "--json",
-        "databaseId,status,conclusion,url,createdAt"
-      ], { stdout: "pipe", stderr: "pipe", env: process.env });
-      const [pollStdout, , pollExit] = await Promise.all([
-        new Response(pollChild.stdout).text(),
-        new Response(pollChild.stderr).text(),
-        pollChild.exited
-      ]);
-      if (pollExit === 0) {
-        const rawParsed = JSON.parse(pollStdout);
-        if (Array.isArray(rawParsed)) {
-          pollRuns = rawParsed.flatMap((entry) => {
-            const entryResult = ghRunEntrySchema.safeParse(entry);
-            return entryResult.success ? [entryResult.data] : [];
-          });
-        }
-      }
-    } catch {
-      continue;
-    }
-    const candidates = pollRuns.filter((run) => {
-      if (baselineId !== null) {
-        return run.databaseId > baselineId;
-      }
-      return new Date(run.createdAt) > triggerTime;
+}
+var DEFAULT_PROVIDER_MODEL = "claude-sonnet-4-6";
+async function runProviderAuthProbe(baseUrl, apiKey, options) {
+  const model = options?.model ?? DEFAULT_PROVIDER_MODEL;
+  const verbose = options?.verbose === true;
+  const endpoint = `${baseUrl}/v1/chat/completions`;
+  try {
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${apiKey}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        model,
+        messages: [{ role: "user", content: "ping" }],
+        max_tokens: 1
+      }),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
-    if (candidates.length === 0) {
-      continue;
+    const details = [];
+    if (verbose) {
+      details.push(`URL: ${endpoint}`);
+      details.push(`Model: ${model}`);
+      details.push(`Status: ${response.status}`);
     }
-    const matched = candidates.reduce((best, run) => run.databaseId > best.databaseId ? run : best);
-    latestMatchedRun = matched;
-    const { status, conclusion, url: runUrl } = matched;
-    if (status === "waiting") {
-      return { kind: "unverified", message: `Workflow requires environment approval at ${runUrl}`, runUrl };
+    if (response.ok) {
+      return {
+        classification: { state: "healthy", reason: "ok" },
+        human: {
+          title: "Upstream provider auth (anthropic)",
+          level: "ok",
+          summary: `anthropic route OK (${model})`,
+          details: details.length > 0 ? details : undefined
+        }
+      };
     }
-    if (status === "completed") {
-      if (conclusion === "success") {
-        let logNote = "";
-        try {
-          const logChild = Bun.spawn(["gh", "run", "view", String(matched.databaseId), "--log", "--repo", repo], {
-            stdout: "pipe",
-            stderr: "pipe",
-            env: process.env
-          });
-          const [logStdout, , logExit] = await Promise.all([
-            new Response(logChild.stdout).text(),
-            new Response(logChild.stderr).text(),
-            logChild.exited
-          ]);
-          if (logExit !== 0) {
-            logNote = " (log fetch failed, but run conclusion is success)";
-          } else if (!/\back\b/i.test(logStdout)) {
-            logNote = ' (log fetch succeeded but "ack" not found in output)';
-          }
-        } catch {
-          logNote = " (log fetch failed, but run conclusion is success)";
+    if (response.status === 401) {
+      return {
+        classification: { state: "dead", reason: "auth-401" },
+        human: {
+          title: "Upstream provider auth (anthropic)",
+          level: "error",
+          summary: `Anthropic upstream auth unavailable (${response.status}) \u2014 run: cliproxy login claude`,
+          details: details.length > 0 ? details : undefined
         }
-        return { kind: "pass", message: `Smoke test passed${logNote}`, runUrl };
+      };
+    }
+    if (response.status === 503) {
+      let bodyText = "";
+      try {
+        bodyText = await response.text();
+      } catch {}
+      const isAuthUnavailable = /auth_unavailable|no auth available|providers=claude/i.test(bodyText);
+      if (isAuthUnavailable) {
+        return {
+          classification: { state: "dead", reason: "auth-unavailable-503" },
+          human: {
+            title: "Upstream provider auth (anthropic)",
+            level: "error",
+            summary: `Anthropic upstream auth unavailable (${response.status}) \u2014 run: cliproxy login claude`,
+            details: details.length > 0 ? details : undefined
+          }
+        };
       }
-      return { kind: "fail", message: `Run completed with conclusion=${conclusion ?? "unknown"}`, runUrl };
     }
-  }
-  if (latestMatchedRun) {
     return {
-      kind: "unverified",
-      message: `Smoke test did not complete in 5 minutes; check ${latestMatchedRun.url}`,
-      runUrl: latestMatchedRun.url
+      classification: { state: "unknown", reason: "unrelated-http" },
+      human: {
+        title: "Upstream provider auth (anthropic)",
+        level: "warning",
+        summary: `Anthropic probe returned HTTP ${response.status}`,
+        details: details.length > 0 ? details : undefined
+      }
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const errorName = error instanceof Error ? error.name : "";
+    const isTimeout = /timeout|timed out|aborted/i.test(`${errorName} ${message}`);
+    return {
+      classification: { state: "unknown", reason: isTimeout ? "timeout" : "network" },
+      human: {
+        title: "Upstream provider auth (anthropic)",
+        level: "warning",
+        summary: `Anthropic probe failed: ${message}`,
+        details: verbose ? [`URL: ${endpoint}`, `Model: ${model}`] : undefined
+      }
     };
   }
-  return {
-    kind: "unverified",
-    message: `Smoke test trigger not yet visible; check ${repoUrl}/actions`
-  };
 }
-
-// src/commands/cliproxy/setup/templates.ts
-import { z as z12 } from "zod";
-var harnessSchema = z12.enum(["opencode", "claude-code", "generic"]);
-var DEFAULT_CLIPROXY_URL4 = "https://cliproxy.fro.bot";
-function stripTrailingSlash4(value) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
+async function checkProviderAuthState(baseUrl, apiKey, options) {
+  const probe = await runProviderAuthProbe(baseUrl, apiKey, options);
+  return probe.classification;
 }
-function getHarnessTemplate(harness, values = {}) {
-  const keyValue = values.keyValue ?? "sk-placeholder";
-  const baseUrl = stripTrailingSlash4(values.baseUrl ?? DEFAULT_CLIPROXY_URL4);
-  if (harness === "opencode") {
-    const rawProviders = values.providers ?? ["anthropic"];
-    const PROVIDER_ORDER = ["anthropic", "openai"];
-    const providers = PROVIDER_ORDER.filter((p) => rawProviders.includes(p));
-    let model;
-    if (values.model) {
-      model = values.model;
-    } else if (providers.length === 1) {
-      model = PROVIDER_DEFAULTS[providers[0]];
-    } else {
-      throw new Error("model required when multiple providers selected");
+async function checkProviderAuth(baseUrl, apiKey, options) {
+  const probe = await runProviderAuthProbe(baseUrl, apiKey, options);
+  return probe.human;
+}
+async function probeManagementAuth(baseUrl, key) {
+  const endpoint = `${baseUrl}/v0/management/config`;
+  try {
+    const response = await fetch(endpoint, {
+      headers: managementHeaders(key),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+    });
+    if (response.ok) {
+      return null;
     }
-    const authObj = {};
-    for (const p of providers) {
-      authObj[p] = { type: "api", key: keyValue };
+    if (response.status === 403) {
+      const payload = await parseJsonResponse(response);
+      const isBanBody = payload !== null && typeof payload === "object" && Object.values(payload).some((v) => typeof v === "string" && /\b(?:ip[- ]?)?bann?ed\b/i.test(v));
+      if (isBanBody) {
+        return {
+          title: "Management access",
+          level: "error",
+          summary: "IP banned \u2014 stop retrying for ~30 min. Management checks skipped."
+        };
+      }
+      return {
+        title: "Management access",
+        level: "error",
+        summary: "Management API returned HTTP 403. Management checks skipped."
+      };
     }
-    const providerConfig = {};
-    for (const p of providers) {
-      providerConfig[p] = { options: { baseURL: `${baseUrl}/v1` } };
+    if (response.status === 401) {
+      return {
+        title: "Management access",
+        level: "error",
+        summary: "Management API returned HTTP 401 (invalid key). Management checks skipped."
+      };
     }
     return {
-      secrets: [
-        {
-          name: "OPENCODE_AUTH_JSON",
-          value: JSON.stringify(authObj)
-        },
-        {
-          name: "OPENCODE_CONFIG",
-          value: JSON.stringify({ provider: providerConfig })
-        }
-      ],
-      variables: [
-        {
-          name: "FRO_BOT_MODEL",
-          value: model
-        }
-      ]
+      title: "Management access",
+      level: "warning",
+      summary: `Management auth probe returned HTTP ${response.status}. Management checks skipped.`
     };
-  }
-  if (harness === "claude-code") {
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
     return {
-      secrets: [
-        {
-          name: "ANTHROPIC_API_KEY",
-          value: keyValue
-        }
-      ],
-      variables: []
+      title: "Management access",
+      level: "error",
+      summary: `Management auth probe failed: ${message}`
     };
   }
-  if (!values.genericSecretNames) {
-    throw new Error("Generic harness requires custom secret names.");
+}
+async function runManagementChecks(baseUrl, key) {
+  if (!key) {
+    return { kind: "no-key" };
+  }
+  const authFailure = await probeManagementAuth(baseUrl, key);
+  if (authFailure !== null) {
+    return { kind: "auth-failure", result: authFailure };
+  }
+  const [usage, version] = await Promise.all([checkUsageStats(baseUrl, key), checkVersion(baseUrl, key)]);
+  return { kind: "checks", usage, version };
+}
+function printCheckResult(result, ctx) {
+  ctx.console.log(`[${levelLabel(result.level)}] ${result.title}`);
+  ctx.console.log(`  ${result.summary}`);
+  if (result.details && result.details.length > 0) {
+    for (const detail of result.details) {
+      ctx.console.log(`  - ${detail}`);
+    }
+  }
+}
+function formatCheckSummary(result) {
+  return `${levelLabel(result.level)}: ${result.summary}`;
+}
+function formatUsageSummaryLine(result) {
+  const recentMatch = /recent:\s*(\d+)/.exec(result.summary);
+  if (!recentMatch) {
+    return null;
+  }
+  const total = Number(recentMatch[1]);
+  const errorMatch = /errors:\s*(\d+)/.exec(result.summary);
+  const errors2 = errorMatch ? Number(errorMatch[1]) : 0;
+  return `Recent requests: ${total}${errors2 > 0 ? `, ${errors2} errors` : ""}`;
+}
+async function getCliproxyStatusSummary(baseUrl, key, verbose) {
+  const normalizedBaseUrl = stripTrailingSlash4(baseUrl);
+  const [httpResult, mgmt] = await Promise.all([
+    checkHttpReachability(`${normalizedBaseUrl}/healthz`, verbose),
+    runManagementChecks(normalizedBaseUrl, key || undefined)
+  ]);
+  let version;
+  let usageStats;
+  if (mgmt.kind === "no-key") {
+    version = "\u2014 (no key)";
+    usageStats = "\u2014 (no key)";
+  } else if (mgmt.kind === "auth-failure") {
+    const authSummary = formatCheckSummary(mgmt.result);
+    version = authSummary;
+    usageStats = authSummary;
+  } else {
+    version = formatCheckSummary(mgmt.version);
+    usageStats = formatCheckSummary(mgmt.usage);
   }
   return {
-    secrets: [
-      { name: values.genericSecretNames.apiKeySecretName, value: keyValue },
-      { name: values.genericSecretNames.baseUrlSecretName, value: `${baseUrl}/v1` }
-    ],
-    variables: []
+    app: "cliproxy",
+    http: formatCheckSummary(httpResult),
+    lastDeploy: "\u2014",
+    version,
+    contentHash: "\u2014",
+    usageStats
   };
 }
-function formatTemplateSummary(template) {
-  const secretLines = template.secrets.map((secret) => `- secret ${secret.name}`);
-  const variableLines = template.variables.map((variable) => `- variable ${variable.name}`);
-  return [...secretLines, ...variableLines].join(`
-`);
-}
-function collectCollisions(template, existingSecrets, existingVariables) {
-  const collisions = [];
-  for (const secret of template.secrets) {
-    if (existingSecrets.includes(secret.name)) {
-      collisions.push(`secret ${secret.name}`);
+async function cliproxyStatusAction(options, ctx) {
+  let errorCount = 0;
+  try {
+    const verbose = options.verbose === true;
+    const baseUrl = stripTrailingSlash4(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL4);
+    const trustedUrl = stripTrailingSlash4(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL4);
+    const urlIsExplicitlyOverridden = options.url !== undefined && baseUrl !== trustedUrl;
+    const managementKey = options.key ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_MANAGEMENT_KEY);
+    const providerKey = options.apiKey ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_API_KEY);
+    ctx.console.log("CLIProxyAPI status");
+    ctx.console.log("");
+    const results = [await checkHttpReachability(`${baseUrl}/healthz`, verbose)];
+    let capturedUsageResult;
+    const mgmt = await runManagementChecks(baseUrl, managementKey);
+    if (mgmt.kind === "no-key") {
+      results.push({
+        title: "Management checks",
+        level: "warning",
+        summary: "CLIPROXY_MANAGEMENT_KEY is not set. Skipping usage stats and version checks. Provide --key or set env var."
+      });
+    } else if (mgmt.kind === "auth-failure") {
+      results.push(mgmt.result);
+    } else {
+      capturedUsageResult = mgmt.usage;
+      results.push(mgmt.usage, mgmt.version);
     }
-  }
-  for (const variable of template.variables) {
-    if (existingVariables.includes(variable.name)) {
-      collisions.push(`variable ${variable.name}`);
+    if (providerKey) {
+      results.push(await checkProviderAuth(baseUrl, providerKey, { verbose }));
+    } else {
+      results.push({
+        title: "Upstream provider auth",
+        level: "warning",
+        summary: "CLIPROXY_API_KEY not set \u2014 skipping upstream provider probe."
+      });
+    }
+    for (const result of results) {
+      printCheckResult(result, ctx);
+      ctx.console.log("");
+    }
+    errorCount = results.filter((result) => result.level === "error").length;
+    const warningCount = results.filter((result) => result.level === "warning").length;
+    ctx.console.log(`Summary: ${results.length} checks, ${errorCount} errors, ${warningCount} warnings`);
+    if (capturedUsageResult) {
+      const usageLine = formatUsageSummaryLine(capturedUsageResult);
+      if (usageLine) {
+        ctx.console.log(usageLine);
+      }
     }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    ctx.console.error(message);
+    ctx.process.exit(1);
+    return;
   }
-  return collisions;
+  if (errorCount > 0) {
+    ctx.process.exit(1);
+  }
+}
+function registerCliproxyStatus(cli) {
+  cli.command("cliproxy status", "Show operational health of CLIProxyAPI and its management endpoints.").option("--url [url]", z9.string().describe("Base URL for CLIProxyAPI health checks. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z9.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--api-key [key]", z9.string().describe("Downstream API key (bearer) for the upstream provider-auth probe. Falls back to CLIPROXY_API_KEY. Skipped when absent.")).option("--verbose", "Enable verbose output for all commands").action(cliproxyStatusAction);
 }
 
-// src/commands/cliproxy/setup/validation.ts
-import { z as z13 } from "zod";
-var modelEntrySchema2 = z13.object({
-  id: z13.string(),
-  owned_by: z13.string().optional()
-}).passthrough();
-var modelsResponseSchema2 = z13.object({
-  data: z13.array(modelEntrySchema2)
-}).passthrough();
-var MODEL_ID_RE2 = /^(?:anthropic|openai)\/[a-z\d](?:[a-z\d.\-]*[a-z\d])?$/;
-var HTTP_TIMEOUT_MS3 = 1e4;
-var PROVIDER_ID_PATTERNS2 = {
-  openai: /^(?:gpt-|o1-|o3-|codex)/i,
-  anthropic: /^claude-/i
+// src/commands/cliproxy/monitor.ts
+var DEFAULT_CLIPROXY_URL5 = "https://cliproxy.fro.bot";
+var PRODUCTION_LABEL = "cliproxy-auth-monitor";
+var TEST_LABEL = "cliproxy-auth-monitor-test";
+var PRODUCTION_IDENTITY_MARKER = "<!-- cliproxy-auth-monitor:v1 -->";
+var TEST_IDENTITY_MARKER = "<!-- cliproxy-auth-monitor-test:v1 -->";
+var MAX_DISCORD_ATTEMPTS = 3;
+var MAX_GITHUB_ATTEMPTS = 3;
+var GITHUB_TIMEOUT_MS = 1e4;
+var DISCORD_TIMEOUT_MS = 1e4;
+var monitorValidationModes = ["live", "synthetic-dead", "synthetic-healthy"];
+function formatMonitorRunSummary(summary) {
+  const issue = summary.issue.length > 0 ? summary.issue.join("+") : "none";
+  return `CLIProxy auth monitor summary: probe=${summary.probeState} reason=${summary.probeReason} transition=${summary.transition} issue=${issue} discord=${summary.discord} at ${summary.timestamp}`;
+}
+var githubIssueSchema = z10.object({
+  number: z10.number().int().nonnegative(),
+  state: z10.enum(["open", "closed"]),
+  title: z10.string(),
+  body: z10.string().nullable(),
+  labels: z10.array(z10.object({ name: z10.string().optional() })),
+  pull_request: z10.unknown().optional()
+});
+var githubIssuesSchema = z10.array(githubIssueSchema);
+var defaultMonitorRuntime = {
+  fetch: globalThis.fetch,
+  sleep: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
+  ghApi: (token, path, method, body) => runGhApiOnce(token, path, method, body),
+  setTimeout,
+  clearTimeout
 };
-function entryMatchesProvider2(entry, provider) {
-  if (entry.owned_by !== undefined && entry.owned_by.trim() !== "") {
-    return entry.owned_by === provider;
-  }
-  const id = entry.id ?? "";
-  if (id.startsWith(`${provider}/`)) {
-    return true;
+function safeError(ctx, category) {
+  ctx.console.error(`CLIProxy auth monitor failed: ${category}`);
+  ctx.process.exit(1);
+}
+function validateProxyOrigin(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname === "cliproxy.fro.bot" && url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+  } catch {
+    return false;
   }
-  const pattern = PROVIDER_ID_PATTERNS2[provider];
-  return pattern === undefined ? false : pattern.test(id);
 }
-function extractErrorMessage3(error) {
-  return error instanceof Error ? error.message : String(error);
+function readInputs(validation) {
+  const env = process.env;
+  const values = {
+    apiKey: env.CLIPROXY_API_KEY,
+    discordWebhook: env.CLIPROXY_AUTH_MONITOR_DISCORD_WEBHOOK,
+    githubToken: env.GITHUB_TOKEN,
+    repository: env.GITHUB_REPOSITORY,
+    actor: env.GITHUB_ACTOR,
+    owner: env.GITHUB_REPOSITORY_OWNER
+  };
+  if (validation !== "live" && values.actor !== values.owner)
+    return { ok: false, category: "synthetic-unauthorized" };
+  if (validation === "live" && !values.apiKey)
+    return { ok: false, category: "missing-CLIPROXY_API_KEY" };
+  if (!values.discordWebhook)
+    return { ok: false, category: "missing-CLIPROXY_AUTH_MONITOR_DISCORD_WEBHOOK" };
+  if (!values.githubToken)
+    return { ok: false, category: "missing-GITHUB_TOKEN" };
+  if (!values.repository)
+    return { ok: false, category: "missing-GITHUB_REPOSITORY" };
+  if (!values.actor)
+    return { ok: false, category: "missing-GITHUB_ACTOR" };
+  if (!values.owner)
+    return { ok: false, category: "missing-GITHUB_REPOSITORY_OWNER" };
+  if (!/^[\w.-]+\/[\w.-]+$/.test(values.repository))
+    return { ok: false, category: "malformed-GITHUB_REPOSITORY" };
+  return {
+    ok: true,
+    inputs: {
+      apiKey: values.apiKey ?? "",
+      discordWebhook: values.discordWebhook,
+      githubToken: values.githubToken,
+      repository: values.repository,
+      actor: values.actor,
+      owner: values.owner
+    }
+  };
 }
-function validateSetupOptions(options, isInteractive) {
-  if (isInteractive) {
-    return;
+var GH_ENV_ALLOWLIST = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "XDG_CONFIG_HOME", "XDG_CACHE_HOME"];
+function createGhEnvironment(token) {
+  const environment = {
+    GH_TOKEN: token,
+    GH_PROMPT_DISABLED: "1",
+    GH_NO_UPDATE_NOTIFIER: "1"
+  };
+  for (const name of GH_ENV_ALLOWLIST) {
+    const value = process.env[name];
+    if (value !== undefined)
+      environment[name] = value;
   }
-  if (options.providers) {
-    const providers = parseProviders(options.providers);
-    if (providers.length > 1 && !options.model) {
-      throw new Error("Pass --model <provider/model-id> when selecting multiple providers.");
-    }
-    if (options.model) {
-      const slashIndex = options.model.indexOf("/");
-      const prefix = slashIndex === -1 ? options.model : options.model.slice(0, slashIndex);
-      if (!providers.includes(prefix)) {
-        throw new Error(`Model prefix ${prefix} does not match selected providers (${providers.join(", ")}). Valid prefixes: ${providers.join(", ")}/`);
+  return environment;
+}
+function tryParseGhResponse(output) {
+  const separator = output.indexOf(`\r
+\r
+`);
+  const splitLength = separator === -1 ? 2 : 4;
+  const splitAt = separator === -1 ? output.indexOf(`
+
+`) : separator;
+  if (splitAt < 0)
+    return null;
+  const headers = output.slice(0, splitAt);
+  const status = /^HTTP\/\S+\s+(\d{3})/m.exec(headers)?.[1];
+  if (!status)
+    return null;
+  return { status: Number(status), body: output.slice(splitAt + splitLength) };
+}
+function interpretGhApiResult(exitCode, stdout) {
+  const parsed = tryParseGhResponse(stdout);
+  if (parsed)
+    return parsed;
+  if (exitCode !== 0)
+    throw new Error("github-transient");
+  throw new Error("github-invalid-response");
+}
+async function runGhApiOnce(token, path, method, body) {
+  const child = Bun.spawn(["gh", "api", path, "--include", "--method", method, ...body ? ["--input", "-"] : []], {
+    stdin: body ? "pipe" : "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: createGhEnvironment(token)
+  });
+  if (body && child.stdin) {
+    child.stdin.write(body);
+    child.stdin.end();
+  }
+  let timedOut = false;
+  let timer;
+  const operation = Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+      reject(new Error("github-timeout"));
+    }, GITHUB_TIMEOUT_MS);
+  });
+  try {
+    const [stdout, _stderr, exitCode] = await Promise.race([operation, timeout]);
+    return interpretGhApiResult(exitCode, stdout);
+  } catch (error) {
+    if (timedOut || error instanceof Error && error.message.startsWith("github-"))
+      throw error;
+    throw new Error("github-transient");
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function createGitHubClient(token, repository, sleep, ghApi) {
+  const base = `/repos/${repository}`;
+  async function requestApi(path, method, body, allowClientError = false, retry = true) {
+    const maxAttempts = retry ? MAX_GITHUB_ATTEMPTS : 1;
+    for (let attempt = 1;attempt <= maxAttempts; attempt++) {
+      try {
+        const response = await ghApi(token, `${base}${path}`, method, body);
+        if (response.status >= 200 && response.status < 300)
+          return response;
+        if (allowClientError && response.status !== 429 && response.status < 500)
+          return response;
+        if (response.status !== 429 && response.status < 500)
+          throw new Error("github-http");
+        throw new Error("github-transient");
+      } catch (error) {
+        const retryable = error instanceof Error && /github-(?:transient|timeout)/.test(error.message);
+        if (!retryable || attempt === maxAttempts)
+          throw error;
+        await sleep(attempt * 100);
       }
     }
+    throw new Error("github-transient");
   }
-  if (!options.dryRun && !options.key) {
-    throw new Error("--key is required when stdin is not a TTY. Provide an existing CLIProxyAPI key value.");
-  }
-  if (!options.repo) {
-    throw new Error("--repo is required when stdin is not a TTY. Provide the target GitHub repository as owner/repo.");
-  }
-  if (!options.harness) {
-    throw new Error("--harness is required when stdin is not a TTY. Choose opencode or claude-code.");
-  }
-  if (options.harness === "generic") {
-    throw new Error("--harness generic is interactive-only because it requires custom secret names.");
-  }
+  return {
+    async request(path, schema, init) {
+      const response = await requestApi(path, init?.method ?? "GET", init?.body, false, init?.retry ?? true);
+      try {
+        return schema.parse(JSON.parse(response.body));
+      } catch {
+        throw new Error("github-malformed-response");
+      }
+    },
+    async requestStatus(path, init) {
+      return (await requestApi(path, init?.method ?? "GET", init?.body, true)).status;
+    }
+  };
 }
-async function verifyModelsAvailable(baseUrl, key, providers, model) {
-  if (providers.length === 1 && providers[0] === "anthropic") {
+function issueBody(identityMarker, state, timestamp, includeState) {
+  const markerPrefix = identityMarker === TEST_IDENTITY_MARKER ? "cliproxy-auth-monitor-test" : "cliproxy-auth-monitor";
+  const marker = includeState ? `
+<!-- ${markerPrefix}:notified=${state} -->` : "";
+  const remediation = state === "dead" ? `
+Remediation: cliproxy login claude.` : "";
+  return `${identityMarker}
+CLIProxyAPI Anthropic authentication monitor.${remediation}
+Last check: ${timestamp}.
+<!-- ${markerPrefix}:last-check=${timestamp} -->${marker}`;
+}
+function issueHasLabel(issue, label) {
+  return issue.labels.some((candidate) => candidate.name === label);
+}
+function notifiedState(body, identityMarker) {
+  const markerPrefix = identityMarker === TEST_IDENTITY_MARKER ? "cliproxy-auth-monitor-test" : "cliproxy-auth-monitor";
+  const match = body?.match(new RegExp(`<!-- ${markerPrefix}:notified=(dead|healthy) -->`));
+  return match?.[1] === "dead" || match?.[1] === "healthy" ? match[1] : null;
+}
+async function resolveIssue(client, identityMarker, label) {
+  const issues = [];
+  let page = 1;
+  while (true) {
+    const path = page === 1 ? "/issues?state=all&per_page=100" : `/issues?state=all&per_page=100&page=${page}`;
+    const batch = await client.request(path, githubIssuesSchema);
+    issues.push(...batch);
+    if (batch.length < 100)
+      break;
+    page++;
+  }
+  const trusted = issues.filter((issue) => issue.pull_request === undefined && issueHasLabel(issue, label));
+  if (trusted.some((issue) => issue.body?.includes(identityMarker) !== true))
+    throw new Error("trusted-label-mismatch");
+  const marked = trusted.filter((issue) => issue.body?.includes(identityMarker) === true).sort((left, right) => left.number - right.number);
+  return marked[0] ?? null;
+}
+async function ensureLabel(client, label) {
+  const encoded = encodeURIComponent(label);
+  const status = await client.requestStatus(`/labels/${encoded}`);
+  if (status === 404) {
+    await client.request("/labels", z10.unknown(), {
+      method: "POST",
+      body: JSON.stringify({ name: label, color: "b60205", description: "CLIProxy auth monitor state" })
+    });
     return;
   }
-  const endpoint = `${baseUrl}/v1/models`;
-  const response = await fetch(endpoint, {
-    headers: { Authorization: `Bearer ${key}` },
-    signal: AbortSignal.timeout(1e4)
+  if (status < 200 || status >= 300)
+    throw new Error(`github-${status}`);
+}
+async function updateIssue(client, issue, state, body) {
+  await client.request(`/issues/${issue.number}`, z10.unknown(), {
+    method: "PATCH",
+    body: JSON.stringify({ state, body })
   });
-  if (response.status === 401 || response.status === 403) {
-    throw new Error("Proxy key rejected. Verify with `cliproxy keys list` or rerun setup to create a new one.");
+}
+async function createIssue(client, label, identityMarker, body, sleep) {
+  await ensureLabel(client, label);
+  for (let attempt = 1;attempt <= MAX_GITHUB_ATTEMPTS; attempt++) {
+    try {
+      return await client.request("/issues", githubIssueSchema, {
+        method: "POST",
+        body: JSON.stringify({ title: "CLIProxy Anthropic authentication outage", body, labels: [label] }),
+        retry: false
+      });
+    } catch (error) {
+      const retryable = error instanceof Error && /github-(?:transient|timeout)/.test(error.message);
+      if (!retryable || attempt === MAX_GITHUB_ATTEMPTS)
+        throw error;
+      const appeared = await resolveIssue(client, identityMarker, label);
+      if (appeared)
+        return appeared;
+      await sleep(attempt * 100);
+    }
   }
-  if (!response.ok) {
-    const rawBody = await response.text();
-    const redacted = (key.length > 0 ? rawBody.replaceAll(key, "<redacted>") : rawBody).replaceAll(/Bearer\s+[^\s"]+/g, "Bearer <redacted>").replaceAll(/sk-[\w.-]{8,}/g, "sk-<redacted>");
-    const excerpt = redacted.slice(0, 200);
-    throw new Error(`/v1/models returned HTTP ${response.status}: ${excerpt}`);
+  throw new Error("github-transient");
+}
+async function sendDiscord(webhook, state, timestamp, synthetic, runtime) {
+  const content = state === "dead" ? `${synthetic ? "[synthetic test] " : ""}CLIProxy Anthropic authentication is unavailable as of ${timestamp}. Run cliproxy login claude.` : `${synthetic ? "[synthetic test] " : ""}CLIProxy Anthropic authentication recovered as of ${timestamp}.`;
+  for (let attempt = 1;attempt <= MAX_DISCORD_ATTEMPTS; attempt++) {
+    try {
+      const controller = new AbortController;
+      const timeout = runtime.setTimeout(() => controller.abort(), DISCORD_TIMEOUT_MS);
+      let response;
+      try {
+        response = await runtime.fetch(webhook, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ content, allowed_mentions: { parse: [] } }),
+          signal: controller.signal
+        });
+      } finally {
+        runtime.clearTimeout(timeout);
+      }
+      if (response.ok)
+        return;
+      const retryable = response.status === 429 || response.status >= 500;
+      if (!retryable || attempt === MAX_DISCORD_ATTEMPTS) {
+        throw new Error(`discord-${response.status}`);
+      }
+      const retryAfter = Number(response.headers.get("retry-after") ?? "0");
+      await runtime.sleep(Math.min(1000, Number.isFinite(retryAfter) ? Math.max(0, retryAfter * 1000) : 0));
+    } catch (error) {
+      if (attempt === MAX_DISCORD_ATTEMPTS || error instanceof Error && /^discord-\d{3}$/.test(error.message))
+        throw error;
+      await runtime.sleep(0);
+    }
   }
-  const json = await response.json();
-  let parsed;
+}
+async function persistNotifiedMarker(client, issue, identityMarker, state, timestamp) {
+  await updateIssue(client, issue, issue.state, issueBody(identityMarker, state, timestamp, true));
+}
+function providerState(validation) {
+  return validation === "synthetic-dead" ? { state: "dead", reason: "auth-401" } : { state: "healthy", reason: "ok" };
+}
+async function cliproxyMonitorAction(options, ctx, runtime = defaultMonitorRuntime) {
+  const validation = options.validation ?? "live";
+  const inputResult = readInputs(validation);
+  if (!inputResult.ok)
+    return safeError(ctx, inputResult.category);
+  const inputs = inputResult.inputs;
+  const proxyUrl = process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL5;
+  if (!validateProxyOrigin(proxyUrl))
+    return safeError(ctx, "untrusted-proxy-origin");
+  const label = validation === "live" ? PRODUCTION_LABEL : TEST_LABEL;
+  const client = createGitHubClient(inputs.githubToken, inputs.repository, runtime.sleep, runtime.ghApi);
+  const timestamp = new Date().toISOString();
   try {
-    parsed = modelsResponseSchema2.parse(json);
+    const classification = validation === "live" ? await checkProviderAuthState(proxyUrl, inputs.apiKey) : providerState(validation);
+    const finish = (transition, issue2 = [], discord = "none") => {
+      const summary = {
+        probeState: classification.state,
+        probeReason: classification.reason,
+        transition,
+        issue: issue2,
+        discord,
+        timestamp
+      };
+      ctx.console.log(formatMonitorRunSummary(summary));
+      return summary;
+    };
+    const identityMarker = validation === "live" ? PRODUCTION_IDENTITY_MARKER : TEST_IDENTITY_MARKER;
+    const issue = await resolveIssue(client, identityMarker, label);
+    if (classification.state === "unknown")
+      return finish("none");
+    const target = classification.state === "dead" ? "dead" : "healthy";
+    if (!issue && target === "healthy")
+      return finish("none");
+    const issueActions = [];
+    if (!issue) {
+      const created = await createIssue(client, label, identityMarker, issueBody(identityMarker, "dead", timestamp, false), runtime.sleep);
+      await sendDiscord(inputs.discordWebhook, "dead", timestamp, validation !== "live", runtime);
+      await persistNotifiedMarker(client, created, identityMarker, "dead", timestamp);
+      return finish("outage", ["created"], "outage-sent");
+    }
+    if (target === "dead") {
+      const currentMarker2 = notifiedState(issue.body, identityMarker);
+      const wasOpen2 = issue.state === "open";
+      const body = issueBody(identityMarker, "dead", timestamp, currentMarker2 === "dead");
+      await updateIssue(client, issue, "open", body);
+      issue.state = "open";
+      issueActions.push(wasOpen2 ? "updated" : "reopened");
+      if (currentMarker2 === "dead" && wasOpen2)
+        return finish("none", issueActions);
+      await sendDiscord(inputs.discordWebhook, "dead", timestamp, validation !== "live", runtime);
+      await persistNotifiedMarker(client, issue, identityMarker, "dead", timestamp);
+      return finish(wasOpen2 ? "notification-retry" : "outage", issueActions, "outage-sent");
+    }
+    const currentMarker = notifiedState(issue.body, identityMarker);
+    const wasOpen = issue.state === "open";
+    if (issue.state === "open") {
+      await updateIssue(client, issue, "closed", issueBody(identityMarker, currentMarker === "dead" ? "dead" : "healthy", timestamp, currentMarker !== null));
+      issue.state = "closed";
+      issueActions.push("closed");
+    } else if (currentMarker === "healthy" || currentMarker === null) {
+      return finish("none", issueActions);
+    }
+    if (currentMarker === "dead") {
+      await sendDiscord(inputs.discordWebhook, "healthy", timestamp, validation !== "live", runtime);
+      await persistNotifiedMarker(client, issue, identityMarker, "healthy", timestamp);
+      return finish(wasOpen ? "recovery" : "notification-retry", issueActions, "recovery-sent");
+    }
+    await persistNotifiedMarker(client, issue, identityMarker, "healthy", timestamp);
+    return finish("repair", issueActions);
   } catch (error) {
-    const message = error instanceof z13.ZodError ? error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ") : extractErrorMessage3(error);
-    throw new Error(`Malformed /v1/models response: ${message}`);
+    const category = error instanceof Error && /trusted-label-mismatch/.test(error.message) ? "trusted-label-mismatch" : error instanceof Error && /ambiguous-identity/.test(error.message) ? "ambiguous-state" : "reconciliation";
+    safeError(ctx, category);
   }
-  const entries = parsed.data;
-  if (providers.includes("openai")) {
-    const hasOpenAi = entries.some((e) => entryMatchesProvider2(e, "openai"));
-    if (!hasOpenAi) {
-      throw new Error("No OpenAI models on proxy \u2014 is the Codex token loaded? Try `cliproxy login codex`.");
-    }
-  }
-  const slashIndex = model.indexOf("/");
-  const bareId = slashIndex === -1 ? model : model.slice(slashIndex + 1);
-  const providerPrefix = slashIndex >= 0 ? model.slice(0, slashIndex) : undefined;
-  const modelPresent = entries.some((e) => e.id === bareId || e.id === model);
-  if (!modelPresent) {
-    const matchingIds = providerPrefix ? entries.filter((e) => entryMatchesProvider2(e, providerPrefix)).map((e) => e.id) : entries.map((e) => e.id);
-    const available = matchingIds.length > 0 ? matchingIds.join(", ") : "(none)";
-    throw new Error(`Model "${bareId}" not found on proxy. Available ${providerPrefix ?? "models"}: ${available}`);
+}
+function registerCliproxyMonitor(cli) {
+  cli.command("cliproxy monitor", "Reconcile Anthropic provider authentication with one canonical GitHub issue and transition-only Discord alerts. Requires CLIPROXY_API_KEY, CLIPROXY_AUTH_MONITOR_DISCORD_WEBHOOK, GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, and GITHUB_REPOSITORY_OWNER environment variables; prefer the cliproxy-auth-monitor.yaml GitHub Actions entrypoint for scheduled or synthetic validation.").option("--validation [mode]", z10.enum(monitorValidationModes).default("live").describe("Validation mode (live, synthetic-dead, or synthetic-healthy): live probes Anthropic; synthetic modes are owner-only isolated test transitions.")).example("# Run the live provider-auth monitor").example("infra cliproxy monitor").example("# Exercise the isolated outage transition as the repository owner").example("infra cliproxy monitor --validation synthetic-dead").action(cliproxyMonitorAction);
+}
+
+// src/commands/cliproxy/open.ts
+import { z as z11 } from "zod";
+var DEFAULT_HOST2 = "cliproxy.fro.bot";
+var DEFAULT_REMOTE_USER2 = "root";
+function resolveHost2(input) {
+  const host = input ?? process.env.CLIPROXY_DOMAIN ?? DEFAULT_HOST2;
+  if (!host) {
+    throw new Error("CLIPROXY_DOMAIN is required. Pass --host or set CLIPROXY_DOMAIN.");
   }
+  return host;
 }
-async function assertProxyReachable(baseUrl) {
-  try {
-    const response = await fetch(`${baseUrl}/healthz`, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
-    });
-    if (!response.ok) {
-      throw new Error(`Proxy check failed for ${baseUrl}: HTTP ${response.status}. Is the proxy running and reachable?`);
+function registerCliproxyOpen(cli) {
+  cli.command("cliproxy open", "Launch CLIProxyAPI TUI dashboard via SSH.").option("--host [host]", z11.string().describe("SSH host for CLIProxyAPI server. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.")).example("# Open the TUI dashboard on the remote CLIProxyAPI instance").example("infra cliproxy open").example("# Open on a custom host").example("infra cliproxy open --host custom.example.com").action(async (options) => {
+    const host = validateCliproxyHost(resolveHost2(options.host));
+    if (!process.stdin.isTTY) {
+      throw new Error("cliproxy open requires an interactive terminal. Run from a shell with TTY attached.");
     }
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Proxy check failed")) {
-      throw error;
+    const path = process.env.PATH;
+    const home = process.env.HOME;
+    if (!path) {
+      throw new Error("PATH is required to invoke ssh");
     }
-    throw new Error(`Unable to reach proxy at ${baseUrl}: ${extractErrorMessage3(error)}`);
-  }
-}
-async function assertProxyKeyWorks(baseUrl, keyValue) {
-  try {
-    const response = await fetch(`${baseUrl}/v1/models`, {
-      headers: {
-        authorization: `Bearer ${keyValue}`
+    if (!home) {
+      throw new Error("HOME is required to invoke ssh");
+    }
+    const remoteCommand = "cd /opt/cliproxy && docker compose exec cli-proxy-api /CLIProxyAPI/CLIProxyAPI --tui";
+    const child = Bun.spawn([
+      "ssh",
+      "-tt",
+      "-o",
+      "BatchMode=yes",
+      "-o",
+      "ConnectTimeout=10",
+      `${DEFAULT_REMOTE_USER2}@${host}`,
+      remoteCommand
+    ], {
+      env: {
+        PATH: path,
+        HOME: home
       },
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit"
     });
-    if (!response.ok) {
-      throw new Error(`Proxy key verification failed with HTTP ${response.status}`);
-    }
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Proxy key verification")) {
-      throw error;
+    const exitCode = await child.exited;
+    if (exitCode !== 0) {
+      throw new Error(`Remote TUI command failed with exit code ${exitCode}`);
     }
-    throw new Error(`Unable to verify proxy key at ${baseUrl}: ${extractErrorMessage3(error)}`);
-  }
+  });
 }
 
-// src/commands/cliproxy/setup/workflow-analyzer.ts
-var REQUIRED_OPENCODE_INPUTS = ["auth-json", "opencode-config", "model"];
-function findFroBotAgentStepBodies(content) {
-  const bodies = [];
-  const pattern = /^(\s*(?:-\s+)?)uses:\s*fro-bot\/agent@/gm;
-  for (const match of content.matchAll(pattern)) {
-    if (match.index === undefined || match[1] === undefined)
-      continue;
-    const stepBodyIndent = match[1].length;
-    const dashIndent = Math.max(0, stepBodyIndent - 2);
-    const lines = content.slice(match.index).split(`
-`);
-    const stepLines = [lines[0] ?? ""];
-    for (let index = 1;index < lines.length; index += 1) {
-      const line = lines[index] ?? "";
-      if (!line.trim()) {
-        stepLines.push(line);
-        continue;
-      }
-      const firstNonSpace = line.search(/\S/);
-      if (firstNonSpace === dashIndent && line.trimStart().startsWith("-"))
-        break;
-      if (firstNonSpace < dashIndent)
-        break;
-      stepLines.push(line);
-    }
-    bodies.push({ stepOrdinal: bodies.length + 1, body: stepLines.join(`
-`) });
+// src/commands/cliproxy/setup.ts
+import { cancel as cancel2, confirm as confirm2, intro, log as log2, note, outro, select as select2, text as text3 } from "@clack/prompts";
+import { z as z16 } from "zod";
+
+// src/commands/cliproxy/setup/gh.ts
+import { confirm, log, spinner } from "@clack/prompts";
+
+// src/commands/cliproxy/setup/prompts.ts
+import * as clack from "@clack/prompts";
+function ensureRepoFormat(value) {
+  const trimmed = value.trim();
+  if (!/^[^/\s]+\/[^/\s]+$/.test(trimmed)) {
+    throw new Error("Repository must be in owner/repo format.");
   }
-  return bodies;
+  return trimmed;
 }
-function analyzeFroBotWorkflow(workflowContent) {
-  const steps = findFroBotAgentStepBodies(workflowContent);
-  if (steps.length === 0) {
-    return { kind: "no-agent-step" };
+function ensureSecretName(value, label) {
+  const trimmed = value.trim();
+  if (!/^[A-Z][A-Z0-9_]*$/.test(trimmed)) {
+    throw new Error(`${label} must be SCREAMING_SNAKE_CASE.`);
   }
-  const stepsWithGaps = steps.map((step) => ({
-    stepOrdinal: step.stepOrdinal,
-    missingInputs: REQUIRED_OPENCODE_INPUTS.filter((input) => {
-      const inputPattern = new RegExp(String.raw`^\s+${input}:`, "m");
-      return !inputPattern.test(step.body);
-    })
-  })).filter((step) => step.missingInputs.length > 0);
-  return { kind: "analyzed", stepsWithGaps };
+  return trimmed;
 }
-function interpretGhContentResult(result) {
-  if (result.exitCode === 0) {
-    return analyzeFroBotWorkflow(result.stdout);
-  }
-  if (/HTTP 404/.test(result.stderr)) {
-    return { kind: "missing" };
+function cancelAndExit(message = "Setup cancelled.") {
+  clack.cancel(message);
+  process.exit(0);
+}
+async function promptValue(promise, cancelMessage) {
+  const value = await promise;
+  if (clack.isCancel(value)) {
+    cancelAndExit(cancelMessage);
   }
-  return {
-    kind: "unreachable",
-    reason: result.stderr.trim() || `gh api exited with code ${result.exitCode}`
-  };
+  return value;
 }
-async function checkFroBotWorkflow(repo) {
-  const result = await runGh([
-    "api",
-    "--header",
-    "Accept: application/vnd.github.raw",
-    `/repos/${repo}/contents/.github/workflows/fro-bot.yaml`
-  ]);
-  return interpretGhContentResult(result);
+function buildApiKeyValue(keyName) {
+  const slug = (keyName.trim().toLowerCase().match(/[a-z0-9]+/g) ?? []).join("-").slice(0, 24);
+  const random = crypto.randomUUID().split("-").join("");
+  return `sk-${slug || "cliproxy"}-${random}`;
 }
-function formatWorkflowSnippet(missingInputs) {
-  const inputMap = {
-    "auth-json": "auth-json: ${{ secrets.OPENCODE_AUTH_JSON }}",
-    "opencode-config": "opencode-config: ${{ secrets.OPENCODE_CONFIG }}",
-    model: "model: ${{ vars.FRO_BOT_MODEL }}"
-  };
-  return missingInputs.map((input) => `          ${inputMap[input]}`).join(`
-`);
+function extractErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function promptGenericSecretNames() {
+  const apiKeySecretName = ensureSecretName(await promptValue(clack.text({
+    message: "Name for the API key secret",
+    placeholder: "CLIPROXY_API_KEY",
+    validate: (value) => {
+      try {
+        ensureSecretName(value ?? "", "API key secret name");
+        return;
+      } catch (error) {
+        return extractErrorMessage(error);
+      }
+    }
+  }), "Setup cancelled before choosing the generic API key secret name."), "API key secret name");
+  const baseUrlSecretName = ensureSecretName(await promptValue(clack.text({
+    message: "Name for the proxy base URL secret",
+    placeholder: "CLIPROXY_BASE_URL",
+    validate: (value) => {
+      try {
+        ensureSecretName(value ?? "", "Base URL secret name");
+        return;
+      } catch (error) {
+        return extractErrorMessage(error);
+      }
+    }
+  }), "Setup cancelled before choosing the generic base URL secret name."), "Base URL secret name");
+  return { apiKeySecretName, baseUrlSecretName };
 }
 
-// src/commands/cliproxy/setup.ts
-var DEFAULT_CLIPROXY_URL5 = "https://cliproxy.fro.bot";
-function resolveBaseUrl3(input) {
-  return stripTrailingSlash4(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL5);
+// src/commands/cliproxy/setup/gh.ts
+function extractErrorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
 }
-function safeWarn(message) {
+async function withSpinner(message, run) {
+  const spinnerInstance = spinner();
+  spinnerInstance.start(message);
   try {
-    log2.warn(message);
-  } catch {}
+    const result = await run(spinnerInstance);
+    spinnerInstance.stop(message);
+    return result;
+  } catch (error) {
+    spinnerInstance.error(`${message} failed`);
+    throw error;
+  }
 }
-function buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames) {
-  const secretPart = writtenSecretNames.length > 0 ? `gh secret list --repo ${repo} (expect: ${writtenSecretNames.join(", ")})` : `gh secret list --repo ${repo}`;
-  const variablePart = writtenVariableNames.length > 0 ? `gh variable list --repo ${repo} (expect: ${writtenVariableNames.join(", ")})` : `gh variable list --repo ${repo}`;
-  return `Post-write readback: could not verify the written names are visible in ${repo} ` + `(the GitHub list call failed). Verify manually: ${secretPart}; ${variablePart}.`;
+async function runCommand(command, args) {
+  const child = Bun.spawn([command, ...args], {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { stdout, stderr, exitCode };
 }
-async function verifyWrittenNamesVisible(repo, writtenSecretNames, writtenVariableNames, listExistingGhNames2) {
-  try {
-    let secretReadback;
-    let variableReadback;
-    let readbackFailed = false;
-    try {
-      secretReadback = await listExistingGhNames2(repo, "secret");
-    } catch {
-      readbackFailed = true;
-      secretReadback = [];
-    }
-    if (readbackFailed) {
-      variableReadback = [];
-    } else {
-      try {
-        variableReadback = await listExistingGhNames2(repo, "variable");
-      } catch {
-        readbackFailed = true;
-        variableReadback = [];
-      }
-    }
-    if (readbackFailed) {
-      safeWarn(buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames));
-      return;
-    }
-    const absentSecrets = writtenSecretNames.filter((name) => !secretReadback.includes(name));
-    const absentVariables = writtenVariableNames.filter((name) => !variableReadback.includes(name));
-    if (absentSecrets.length === 0 && absentVariables.length === 0) {
-      return;
-    }
-    const lines = [
-      `Post-write readback: the following written names are not visible in ${repo} \u2014 ` + `the token's list view may be unreliable and the pre-write safety gates may have been bypassed.`
-    ];
-    if (absentSecrets.length > 0) {
-      lines.push(`  Absent secrets: ${absentSecrets.join(", ")}`);
-      lines.push(`  Verify manually: gh secret list --repo ${repo}`);
-    }
-    if (absentVariables.length > 0) {
-      lines.push(`  Absent variables: ${absentVariables.join(", ")}`);
-      lines.push(`  Verify manually: gh variable list --repo ${repo}`);
-    }
-    safeWarn(lines.join(`
-`));
-  } catch {
-    safeWarn(buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames));
-  }
+async function runGh(args) {
+  return runCommand("gh", args);
 }
-function extractErrorMessage4(error) {
-  return error instanceof Error ? error.message : String(error);
+function isGhRateLimitError(text2) {
+  return /rate limit/i.test(text2);
 }
-function redactKey(key) {
-  if (key.length < 12)
-    return "sk-***";
-  return `${key.slice(0, 3)}***${key.slice(-4)}`;
+async function queryRateLimitReset() {
+  try {
+    const result = await runGh(["api", "rate_limit"]);
+    if (result.exitCode === 0) {
+      const parsed = JSON.parse(result.stdout);
+      const reset = parsed.resources?.graphql?.reset ?? parsed.resources?.core?.reset;
+      if (reset) {
+        return new Date(reset * 1000).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+      }
+    }
+  } catch {}
+  return "an unknown time";
 }
-async function buildInteractivePlan(options, baseUrl, promptsImpl) {
-  const createKey = !options.key;
-  const keyName = createKey ? await promptsImpl.promptValue(text3({
-    message: "Name this new CLIProxyAPI key",
-    placeholder: "my-repo-ci",
-    validate: (value) => (value ?? "").trim().length > 0 ? undefined : "Key name is required."
-  }), "Setup cancelled before naming the key.") : undefined;
-  const harness = options.harness ?? await promptsImpl.promptValue(select2({
-    message: "Choose the harness to configure",
-    options: [
-      { value: "opencode", label: "OpenCode" },
-      { value: "claude-code", label: "Claude Code" },
-      { value: "generic", label: "Generic" }
-    ]
-  }), "Setup cancelled before selecting a harness.");
-  const repo = options.repo ? ensureRepoFormat(options.repo) : ensureRepoFormat(await promptsImpl.promptValue(text3({
-    message: "Target GitHub repository",
-    placeholder: "owner/repo",
-    validate: (value) => {
-      try {
-        ensureRepoFormat(value ?? "");
-        return;
-      } catch (error) {
-        return extractErrorMessage4(error);
+async function withGhRetry(label, fn, interactive, queryReset = queryRateLimitReset) {
+  for (;; ) {
+    try {
+      return await withSpinner(label, fn);
+    } catch (error) {
+      const message = extractErrorMessage2(error);
+      if (!isGhRateLimitError(message)) {
+        throw error;
+      }
+      const reset = await queryReset();
+      if (!interactive) {
+        throw new Error(`${message} \u2014 GitHub API rate limit resets at ${reset}. Re-run when ready.`);
+      }
+      log.warn(`GitHub API rate limit exceeded. Resets at ${reset}.`);
+      const retry = await promptValue(confirm({
+        message: "Retry this step when ready?",
+        active: "retry",
+        inactive: "abort",
+        initialValue: true
+      }), "Setup aborted after rate limit.");
+      if (!retry) {
+        cancelAndExit("Setup aborted after GitHub API rate limit.");
       }
     }
-  }), "Setup cancelled before choosing a repository."));
-  let providers;
-  let model;
-  if (harness === "opencode") {
-    const doPromptForProviders = promptsImpl.promptForProviders ?? promptForProviders;
-    const doPromptForModel = promptsImpl.promptForModel ?? promptForModel;
-    providers = await doPromptForProviders();
-    model = await doPromptForModel(providers);
   }
-  const keyValue = options.key ?? buildApiKeyValue(keyName ?? "cliproxy");
-  const genericSecretNames = harness === "generic" ? await promptGenericSecretNames() : undefined;
-  return {
-    repo,
-    harness,
-    keyValue,
-    keyName,
-    createKey,
-    template: getHarnessTemplate(harness, { keyValue, baseUrl, genericSecretNames, providers, model })
-  };
 }
-function requiresDestructiveProviderChangeConfirmation(providers) {
-  return !(providers.length === 1 && providers[0] === "anthropic");
+async function assertGhInstalled() {
+  if (!Bun.which("gh")) {
+    throw new Error("GitHub CLI is required for cliproxy setup. Install gh first: https://cli.github.com/");
+  }
 }
-async function buildNonInteractivePlan(options, baseUrl, deps) {
-  const harness = harnessSchema.parse(options.harness);
-  const repo = ensureRepoFormat(options.repo ?? "");
-  const keyValue = options.key ?? "";
-  const providers = options.providers ? parseProviders(options.providers) : ["anthropic"];
-  let model;
-  if (options.model) {
-    model = options.model;
-  } else if (providers.length === 1) {
-    model = PROVIDER_DEFAULTS[providers[0]];
-  } else {
-    throw new Error("Pass --model <provider/model-id> when selecting multiple providers.");
+async function assertGhAuthenticated() {
+  const result = await runGh(["auth", "status"]);
+  if (result.exitCode !== 0) {
+    throw new Error(`GitHub CLI is not authenticated. Run "gh auth login" first. ${result.stderr.trim()}`.trim());
   }
-  if (options.dryRun) {
-    return {
-      repo,
-      harness,
-      keyValue,
-      createKey: false,
-      template: getHarnessTemplate(harness, { keyValue: keyValue || "sk-placeholder", baseUrl, providers, model })
-    };
+}
+async function assertRepoAccess(repo) {
+  const { z: z12 } = await import("zod");
+  const ghRepoViewSchema = z12.object({
+    nameWithOwner: z12.string(),
+    viewerPermission: z12.string()
+  });
+  const result = await runGh(["repo", "view", repo, "--json", "nameWithOwner,viewerPermission"]);
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to access ${repo}. ${result.stderr.trim()}`.trim());
   }
-  const verifyModels = deps?.validation?.verifyModelsAvailable ?? verifyModelsAvailable;
-  if (requiresDestructiveProviderChangeConfirmation(providers) && !options.force) {
-    throw new Error(`Refusing destructive provider change on ${options.repo ?? ""} without --force. Selected providers ${providers.join(", ")} would overwrite existing GitHub secret values (OPENCODE_AUTH_JSON, OPENCODE_CONFIG, FRO_BOT_MODEL). Note: --force authorizes overwriting these GitHub secret values; it does NOT rotate the underlying CLIProxyAPI proxy bearer token (which is preserved byte-for-byte when --key is supplied).`);
+  const parsed = ghRepoViewSchema.parse(JSON.parse(result.stdout));
+  const writePermissions = new Set(["ADMIN", "MAINTAIN", "WRITE"]);
+  if (!writePermissions.has(parsed.viewerPermission)) {
+    throw new Error(`GitHub CLI does not have write access to ${parsed.nameWithOwner}. Current permission: ${parsed.viewerPermission}.`);
   }
-  await verifyModels(baseUrl, keyValue, providers, model);
-  return {
-    repo,
-    harness,
-    keyValue,
-    createKey: false,
-    template: getHarnessTemplate(harness, { keyValue, baseUrl, providers, model })
-  };
 }
-var realGh = {
-  assertGhInstalled,
-  assertGhAuthenticated,
-  assertRepoAccess,
-  listExistingGhNames,
-  createManagementApiKey,
-  deleteManagementApiKey,
-  applyGhValue,
-  withGhRetry
-};
-var realPrompts = {
-  promptValue,
-  confirm: confirm2,
-  intro,
-  note,
-  outro,
-  promptForProviders,
-  promptForModel
-};
-var realSmoke = {
-  runSmokeTest
-};
-var realValidation = {
-  assertProxyReachable,
-  assertProxyKeyWorks,
-  verifyModelsAvailable
-};
-var realCtx = {
-  console: {
-    log: (...args) => {
-      console.log(...args);
-    },
-    error: (...args) => {
-      console.error(...args);
-    }
-  },
-  process: {
-    stdout: { write: (chunk) => process.stdout.write(chunk) },
-    stderr: { write: (chunk) => process.stderr.write(chunk) },
-    exit: (code) => process.exit(code)
+async function listExistingGhNames(repo, kind) {
+  const { z: z12 } = await import("zod");
+  const ghNameListSchema = z12.array(z12.object({ name: z12.string() }));
+  const result = await runGh([kind, "list", "--repo", repo, "--json", "name"]);
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to list existing GitHub ${kind}s for ${repo}. ${result.stderr.trim()}`.trim());
   }
-};
-async function runSetupCommand(options, deps = {}) {
-  const interactive = deps.interactive ?? Boolean(process.stdin.isTTY);
-  const baseUrl = deps.baseUrl ?? resolveBaseUrl3();
-  const ctxInjected = deps.ctx !== undefined;
-  const ctx = deps.ctx ?? realCtx;
-  const gh = deps.gh ?? realGh;
-  const prompts = deps.prompts ?? realPrompts;
-  const smoke = deps.smoke ?? realSmoke;
-  const validation = deps.validation ?? realValidation;
-  const mgmtKeyResolver = deps.resolveManagementKey ?? resolveManagementKey;
-  if (options.dryRun) {
-    const providers = options.providers ? parseProviders(options.providers) : ["anthropic"];
-    const model = options.model ?? PROVIDER_DEFAULTS[providers[0]];
-    const harness = options.harness ?? "opencode";
-    const repo = options.repo ?? "<repo not specified>";
-    const keyValue = options.key ?? "sk-placeholder";
-    ctx.console.log(formatDryRunPreview({
-      repo,
-      harness,
-      providers,
-      model,
-      template: getHarnessTemplate(harness, { keyValue, baseUrl, providers, model })
-    }));
+  return ghNameListSchema.parse(JSON.parse(result.stdout)).map((entry) => entry.name);
+}
+async function createManagementApiKey(baseUrl, managementKey, keyValue) {
+  const endpoint = `${baseUrl}/v0/management/api-keys`;
+  const currentPayload = await requestJson(endpoint, {
+    method: "GET",
+    headers: managementHeaders(managementKey)
+  });
+  const currentKeys = parseManagementKeyList(currentPayload);
+  if (currentKeys.includes(keyValue)) {
     return;
   }
-  validateSetupOptions(options, interactive);
-  if (interactive) {
-    prompts.intro("CLIProxyAPI setup wizard");
+  await requestJson(endpoint, {
+    method: "PUT",
+    headers: managementHeaders(managementKey),
+    body: JSON.stringify([...currentKeys, keyValue])
+  });
+}
+async function deleteManagementApiKey(baseUrl, managementKey, keyValue) {
+  const endpoint = `${baseUrl}/v0/management/api-keys`;
+  const currentPayload = await requestJson(endpoint, {
+    method: "GET",
+    headers: managementHeaders(managementKey)
+  });
+  const currentKeys = parseManagementKeyList(currentPayload);
+  const filtered = currentKeys.filter((k) => k !== keyValue);
+  if (filtered.length === currentKeys.length) {
+    return;
   }
-  try {
-    await withSpinner("Checking GitHub CLI availability", async () => {
-      await gh.assertGhInstalled();
-      await gh.assertGhAuthenticated();
-    });
-    await withSpinner("Checking CLIProxyAPI reachability", async () => {
-      await validation.assertProxyReachable(baseUrl);
+  await requestJson(endpoint, {
+    method: "PUT",
+    headers: managementHeaders(managementKey),
+    body: JSON.stringify(filtered)
+  });
+}
+async function applyGhValue(kind, name, repo, value) {
+  if (kind === "secret") {
+    const child = Bun.spawn(["gh", "secret", "set", name, "--repo", repo], {
+      stdin: new Blob([value]).stream(),
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
     });
-    const plan = interactive ? await buildInteractivePlan(options, baseUrl, prompts) : await buildNonInteractivePlan(options, baseUrl, { validation });
-    if (plan.createKey) {
-      mgmtKeyResolver();
+    const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited]);
+    if (exitCode !== 0) {
+      throw new Error(`gh secret set ${name} failed: ${stderr.trim()}`.trim());
     }
-    await gh.withGhRetry(`Checking GitHub access for ${plan.repo}`, async () => {
-      await gh.assertRepoAccess(plan.repo);
-    }, interactive);
-    if (options.key) {
-      log2.info("Using the provided API key value directly. No new CLIProxyAPI key will be created.");
+    return;
+  }
+  const result = await runGh([kind, "set", name, "--repo", repo, "--body", value]);
+  if (result.exitCode !== 0) {
+    throw new Error(`gh ${kind} set ${name} failed: ${result.stderr.trim()}`.trim());
+  }
+}
+
+// src/commands/cliproxy/setup/preview.ts
+function formatDryRunPreview(opts) {
+  const { repo, harness, providers, model, template } = opts;
+  const lines = [
+    `Dry run: cliproxy setup --harness ${harness}`,
+    `Repository: ${repo}`,
+    `Providers: ${providers.join(", ")}`,
+    `Model: ${model}`,
+    "Planned secrets:"
+  ];
+  for (const secret of template.secrets) {
+    const size = new TextEncoder().encode(secret.value).byteLength;
+    lines.push(`  - ${secret.name} (${size} bytes)`);
+  }
+  lines.push("Planned variables:");
+  for (const variable of template.variables) {
+    lines.push(`  - ${variable.name} = ${variable.value}`);
+  }
+  lines.push("Proxy key (redacted): <proxy-key>");
+  lines.push("No mutations will be performed.");
+  return lines.join(`
+`);
+}
+
+// src/commands/cliproxy/setup/providers.ts
+import { isCancel as isCancel2, multiselect, select, text as text2 } from "@clack/prompts";
+import { z as z12 } from "zod";
+var providerIdSchema = z12.enum(["anthropic", "openai"]);
+var MODEL_ID_RE = /^(?:anthropic|openai)\/[a-z\d](?:[a-z\d.\-]*[a-z\d])?$/;
+function parseProviders(input) {
+  const parts = input.split(",").map((p) => p.trim()).filter(Boolean);
+  if (parts.length === 0) {
+    throw new Error("--providers must not be empty. Supported values: anthropic, openai");
+  }
+  const parsed = parts.map((p) => {
+    const result = providerIdSchema.safeParse(p);
+    if (!result.success) {
+      throw new Error(`Unknown provider "${p}". Supported values: anthropic, openai`);
     }
-    if (interactive) {
-      prompts.note([
-        `Proxy: ${baseUrl}`,
-        `Repository: ${plan.repo}`,
-        `Harness: ${plan.harness}`,
-        plan.createKey ? `New key name: ${plan.keyName}` : "Using existing key value",
-        "GitHub values to write:",
-        formatTemplateSummary(plan.template)
-      ].join(`
-`), "Setup summary");
-      const shouldContinue = await prompts.promptValue(prompts.confirm({
-        message: "Proceed with GitHub secret and variable updates?",
-        active: "yes",
-        inactive: "no",
-        initialValue: true
-      }), "Setup cancelled before applying GitHub values.");
-      if (!shouldContinue) {
-        cancelAndExit("No changes applied.");
-      }
+    return result.data;
+  });
+  const deduped = new Set(parsed);
+  if (deduped.size < parsed.length) {
+    throw new Error(`--providers contains duplicate values: ${parsed.join(",")}`);
+  }
+  return parsed;
+}
+var PROVIDER_DEFAULTS = {
+  anthropic: "anthropic/claude-sonnet-4-6",
+  openai: "openai/gpt-5.4-mini"
+};
+var CUSTOM_MODEL_SENTINEL = "__custom__";
+async function promptForProviders() {
+  let providers = [];
+  do {
+    const result = await multiselect({
+      message: "Select providers to configure",
+      options: [
+        { value: "anthropic", label: "Anthropic" },
+        { value: "openai", label: "OpenAI" }
+      ],
+      initialValues: ["anthropic"],
+      required: false
+    });
+    if (isCancel2(result)) {
+      cancelAndExit("Setup cancelled before selecting providers.");
     }
-    const [existingSecrets, existingVariables] = await gh.withGhRetry("Checking existing GitHub secrets and variables", async () => Promise.all([gh.listExistingGhNames(plan.repo, "secret"), gh.listExistingGhNames(plan.repo, "variable")]), interactive);
-    if (options.key && existingSecrets.includes("OPENCODE_AUTH_JSON")) {
-      if (interactive) {
-        const proceed = await prompts.promptValue(prompts.confirm({
-          message: `You supplied --key ${redactKey(options.key)}. Verify it matches the bearer token inside the existing OPENCODE_AUTH_JSON on ${plan.repo}. Continue?`,
-          active: "yes",
-          inactive: "no",
-          initialValue: false
-        }), "Setup cancelled. Run with --ack-key-reuse to bypass interactive confirmation.");
-        if (!proceed) {
-          cancelAndExit("Setup cancelled. Run with --ack-key-reuse to bypass interactive confirmation.");
+    providers = result;
+  } while (providers.length === 0);
+  return providers;
+}
+async function promptForModel(providers) {
+  if (providers.length === 1) {
+    return PROVIDER_DEFAULTS[providers[0]];
+  }
+  const chosen = await select({
+    message: "Choose a default model",
+    options: [
+      { value: "openai/gpt-5.4-mini", label: "openai/gpt-5.4-mini" },
+      { value: "anthropic/claude-sonnet-4-6", label: "anthropic/claude-sonnet-4-6" },
+      { value: CUSTOM_MODEL_SENTINEL, label: "Enter custom model ID..." }
+    ]
+  });
+  if (isCancel2(chosen)) {
+    cancelAndExit("Setup cancelled before selecting a model.");
+  }
+  if (chosen === CUSTOM_MODEL_SENTINEL) {
+    return promptForCustomModel();
+  }
+  return chosen;
+}
+async function promptForCustomModel() {
+  let modelId;
+  do {
+    const result = await text2({
+      message: "Enter a custom model ID (e.g. openai/gpt-5.4-mini)",
+      placeholder: "provider/model-name",
+      validate: (value) => {
+        if (!MODEL_ID_RE.test(value ?? "")) {
+          return "Model ID must match provider/model-name (lowercase, digits, dots, hyphens only)";
         }
-      } else if (!options.ackKeyReuse) {
-        throw new Error(`Refusing key-reuse without explicit acknowledgment. Pass --ack-key-reuse to confirm that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON on ${plan.repo}. (The CLI cannot verify this because GitHub secrets are write-only.)`);
+        return;
       }
+    });
+    if (isCancel2(result)) {
+      cancelAndExit("Setup cancelled before entering a custom model ID.");
     }
-    const collisions = collectCollisions(plan.template, existingSecrets, existingVariables);
-    if (collisions.length > 0) {
-      if (!interactive && !options.force) {
-        throw new Error(`Refusing to overwrite existing GitHub values in ${plan.repo}: ${collisions.join(", ")}. Pass --force to confirm. Note: --force only authorizes overwriting these GitHub secret values; it does NOT rotate the underlying CLIProxyAPI proxy bearer token (which is preserved byte-for-byte when --key is supplied).`);
-      }
-      if (!interactive && options.force) {
-        log2.warn(`Overwriting existing GitHub values: ${collisions.join(", ")}. ` + `Concurrent setup runs against the same repo are not coordinated and resolve last-write-wins \u2014 don't run setup against this repo from two places at once.`);
-      }
-      if (interactive) {
-        log2.warn(`Existing GitHub values will be overwritten: ${collisions.join(", ")}`);
-        const overwrite = await prompts.promptValue(prompts.confirm({
-          message: "Overwrite the existing GitHub values?",
-          active: "overwrite",
-          inactive: "cancel",
-          initialValue: false
-        }), "Setup cancelled instead of overwriting existing values.");
-        if (!overwrite) {
-          cancelAndExit("Existing GitHub values left unchanged.");
-        }
+    const candidate = result;
+    if (MODEL_ID_RE.test(candidate)) {
+      modelId = candidate;
+    }
+  } while (!modelId);
+  return modelId;
+}
+
+// src/commands/cliproxy/setup/smoke-test.ts
+import { z as z13 } from "zod";
+var baselineRunSchema = z13.array(z13.object({ databaseId: z13.number() }));
+var ghRunEntrySchema = z13.object({
+  databaseId: z13.number(),
+  status: z13.string(),
+  conclusion: z13.string().nullable(),
+  url: z13.string(),
+  createdAt: z13.string()
+});
+async function runSmokeTest(repo, _model, internals = {}) {
+  const BACKOFF_MS = [5000, 15000, 30000, 60000, 60000];
+  const delayFn = async (ms) => {
+    if (internals._testDelayMs !== undefined) {
+      if (internals._testDelayMs > 0) {
+        await new Promise((resolve2) => setTimeout(resolve2, internals._testDelayMs));
       }
+      return;
     }
-    let keyCreatedByThisRun = false;
-    const managementKey = plan.createKey ? mgmtKeyResolver() : undefined;
-    if (plan.createKey && managementKey) {
-      await withSpinner("Creating a new CLIProxyAPI key", async () => {
-        await gh.createManagementApiKey(baseUrl, managementKey, plan.keyValue);
-        keyCreatedByThisRun = true;
-      });
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
+  };
+  const repoUrl = `https://github.com/${repo}`;
+  let baselineId = null;
+  try {
+    const baselineChild = Bun.spawn(["gh", "run", "list", "--workflow=fro-bot.yaml", "--repo", repo, "--limit", "1", "--json", "databaseId"], { stdout: "pipe", stderr: "pipe", env: process.env });
+    const [baselineStdout, , baselineExit] = await Promise.all([
+      new Response(baselineChild.stdout).text(),
+      new Response(baselineChild.stderr).text(),
+      baselineChild.exited
+    ]);
+    if (baselineExit === 0) {
+      const parseResult = baselineRunSchema.safeParse(JSON.parse(baselineStdout));
+      if (parseResult.success && parseResult.data.length > 0 && parseResult.data[0]) {
+        baselineId = parseResult.data[0].databaseId;
+      }
     }
-    try {
-      await gh.withGhRetry("Writing GitHub secrets and variables", async (spinnerInstance) => {
-        for (const secret of plan.template.secrets) {
-          spinnerInstance.message(`Setting secret ${secret.name}`);
-          await gh.applyGhValue("secret", secret.name, plan.repo, secret.value);
-        }
-        for (const variable of plan.template.variables) {
-          spinnerInstance.message(`Setting variable ${variable.name}`);
-          await gh.applyGhValue("variable", variable.name, plan.repo, variable.value);
-        }
-      }, interactive);
-      await verifyWrittenNamesVisible(plan.repo, plan.template.secrets.map((s) => s.name), plan.template.variables.map((v) => v.name), gh.listExistingGhNames);
-      await withSpinner("Verifying the new key through the proxy", async () => {
-        await validation.assertProxyKeyWorks(baseUrl, plan.keyValue);
-      });
-      if (plan.harness === "opencode") {
-        const workflow = await gh.withGhRetry(`Checking ${plan.repo} fro-bot.yaml wiring`, async () => {
-          return checkFroBotWorkflow(plan.repo);
-        }, interactive);
-        switch (workflow.kind) {
-          case "missing": {
-            log2.warn(`No .github/workflows/fro-bot.yaml found in ${plan.repo}. The secrets and variables are set, but Fro Bot won't run until the workflow exists and passes them as inputs. See marcusrbrown/infra/.github/workflows/fro-bot.yaml for a reference.`);
-            break;
-          }
-          case "unreachable": {
-            log2.warn(`Could not check .github/workflows/fro-bot.yaml in ${plan.repo}: ${workflow.reason}. The secrets and variables are set, but the workflow wiring was not verified. Re-run 'infra cliproxy setup' later to confirm, or inspect the file directly.`);
-            break;
-          }
-          case "no-agent-step": {
-            log2.warn(`${plan.repo} .github/workflows/fro-bot.yaml exists but has no 'fro-bot/agent' step. Add one that passes the secrets and variables just written. See marcusrbrown/infra/.github/workflows/fro-bot.yaml for a reference.`);
-            break;
-          }
-          case "analyzed": {
-            for (const step of workflow.stepsWithGaps) {
-              const missing = [...step.missingInputs];
-              log2.warn([
-                `${plan.repo} .github/workflows/fro-bot.yaml fro-bot/agent step #${step.stepOrdinal} is missing ${missing.length} required input${missing.length > 1 ? "s" : ""} (${missing.join(", ")}).`,
-                `Without ${missing.includes("opencode-config") ? "opencode-config, the baseURL override is ignored and Fro Bot hits api.anthropic.com with the proxy key, which fails with 401" : "these, the secrets you just wrote will not reach OpenCode"}.`,
-                "",
-                `Add under the 'with:' block of the 'fro-bot/agent' step:`,
-                formatWorkflowSnippet(missing)
-              ].join(`
-`));
-            }
-            break;
-          }
-          default: {
-            const _exhaustive = workflow;
-            throw new Error(`Unhandled FroBotWorkflowCheck kind: ${JSON.stringify(_exhaustive)}`);
-          }
+  } catch {}
+  const triggerTime = internals._testTriggerTime ?? new Date;
+  const triggerChild = Bun.spawn(["gh", "workflow", "run", "fro-bot.yaml", "--repo", repo, "-f", "prompt=reply with exactly: ack"], { stdout: "pipe", stderr: "pipe", env: process.env });
+  const [, triggerStderr, triggerExit] = await Promise.all([
+    new Response(triggerChild.stdout).text(),
+    new Response(triggerChild.stderr).text(),
+    triggerChild.exited
+  ]);
+  if (triggerExit !== 0) {
+    const redacted = triggerStderr.slice(0, 200);
+    return { kind: "unverified", message: `gh workflow run failed: ${redacted}` };
+  }
+  let latestMatchedRun;
+  for (const BACKOFF_M of BACKOFF_MS) {
+    await delayFn(BACKOFF_M ?? 60000);
+    let pollRuns = [];
+    try {
+      const pollChild = Bun.spawn([
+        "gh",
+        "run",
+        "list",
+        "--workflow=fro-bot.yaml",
+        "--repo",
+        repo,
+        "--limit",
+        "5",
+        "--json",
+        "databaseId,status,conclusion,url,createdAt"
+      ], { stdout: "pipe", stderr: "pipe", env: process.env });
+      const [pollStdout, , pollExit] = await Promise.all([
+        new Response(pollChild.stdout).text(),
+        new Response(pollChild.stderr).text(),
+        pollChild.exited
+      ]);
+      if (pollExit === 0) {
+        const rawParsed = JSON.parse(pollStdout);
+        if (Array.isArray(rawParsed)) {
+          pollRuns = rawParsed.flatMap((entry) => {
+            const entryResult = ghRunEntrySchema.safeParse(entry);
+            return entryResult.success ? [entryResult.data] : [];
+          });
         }
       }
-    } catch (mutationError) {
-      if (keyCreatedByThisRun && managementKey) {
+    } catch {
+      continue;
+    }
+    const candidates = pollRuns.filter((run) => {
+      if (baselineId !== null) {
+        return run.databaseId > baselineId;
+      }
+      return new Date(run.createdAt) > triggerTime;
+    });
+    if (candidates.length === 0) {
+      continue;
+    }
+    const matched = candidates.reduce((best, run) => run.databaseId > best.databaseId ? run : best);
+    latestMatchedRun = matched;
+    const { status, conclusion, url: runUrl } = matched;
+    if (status === "waiting") {
+      return { kind: "unverified", message: `Workflow requires environment approval at ${runUrl}`, runUrl };
+    }
+    if (status === "completed") {
+      if (conclusion === "success") {
+        let logNote = "";
         try {
-          await gh.deleteManagementApiKey(baseUrl, managementKey, plan.keyValue);
-          log2.warn("Rolled back the newly created CLIProxyAPI key after failure.");
+          const logChild = Bun.spawn(["gh", "run", "view", String(matched.databaseId), "--log", "--repo", repo], {
+            stdout: "pipe",
+            stderr: "pipe",
+            env: process.env
+          });
+          const [logStdout, , logExit] = await Promise.all([
+            new Response(logChild.stdout).text(),
+            new Response(logChild.stderr).text(),
+            logChild.exited
+          ]);
+          if (logExit !== 0) {
+            logNote = " (log fetch failed, but run conclusion is success)";
+          } else if (!/\back\b/i.test(logStdout)) {
+            logNote = ' (log fetch succeeded but "ack" not found in output)';
+          }
         } catch {
-          log2.warn("Failed to roll back the newly created CLIProxyAPI key. Remove it manually via: infra cliproxy keys remove");
+          logNote = " (log fetch failed, but run conclusion is success)";
         }
+        return { kind: "pass", message: `Smoke test passed${logNote}`, runUrl };
       }
-      throw mutationError;
+      return { kind: "fail", message: `Run completed with conclusion=${conclusion ?? "unknown"}`, runUrl };
     }
-    if (interactive) {
-      prompts.outro(`Setup complete for ${plan.repo}. The ${plan.harness} harness can now use ${baseUrl}/v1.`);
+  }
+  if (latestMatchedRun) {
+    return {
+      kind: "unverified",
+      message: `Smoke test did not complete in 5 minutes; check ${latestMatchedRun.url}`,
+      runUrl: latestMatchedRun.url
+    };
+  }
+  return {
+    kind: "unverified",
+    message: `Smoke test trigger not yet visible; check ${repoUrl}/actions`
+  };
+}
+
+// src/commands/cliproxy/setup/templates.ts
+import { z as z14 } from "zod";
+var harnessSchema = z14.enum(["opencode", "claude-code", "generic"]);
+var DEFAULT_CLIPROXY_URL6 = "https://cliproxy.fro.bot";
+function stripTrailingSlash5(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function getHarnessTemplate(harness, values = {}) {
+  const keyValue = values.keyValue ?? "sk-placeholder";
+  const baseUrl = stripTrailingSlash5(values.baseUrl ?? DEFAULT_CLIPROXY_URL6);
+  if (harness === "opencode") {
+    const rawProviders = values.providers ?? ["anthropic"];
+    const PROVIDER_ORDER = ["anthropic", "openai"];
+    const providers = PROVIDER_ORDER.filter((p) => rawProviders.includes(p));
+    let model;
+    if (values.model) {
+      model = values.model;
+    } else if (providers.length === 1) {
+      model = PROVIDER_DEFAULTS[providers[0]];
     } else {
-      log2.success(`Setup complete for ${plan.repo}.`);
+      throw new Error("model required when multiple providers selected");
     }
-    if (options.verifySmoke) {
-      const smokeResult = await withSpinner("Running smoke test", async () => smoke.runSmokeTest(plan.repo, plan.template.variables.find((v) => v.name === "FRO_BOT_MODEL")?.value ?? "")).catch(async (error) => {
-        return {
-          kind: "unverified",
-          message: `Smoke test error: ${extractErrorMessage4(error)}`,
-          runUrl: undefined
-        };
-      });
-      ctx.console.log(`[smoke-test] kind=${smokeResult.kind}`);
-      switch (smokeResult.kind) {
-        case "pass": {
-          log2.success(`\u2713 ${smokeResult.message}${smokeResult.runUrl ? ` \u2014 ${smokeResult.runUrl}` : ""}`);
-          break;
-        }
-        case "fail": {
-          log2.warn(`\u2717 ${smokeResult.message}${smokeResult.runUrl ? ` \u2014 ${smokeResult.runUrl}` : ""}`);
-          break;
+    const authObj = {};
+    for (const p of providers) {
+      authObj[p] = { type: "api", key: keyValue };
+    }
+    const providerConfig = {};
+    for (const p of providers) {
+      providerConfig[p] = { options: { baseURL: `${baseUrl}/v1` } };
+    }
+    return {
+      secrets: [
+        {
+          name: "OPENCODE_AUTH_JSON",
+          value: JSON.stringify(authObj)
+        },
+        {
+          name: "OPENCODE_CONFIG",
+          value: JSON.stringify({ provider: providerConfig })
         }
-        case "unverified": {
-          log2.warn(`\u26A0 ${smokeResult.message}${smokeResult.runUrl ? ` \u2014 ${smokeResult.runUrl}` : ""}`);
-          break;
+      ],
+      variables: [
+        {
+          name: "FRO_BOT_MODEL",
+          value: model
         }
-        default: {
-          const _exhaustive = smokeResult;
-          throw new Error(`Unhandled SmokeResult kind: ${JSON.stringify(_exhaustive)}`);
+      ]
+    };
+  }
+  if (harness === "claude-code") {
+    return {
+      secrets: [
+        {
+          name: "ANTHROPIC_API_KEY",
+          value: keyValue
         }
+      ],
+      variables: []
+    };
+  }
+  if (!values.genericSecretNames) {
+    throw new Error("Generic harness requires custom secret names.");
+  }
+  return {
+    secrets: [
+      { name: values.genericSecretNames.apiKeySecretName, value: keyValue },
+      { name: values.genericSecretNames.baseUrlSecretName, value: `${baseUrl}/v1` }
+    ],
+    variables: []
+  };
+}
+function formatTemplateSummary(template) {
+  const secretLines = template.secrets.map((secret) => `- secret ${secret.name}`);
+  const variableLines = template.variables.map((variable) => `- variable ${variable.name}`);
+  return [...secretLines, ...variableLines].join(`
+`);
+}
+function collectCollisions(template, existingSecrets, existingVariables) {
+  const collisions = [];
+  for (const secret of template.secrets) {
+    if (existingSecrets.includes(secret.name)) {
+      collisions.push(`secret ${secret.name}`);
+    }
+  }
+  for (const variable of template.variables) {
+    if (existingVariables.includes(variable.name)) {
+      collisions.push(`variable ${variable.name}`);
+    }
+  }
+  return collisions;
+}
+
+// src/commands/cliproxy/setup/validation.ts
+import { z as z15 } from "zod";
+var modelEntrySchema2 = z15.object({
+  id: z15.string(),
+  owned_by: z15.string().optional()
+}).passthrough();
+var modelsResponseSchema2 = z15.object({
+  data: z15.array(modelEntrySchema2)
+}).passthrough();
+var MODEL_ID_RE2 = /^(?:anthropic|openai)\/[a-z\d](?:[a-z\d.\-]*[a-z\d])?$/;
+var HTTP_TIMEOUT_MS3 = 1e4;
+var PROVIDER_ID_PATTERNS2 = {
+  openai: /^(?:gpt-|o1-|o3-|codex)/i,
+  anthropic: /^claude-/i
+};
+function entryMatchesProvider2(entry, provider) {
+  if (entry.owned_by !== undefined && entry.owned_by.trim() !== "") {
+    return entry.owned_by === provider;
+  }
+  const id = entry.id ?? "";
+  if (id.startsWith(`${provider}/`)) {
+    return true;
+  }
+  const pattern = PROVIDER_ID_PATTERNS2[provider];
+  return pattern === undefined ? false : pattern.test(id);
+}
+function extractErrorMessage3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function validateSetupOptions(options, isInteractive) {
+  if (isInteractive) {
+    return;
+  }
+  if (options.providers) {
+    const providers = parseProviders(options.providers);
+    if (providers.length > 1 && !options.model) {
+      throw new Error("Pass --model <provider/model-id> when selecting multiple providers.");
+    }
+    if (options.model) {
+      const slashIndex = options.model.indexOf("/");
+      const prefix = slashIndex === -1 ? options.model : options.model.slice(0, slashIndex);
+      if (!providers.includes(prefix)) {
+        throw new Error(`Model prefix ${prefix} does not match selected providers (${providers.join(", ")}). Valid prefixes: ${providers.join(", ")}/`);
+      }
+    }
+  }
+  if (!options.dryRun && !options.key) {
+    throw new Error("--key is required when stdin is not a TTY. Provide an existing CLIProxyAPI key value.");
+  }
+  if (!options.repo) {
+    throw new Error("--repo is required when stdin is not a TTY. Provide the target GitHub repository as owner/repo.");
+  }
+  if (!options.harness) {
+    throw new Error("--harness is required when stdin is not a TTY. Choose opencode or claude-code.");
+  }
+  if (options.harness === "generic") {
+    throw new Error("--harness generic is interactive-only because it requires custom secret names.");
+  }
+}
+async function verifyModelsAvailable(baseUrl, key, providers, model) {
+  if (providers.length === 1 && providers[0] === "anthropic") {
+    return;
+  }
+  const endpoint = `${baseUrl}/v1/models`;
+  const response = await fetch(endpoint, {
+    headers: { Authorization: `Bearer ${key}` },
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (response.status === 401 || response.status === 403) {
+    throw new Error("Proxy key rejected. Verify with `cliproxy keys list` or rerun setup to create a new one.");
+  }
+  if (!response.ok) {
+    const rawBody = await response.text();
+    const redacted = (key.length > 0 ? rawBody.replaceAll(key, "<redacted>") : rawBody).replaceAll(/Bearer\s+[^\s"]+/g, "Bearer <redacted>").replaceAll(/sk-[\w.-]{8,}/g, "sk-<redacted>");
+    const excerpt = redacted.slice(0, 200);
+    throw new Error(`/v1/models returned HTTP ${response.status}: ${excerpt}`);
+  }
+  const json = await response.json();
+  let parsed;
+  try {
+    parsed = modelsResponseSchema2.parse(json);
+  } catch (error) {
+    const message = error instanceof z15.ZodError ? error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ") : extractErrorMessage3(error);
+    throw new Error(`Malformed /v1/models response: ${message}`);
+  }
+  const entries = parsed.data;
+  if (providers.includes("openai")) {
+    const hasOpenAi = entries.some((e) => entryMatchesProvider2(e, "openai"));
+    if (!hasOpenAi) {
+      throw new Error("No OpenAI models on proxy \u2014 is the Codex token loaded? Try `cliproxy login codex`.");
+    }
+  }
+  const slashIndex = model.indexOf("/");
+  const bareId = slashIndex === -1 ? model : model.slice(slashIndex + 1);
+  const providerPrefix = slashIndex >= 0 ? model.slice(0, slashIndex) : undefined;
+  const modelPresent = entries.some((e) => e.id === bareId || e.id === model);
+  if (!modelPresent) {
+    const matchingIds = providerPrefix ? entries.filter((e) => entryMatchesProvider2(e, providerPrefix)).map((e) => e.id) : entries.map((e) => e.id);
+    const available = matchingIds.length > 0 ? matchingIds.join(", ") : "(none)";
+    throw new Error(`Model "${bareId}" not found on proxy. Available ${providerPrefix ?? "models"}: ${available}`);
+  }
+}
+async function assertProxyReachable(baseUrl) {
+  try {
+    const response = await fetch(`${baseUrl}/healthz`, {
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
+    });
+    if (!response.ok) {
+      throw new Error(`Proxy check failed for ${baseUrl}: HTTP ${response.status}. Is the proxy running and reachable?`);
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Proxy check failed")) {
+      throw error;
+    }
+    throw new Error(`Unable to reach proxy at ${baseUrl}: ${extractErrorMessage3(error)}`);
+  }
+}
+async function assertProxyKeyWorks(baseUrl, keyValue) {
+  try {
+    const response = await fetch(`${baseUrl}/v1/models`, {
+      headers: {
+        authorization: `Bearer ${keyValue}`
+      },
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
+    });
+    if (!response.ok) {
+      throw new Error(`Proxy key verification failed with HTTP ${response.status}`);
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Proxy key verification")) {
+      throw error;
+    }
+    throw new Error(`Unable to verify proxy key at ${baseUrl}: ${extractErrorMessage3(error)}`);
+  }
+}
+
+// src/commands/cliproxy/setup/workflow-analyzer.ts
+var REQUIRED_OPENCODE_INPUTS = ["auth-json", "opencode-config", "model"];
+function findFroBotAgentStepBodies(content) {
+  const bodies = [];
+  const pattern = /^(\s*(?:-\s+)?)uses:\s*fro-bot\/agent@/gm;
+  for (const match of content.matchAll(pattern)) {
+    if (match.index === undefined || match[1] === undefined)
+      continue;
+    const stepBodyIndent = match[1].length;
+    const dashIndent = Math.max(0, stepBodyIndent - 2);
+    const lines = content.slice(match.index).split(`
+`);
+    const stepLines = [lines[0] ?? ""];
+    for (let index = 1;index < lines.length; index += 1) {
+      const line = lines[index] ?? "";
+      if (!line.trim()) {
+        stepLines.push(line);
+        continue;
+      }
+      const firstNonSpace = line.search(/\S/);
+      if (firstNonSpace === dashIndent && line.trimStart().startsWith("-"))
+        break;
+      if (firstNonSpace < dashIndent)
+        break;
+      stepLines.push(line);
+    }
+    bodies.push({ stepOrdinal: bodies.length + 1, body: stepLines.join(`
+`) });
+  }
+  return bodies;
+}
+function analyzeFroBotWorkflow(workflowContent) {
+  const steps = findFroBotAgentStepBodies(workflowContent);
+  if (steps.length === 0) {
+    return { kind: "no-agent-step" };
+  }
+  const stepsWithGaps = steps.map((step) => ({
+    stepOrdinal: step.stepOrdinal,
+    missingInputs: REQUIRED_OPENCODE_INPUTS.filter((input) => {
+      const inputPattern = new RegExp(String.raw`^\s+${input}:`, "m");
+      return !inputPattern.test(step.body);
+    })
+  })).filter((step) => step.missingInputs.length > 0);
+  return { kind: "analyzed", stepsWithGaps };
+}
+function interpretGhContentResult(result) {
+  if (result.exitCode === 0) {
+    return analyzeFroBotWorkflow(result.stdout);
+  }
+  if (/HTTP 404/.test(result.stderr)) {
+    return { kind: "missing" };
+  }
+  return {
+    kind: "unreachable",
+    reason: result.stderr.trim() || `gh api exited with code ${result.exitCode}`
+  };
+}
+async function checkFroBotWorkflow(repo) {
+  const result = await runGh([
+    "api",
+    "--header",
+    "Accept: application/vnd.github.raw",
+    `/repos/${repo}/contents/.github/workflows/fro-bot.yaml`
+  ]);
+  return interpretGhContentResult(result);
+}
+function formatWorkflowSnippet(missingInputs) {
+  const inputMap = {
+    "auth-json": "auth-json: ${{ secrets.OPENCODE_AUTH_JSON }}",
+    "opencode-config": "opencode-config: ${{ secrets.OPENCODE_CONFIG }}",
+    model: "model: ${{ vars.FRO_BOT_MODEL }}"
+  };
+  return missingInputs.map((input) => `          ${inputMap[input]}`).join(`
+`);
+}
+
+// src/commands/cliproxy/setup.ts
+var DEFAULT_CLIPROXY_URL7 = "https://cliproxy.fro.bot";
+function resolveBaseUrl3(input) {
+  return stripTrailingSlash5(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL7);
+}
+function safeWarn(message) {
+  try {
+    log2.warn(message);
+  } catch {}
+}
+function buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames) {
+  const secretPart = writtenSecretNames.length > 0 ? `gh secret list --repo ${repo} (expect: ${writtenSecretNames.join(", ")})` : `gh secret list --repo ${repo}`;
+  const variablePart = writtenVariableNames.length > 0 ? `gh variable list --repo ${repo} (expect: ${writtenVariableNames.join(", ")})` : `gh variable list --repo ${repo}`;
+  return `Post-write readback: could not verify the written names are visible in ${repo} ` + `(the GitHub list call failed). Verify manually: ${secretPart}; ${variablePart}.`;
+}
+async function verifyWrittenNamesVisible(repo, writtenSecretNames, writtenVariableNames, listExistingGhNames2) {
+  try {
+    let secretReadback;
+    let variableReadback;
+    let readbackFailed = false;
+    try {
+      secretReadback = await listExistingGhNames2(repo, "secret");
+    } catch {
+      readbackFailed = true;
+      secretReadback = [];
+    }
+    if (readbackFailed) {
+      variableReadback = [];
+    } else {
+      try {
+        variableReadback = await listExistingGhNames2(repo, "variable");
+      } catch {
+        readbackFailed = true;
+        variableReadback = [];
       }
     }
-  } catch (error) {
-    const message = extractErrorMessage4(error);
-    if (ctxInjected) {
-      ctx.console.error(message);
+    if (readbackFailed) {
+      safeWarn(buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames));
+      return;
     }
-    if (interactive) {
-      cancel2(message);
+    const absentSecrets = writtenSecretNames.filter((name) => !secretReadback.includes(name));
+    const absentVariables = writtenVariableNames.filter((name) => !variableReadback.includes(name));
+    if (absentSecrets.length === 0 && absentVariables.length === 0) {
+      return;
     }
-    throw error;
-  }
-}
-function registerCliproxySetup(cli) {
-  cli.command("cliproxy setup", "Interactively onboard a GitHub repository to CLIProxyAPI by creating or reusing a key and wiring the required GitHub secrets and variables.").option("--key [key]", z14.string().describe("Existing CLIProxyAPI API key value. When provided, setup skips key creation and reuses this key for GitHub secrets.")).option("--repo [repo]", z14.string().describe("Target GitHub repository in owner/repo format. Skips the repository prompt when provided.")).option("--harness [harness]", harnessSchema.describe("Harness template to configure. Choose opencode, claude-code, or generic. Generic remains interactive-only.")).option("--providers [providers]", z14.string().describe("Comma-separated list of providers to enable. Default: anthropic. Supported values: anthropic, openai. Example: --providers anthropic,openai")).option("--model [model]", z14.string().regex(MODEL_ID_RE2).describe("Override the default model. Must be provider-prefixed and lowercase. Required when multiple providers selected. Examples: anthropic/claude-sonnet-4-6, openai/gpt-4o")).option("--force", z14.boolean().optional().describe("Overwrite existing GitHub secrets and variables without prompting.")).option("--dry-run", z14.boolean().optional().describe("Print the plan without applying any changes.")).option("--verify-smoke", z14.boolean().optional().describe("Run a smoke test against the proxy after setup completes.")).option("--ack-key-reuse", z14.boolean().default(false).describe("Acknowledge that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON. Required in non-interactive mode when --key is supplied for a repo with existing OPENCODE_AUTH_JSON.")).example("# Preview planned actions without applying any changes (no flags required)").example("infra cliproxy setup --dry-run").example("# Run the interactive onboarding wizard").example("infra cliproxy setup").example("# Run non-interactively with an existing key (anthropic-only)").example("infra cliproxy setup --repo owner/repo --harness opencode --key sk-existing --force").example("# Enable both providers non-interactively (requires --force and --model)").example("infra cliproxy setup --repo owner/repo --harness opencode --providers anthropic,openai --model openai/gpt-5.4-mini --key sk-existing --ack-key-reuse --force").action(async (options, ctx) => {
-    await runSetupCommand(options, { ctx });
-  });
-}
-
-// src/commands/cliproxy/status.ts
-import { z as z15 } from "zod";
-var DEFAULT_CLIPROXY_URL6 = "https://cliproxy.fro.bot";
-function levelLabel(level) {
-  if (level === "ok") {
-    return "OK";
-  }
-  if (level === "warning") {
-    return "WARN";
+    const lines = [
+      `Post-write readback: the following written names are not visible in ${repo} \u2014 ` + `the token's list view may be unreliable and the pre-write safety gates may have been bypassed.`
+    ];
+    if (absentSecrets.length > 0) {
+      lines.push(`  Absent secrets: ${absentSecrets.join(", ")}`);
+      lines.push(`  Verify manually: gh secret list --repo ${repo}`);
+    }
+    if (absentVariables.length > 0) {
+      lines.push(`  Absent variables: ${absentVariables.join(", ")}`);
+      lines.push(`  Verify manually: gh variable list --repo ${repo}`);
+    }
+    safeWarn(lines.join(`
+`));
+  } catch {
+    safeWarn(buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames));
   }
-  return "ERROR";
 }
-function formatDurationMs(durationMs) {
-  return `${Math.max(0, Math.round(durationMs))}ms`;
+function extractErrorMessage4(error) {
+  return error instanceof Error ? error.message : String(error);
 }
-function stripTrailingSlash5(value) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
+function redactKey(key) {
+  if (key.length < 12)
+    return "sk-***";
+  return `${key.slice(0, 3)}***${key.slice(-4)}`;
 }
-async function parseJsonResponse(response) {
-  try {
-    return await response.json();
-  } catch {
-    return null;
+async function buildInteractivePlan(options, baseUrl, promptsImpl) {
+  const createKey = !options.key;
+  const keyName = createKey ? await promptsImpl.promptValue(text3({
+    message: "Name this new CLIProxyAPI key",
+    placeholder: "my-repo-ci",
+    validate: (value) => (value ?? "").trim().length > 0 ? undefined : "Key name is required."
+  }), "Setup cancelled before naming the key.") : undefined;
+  const harness = options.harness ?? await promptsImpl.promptValue(select2({
+    message: "Choose the harness to configure",
+    options: [
+      { value: "opencode", label: "OpenCode" },
+      { value: "claude-code", label: "Claude Code" },
+      { value: "generic", label: "Generic" }
+    ]
+  }), "Setup cancelled before selecting a harness.");
+  const repo = options.repo ? ensureRepoFormat(options.repo) : ensureRepoFormat(await promptsImpl.promptValue(text3({
+    message: "Target GitHub repository",
+    placeholder: "owner/repo",
+    validate: (value) => {
+      try {
+        ensureRepoFormat(value ?? "");
+        return;
+      } catch (error) {
+        return extractErrorMessage4(error);
+      }
+    }
+  }), "Setup cancelled before choosing a repository."));
+  let providers;
+  let model;
+  if (harness === "opencode") {
+    const doPromptForProviders = promptsImpl.promptForProviders ?? promptForProviders;
+    const doPromptForModel = promptsImpl.promptForModel ?? promptForModel;
+    providers = await doPromptForProviders();
+    model = await doPromptForModel(providers);
   }
+  const keyValue = options.key ?? buildApiKeyValue(keyName ?? "cliproxy");
+  const genericSecretNames = harness === "generic" ? await promptGenericSecretNames() : undefined;
+  return {
+    repo,
+    harness,
+    keyValue,
+    keyName,
+    createKey,
+    template: getHarnessTemplate(harness, { keyValue, baseUrl, genericSecretNames, providers, model })
+  };
 }
-function toNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+function requiresDestructiveProviderChangeConfirmation(providers) {
+  return !(providers.length === 1 && providers[0] === "anthropic");
 }
-async function checkHttpReachability(url, verbose) {
-  const startedAt = performance.now();
-  try {
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
-    });
-    const elapsedMs = performance.now() - startedAt;
-    const details = [];
-    if (verbose) {
-      details.push(`URL: ${url}`);
-      details.push(`Status text: ${response.statusText || "(none)"}`);
-      if (response.headers.get("content-type")) {
-        details.push(`Content-Type: ${response.headers.get("content-type")}`);
-      }
-    }
-    return {
-      title: "HTTP reachability",
-      level: response.ok ? "ok" : "error",
-      summary: `GET ${url} \u2192 ${response.status} (${formatDurationMs(elapsedMs)})`,
-      details
-    };
-  } catch (error) {
-    const elapsedMs = performance.now() - startedAt;
-    const message = error instanceof Error ? error.message : String(error);
+async function buildNonInteractivePlan(options, baseUrl, deps) {
+  const harness = harnessSchema.parse(options.harness);
+  const repo = ensureRepoFormat(options.repo ?? "");
+  const keyValue = options.key ?? "";
+  const providers = options.providers ? parseProviders(options.providers) : ["anthropic"];
+  let model;
+  if (options.model) {
+    model = options.model;
+  } else if (providers.length === 1) {
+    model = PROVIDER_DEFAULTS[providers[0]];
+  } else {
+    throw new Error("Pass --model <provider/model-id> when selecting multiple providers.");
+  }
+  if (options.dryRun) {
     return {
-      title: "HTTP reachability",
-      level: "error",
-      summary: `Request failed after ${formatDurationMs(elapsedMs)}: ${message}`,
-      details: verbose ? [`URL: ${url}`, `Timeout: ${HTTP_TIMEOUT_MS2}ms`] : undefined
+      repo,
+      harness,
+      keyValue,
+      createKey: false,
+      template: getHarnessTemplate(harness, { keyValue: keyValue || "sk-placeholder", baseUrl, providers, model })
     };
   }
-}
-function countQueueErrors(records) {
-  let count = 0;
-  for (const record of records) {
-    if (record === null || typeof record !== "object") {
-      continue;
-    }
-    const rec = record;
-    const status = toNumber(rec.status);
-    if (status !== null && status >= 400) {
-      count++;
-      continue;
-    }
-    if (rec.error !== undefined || rec.failed === true || rec.failure === true) {
-      count++;
-    }
+  const verifyModels = deps?.validation?.verifyModelsAvailable ?? verifyModelsAvailable;
+  if (requiresDestructiveProviderChangeConfirmation(providers) && !options.force) {
+    throw new Error(`Refusing destructive provider change on ${options.repo ?? ""} without --force. Selected providers ${providers.join(", ")} would overwrite existing GitHub secret values (OPENCODE_AUTH_JSON, OPENCODE_CONFIG, FRO_BOT_MODEL). Note: --force authorizes overwriting these GitHub secret values; it does NOT rotate the underlying CLIProxyAPI proxy bearer token (which is preserved byte-for-byte when --key is supplied).`);
   }
-  return count;
+  await verifyModels(baseUrl, keyValue, providers, model);
+  return {
+    repo,
+    harness,
+    keyValue,
+    createKey: false,
+    template: getHarnessTemplate(harness, { keyValue, baseUrl, providers, model })
+  };
 }
-async function checkUsageStats(baseUrl, key) {
-  const endpoint = `${baseUrl}/v0/management/usage-queue?count=50`;
-  try {
-    const response = await fetch(endpoint, {
-      headers: managementHeaders(key),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
-    });
-    if (response.status === 429) {
-      return {
-        title: "Usage stats",
-        level: "warning",
-        summary: "Rate limited by management API (HTTP 429). Retry in a few moments."
-      };
-    }
-    if (!response.ok) {
-      return {
-        title: "Usage stats",
-        level: "error",
-        summary: `GET /v0/management/usage-queue failed with HTTP ${response.status}`
-      };
-    }
-    const payload = await parseJsonResponse(response);
-    if (!Array.isArray(payload)) {
-      return {
-        title: "Usage stats",
-        level: "warning",
-        summary: "Usage-queue response was not an array \u2014 cannot parse recent activity."
-      };
-    }
-    const total = payload.length;
-    const errors2 = countQueueErrors(payload);
-    if (total === 0) {
-      return {
-        title: "Usage stats",
-        level: "ok",
-        summary: "recent: 0 (idle)"
-      };
+var realGh = {
+  assertGhInstalled,
+  assertGhAuthenticated,
+  assertRepoAccess,
+  listExistingGhNames,
+  createManagementApiKey,
+  deleteManagementApiKey,
+  applyGhValue,
+  withGhRetry
+};
+var realPrompts = {
+  promptValue,
+  confirm: confirm2,
+  intro,
+  note,
+  outro,
+  promptForProviders,
+  promptForModel
+};
+var realSmoke = {
+  runSmokeTest
+};
+var realValidation = {
+  assertProxyReachable,
+  assertProxyKeyWorks,
+  verifyModelsAvailable
+};
+var realCtx = {
+  console: {
+    log: (...args) => {
+      console.log(...args);
+    },
+    error: (...args) => {
+      console.error(...args);
     }
-    return {
-      title: "Usage stats",
-      level: errors2 > 0 ? "warning" : "ok",
-      summary: errors2 > 0 ? `recent: ${total}, errors: ${errors2}` : `recent: ${total}`
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      title: "Usage stats",
-      level: "error",
-      summary: `Unable to read usage stats: ${message}`
-    };
+  },
+  process: {
+    stdout: { write: (chunk) => process.stdout.write(chunk) },
+    stderr: { write: (chunk) => process.stderr.write(chunk) },
+    exit: (code) => process.exit(code)
+  }
+};
+async function runSetupCommand(options, deps = {}) {
+  const interactive = deps.interactive ?? Boolean(process.stdin.isTTY);
+  const baseUrl = deps.baseUrl ?? resolveBaseUrl3();
+  const ctxInjected = deps.ctx !== undefined;
+  const ctx = deps.ctx ?? realCtx;
+  const gh = deps.gh ?? realGh;
+  const prompts = deps.prompts ?? realPrompts;
+  const smoke = deps.smoke ?? realSmoke;
+  const validation = deps.validation ?? realValidation;
+  const mgmtKeyResolver = deps.resolveManagementKey ?? resolveManagementKey;
+  if (options.dryRun) {
+    const providers = options.providers ? parseProviders(options.providers) : ["anthropic"];
+    const model = options.model ?? PROVIDER_DEFAULTS[providers[0]];
+    const harness = options.harness ?? "opencode";
+    const repo = options.repo ?? "<repo not specified>";
+    const keyValue = options.key ?? "sk-placeholder";
+    ctx.console.log(formatDryRunPreview({
+      repo,
+      harness,
+      providers,
+      model,
+      template: getHarnessTemplate(harness, { keyValue, baseUrl, providers, model })
+    }));
+    return;
+  }
+  validateSetupOptions(options, interactive);
+  if (interactive) {
+    prompts.intro("CLIProxyAPI setup wizard");
   }
-}
-async function checkVersion(baseUrl, key) {
-  const endpoint = `${baseUrl}/v0/management/latest-version`;
   try {
-    const response = await fetch(endpoint, {
-      headers: managementHeaders(key),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+    await withSpinner("Checking GitHub CLI availability", async () => {
+      await gh.assertGhInstalled();
+      await gh.assertGhAuthenticated();
     });
-    if (response.status === 429) {
-      return {
-        title: "Latest version",
-        level: "warning",
-        summary: "Rate limited by management API (HTTP 429). Retry in a few moments."
-      };
+    await withSpinner("Checking CLIProxyAPI reachability", async () => {
+      await validation.assertProxyReachable(baseUrl);
+    });
+    const plan = interactive ? await buildInteractivePlan(options, baseUrl, prompts) : await buildNonInteractivePlan(options, baseUrl, { validation });
+    if (plan.createKey) {
+      mgmtKeyResolver();
     }
-    if (!response.ok) {
-      return {
-        title: "Latest version",
-        level: "error",
-        summary: `GET /v0/management/latest-version failed with HTTP ${response.status}`
-      };
+    await gh.withGhRetry(`Checking GitHub access for ${plan.repo}`, async () => {
+      await gh.assertRepoAccess(plan.repo);
+    }, interactive);
+    if (options.key) {
+      log2.info("Using the provided API key value directly. No new CLIProxyAPI key will be created.");
     }
-    const payload = await parseJsonResponse(response);
-    if (payload && typeof payload === "object") {
-      const version = payload["latest-version"];
-      if (typeof version === "string" && version.length > 0) {
-        return { title: "Latest version", level: "ok", summary: version };
+    if (interactive) {
+      prompts.note([
+        `Proxy: ${baseUrl}`,
+        `Repository: ${plan.repo}`,
+        `Harness: ${plan.harness}`,
+        plan.createKey ? `New key name: ${plan.keyName}` : "Using existing key value",
+        "GitHub values to write:",
+        formatTemplateSummary(plan.template)
+      ].join(`
+`), "Setup summary");
+      const shouldContinue = await prompts.promptValue(prompts.confirm({
+        message: "Proceed with GitHub secret and variable updates?",
+        active: "yes",
+        inactive: "no",
+        initialValue: true
+      }), "Setup cancelled before applying GitHub values.");
+      if (!shouldContinue) {
+        cancelAndExit("No changes applied.");
       }
     }
-    return {
-      title: "Latest version",
-      level: "warning",
-      summary: "Response did not include a latest-version string."
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return { title: "Latest version", level: "error", summary: `Unable to check latest version: ${message}` };
-  }
-}
-var DEFAULT_PROVIDER_MODEL = "claude-sonnet-4-6";
-async function checkProviderAuth(baseUrl, apiKey, options) {
-  const model = options?.model ?? DEFAULT_PROVIDER_MODEL;
-  const verbose = options?.verbose === true;
-  const endpoint = `${baseUrl}/v1/chat/completions`;
-  try {
-    const response = await fetch(endpoint, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${apiKey}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        model,
-        messages: [{ role: "user", content: "ping" }],
-        max_tokens: 1
-      }),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
-    });
-    const details = [];
-    if (verbose) {
-      details.push(`URL: ${endpoint}`);
-      details.push(`Model: ${model}`);
-      details.push(`Status: ${response.status}`);
+    const [existingSecrets, existingVariables] = await gh.withGhRetry("Checking existing GitHub secrets and variables", async () => Promise.all([gh.listExistingGhNames(plan.repo, "secret"), gh.listExistingGhNames(plan.repo, "variable")]), interactive);
+    if (options.key && existingSecrets.includes("OPENCODE_AUTH_JSON")) {
+      if (interactive) {
+        const proceed = await prompts.promptValue(prompts.confirm({
+          message: `You supplied --key ${redactKey(options.key)}. Verify it matches the bearer token inside the existing OPENCODE_AUTH_JSON on ${plan.repo}. Continue?`,
+          active: "yes",
+          inactive: "no",
+          initialValue: false
+        }), "Setup cancelled. Run with --ack-key-reuse to bypass interactive confirmation.");
+        if (!proceed) {
+          cancelAndExit("Setup cancelled. Run with --ack-key-reuse to bypass interactive confirmation.");
+        }
+      } else if (!options.ackKeyReuse) {
+        throw new Error(`Refusing key-reuse without explicit acknowledgment. Pass --ack-key-reuse to confirm that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON on ${plan.repo}. (The CLI cannot verify this because GitHub secrets are write-only.)`);
+      }
     }
-    if (response.ok) {
-      return {
-        title: "Upstream provider auth (anthropic)",
-        level: "ok",
-        summary: `anthropic route OK (${model})`,
-        details: details.length > 0 ? details : undefined
-      };
+    const collisions = collectCollisions(plan.template, existingSecrets, existingVariables);
+    if (collisions.length > 0) {
+      if (!interactive && !options.force) {
+        throw new Error(`Refusing to overwrite existing GitHub values in ${plan.repo}: ${collisions.join(", ")}. Pass --force to confirm. Note: --force only authorizes overwriting these GitHub secret values; it does NOT rotate the underlying CLIProxyAPI proxy bearer token (which is preserved byte-for-byte when --key is supplied).`);
+      }
+      if (!interactive && options.force) {
+        log2.warn(`Overwriting existing GitHub values: ${collisions.join(", ")}. ` + `Concurrent setup runs against the same repo are not coordinated and resolve last-write-wins \u2014 don't run setup against this repo from two places at once.`);
+      }
+      if (interactive) {
+        log2.warn(`Existing GitHub values will be overwritten: ${collisions.join(", ")}`);
+        const overwrite = await prompts.promptValue(prompts.confirm({
+          message: "Overwrite the existing GitHub values?",
+          active: "overwrite",
+          inactive: "cancel",
+          initialValue: false
+        }), "Setup cancelled instead of overwriting existing values.");
+        if (!overwrite) {
+          cancelAndExit("Existing GitHub values left unchanged.");
+        }
+      }
     }
-    if (response.status === 401) {
-      return {
-        title: "Upstream provider auth (anthropic)",
-        level: "error",
-        summary: `Anthropic upstream auth unavailable (${response.status}) \u2014 run: cliproxy login claude`,
-        details: details.length > 0 ? details : undefined
-      };
+    let keyCreatedByThisRun = false;
+    const managementKey = plan.createKey ? mgmtKeyResolver() : undefined;
+    if (plan.createKey && managementKey) {
+      await withSpinner("Creating a new CLIProxyAPI key", async () => {
+        await gh.createManagementApiKey(baseUrl, managementKey, plan.keyValue);
+        keyCreatedByThisRun = true;
+      });
     }
-    if (response.status === 503) {
-      let bodyText = "";
-      try {
-        bodyText = await response.text();
-      } catch {}
-      const isAuthUnavailable = /auth_unavailable|no auth available|providers=claude/i.test(bodyText);
-      if (isAuthUnavailable) {
-        return {
-          title: "Upstream provider auth (anthropic)",
-          level: "error",
-          summary: `Anthropic upstream auth unavailable (${response.status}) \u2014 run: cliproxy login claude`,
-          details: details.length > 0 ? details : undefined
-        };
+    try {
+      await gh.withGhRetry("Writing GitHub secrets and variables", async (spinnerInstance) => {
+        for (const secret of plan.template.secrets) {
+          spinnerInstance.message(`Setting secret ${secret.name}`);
+          await gh.applyGhValue("secret", secret.name, plan.repo, secret.value);
+        }
+        for (const variable of plan.template.variables) {
+          spinnerInstance.message(`Setting variable ${variable.name}`);
+          await gh.applyGhValue("variable", variable.name, plan.repo, variable.value);
+        }
+      }, interactive);
+      await verifyWrittenNamesVisible(plan.repo, plan.template.secrets.map((s) => s.name), plan.template.variables.map((v) => v.name), gh.listExistingGhNames);
+      await withSpinner("Verifying the new key through the proxy", async () => {
+        await validation.assertProxyKeyWorks(baseUrl, plan.keyValue);
+      });
+      if (plan.harness === "opencode") {
+        const workflow = await gh.withGhRetry(`Checking ${plan.repo} fro-bot.yaml wiring`, async () => {
+          return checkFroBotWorkflow(plan.repo);
+        }, interactive);
+        switch (workflow.kind) {
+          case "missing": {
+            log2.warn(`No .github/workflows/fro-bot.yaml found in ${plan.repo}. The secrets and variables are set, but Fro Bot won't run until the workflow exists and passes them as inputs. See marcusrbrown/infra/.github/workflows/fro-bot.yaml for a reference.`);
+            break;
+          }
+          case "unreachable": {
+            log2.warn(`Could not check .github/workflows/fro-bot.yaml in ${plan.repo}: ${workflow.reason}. The secrets and variables are set, but the workflow wiring was not verified. Re-run 'infra cliproxy setup' later to confirm, or inspect the file directly.`);
+            break;
+          }
+          case "no-agent-step": {
+            log2.warn(`${plan.repo} .github/workflows/fro-bot.yaml exists but has no 'fro-bot/agent' step. Add one that passes the secrets and variables just written. See marcusrbrown/infra/.github/workflows/fro-bot.yaml for a reference.`);
+            break;
+          }
+          case "analyzed": {
+            for (const step of workflow.stepsWithGaps) {
+              const missing = [...step.missingInputs];
+              log2.warn([
+                `${plan.repo} .github/workflows/fro-bot.yaml fro-bot/agent step #${step.stepOrdinal} is missing ${missing.length} required input${missing.length > 1 ? "s" : ""} (${missing.join(", ")}).`,
+                `Without ${missing.includes("opencode-config") ? "opencode-config, the baseURL override is ignored and Fro Bot hits api.anthropic.com with the proxy key, which fails with 401" : "these, the secrets you just wrote will not reach OpenCode"}.`,
+                "",
+                `Add under the 'with:' block of the 'fro-bot/agent' step:`,
+                formatWorkflowSnippet(missing)
+              ].join(`
+`));
+            }
+            break;
+          }
+          default: {
+            const _exhaustive = workflow;
+            throw new Error(`Unhandled FroBotWorkflowCheck kind: ${JSON.stringify(_exhaustive)}`);
+          }
+        }
+      }
+    } catch (mutationError) {
+      if (keyCreatedByThisRun && managementKey) {
+        try {
+          await gh.deleteManagementApiKey(baseUrl, managementKey, plan.keyValue);
+          log2.warn("Rolled back the newly created CLIProxyAPI key after failure.");
+        } catch {
+          log2.warn("Failed to roll back the newly created CLIProxyAPI key. Remove it manually via: infra cliproxy keys remove");
+        }
       }
+      throw mutationError;
     }
-    return {
-      title: "Upstream provider auth (anthropic)",
-      level: "warning",
-      summary: `Anthropic probe returned HTTP ${response.status}`,
-      details: details.length > 0 ? details : undefined
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      title: "Upstream provider auth (anthropic)",
-      level: "warning",
-      summary: `Anthropic probe failed: ${message}`,
-      details: verbose ? [`URL: ${endpoint}`, `Model: ${model}`] : undefined
-    };
-  }
-}
-async function probeManagementAuth(baseUrl, key) {
-  const endpoint = `${baseUrl}/v0/management/config`;
-  try {
-    const response = await fetch(endpoint, {
-      headers: managementHeaders(key),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
-    });
-    if (response.ok) {
-      return null;
+    if (interactive) {
+      prompts.outro(`Setup complete for ${plan.repo}. The ${plan.harness} harness can now use ${baseUrl}/v1.`);
+    } else {
+      log2.success(`Setup complete for ${plan.repo}.`);
     }
-    if (response.status === 403) {
-      const payload = await parseJsonResponse(response);
-      const isBanBody = payload !== null && typeof payload === "object" && Object.values(payload).some((v) => typeof v === "string" && /\b(?:ip[- ]?)?bann?ed\b/i.test(v));
-      if (isBanBody) {
+    if (options.verifySmoke) {
+      const smokeResult = await withSpinner("Running smoke test", async () => smoke.runSmokeTest(plan.repo, plan.template.variables.find((v) => v.name === "FRO_BOT_MODEL")?.value ?? "")).catch(async (error) => {
         return {
-          title: "Management access",
-          level: "error",
-          summary: "IP banned \u2014 stop retrying for ~30 min. Management checks skipped."
+          kind: "unverified",
+          message: `Smoke test error: ${extractErrorMessage4(error)}`,
+          runUrl: undefined
         };
+      });
+      ctx.console.log(`[smoke-test] kind=${smokeResult.kind}`);
+      switch (smokeResult.kind) {
+        case "pass": {
+          log2.success(`\u2713 ${smokeResult.message}${smokeResult.runUrl ? ` \u2014 ${smokeResult.runUrl}` : ""}`);
+          break;
+        }
+        case "fail": {
+          log2.warn(`\u2717 ${smokeResult.message}${smokeResult.runUrl ? ` \u2014 ${smokeResult.runUrl}` : ""}`);
+          break;
+        }
+        case "unverified": {
+          log2.warn(`\u26A0 ${smokeResult.message}${smokeResult.runUrl ? ` \u2014 ${smokeResult.runUrl}` : ""}`);
+          break;
+        }
+        default: {
+          const _exhaustive = smokeResult;
+          throw new Error(`Unhandled SmokeResult kind: ${JSON.stringify(_exhaustive)}`);
+        }
       }
-      return {
-        title: "Management access",
-        level: "error",
-        summary: "Management API returned HTTP 403. Management checks skipped."
-      };
-    }
-    if (response.status === 401) {
-      return {
-        title: "Management access",
-        level: "error",
-        summary: "Management API returned HTTP 401 (invalid key). Management checks skipped."
-      };
     }
-    return {
-      title: "Management access",
-      level: "warning",
-      summary: `Management auth probe returned HTTP ${response.status}. Management checks skipped.`
-    };
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      title: "Management access",
-      level: "error",
-      summary: `Management auth probe failed: ${message}`
-    };
-  }
-}
-async function runManagementChecks(baseUrl, key) {
-  if (!key) {
-    return { kind: "no-key" };
-  }
-  const authFailure = await probeManagementAuth(baseUrl, key);
-  if (authFailure !== null) {
-    return { kind: "auth-failure", result: authFailure };
-  }
-  const [usage, version] = await Promise.all([checkUsageStats(baseUrl, key), checkVersion(baseUrl, key)]);
-  return { kind: "checks", usage, version };
-}
-function printCheckResult(result, ctx) {
-  ctx.console.log(`[${levelLabel(result.level)}] ${result.title}`);
-  ctx.console.log(`  ${result.summary}`);
-  if (result.details && result.details.length > 0) {
-    for (const detail of result.details) {
-      ctx.console.log(`  - ${detail}`);
-    }
-  }
-}
-function formatCheckSummary(result) {
-  return `${levelLabel(result.level)}: ${result.summary}`;
-}
-function formatUsageSummaryLine(result) {
-  const recentMatch = /recent:\s*(\d+)/.exec(result.summary);
-  if (!recentMatch) {
-    return null;
-  }
-  const total = Number(recentMatch[1]);
-  const errorMatch = /errors:\s*(\d+)/.exec(result.summary);
-  const errors2 = errorMatch ? Number(errorMatch[1]) : 0;
-  return `Recent requests: ${total}${errors2 > 0 ? `, ${errors2} errors` : ""}`;
-}
-async function getCliproxyStatusSummary(baseUrl, key, verbose) {
-  const normalizedBaseUrl = stripTrailingSlash5(baseUrl);
-  const [httpResult, mgmt] = await Promise.all([
-    checkHttpReachability(`${normalizedBaseUrl}/healthz`, verbose),
-    runManagementChecks(normalizedBaseUrl, key || undefined)
-  ]);
-  let version;
-  let usageStats;
-  if (mgmt.kind === "no-key") {
-    version = "\u2014 (no key)";
-    usageStats = "\u2014 (no key)";
-  } else if (mgmt.kind === "auth-failure") {
-    const authSummary = formatCheckSummary(mgmt.result);
-    version = authSummary;
-    usageStats = authSummary;
-  } else {
-    version = formatCheckSummary(mgmt.version);
-    usageStats = formatCheckSummary(mgmt.usage);
-  }
-  return {
-    app: "cliproxy",
-    http: formatCheckSummary(httpResult),
-    lastDeploy: "\u2014",
-    version,
-    contentHash: "\u2014",
-    usageStats
-  };
-}
-async function cliproxyStatusAction(options, ctx) {
-  let errorCount = 0;
-  try {
-    const verbose = options.verbose === true;
-    const baseUrl = stripTrailingSlash5(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL6);
-    const trustedUrl = stripTrailingSlash5(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL6);
-    const urlIsExplicitlyOverridden = options.url !== undefined && baseUrl !== trustedUrl;
-    const managementKey = options.key ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_MANAGEMENT_KEY);
-    const providerKey = options.apiKey ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_API_KEY);
-    ctx.console.log("CLIProxyAPI status");
-    ctx.console.log("");
-    const results = [await checkHttpReachability(`${baseUrl}/healthz`, verbose)];
-    let capturedUsageResult;
-    const mgmt = await runManagementChecks(baseUrl, managementKey);
-    if (mgmt.kind === "no-key") {
-      results.push({
-        title: "Management checks",
-        level: "warning",
-        summary: "CLIPROXY_MANAGEMENT_KEY is not set. Skipping usage stats and version checks. Provide --key or set env var."
-      });
-    } else if (mgmt.kind === "auth-failure") {
-      results.push(mgmt.result);
-    } else {
-      capturedUsageResult = mgmt.usage;
-      results.push(mgmt.usage, mgmt.version);
-    }
-    if (providerKey) {
-      results.push(await checkProviderAuth(baseUrl, providerKey, { verbose }));
-    } else {
-      results.push({
-        title: "Upstream provider auth",
-        level: "warning",
-        summary: "CLIPROXY_API_KEY not set \u2014 skipping upstream provider probe."
-      });
-    }
-    for (const result of results) {
-      printCheckResult(result, ctx);
-      ctx.console.log("");
+    const message = extractErrorMessage4(error);
+    if (ctxInjected) {
+      ctx.console.error(message);
     }
-    errorCount = results.filter((result) => result.level === "error").length;
-    const warningCount = results.filter((result) => result.level === "warning").length;
-    ctx.console.log(`Summary: ${results.length} checks, ${errorCount} errors, ${warningCount} warnings`);
-    if (capturedUsageResult) {
-      const usageLine = formatUsageSummaryLine(capturedUsageResult);
-      if (usageLine) {
-        ctx.console.log(usageLine);
-      }
+    if (interactive) {
+      cancel2(message);
     }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    ctx.console.error(message);
-    ctx.process.exit(1);
-    return;
-  }
-  if (errorCount > 0) {
-    ctx.process.exit(1);
+    throw error;
   }
 }
-function registerCliproxyStatus(cli) {
-  cli.command("cliproxy status", "Show operational health of CLIProxyAPI and its management endpoints.").option("--url [url]", z15.string().describe("Base URL for CLIProxyAPI health checks. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z15.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--api-key [key]", z15.string().describe("Downstream API key (bearer) for the upstream provider-auth probe. Falls back to CLIPROXY_API_KEY. Skipped when absent.")).option("--verbose", "Enable verbose output for all commands").action(cliproxyStatusAction);
+function registerCliproxySetup(cli) {
+  cli.command("cliproxy setup", "Interactively onboard a GitHub repository to CLIProxyAPI by creating or reusing a key and wiring the required GitHub secrets and variables.").option("--key [key]", z16.string().describe("Existing CLIProxyAPI API key value. When provided, setup skips key creation and reuses this key for GitHub secrets.")).option("--repo [repo]", z16.string().describe("Target GitHub repository in owner/repo format. Skips the repository prompt when provided.")).option("--harness [harness]", harnessSchema.describe("Harness template to configure. Choose opencode, claude-code, or generic. Generic remains interactive-only.")).option("--providers [providers]", z16.string().describe("Comma-separated list of providers to enable. Default: anthropic. Supported values: anthropic, openai. Example: --providers anthropic,openai")).option("--model [model]", z16.string().regex(MODEL_ID_RE2).describe("Override the default model. Must be provider-prefixed and lowercase. Required when multiple providers selected. Examples: anthropic/claude-sonnet-4-6, openai/gpt-4o")).option("--force", z16.boolean().optional().describe("Overwrite existing GitHub secrets and variables without prompting.")).option("--dry-run", z16.boolean().optional().describe("Print the plan without applying any changes.")).option("--verify-smoke", z16.boolean().optional().describe("Run a smoke test against the proxy after setup completes.")).option("--ack-key-reuse", z16.boolean().default(false).describe("Acknowledge that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON. Required in non-interactive mode when --key is supplied for a repo with existing OPENCODE_AUTH_JSON.")).example("# Preview planned actions without applying any changes (no flags required)").example("infra cliproxy setup --dry-run").example("# Run the interactive onboarding wizard").example("infra cliproxy setup").example("# Run non-interactively with an existing key (anthropic-only)").example("infra cliproxy setup --repo owner/repo --harness opencode --key sk-existing --force").example("# Enable both providers non-interactively (requires --force and --model)").example("infra cliproxy setup --repo owner/repo --harness opencode --providers anthropic,openai --model openai/gpt-5.4-mini --key sk-existing --ack-key-reuse --force").action(async (options, ctx) => {
+    await runSetupCommand(options, { ctx });
+  });
 }
 
 // src/commands/cliproxy/index.ts
@@ -9643,12 +10053,13 @@ function registerCliproxyCommands(cli) {
   registerCliproxyKeys(cli);
   registerCliproxyLogin(cli);
   registerCliproxyModels(cli);
+  registerCliproxyMonitor(cli);
   registerCliproxyOpen(cli);
   registerCliproxySetup(cli);
 }
 
 // src/commands/dashboard/deploy.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var REPO3 = "marcusrbrown/infra";
 var WORKFLOW_NAME3 = "Deploy Dashboard";
 var WORKFLOW_URL3 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-dashboard.yaml";
@@ -9710,7 +10121,7 @@ function validateDashboardRemotePreconditions() {
   }
 }
 function registerDashboardDeploy(cli) {
-  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z16.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z16.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z16.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z16.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
+  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z17.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z17.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z17.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z17.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
     validateReleaseFlags({ imageVersion: options.imageVersion, digest: options.digest, local: options.local });
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/dashboard", "deploy"];
@@ -9753,7 +10164,7 @@ function registerDashboardDeploy(cli) {
 }
 
 // src/commands/dashboard/logs.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 
 // ../shared/server/droplet-helpers.ts
 import { appendFileSync, chmodSync as chmodSync2, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
@@ -9865,7 +10276,7 @@ async function streamDashboardLogs(opts, spawn = defaultLogsSpawn2, printOut, pr
   return { refused: false, exitCode };
 }
 function registerDashboardLogs(cli) {
-  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z17.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z17.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z17.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z18.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z18.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z18.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "dashboard";
     try {
       validateService(targetService);
@@ -9895,7 +10306,7 @@ function registerDashboardLogs(cli) {
 }
 
 // src/commands/dashboard/status.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // src/lib/redact.ts
 function redactHost(text4, host) {
@@ -10079,7 +10490,7 @@ async function dashboardStatusAction(options, ctx, spawn) {
   }
 }
 function registerDashboardStatus(cli) {
-  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z18.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
+  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z19.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
 }
 
 // src/commands/dashboard/index.ts
@@ -10091,7 +10502,7 @@ function registerDashboardCommands(cli) {
 
 // src/commands/gateway/backup.ts
 import { closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync } from "fs";
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/commands/gateway/host.ts
 var VALID_HOST_RE4 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -10201,11 +10612,11 @@ async function gatewayBackupAction(options, ctx, spawn) {
   ctx.console.log(`CA backup written to: ${output}`);
 }
 function registerGatewayBackup(cli) {
-  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z19.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z19.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
+  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z20.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z20.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
 }
 
 // src/commands/gateway/deploy.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var REPO4 = "marcusrbrown/infra";
 var WORKFLOW_NAME4 = "Deploy Gateway";
 var WORKFLOW_URL4 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-gateway.yaml";
@@ -10270,7 +10681,7 @@ function validateGatewayRemotePreconditions() {
   }
 }
 function registerGatewayDeploy(cli) {
-  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z20.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z20.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z20.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
+  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z21.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z21.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z21.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -10318,7 +10729,7 @@ function registerGatewayDeploy(cli) {
 }
 
 // src/commands/gateway/logs.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var COMPOSE_PROJECT_DIR3 = "/opt/gateway/deploy";
 var SENSITIVE_WARNING4 = "Warning: Logs may contain Discord tokens, S3 credentials, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
 var VALID_SERVICES2 = ["gateway", "workspace", "mitmproxy"];
@@ -10367,7 +10778,7 @@ async function streamGatewayLogs(opts, spawn = defaultLogsSpawn3, printOut, prin
   return { refused: false, exitCode };
 }
 function registerGatewayLogs(cli) {
-  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z21.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z21.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z21.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
+  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z22.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z22.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z22.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
     const targetService = service ?? "gateway";
     try {
       validateService2(targetService);
@@ -10397,7 +10808,7 @@ function registerGatewayLogs(cli) {
 }
 
 // src/commands/gateway/restore.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
@@ -10551,7 +10962,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn3) {
   }
 }
 function registerGatewayRestore(cli) {
-  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z22.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z22.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
+  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z23.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z23.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
     const hostEnvKey = "GATEWAY_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -10572,7 +10983,7 @@ function registerGatewayRestore(cli) {
 }
 
 // src/commands/gateway/status.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var COMPOSE_PROJECT_DIR5 = "/opt/gateway/deploy";
 function parseComposePsOutput2(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -10714,7 +11125,7 @@ async function gatewayStatusAction(options, ctx, spawn) {
   }
 }
 function registerGatewayStatus(cli) {
-  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z23.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
+  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z24.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
 }
 
 // src/commands/gateway/index.ts
@@ -10729,7 +11140,7 @@ function registerGatewayCommands(cli) {
 // src/commands/keeweb/deploy.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join6 } from "path";
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var REPO5 = "marcusrbrown/infra";
 var WORKFLOW_NAME5 = "Deploy KeeWeb";
 var WORKFLOW_URL5 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-keeweb.yaml";
@@ -10783,7 +11194,7 @@ function validateRemotePreconditions3() {
   }
 }
 function registerKeewebDeploy(cli) {
-  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z24.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z24.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z24.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
+  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z25.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z25.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z25.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
     if (options.nginx && !options.local) {
       throw new Error("--nginx is only valid with --local");
     }
@@ -10862,13 +11273,13 @@ function registerKeewebOpen(cli) {
 
 // src/commands/keeweb/status.ts
 import { join as join7 } from "path";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var SITE_URL = "https://kw.igg.ms/";
 var GH_REPO = "marcusrbrown/infra";
 var HTTP_TIMEOUT_MS4 = 1e4;
-var ghRunSchema = z25.array(z25.object({
-  createdAt: z25.string().min(1),
-  url: z25.url()
+var ghRunSchema = z26.array(z26.object({
+  createdAt: z26.string().min(1),
+  url: z26.url()
 }));
 function levelLabel2(level) {
   if (level === "ok") {
@@ -11166,10 +11577,10 @@ function registerMcp(cli) {
 }
 
 // src/commands/status.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 
 // src/commands/umami/deploy.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var REPO6 = "marcusrbrown/infra";
 var WORKFLOW_NAME6 = "Deploy Umami";
 var WORKFLOW_URL6 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-umami.yaml";
@@ -11204,7 +11615,7 @@ function validateUmamiRemotePreconditions() {
   }
 }
 function registerUmamiDeploy(cli) {
-  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z26.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z26.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
+  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z27.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z27.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/umami", "deploy"];
       if (options.dryRun) {
@@ -11245,7 +11656,7 @@ function registerUmamiDeploy(cli) {
 }
 
 // src/commands/umami/logs.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 
 // src/commands/umami/host.ts
 var VALID_HOST_RE5 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -11309,7 +11720,7 @@ async function streamUmamiLogs(opts, spawn = defaultLogsSpawn4, printOut, printE
   return { refused: false, exitCode };
 }
 function registerUmamiLogs(cli) {
-  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z27.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z27.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z27.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z28.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z28.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z28.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "umami";
     try {
       validateService3(targetService);
@@ -11339,7 +11750,7 @@ function registerUmamiLogs(cli) {
 }
 
 // src/commands/umami/status.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var COMPOSE_PROJECT_DIR7 = "/opt/umami";
 function parseComposePsOutput3(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -11510,7 +11921,7 @@ async function umamiStatusAction(options, ctx, spawn) {
   }
 }
 function registerUmamiStatus(cli) {
-  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z28.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
+  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z29.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
 }
 
 // src/commands/umami/index.ts
@@ -11523,24 +11934,24 @@ function registerUmamiCommands(cli) {
 // src/commands/vpn/client.ts
 import { mkdir, writeFile as writeFile2 } from "fs/promises";
 import { join as join8, resolve as resolve2 } from "path";
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 
 // src/commands/vpn/peers.ts
 import { readFile, writeFile } from "fs/promises";
-import { z as z29 } from "zod";
-var peerSchema = z29.object({
-  name: z29.string(),
-  publicKey: z29.string(),
-  tunnelIp: z29.string()
+import { z as z30 } from "zod";
+var peerSchema = z30.object({
+  name: z30.string(),
+  publicKey: z30.string(),
+  tunnelIp: z30.string()
 });
-var peersFileSchema = z29.object({
-  peers: z29.array(peerSchema)
+var peersFileSchema = z30.object({
+  peers: z30.array(peerSchema)
 }).superRefine((data, ctx) => {
   const seenIps = new Set;
   for (const peer of data.peers) {
     if (seenIps.has(peer.tunnelIp)) {
       ctx.addIssue({
-        code: z29.ZodIssueCode.custom,
+        code: z30.ZodIssueCode.custom,
         message: `Duplicate tunnel IP "${peer.tunnelIp}" \u2014 each peer must have a unique tunnel IP.`,
         path: ["peers"]
       });
@@ -11552,7 +11963,7 @@ var peersFileSchema = z29.object({
   for (const peer of data.peers) {
     if (seenNames.has(peer.name)) {
       ctx.addIssue({
-        code: z29.ZodIssueCode.custom,
+        code: z30.ZodIssueCode.custom,
         message: `Duplicate name "${peer.name}" \u2014 each peer must have a unique name.`,
         path: ["peers"]
       });
@@ -11794,7 +12205,7 @@ function resolveDefaultClientsDir() {
   return join8(findRepoRoot(), "apps", "vpn", "clients");
 }
 function registerVpnClient(cli) {
-  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z30.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z30.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z30.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z30.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
+  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z31.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z31.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z31.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z31.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
     const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY;
     const endpoint = options.endpoint ?? process.env.VPN_HOST;
     if (!serverPublicKey) {
@@ -11858,7 +12269,7 @@ function registerVpnClient(cli) {
 }
 
 // src/commands/vpn/deploy.ts
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var REPO7 = "marcusrbrown/infra";
 var WORKFLOW_NAME7 = "Deploy VPN";
 var WORKFLOW_URL7 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml";
@@ -11888,7 +12299,7 @@ function validateVpnRemotePreconditions() {
   }
 }
 function registerVpnDeploy(cli) {
-  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z31.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z31.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z31.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
+  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z32.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z32.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z32.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -11936,7 +12347,7 @@ function registerVpnDeploy(cli) {
 }
 
 // src/commands/vpn/logs.ts
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // src/commands/vpn/host.ts
 var VALID_HOST_RE6 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -11992,7 +12403,7 @@ async function streamVpnLogs(opts, spawn = defaultLogsSpawn5, printOut, printErr
   return { refused: false, exitCode };
 }
 function registerVpnLogs(cli) {
-  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z32.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z32.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z32.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
+  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z33.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z33.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z33.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
     const hostEnvKey = options.key ?? "VPN_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -12014,7 +12425,7 @@ function registerVpnLogs(cli) {
 }
 
 // src/commands/vpn/status.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 
 // src/commands/vpn/shared.ts
 function parseWgShowOutput(output) {
@@ -12141,7 +12552,7 @@ async function vpnStatusAction(options, ctx, spawn) {
   }
 }
 function registerVpnStatus(cli) {
-  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z33.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
+  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z34.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
 }
 
 // src/commands/vpn/index.ts
@@ -12153,7 +12564,7 @@ function registerVpnCommands(cli) {
 }
 
 // src/commands/status.ts
-var DEFAULT_CLIPROXY_URL7 = "https://cliproxy.fro.bot";
+var DEFAULT_CLIPROXY_URL8 = "https://cliproxy.fro.bot";
 var ERROR_PREFIX = "\u274C";
 var TABLE_COLUMNS = [
   { key: "app", label: "App" },
@@ -12203,7 +12614,7 @@ async function unifiedStatusAction(options, ctx, dependencies = {
   getBrokerStatusSummary
 }) {
   const verbose = options.verbose === true;
-  const cliproxyBaseUrl = stripTrailingSlash6(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL7);
+  const cliproxyBaseUrl = stripTrailingSlash6(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
   const cliproxyKey = process.env.CLIPROXY_MANAGEMENT_KEY ?? "";
   const gatewayHost = process.env.GATEWAY_HOST ?? "";
   const umamiHost = process.env.UMAMI_DOMAIN ?? "";
@@ -12248,7 +12659,7 @@ function registerStatus(cli, dependencies = {
   getVpnStatusSummary,
   getBrokerStatusSummary
 }) {
-  cli.command("status", "Show status of all deployments").option("--json", z34.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z34.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+  cli.command("status", "Show status of all deployments").option("--json", z35.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z35.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
 }
 
 // src/cli.ts