@marcusrbrown/infra 0.15.0 → 0.15.1

package/dist/cli.js

@@ -6949,7 +6949,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.15.0",
+  version: "0.15.1",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -7201,8 +7201,16 @@ function readablePipe(pipe) {
     throw new Error("CLI subprocess did not expose piped output.");
   return pipe;
 }
-async function runCommand(command, args, timeoutMs = COMMAND_TIMEOUT_MS, stdin) {
-  const operation = `${command} ${args.join(" ")}`.trim();
+function redactExactValues(text2, values) {
+  let redacted = text2;
+  for (const value of new Set(values)) {
+    if (value.length > 0)
+      redacted = redacted.split(value).join("[REDACTED]");
+  }
+  return redacted;
+}
+async function runCommand(command, args, timeoutMs = COMMAND_TIMEOUT_MS, stdin, env = process.env, redactValues = []) {
+  const operation = redactExactValues(`${command} ${args.join(" ")}`.trim(), redactValues);
   const controller = new AbortController;
   let timeout;
   let child;
@@ -7212,7 +7220,7 @@ async function runCommand(command, args, timeoutMs = COMMAND_TIMEOUT_MS, stdin)
         signal: controller.signal,
         stdout: "pipe",
         stderr: "pipe",
-        env: process.env
+        env
       });
     } else {
       child = Bun.spawn([command, ...args], {
@@ -7220,7 +7228,7 @@ async function runCommand(command, args, timeoutMs = COMMAND_TIMEOUT_MS, stdin)
         stdin: new Blob([stdin]).stream(),
         stdout: "pipe",
         stderr: "pipe",
-        env: process.env
+        env
       });
     }
   } catch (error) {
@@ -7245,7 +7253,11 @@ async function runCommand(command, args, timeoutMs = COMMAND_TIMEOUT_MS, stdin)
       timeoutPromise
     ]);
     const [stdout, stderr, exitCode] = result;
-    return { stdout, stderr, exitCode };
+    return {
+      stdout: redactExactValues(stdout, redactValues),
+      stderr: redactExactValues(stderr, redactValues),
+      exitCode
+    };
   } catch (error) {
     if (controller.signal.aborted)
       throw new Error(`${command} CLI timed out during ${operation}.`);
@@ -9211,8 +9223,32 @@ function parseManifest(raw) {
     throw error;
   }
 }
-async function runAwsCommand(args) {
-  return runCommand("aws", args);
+async function runAwsCommand(args, env, redactValues) {
+  return runCommand("aws", args, undefined, undefined, env, redactValues);
+}
+var AWS_CHILD_LOCALE_KEYS = new Set(["LANG", "LANGUAGE"]);
+function buildAwsChildEnv(manifest, sourceEnv = process.env) {
+  const accessKeyId = sourceEnv.AGENT_AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = sourceEnv.AGENT_AWS_SECRET_ACCESS_KEY?.trim();
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("Dedicated AWS credentials are required for agent storage preflight. Set AGENT_AWS_ACCESS_KEY_ID and AGENT_AWS_SECRET_ACCESS_KEY in the operator-local environment.");
+  }
+  const childEnv = {};
+  for (const [key, value] of Object.entries(sourceEnv)) {
+    if (value !== undefined && (key === "PATH" || key === "HOME" || key === "TMPDIR" || AWS_CHILD_LOCALE_KEYS.has(key) || key.startsWith("LC_"))) {
+      childEnv[key] = value;
+    }
+  }
+  childEnv.AWS_CONFIG_FILE = "/dev/null";
+  childEnv.AWS_SHARED_CREDENTIALS_FILE = "/dev/null";
+  childEnv.AWS_ACCESS_KEY_ID = accessKeyId;
+  childEnv.AWS_SECRET_ACCESS_KEY = secretAccessKey;
+  childEnv.AWS_REGION = sourceEnv.AGENT_AWS_REGION?.trim() || manifest.bucket_region;
+  childEnv.AWS_DEFAULT_REGION = childEnv.AWS_REGION;
+  const sessionToken = sourceEnv.AGENT_AWS_SESSION_TOKEN?.trim();
+  if (sessionToken)
+    childEnv.AWS_SESSION_TOKEN = sessionToken;
+  return childEnv;
 }
 async function runProvisionerCommand(manifest, options) {
   const args = ["run", "provision:agent", "--", "--teardown", "--manifest", "-"];
@@ -9256,8 +9292,16 @@ function canonicalBucketRegion(location) {
     return "eu-west-1";
   return String(location);
 }
-async function verifyProvisionedResources(manifest, runAws = runAwsCommand) {
-  const roleResult = await runAws([
+async function verifyProvisionedResources(manifest, runAws, awsCommand = runAwsCommand) {
+  let executeAws;
+  if (runAws) {
+    executeAws = runAws;
+  } else {
+    const awsEnv = buildAwsChildEnv(manifest);
+    const redactValues = [awsEnv.AWS_ACCESS_KEY_ID, awsEnv.AWS_SECRET_ACCESS_KEY, awsEnv.AWS_SESSION_TOKEN].filter((value) => value !== undefined && value.length > 0);
+    executeAws = (args) => awsCommand(args, awsEnv, redactValues);
+  }
+  const roleResult = await executeAws([
     "iam",
     "get-role",
     "--role-name",
@@ -9277,7 +9321,7 @@ async function verifyProvisionedResources(manifest, runAws = runAwsCommand) {
   if (roleArn !== manifest.role_arn) {
     throw new Error(`AWS IAM role readback does not match the handoff manifest for ${manifest.owner}/${manifest.repo}; run the provisioner first.`);
   }
-  const bucketResult = await runAws([
+  const bucketResult = await executeAws([
     "s3api",
     "head-bucket",
     "--bucket",
@@ -9289,7 +9333,7 @@ async function verifyProvisionedResources(manifest, runAws = runAwsCommand) {
   if (bucketResult.exitCode !== 0) {
     throw new Error(`AWS S3 bucket ${manifest.bucket} is absent, inaccessible, or owned by another account; run the provisioner first. ${bucketResult.stderr.trim()}`.trim());
   }
-  const locationResult = await runAws([
+  const locationResult = await executeAws([
     "s3api",
     "get-bucket-location",
     "--bucket",
@@ -9372,7 +9416,7 @@ async function prepareStorageSetup(repo, options, deps = {}) {
   const rawManifest = await loadManifest(options.manifest ?? "-");
   const manifest = parseManifest(rawManifest);
   await verifyRepoIdentity(repo, manifest, deps.runGh ?? runGh);
-  const verifyResources = deps.verifyResources ?? ((value) => verifyProvisionedResources(value, deps.runAws));
+  const verifyResources = deps.verifyResources ?? ((value) => verifyProvisionedResources(value, deps.runAws, deps.runAwsCommand));
   await verifyResources(manifest);
   await verifyOidcSubject(repo, deps.runGh ?? runGh);
   const verifyWorkflowSetup = deps.verifyWorkflow ?? ((value, handoff) => verifyWorkflow(value, handoff, { runGh: deps.runGh }));
@@ -9454,7 +9498,7 @@ async function runStorageTeardown(repo, options = {}, deps = {}) {
   await runProvisioner(rawManifest, { purgeState: options.purgeState, plan: options.plan ?? false });
 }
 function registerAgentStorageCommand(cli) {
-  cli.command("agent storage", "Verify the provisioned S3 handoff and wire non-secret GitHub storage variables.").option("--repo [repo]", z6.string().describe("Target GitHub repository in owner/repo format.")).option("--manifest [manifest]", z6.string().default("-").describe("Handoff manifest path, or - to read JSON from stdin.")).option("--plan", z6.boolean().optional().describe("Verify and report storage writes without mutating GitHub.")).option("--dry-run", z6.boolean().optional().describe("Alias for --plan.")).example("infra agent storage --repo owner/repo --manifest handoff.json").example("cat handoff.json | infra agent storage --repo owner/repo --manifest -").action(async (options) => {
+  cli.command("agent storage", "Verify the provisioned S3 handoff and wire non-secret GitHub storage variables. AWS readback requires AGENT_AWS_ACCESS_KEY_ID and AGENT_AWS_SECRET_ACCESS_KEY and ignores ambient AWS_* values.").option("--repo [repo]", z6.string().describe("Target GitHub repository in owner/repo format.")).option("--manifest [manifest]", z6.string().default("-").describe("Handoff manifest path, or - to read JSON from stdin.")).option("--plan", z6.boolean().optional().describe("Verify and report storage writes without mutating GitHub.")).option("--dry-run", z6.boolean().optional().describe("Alias for --plan.")).example("infra agent storage --repo owner/repo --manifest handoff.json").example("cat handoff.json | infra agent storage --repo owner/repo --manifest -").action(async (options) => {
     if (!options.repo) {
       throw new Error("--repo is required for agent storage.");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",