@marcusrbrown/infra 0.2.0 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/__snapshots__/cli.test.ts.snap

@@ -9,17 +9,64 @@ Usage:
 
 
 Commands:
-  keeweb status  Show operational health of the KeeWeb deployment
+  keeweb status                      Show operational health of the KeeWeb deployment
 
 
-  keeweb deploy  Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.
+  keeweb deploy                      Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.
 
-    --local      Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions. (default: false)
-    --nginx      Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx. (default: false)
-    --dry-run    Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions. (default: false)
+    --local                          Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions. (default: false)
+    --nginx                          Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx. (default: false)
+    --dry-run                        Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions. (default: false)
 
 
-  mcp            Start a stdio MCP server exposing all CLI commands as tools for coding agents
+  cliproxy status                    Show operational health of CLIProxyAPI and its management endpoints.
+
+    --url [url]                      Base URL for CLIProxyAPI health checks. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
+    --key [key]                      Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
+
+
+  cliproxy deploy                    Deploy CLIProxyAPI. Default mode triggers the GitHub Deploy workflow, while --local runs apps/cliproxy/src/deploy.ts directly with Bun.
+
+    --local                          Run local deployment with Bun using apps/cliproxy/src/deploy.ts instead of triggering GitHub Actions. (default: false)
+    --dry-run                        Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow. (default: false)
+
+
+  cliproxy config get                Fetch current CLIProxyAPI management config and print it as formatted JSON.
+
+    --url [url]                      Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
+    --key [key]                      Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
+
+
+  cliproxy config set <key> <value>  Update mutable CLIProxyAPI config values through management endpoints (debug, request-retry, proxy-url).
+
+    --url [url]                      Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
+    --key [key]                      Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
+
+
+  cliproxy keys list                 List CLIProxyAPI API keys from the management API.
+
+    --url [url]                      Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
+    --key [key]                      Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
+
+
+  cliproxy keys add <key>            Add an API key by fetching current keys, appending the value, and replacing full key set.
+
+    --url [url]                      Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
+    --key [key]                      Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
+
+
+  cliproxy keys remove <key>         Remove an API key via management API endpoint query parameter.
+
+    --url [url]                      Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.
+    --key [key]                      Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.
+
+
+  cliproxy login <provider>          Run provider login on the remote CLIProxyAPI host and print OAuth URL output.
+
+    --host [host]                    CLIProxyAPI droplet host for SSH execution. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.
+
+
+  mcp                                Start a stdio MCP server exposing all CLI commands as tools for coding agents
 
 
 Options:

package/src/cli.ts

@@ -2,6 +2,11 @@
 
 import {goke} from 'goke'
 import pkg from '../package.json' with {type: 'json'}
+import {registerCliproxyConfig} from './commands/cliproxy-config'
+import {registerCliproxyDeploy} from './commands/cliproxy-deploy'
+import {registerCliproxyKeys} from './commands/cliproxy-keys'
+import {registerCliproxyLogin} from './commands/cliproxy-login'
+import {registerCliproxyStatus} from './commands/cliproxy-status'
 import {registerKeewebDeploy} from './commands/keeweb-deploy'
 import {registerKeewebStatus} from './commands/keeweb-status'
 import {registerMcp} from './commands/mcp'
@@ -12,6 +17,11 @@ cli.option('--verbose', 'Enable verbose output for all commands')
 
 registerKeewebStatus(cli)
 registerKeewebDeploy(cli)
+registerCliproxyStatus(cli)
+registerCliproxyDeploy(cli)
+registerCliproxyConfig(cli)
+registerCliproxyKeys(cli)
+registerCliproxyLogin(cli)
 registerMcp(cli)
 
 cli.help()

package/src/commands/cliproxy-config.test.ts

@@ -0,0 +1,181 @@
+import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
+
+import {buildSetRequest, parseBoolean, parseNumber, resolveManagementKey} from './cliproxy-config'
+import {toStringArray} from './cliproxy-keys'
+import {requireSshAuthSock, resolveHost} from './cliproxy-login'
+
+describe('cliproxy config helpers', () => {
+  describe('parseBoolean', () => {
+    it('parses true values case-insensitively', () => {
+      expect(parseBoolean('true')).toBe(true)
+      expect(parseBoolean('True')).toBe(true)
+      expect(parseBoolean('TRUE')).toBe(true)
+    })
+
+    it('parses false values case-insensitively', () => {
+      expect(parseBoolean('false')).toBe(false)
+      expect(parseBoolean('False')).toBe(false)
+    })
+
+    it('throws for invalid values', () => {
+      expect(() => parseBoolean('wat')).toThrow()
+    })
+  })
+
+  describe('parseNumber', () => {
+    it('parses integers and floats', () => {
+      expect(parseNumber('42', 'request-retry')).toBe(42)
+      expect(parseNumber('3.14', 'request-retry')).toBe(3.14)
+    })
+
+    it('throws TypeError for non-numeric values', () => {
+      expect(() => parseNumber('abc', 'request-retry')).toThrow(TypeError)
+    })
+
+    it('throws TypeError for NaN', () => {
+      expect(() => parseNumber('NaN', 'request-retry')).toThrow(TypeError)
+    })
+
+    it('throws TypeError for Infinity', () => {
+      expect(() => parseNumber('Infinity', 'request-retry')).toThrow(TypeError)
+    })
+  })
+
+  describe('buildSetRequest', () => {
+    it('builds a boolean debug request', () => {
+      const request = buildSetRequest('https://cliproxy.example.com', 'debug', 'true')
+
+      expect(request.endpoint.endsWith('/debug')).toBe(true)
+      expect(JSON.parse(request.body)).toEqual({debug: true})
+    })
+
+    it('builds a numeric request-retry request', () => {
+      const request = buildSetRequest('https://cliproxy.example.com', 'request-retry', '3')
+
+      expect(request.endpoint.endsWith('/request-retry')).toBe(true)
+      expect(JSON.parse(request.body)).toEqual({request_retry: 3})
+    })
+
+    it('builds a string proxy-url request', () => {
+      const request = buildSetRequest('https://cliproxy.example.com', 'proxy-url', 'https://x.com')
+
+      expect(request.endpoint.endsWith('/proxy-url')).toBe(true)
+      expect(JSON.parse(request.body)).toEqual({proxy_url: 'https://x.com'})
+    })
+
+    it('throws for immutable fields', () => {
+      expect(() => buildSetRequest('https://cliproxy.example.com', 'provider', 'claude')).toThrow()
+    })
+  })
+
+  describe('resolveManagementKey', () => {
+    const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+    beforeEach(() => {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    })
+
+    afterEach(() => {
+      if (originalManagementKey === undefined) {
+        delete process.env.CLIPROXY_MANAGEMENT_KEY
+      } else {
+        process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+      }
+    })
+
+    it('returns explicit input when provided', () => {
+      process.env.CLIPROXY_MANAGEMENT_KEY = 'env-key'
+
+      expect(resolveManagementKey('explicit-key')).toBe('explicit-key')
+    })
+
+    it('falls back to CLIPROXY_MANAGEMENT_KEY', () => {
+      process.env.CLIPROXY_MANAGEMENT_KEY = 'env-key'
+
+      expect(resolveManagementKey()).toBe('env-key')
+    })
+
+    it('throws when no key is available', () => {
+      expect(() => resolveManagementKey()).toThrow()
+    })
+  })
+})
+
+describe('cliproxy keys helpers', () => {
+  describe('toStringArray', () => {
+    it('returns string arrays filtered to strings only', () => {
+      expect(toStringArray(['a', 'b'])).toEqual(['a', 'b'])
+      expect(toStringArray(['a', 1, 'b', false])).toEqual(['a', 'b'])
+    })
+
+    it('reads api_keys from objects', () => {
+      expect(toStringArray({api_keys: ['a', 'b']})).toEqual(['a', 'b'])
+    })
+
+    it('returns an empty array for unsupported payloads', () => {
+      expect(toStringArray(null)).toEqual([])
+      expect(toStringArray(undefined)).toEqual([])
+      expect(toStringArray(123)).toEqual([])
+    })
+  })
+})
+
+describe('cliproxy login helpers', () => {
+  describe('resolveHost', () => {
+    const originalHost = process.env.CLIPROXY_DOMAIN
+
+    beforeEach(() => {
+      delete process.env.CLIPROXY_DOMAIN
+    })
+
+    afterEach(() => {
+      if (originalHost === undefined) {
+        delete process.env.CLIPROXY_DOMAIN
+      } else {
+        process.env.CLIPROXY_DOMAIN = originalHost
+      }
+    })
+
+    it('returns explicit input when provided', () => {
+      process.env.CLIPROXY_DOMAIN = 'env.example.com'
+
+      expect(resolveHost('explicit.example.com')).toBe('explicit.example.com')
+    })
+
+    it('falls back to CLIPROXY_DOMAIN', () => {
+      process.env.CLIPROXY_DOMAIN = 'env.example.com'
+
+      expect(resolveHost()).toBe('env.example.com')
+    })
+
+    it('falls back to the default host', () => {
+      expect(resolveHost()).toBe('cliproxy.fro.bot')
+    })
+  })
+
+  describe('requireSshAuthSock', () => {
+    const originalSshAuthSock = process.env.SSH_AUTH_SOCK
+
+    beforeEach(() => {
+      delete process.env.SSH_AUTH_SOCK
+    })
+
+    afterEach(() => {
+      if (originalSshAuthSock === undefined) {
+        delete process.env.SSH_AUTH_SOCK
+      } else {
+        process.env.SSH_AUTH_SOCK = originalSshAuthSock
+      }
+    })
+
+    it('returns SSH_AUTH_SOCK when set', () => {
+      process.env.SSH_AUTH_SOCK = '/tmp/agent.sock'
+
+      expect(requireSshAuthSock()).toBe('/tmp/agent.sock')
+    })
+
+    it('throws when SSH_AUTH_SOCK is missing', () => {
+      expect(() => requireSshAuthSock()).toThrow()
+    })
+  })
+})

package/src/commands/cliproxy-config.ts

@@ -0,0 +1,164 @@
+import type {goke} from 'goke'
+
+import {z} from 'zod'
+
+const DEFAULT_CLIPROXY_URL = 'https://cliproxy.fro.bot'
+const HTTP_TIMEOUT_MS = 10_000
+
+function stripTrailingSlash(value: string): string {
+  return value.endsWith('/') ? value.slice(0, -1) : value
+}
+
+function resolveBaseUrl(input?: string): string {
+  return stripTrailingSlash(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
+}
+
+export function resolveManagementKey(input?: string): string {
+  const key = input ?? process.env.CLIPROXY_MANAGEMENT_KEY
+
+  if (!key) {
+    throw new Error('Management API key is required. Pass --key or set CLIPROXY_MANAGEMENT_KEY.')
+  }
+
+  return key
+}
+
+function managementHeaders(key: string): Headers {
+  const headers = new Headers()
+  headers.set('authorization', `Bearer ${key}`)
+  headers.set('x-management-key', key)
+  headers.set('content-type', 'application/json')
+  return headers
+}
+
+async function requestJson(endpoint: string, init: RequestInit): Promise<unknown> {
+  const response = await fetch(endpoint, {
+    ...init,
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+  })
+
+  if (!response.ok) {
+    const body = await response.text()
+    throw new Error(`${init.method ?? 'GET'} ${endpoint} failed with HTTP ${response.status}: ${body}`)
+  }
+
+  try {
+    return await response.json()
+  } catch {
+    return null
+  }
+}
+
+export function parseBoolean(value: string): boolean {
+  const normalized = value.toLowerCase()
+  if (normalized === 'true') {
+    return true
+  }
+
+  if (normalized === 'false') {
+    return false
+  }
+
+  throw new Error('debug expects a boolean value: true or false')
+}
+
+export function parseNumber(value: string, field: string): number {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) {
+    throw new TypeError(`${field} expects a numeric value`)
+  }
+
+  return parsed
+}
+
+export function buildSetRequest(baseUrl: string, field: string, rawValue: string): {endpoint: string; body: string} {
+  if (field === 'debug') {
+    return {
+      endpoint: `${baseUrl}/v0/management/debug`,
+      body: JSON.stringify({debug: parseBoolean(rawValue)}),
+    }
+  }
+
+  if (field === 'request-retry') {
+    return {
+      endpoint: `${baseUrl}/v0/management/request-retry`,
+      body: JSON.stringify({request_retry: parseNumber(rawValue, 'request-retry')}),
+    }
+  }
+
+  if (field === 'proxy-url') {
+    return {
+      endpoint: `${baseUrl}/v0/management/proxy-url`,
+      body: JSON.stringify({proxy_url: rawValue}),
+    }
+  }
+
+  throw new Error(
+    `Key "${field}" is not mutable via API. Only debug, request-retry, and proxy-url are supported. Edit config.yaml directly for other keys.`,
+  )
+}
+
+export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
+  cli
+    .command('cliproxy config get', 'Fetch current CLIProxyAPI management config and print it as formatted JSON.')
+    .option(
+      '--url [url]',
+      z
+        .string()
+        .describe(
+          'Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.',
+        ),
+    )
+    .option(
+      '--key [key]',
+      z.string().describe('Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.'),
+    )
+    .action(async options => {
+      const baseUrl = resolveBaseUrl(options.url)
+      const managementKey = resolveManagementKey(options.key)
+      const endpoint = `${baseUrl}/v0/management/config`
+      const payload = await requestJson(endpoint, {
+        method: 'GET',
+        headers: managementHeaders(managementKey),
+      })
+
+      console.log(JSON.stringify(payload, null, 2))
+    })
+
+  cli
+    .command(
+      'cliproxy config set <key> <value>',
+      'Update mutable CLIProxyAPI config values through management endpoints (debug, request-retry, proxy-url).',
+    )
+    .option(
+      '--url [url]',
+      z
+        .string()
+        .describe(
+          'Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.',
+        ),
+    )
+    .option(
+      '--key [key]',
+      z.string().describe('Management API bearer token. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.'),
+    )
+    .example('# Enable debug mode via management API')
+    .example('infra cliproxy config set debug true')
+    .example('# Update request retry budget to 3')
+    .example('infra cliproxy config set request-retry 3')
+    .example('# Point proxy upstream to a different URL')
+    .example('infra cliproxy config set proxy-url https://example.com')
+    .action(async (field, value, options) => {
+      const baseUrl = resolveBaseUrl(options.url)
+      const managementKey = resolveManagementKey(options.key)
+      const request = buildSetRequest(baseUrl, field, value)
+
+      const payload = await requestJson(request.endpoint, {
+        method: 'PUT',
+        headers: managementHeaders(managementKey),
+        body: request.body,
+      })
+
+      console.log(JSON.stringify(payload, null, 2))
+    })
+}

package/src/commands/cliproxy-deploy.test.ts

@@ -0,0 +1,181 @@
+import {resolve} from 'node:path'
+import {afterEach, beforeEach, describe, expect, it, spyOn} from 'bun:test'
+
+import {getLocalDeployEnv, resolveLocalDeployScriptPath, validateRemotePreconditions} from './cliproxy-deploy'
+
+const cliDir = resolve(import.meta.dir, '../..')
+
+const envKeys = ['CLIPROXY_DOMAIN', 'CLIPROXY_MANAGEMENT_KEY', 'HOME', 'PATH', 'SSH_AUTH_SOCK'] as const
+
+type ManagedEnvKey = (typeof envKeys)[number]
+
+let originalEnv: Partial<Record<ManagedEnvKey, string | undefined>>
+
+function restoreManagedEnv(): void {
+  for (const key of envKeys) {
+    const value = originalEnv[key]
+
+    if (value === undefined) {
+      delete process.env[key]
+      continue
+    }
+
+    process.env[key] = value
+  }
+}
+
+function setManagedEnv(overrides: Partial<Record<ManagedEnvKey, string | undefined>>): void {
+  restoreManagedEnv()
+
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === undefined) {
+      delete process.env[key]
+      continue
+    }
+
+    process.env[key as ManagedEnvKey] = value
+  }
+}
+
+async function runDeployCommand(
+  args: string[],
+  envOverrides: Partial<Record<ManagedEnvKey, string | undefined>> = {},
+): Promise<{stdout: string; stderr: string; exitCode: number}> {
+  const env = {...process.env}
+
+  for (const [key, value] of Object.entries(envOverrides)) {
+    if (value === undefined) {
+      delete env[key]
+      continue
+    }
+
+    env[key] = value
+  }
+
+  const proc = Bun.spawn(['bun', 'src/cli.ts', 'cliproxy', 'deploy', ...args], {
+    cwd: cliDir,
+    env: {
+      ...env,
+      HOME: env.HOME ?? '/tmp/test-home',
+      NO_COLOR: '1',
+      PATH: env.PATH ?? '/usr/bin:/bin',
+      SSH_AUTH_SOCK: env.SSH_AUTH_SOCK ?? '/tmp/test-sock',
+    },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+
+  return {stdout, stderr, exitCode}
+}
+
+describe('cliproxy deploy', () => {
+  beforeEach(() => {
+    originalEnv = Object.fromEntries(envKeys.map(key => [key, process.env[key]]))
+  })
+
+  afterEach(() => {
+    restoreManagedEnv()
+  })
+
+  describe('resolveLocalDeployScriptPath', () => {
+    it('returns a string path containing deploy.ts', () => {
+      const deployScriptPath = resolveLocalDeployScriptPath()
+
+      expect(typeof deployScriptPath).toBe('string')
+      expect(deployScriptPath).toContain('deploy.ts')
+    })
+  })
+
+  describe('getLocalDeployEnv', () => {
+    it('returns the expected deploy environment when required variables are present', () => {
+      setManagedEnv({
+        CLIPROXY_DOMAIN: 'cliproxy.example.com',
+        CLIPROXY_MANAGEMENT_KEY: 'test-management-key',
+        HOME: '/tmp/test-home',
+        PATH: '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(getLocalDeployEnv()).toEqual({
+        CLIPROXY_DOMAIN: 'cliproxy.example.com',
+        CLIPROXY_MANAGEMENT_KEY: 'test-management-key',
+        HOME: '/tmp/test-home',
+        PATH: '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+    })
+
+    it('throws when PATH is missing', () => {
+      setManagedEnv({
+        HOME: '/tmp/test-home',
+        PATH: undefined,
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(() => getLocalDeployEnv()).toThrow(/PATH/)
+    })
+
+    it('throws when HOME is missing', () => {
+      setManagedEnv({
+        HOME: undefined,
+        PATH: '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(() => getLocalDeployEnv()).toThrow(/HOME/)
+    })
+
+    it('throws when SSH_AUTH_SOCK is missing', () => {
+      setManagedEnv({
+        HOME: '/tmp/test-home',
+        PATH: '/usr/bin:/bin',
+        SSH_AUTH_SOCK: undefined,
+      })
+
+      expect(() => getLocalDeployEnv()).toThrow(/SSH_AUTH_SOCK/)
+    })
+  })
+
+  describe('validateRemotePreconditions', () => {
+    it('does not throw when gh is available', () => {
+      const whichSpy = spyOn(Bun, 'which').mockReturnValue('/opt/homebrew/bin/gh')
+
+      expect(() => validateRemotePreconditions()).not.toThrow()
+
+      whichSpy.mockRestore()
+    })
+
+    it('throws when gh is unavailable', () => {
+      const whichSpy = spyOn(Bun, 'which').mockReturnValue(null)
+
+      expect(() => validateRemotePreconditions()).toThrow(/gh CLI is required/)
+
+      whichSpy.mockRestore()
+    })
+  })
+
+  describe('CLI flag interactions', () => {
+    it('prints the local dry-run plan', async () => {
+      const deployScriptPath = resolveLocalDeployScriptPath()
+      const {stdout, stderr, exitCode} = await runDeployCommand(['--local', '--dry-run'])
+
+      expect(exitCode).toBe(0)
+      expect(stderr).toBe('')
+      expect(stdout).toContain('Dry run: local CLIProxyAPI deploy')
+      expect(stdout).toContain(deployScriptPath)
+      expect(stdout).toContain('CLIPROXY_DOMAIN=')
+    })
+
+    it('rejects invalid options with a non-zero exit code', async () => {
+      const {exitCode} = await runDeployCommand(['--bogus'])
+
+      expect(exitCode).not.toBe(0)
+    })
+  })
+})