@marcusrbrown/infra 0.23.0 → 0.25.0

package/README.md

@@ -38,21 +38,40 @@ bunx @marcusrbrown/infra keeweb deploy --local --nginx  # include nginx config
 bunx @marcusrbrown/infra keeweb open
 ```
 
+### Agent
+
+Configure model credentials for the Fro Bot agent and wire the optional S3 durable-storage handoff.
+
+| Subcommand | Description |
+| --- | --- |
+| `agent setup` | Interactive wizard to configure generalized agent model-credential secrets/variables |
+| `agent storage --repo OWNER/REPO --manifest FILE` | Verify the provisioned S3 handoff and wire non-secret GitHub storage variables |
+| `agent storage teardown --repo OWNER/REPO --manifest FILE` | Unwire S3 variables and remove the repo-scoped storage resources |
+
+```bash
+bunx @marcusrbrown/infra agent setup
+bunx @marcusrbrown/infra agent setup --repo owner/repo --harness opencode --key sk-existing --force
+bunx @marcusrbrown/infra agent storage --repo owner/repo --manifest handoff.json
+bunx @marcusrbrown/infra agent storage --repo owner/repo --manifest handoff.json --plan  # report without mutating
+bunx @marcusrbrown/infra agent storage teardown --repo owner/repo --manifest handoff.json
+```
+
 ### CLIProxyAPI
 
 Manage the CLIProxyAPI proxy on `cliproxy.fro.bot`.
 
-| Subcommand         | Description                                                              |
-| ------------------ | ------------------------------------------------------------------------ |
-| `cliproxy status`  | HTTP reachability, usage stats, version                                  |
-| `cliproxy models`  | List models served at /v1/models; optional `[provider]` filter           |
-| `cliproxy deploy`  | Trigger deployment (GitHub Actions by default; `--local` for direct SSH) |
-| `cliproxy config`  | Get or set proxy configuration via the management API                    |
-| `cliproxy keys`    | List, add, or remove API keys via the management API                     |
-| `cliproxy login`   | Authenticate a provider (claude or codex) via SSH                        |
-| `cliproxy monitor` | Probe Anthropic auth and send issue/Discord transition alerts            |
-| `cliproxy open`    | Open an interactive TUI via SSH                                          |
-| `cliproxy setup`   | Interactive wizard to onboard a repo to CLIProxyAPI                      |
+| Subcommand             | Description                                                              |
+| ---------------------- | ------------------------------------------------------------------------ |
+| `cliproxy status`      | HTTP reachability, usage stats, version                                  |
+| `cliproxy models`      | List models served at /v1/models; optional `[provider]` filter           |
+| `cliproxy deploy`      | Trigger deployment (GitHub Actions by default; `--local` for direct SSH) |
+| `cliproxy config`      | Get or set proxy configuration via the management API                    |
+| `cliproxy keys`        | List, add, or remove API keys via the management API                     |
+| `cliproxy login`       | Authenticate a provider (claude or codex) via SSH                        |
+| `cliproxy monitor`     | Probe Anthropic auth and send issue/Discord transition alerts            |
+| `cliproxy open`        | Open an interactive TUI via SSH                                          |
+| `cliproxy reset-quota` | Reset quota for a CLIProxyAPI auth record                                |
+| `cliproxy setup`       | Interactive wizard to onboard a repo to CLIProxyAPI                      |
 
 ```bash
 bunx @marcusrbrown/infra cliproxy status
@@ -68,10 +87,27 @@ bunx @marcusrbrown/infra cliproxy login claude
 bunx @marcusrbrown/infra cliproxy login codex
 bunx @marcusrbrown/infra cliproxy monitor
 bunx @marcusrbrown/infra cliproxy open
+bunx @marcusrbrown/infra cliproxy reset-quota
 bunx @marcusrbrown/infra cliproxy setup
 bunx @marcusrbrown/infra cliproxy setup --repo OWNER/REPO --harness opencode
 ```
 
+### Broker
+
+Manage the OIDC credential broker on `broker.fro.bot`.
+
+| Subcommand      | Description                                                              |
+| --------------- | ------------------------------------------------------------------------ |
+| `broker status` | HTTP reachability via `/healthz`                                         |
+| `broker deploy` | Trigger deployment (GitHub Actions by default; `--local` for direct SSH) |
+| `broker logs`   | Stream broker service logs (`--tail N` to limit lines)                   |
+
+```bash
+bunx @marcusrbrown/infra broker status
+bunx @marcusrbrown/infra broker deploy
+bunx @marcusrbrown/infra broker logs --tail 100
+```
+
 ### Gateway
 
 Manage the Fro Bot gateway on `gateway.fro.bot`.
@@ -108,6 +144,46 @@ bunx @marcusrbrown/infra umami deploy
 bunx @marcusrbrown/infra umami logs --tail 50
 ```
 
+### Dashboard
+
+Manage the Fro Bot operator dashboard.
+
+| Subcommand         | Description                                                              |
+| ------------------ | ------------------------------------------------------------------------ |
+| `dashboard status` | SSH health check, `docker compose ps` service states                     |
+| `dashboard deploy` | Trigger deployment (GitHub Actions by default; `--local` for direct SSH) |
+| `dashboard logs`   | Stream dashboard service logs (`--tail N` to limit lines)                |
+
+```bash
+bunx @marcusrbrown/infra dashboard status
+bunx @marcusrbrown/infra dashboard deploy
+bunx @marcusrbrown/infra dashboard deploy --image-version 2026.06.47  # pin a CalVer release
+bunx @marcusrbrown/infra dashboard logs dashboard --tail 100
+```
+
+### VPN
+
+Manage the WireGuard VPN egress box.
+
+| Subcommand                 | Description                                                              |
+| -------------------------- | ------------------------------------------------------------------------ |
+| `vpn status`               | SSH health check, `wg show wg0` interface state                          |
+| `vpn deploy`               | Trigger deployment (GitHub Actions by default; `--local` for direct SSH) |
+| `vpn logs`                 | Stream WireGuard logs (`--tail N` to limit lines)                        |
+| `vpn client add <name>`    | Generate a keypair, assign a tunnel IP, write the client `.conf`         |
+| `vpn client list`          | List peers (name, tunnel IP, public key)                                 |
+| `vpn client remove <name>` | Remove a peer                                                            |
+
+```bash
+bunx @marcusrbrown/infra vpn status
+bunx @marcusrbrown/infra vpn deploy
+bunx @marcusrbrown/infra vpn deploy --force-server-key  # rotates the server key, invalidates all client configs
+bunx @marcusrbrown/infra vpn logs --tail 100
+bunx @marcusrbrown/infra vpn client add laptop
+bunx @marcusrbrown/infra vpn client list
+bunx @marcusrbrown/infra vpn client remove laptop
+```
+
 ### Unified Status
 
 ```bash
@@ -117,7 +193,7 @@ bunx @marcusrbrown/infra status --json   # machine-readable output
 
 ### MCP Bridge
 
-Exposes read-only status commands as MCP tools over stdio.
+Starts a stdio MCP server exposing a read-only allowlist of exactly 9 status commands as tools: `gateway status`, `cliproxy status`, `cliproxy models`, `keeweb status`, `umami status`, `dashboard status`, `vpn status`, `broker status`, and unified `status`. Every mutating command is deliberately excluded from the allowlist.
 
 ```bash
 bunx @marcusrbrown/infra mcp

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.23.0",
+  version: "0.25.0",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -6993,7 +6993,7 @@ var package_default = {
   },
   devDependencies: {
     "@marcusrbrown/infra-shared": "workspace:*",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     yaml: "2.9.1"
   },
   engines: {
@@ -8406,7 +8406,7 @@ var CONTENT_EVENTS = new Set([
   "discussion_comment"
 ]);
 var VERIFIED_ACTION_SHA_BY_LAYOUT = {
-  "fro-bot/agent@v0.96.0": "c29ac295b8da06768b140c32e5bd0ae3aff45dc6"
+  "fro-bot/agent@v0.118.2": "77f2bad7d68ac38279cd0fa28f38b26a0cd15dfb"
 };
 var REQUIRED_S3_INPUTS = {
   "s3-backup": undefined,
@@ -8849,9 +8849,16 @@ function hasHandoff(job) {
   const serialized = stringifyUnknown(job);
   return /needs\.[\w-]+\.outputs\./.test(serialized) || /actions\/(?:download-artifact|upload-artifact|cache|cache\/restore|cache\/save)@/.test(serialized);
 }
+var STATIC_AWS_CREDENTIAL_PATTERN = /AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|aws-access-key-id|aws-secret-access-key/;
+function withoutBlankedCredentialKeys(value) {
+  if (Array.isArray(value))
+    return value.map(withoutBlankedCredentialKeys);
+  if (!isMapping(value))
+    return value;
+  return Object.fromEntries(Object.entries(value).filter(([key, entry]) => !(entry === "" && STATIC_AWS_CREDENTIAL_PATTERN.test(key))).map(([key, entry]) => [key, withoutBlankedCredentialKeys(entry)]));
+}
 function hasStaticAwsCredentials(job) {
-  const serialized = stringifyUnknown(job);
-  return /AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|aws-access-key-id|aws-secret-access-key/.test(serialized);
+  return STATIC_AWS_CREDENTIAL_PATTERN.test(stringifyUnknown(withoutBlankedCredentialKeys(job)));
 }
 function ancestors(jobId, analyses) {
   const visited = new Set;
@@ -8910,7 +8917,7 @@ function formatStorageWorkflowSnippet() {
         with:
           role-to-assume: \${{ vars.FRO_BOT_S3_ROLE_TO_ASSUME }}
           aws-region: \${{ vars.FRO_BOT_S3_REGION }}
-      - uses: fro-bot/agent@c29ac295b8da06768b140c32e5bd0ae3aff45dc6
+      - uses: fro-bot/agent@77f2bad7d68ac38279cd0fa28f38b26a0cd15dfb
         with:
           s3-backup: true
           s3-bucket: \${{ vars.FRO_BOT_S3_BUCKET }}
@@ -8946,10 +8953,6 @@ function environmentResult(environmentValue, branchPoliciesValue) {
     violations.push("GitHub Environment fro-bot-storage is missing or returned an invalid response.");
     return { verified: false, violations };
   }
-  const protectionRules = Array.isArray(environmentValue.protection_rules) ? environmentValue.protection_rules : [];
-  const hasReviewer = protectionRules.some((rule) => isMapping(rule) && rule.type === "required_reviewers" && Array.isArray(rule.reviewers) && rule.reviewers.length > 0);
-  if (!hasReviewer)
-    violations.push("GitHub Environment fro-bot-storage has no required reviewer protection rule.");
   const branchPolicy = environmentValue.deployment_branch_policy;
   if (!isMapping(branchPolicy) || branchPolicy.protected_branches !== false || branchPolicy.custom_branch_policies !== true) {
     violations.push("GitHub Environment fro-bot-storage does not use a custom deployment-branch policy.");
@@ -9135,7 +9138,7 @@ var STORAGE_VARIABLE_NAMES = {
   prefix: "FRO_BOT_S3_PREFIX",
   expectedBucketOwner: "FRO_BOT_S3_EXPECTED_BUCKET_OWNER"
 };
-var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.96.0";
+var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.118.2";
 var manifestSchema = z6.object({
   owner: z6.string().min(1),
   repo: z6.string().min(1),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",
@@ -43,7 +43,7 @@
   },
   "devDependencies": {
     "@marcusrbrown/infra-shared": "workspace:*",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "yaml": "2.9.1"
   },
   "engines": {