@marcusrbrown/infra 0.24.0 → 0.25.1

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.24.0",
+  version: "0.25.1",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -6993,7 +6993,7 @@ var package_default = {
   },
   devDependencies: {
     "@marcusrbrown/infra-shared": "workspace:*",
-    "@modelcontextprotocol/sdk": "1.31.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     yaml: "2.9.1"
   },
   engines: {
@@ -8406,7 +8406,7 @@ var CONTENT_EVENTS = new Set([
   "discussion_comment"
 ]);
 var VERIFIED_ACTION_SHA_BY_LAYOUT = {
-  "fro-bot/agent@v0.96.0": "c29ac295b8da06768b140c32e5bd0ae3aff45dc6"
+  "fro-bot/agent@v0.119.2": "83ed683da24111bd1474eb4bda39715ed5799bc2"
 };
 var REQUIRED_S3_INPUTS = {
   "s3-backup": undefined,
@@ -8849,9 +8849,16 @@ function hasHandoff(job) {
   const serialized = stringifyUnknown(job);
   return /needs\.[\w-]+\.outputs\./.test(serialized) || /actions\/(?:download-artifact|upload-artifact|cache|cache\/restore|cache\/save)@/.test(serialized);
 }
+var STATIC_AWS_CREDENTIAL_PATTERN = /AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|aws-access-key-id|aws-secret-access-key/;
+function withoutBlankedCredentialKeys(value) {
+  if (Array.isArray(value))
+    return value.map(withoutBlankedCredentialKeys);
+  if (!isMapping(value))
+    return value;
+  return Object.fromEntries(Object.entries(value).filter(([key, entry]) => !(entry === "" && STATIC_AWS_CREDENTIAL_PATTERN.test(key))).map(([key, entry]) => [key, withoutBlankedCredentialKeys(entry)]));
+}
 function hasStaticAwsCredentials(job) {
-  const serialized = stringifyUnknown(job);
-  return /AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|aws-access-key-id|aws-secret-access-key/.test(serialized);
+  return STATIC_AWS_CREDENTIAL_PATTERN.test(stringifyUnknown(withoutBlankedCredentialKeys(job)));
 }
 function ancestors(jobId, analyses) {
   const visited = new Set;
@@ -8910,7 +8917,7 @@ function formatStorageWorkflowSnippet() {
         with:
           role-to-assume: \${{ vars.FRO_BOT_S3_ROLE_TO_ASSUME }}
           aws-region: \${{ vars.FRO_BOT_S3_REGION }}
-      - uses: fro-bot/agent@c29ac295b8da06768b140c32e5bd0ae3aff45dc6
+      - uses: fro-bot/agent@83ed683da24111bd1474eb4bda39715ed5799bc2
         with:
           s3-backup: true
           s3-bucket: \${{ vars.FRO_BOT_S3_BUCKET }}
@@ -8946,10 +8953,6 @@ function environmentResult(environmentValue, branchPoliciesValue) {
     violations.push("GitHub Environment fro-bot-storage is missing or returned an invalid response.");
     return { verified: false, violations };
   }
-  const protectionRules = Array.isArray(environmentValue.protection_rules) ? environmentValue.protection_rules : [];
-  const hasReviewer = protectionRules.some((rule) => isMapping(rule) && rule.type === "required_reviewers" && Array.isArray(rule.reviewers) && rule.reviewers.length > 0);
-  if (!hasReviewer)
-    violations.push("GitHub Environment fro-bot-storage has no required reviewer protection rule.");
   const branchPolicy = environmentValue.deployment_branch_policy;
   if (!isMapping(branchPolicy) || branchPolicy.protected_branches !== false || branchPolicy.custom_branch_policies !== true) {
     violations.push("GitHub Environment fro-bot-storage does not use a custom deployment-branch policy.");
@@ -9135,7 +9138,7 @@ var STORAGE_VARIABLE_NAMES = {
   prefix: "FRO_BOT_S3_PREFIX",
   expectedBucketOwner: "FRO_BOT_S3_EXPECTED_BUCKET_OWNER"
 };
-var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.96.0";
+var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.119.2";
 var manifestSchema = z6.object({
   owner: z6.string().min(1),
   repo: z6.string().min(1),
@@ -11931,8 +11934,29 @@ function validateGatewayHost(host) {
   return host;
 }
 
+// src/commands/gateway/volume.ts
+var GATEWAY_COMPOSE_PROJECT_NAME = "fro-bot";
+var MITMPROXY_CERTS_VOLUME = `${GATEWAY_COMPOSE_PROJECT_NAME}_mitmproxy-certs`;
+var VOLUME_EXISTS_SENTINEL = "EXISTS";
+var VOLUME_MISSING_SENTINEL = "MISSING";
+function volumeProbeCommand(volume) {
+  return `docker volume inspect ${volume} >/dev/null 2>&1 && echo ${VOLUME_EXISTS_SENTINEL} || echo ${VOLUME_MISSING_SENTINEL}`;
+}
+function checkVolumeProbeResult(volume, result) {
+  if (result.exitCode !== 0) {
+    return `Could not verify Docker volume ${volume} on the gateway host (exit ${result.exitCode}): ${result.stderr.trim() || "unknown error"}`;
+  }
+  const sentinel = result.stdout.trim();
+  if (sentinel === VOLUME_EXISTS_SENTINEL) {
+    return;
+  }
+  if (sentinel === VOLUME_MISSING_SENTINEL) {
+    return `Docker volume ${volume} does not exist on the gateway host; refusing to continue (it would be created empty as a side effect).`;
+  }
+  return `Could not verify Docker volume ${volume} on the gateway host: unrecognized probe output`;
+}
+
 // src/commands/gateway/backup.ts
-var MITMPROXY_CERTS_VOLUME = "mitmproxy-certs";
 var CA_CERT_FILE = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE = "mitmproxy-ca.pem";
 var DEFAULT_OUTPUT = "apps/gateway/.local/mitmproxy-ca.tar";
@@ -11945,7 +11969,7 @@ async function backupGatewayCa(opts, spawn = defaultSpawn3, printErr) {
     return { ok: false, error: "Only CA backup is currently supported; --no-include-ca is not accepted" };
   }
   validateGatewayHost(opts.host);
-  const sshCmd = [
+  const sshCommand = (remote) => [
     "ssh",
     "-o",
     "BatchMode=yes",
@@ -11953,13 +11977,28 @@ async function backupGatewayCa(opts, spawn = defaultSpawn3, printErr) {
     "StrictHostKeyChecking=yes",
     ...buildKnownHostsArgs(),
     `root@${opts.host}`,
-    `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`
+    remote
   ];
   const env = {
     PATH: process.env.PATH ?? "/usr/bin:/bin",
     HOME: process.env.HOME ?? "/tmp",
     ...process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}
   };
+  const probe = spawn(sshCommand(volumeProbeCommand(MITMPROXY_CERTS_VOLUME)), { env, stdout: "pipe", stderr: "pipe" });
+  const [probeStdout, probeStderr, probeExit] = await Promise.all([
+    new Response(probe.stdout).text(),
+    new Response(probe.stderr).text(),
+    probe.exited
+  ]);
+  const probeError = checkVolumeProbeResult(MITMPROXY_CERTS_VOLUME, {
+    stdout: probeStdout,
+    stderr: probeStderr,
+    exitCode: probeExit
+  });
+  if (probeError !== undefined) {
+    return { ok: false, error: probeError };
+  }
+  const sshCmd = sshCommand(`docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`);
   const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
   const [tarBytes, stderrText, exitCode] = await Promise.all([
     new Response(child.stdout).arrayBuffer(),
@@ -12228,7 +12267,6 @@ function registerGatewayLogs(cli) {
 
 // src/commands/gateway/restore.ts
 import { z as z25 } from "zod";
-var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
 var COMPOSE_PROJECT_DIR4 = "/opt/gateway/deploy";
@@ -12297,6 +12335,11 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
   if (archiveError !== undefined) {
     return { ok: false, error: archiveError };
   }
+  const probeResult = await spawnText(spawn, sshCommand(opts.host, volumeProbeCommand(MITMPROXY_CERTS_VOLUME)), env);
+  const probeError = checkVolumeProbeResult(MITMPROXY_CERTS_VOLUME, probeResult);
+  if (probeError !== undefined) {
+    return { ok: false, error: probeError };
+  }
   const mktempResult = await spawnText(spawn, sshCommand(opts.host, "mktemp -t gateway-ca-restore-XXXXXX.tar"), env);
   if (mktempResult.exitCode !== 0) {
     return {
@@ -12333,7 +12376,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
       };
       return primaryError;
     }
-    const extractResult = await spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/dst -v ${tmpRemote}:/src.tar:ro alpine sh -c 'tar -xf /src.tar -C /dst'`), env);
+    const extractResult = await spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/dst -v ${tmpRemote}:/src.tar:ro alpine sh -c 'tar -xf /src.tar -C /dst'`), env);
     if (extractResult.exitCode !== 0) {
       primaryError = {
         ok: false,
@@ -12350,8 +12393,8 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
       return primaryError;
     }
     const [certResult, keyResult] = await Promise.all([
-      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/src:ro alpine cat /src/${CA_CERT_FILE2}`), env),
-      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/src:ro alpine cat /src/${CA_KEY_FILE2}`), env)
+      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine cat /src/${CA_CERT_FILE2}`), env),
+      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine cat /src/${CA_KEY_FILE2}`), env)
     ]);
     if (certResult.exitCode !== 0 || keyResult.exitCode !== 0) {
       primaryError = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.24.0",
+  "version": "0.25.1",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",
@@ -43,7 +43,7 @@
   },
   "devDependencies": {
     "@marcusrbrown/infra-shared": "workspace:*",
-    "@modelcontextprotocol/sdk": "1.31.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "yaml": "2.9.1"
   },
   "engines": {