@marcusrbrown/infra 0.25.0 → 0.25.1

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.25.0",
+  version: "0.25.1",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -8406,7 +8406,7 @@ var CONTENT_EVENTS = new Set([
   "discussion_comment"
 ]);
 var VERIFIED_ACTION_SHA_BY_LAYOUT = {
-  "fro-bot/agent@v0.118.2": "77f2bad7d68ac38279cd0fa28f38b26a0cd15dfb"
+  "fro-bot/agent@v0.119.2": "83ed683da24111bd1474eb4bda39715ed5799bc2"
 };
 var REQUIRED_S3_INPUTS = {
   "s3-backup": undefined,
@@ -8917,7 +8917,7 @@ function formatStorageWorkflowSnippet() {
         with:
           role-to-assume: \${{ vars.FRO_BOT_S3_ROLE_TO_ASSUME }}
           aws-region: \${{ vars.FRO_BOT_S3_REGION }}
-      - uses: fro-bot/agent@77f2bad7d68ac38279cd0fa28f38b26a0cd15dfb
+      - uses: fro-bot/agent@83ed683da24111bd1474eb4bda39715ed5799bc2
         with:
           s3-backup: true
           s3-bucket: \${{ vars.FRO_BOT_S3_BUCKET }}
@@ -9138,7 +9138,7 @@ var STORAGE_VARIABLE_NAMES = {
   prefix: "FRO_BOT_S3_PREFIX",
   expectedBucketOwner: "FRO_BOT_S3_EXPECTED_BUCKET_OWNER"
 };
-var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.118.2";
+var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.119.2";
 var manifestSchema = z6.object({
   owner: z6.string().min(1),
   repo: z6.string().min(1),
@@ -11934,8 +11934,29 @@ function validateGatewayHost(host) {
   return host;
 }
 
+// src/commands/gateway/volume.ts
+var GATEWAY_COMPOSE_PROJECT_NAME = "fro-bot";
+var MITMPROXY_CERTS_VOLUME = `${GATEWAY_COMPOSE_PROJECT_NAME}_mitmproxy-certs`;
+var VOLUME_EXISTS_SENTINEL = "EXISTS";
+var VOLUME_MISSING_SENTINEL = "MISSING";
+function volumeProbeCommand(volume) {
+  return `docker volume inspect ${volume} >/dev/null 2>&1 && echo ${VOLUME_EXISTS_SENTINEL} || echo ${VOLUME_MISSING_SENTINEL}`;
+}
+function checkVolumeProbeResult(volume, result) {
+  if (result.exitCode !== 0) {
+    return `Could not verify Docker volume ${volume} on the gateway host (exit ${result.exitCode}): ${result.stderr.trim() || "unknown error"}`;
+  }
+  const sentinel = result.stdout.trim();
+  if (sentinel === VOLUME_EXISTS_SENTINEL) {
+    return;
+  }
+  if (sentinel === VOLUME_MISSING_SENTINEL) {
+    return `Docker volume ${volume} does not exist on the gateway host; refusing to continue (it would be created empty as a side effect).`;
+  }
+  return `Could not verify Docker volume ${volume} on the gateway host: unrecognized probe output`;
+}
+
 // src/commands/gateway/backup.ts
-var MITMPROXY_CERTS_VOLUME = "mitmproxy-certs";
 var CA_CERT_FILE = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE = "mitmproxy-ca.pem";
 var DEFAULT_OUTPUT = "apps/gateway/.local/mitmproxy-ca.tar";
@@ -11948,7 +11969,7 @@ async function backupGatewayCa(opts, spawn = defaultSpawn3, printErr) {
     return { ok: false, error: "Only CA backup is currently supported; --no-include-ca is not accepted" };
   }
   validateGatewayHost(opts.host);
-  const sshCmd = [
+  const sshCommand = (remote) => [
     "ssh",
     "-o",
     "BatchMode=yes",
@@ -11956,13 +11977,28 @@ async function backupGatewayCa(opts, spawn = defaultSpawn3, printErr) {
     "StrictHostKeyChecking=yes",
     ...buildKnownHostsArgs(),
     `root@${opts.host}`,
-    `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`
+    remote
   ];
   const env = {
     PATH: process.env.PATH ?? "/usr/bin:/bin",
     HOME: process.env.HOME ?? "/tmp",
     ...process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}
   };
+  const probe = spawn(sshCommand(volumeProbeCommand(MITMPROXY_CERTS_VOLUME)), { env, stdout: "pipe", stderr: "pipe" });
+  const [probeStdout, probeStderr, probeExit] = await Promise.all([
+    new Response(probe.stdout).text(),
+    new Response(probe.stderr).text(),
+    probe.exited
+  ]);
+  const probeError = checkVolumeProbeResult(MITMPROXY_CERTS_VOLUME, {
+    stdout: probeStdout,
+    stderr: probeStderr,
+    exitCode: probeExit
+  });
+  if (probeError !== undefined) {
+    return { ok: false, error: probeError };
+  }
+  const sshCmd = sshCommand(`docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`);
   const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
   const [tarBytes, stderrText, exitCode] = await Promise.all([
     new Response(child.stdout).arrayBuffer(),
@@ -12231,7 +12267,6 @@ function registerGatewayLogs(cli) {
 
 // src/commands/gateway/restore.ts
 import { z as z25 } from "zod";
-var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
 var COMPOSE_PROJECT_DIR4 = "/opt/gateway/deploy";
@@ -12300,6 +12335,11 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
   if (archiveError !== undefined) {
     return { ok: false, error: archiveError };
   }
+  const probeResult = await spawnText(spawn, sshCommand(opts.host, volumeProbeCommand(MITMPROXY_CERTS_VOLUME)), env);
+  const probeError = checkVolumeProbeResult(MITMPROXY_CERTS_VOLUME, probeResult);
+  if (probeError !== undefined) {
+    return { ok: false, error: probeError };
+  }
   const mktempResult = await spawnText(spawn, sshCommand(opts.host, "mktemp -t gateway-ca-restore-XXXXXX.tar"), env);
   if (mktempResult.exitCode !== 0) {
     return {
@@ -12336,7 +12376,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
       };
       return primaryError;
     }
-    const extractResult = await spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/dst -v ${tmpRemote}:/src.tar:ro alpine sh -c 'tar -xf /src.tar -C /dst'`), env);
+    const extractResult = await spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/dst -v ${tmpRemote}:/src.tar:ro alpine sh -c 'tar -xf /src.tar -C /dst'`), env);
     if (extractResult.exitCode !== 0) {
       primaryError = {
         ok: false,
@@ -12353,8 +12393,8 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
       return primaryError;
     }
     const [certResult, keyResult] = await Promise.all([
-      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/src:ro alpine cat /src/${CA_CERT_FILE2}`), env),
-      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/src:ro alpine cat /src/${CA_KEY_FILE2}`), env)
+      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine cat /src/${CA_CERT_FILE2}`), env),
+      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine cat /src/${CA_KEY_FILE2}`), env)
     ]);
     if (certResult.exitCode !== 0 || keyResult.exitCode !== 0) {
       primaryError = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",