@marcusrbrown/infra 0.25.0 → 0.25.2

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.25.0",
+  version: "0.25.2",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -8390,6 +8390,13 @@ function registerSetupCommand(cli, commandLabel) {
 import { log as log3 } from "@clack/prompts";
 import { z as z6 } from "zod";
 
+// src/commands/agent/key-layout.ts
+var KEY_LAYOUT_VERSION = "fro-bot-agent-s3-layout/1";
+var LEGACY_KEY_LAYOUT_LABELS = new Set(["fro-bot/agent@v0.118.2", "fro-bot/agent@v0.119.2"]);
+function isKnownKeyLayoutVersion(label) {
+  return label === KEY_LAYOUT_VERSION || LEGACY_KEY_LAYOUT_LABELS.has(label);
+}
+
 // src/commands/agent/workflow-verify.ts
 var WORKFLOW_PATH = ".github/workflows/fro-bot.yaml";
 var STORAGE_ENVIRONMENT = "fro-bot-storage";
@@ -8405,9 +8412,6 @@ var CONTENT_EVENTS = new Set([
   "discussion",
   "discussion_comment"
 ]);
-var VERIFIED_ACTION_SHA_BY_LAYOUT = {
-  "fro-bot/agent@v0.118.2": "77f2bad7d68ac38279cd0fa28f38b26a0cd15dfb"
-};
 var REQUIRED_S3_INPUTS = {
   "s3-backup": undefined,
   "s3-bucket": "FRO_BOT_S3_BUCKET",
@@ -8778,8 +8782,7 @@ function checkStorageAction(jobId, job, manifest, violations) {
     violations.push(`Storage job '${jobId}' must contain a fro-bot/agent action step.`);
     return;
   }
-  const verifiedSha = VERIFIED_ACTION_SHA_BY_LAYOUT[manifest.key_layout_version];
-  if (!verifiedSha) {
+  if (!isKnownKeyLayoutVersion(manifest.key_layout_version)) {
     violations.push(`Unknown key_layout_version '${manifest.key_layout_version}'; refusing to verify fro-bot/agent.`);
   }
   const firstAgentIndex = steps.findIndex((step) => typeof step.uses === "string" && step.uses.startsWith("fro-bot/agent@"));
@@ -8807,8 +8810,8 @@ function checkStorageAction(jobId, job, manifest, violations) {
   for (const [index, step] of agentSteps.entries()) {
     const uses = String(step.uses);
     const ref = uses.split("@").at(-1) ?? "";
-    if (verifiedSha && ref !== verifiedSha) {
-      violations.push(`Storage job '${jobId}' action ref '${ref}' is not the verified layout for '${manifest.key_layout_version}'; ` + `storage job must pin fro-bot/agent to the verified SHA for '${manifest.key_layout_version}', not a moveable tag.`);
+    if (!/^[0-9a-f]{40}$/i.test(ref)) {
+      violations.push(`Storage job '${jobId}' fro-bot/agent step ${index + 1} ref '${ref}' is not a full commit SHA; ` + "storage job must pin fro-bot/agent to a full 40-hex commit SHA, not a moveable tag or branch.");
     }
     if (!isMapping(step.with)) {
       violations.push(`Storage job '${jobId}' agent step ${index + 1} is missing its S3 inputs.`);
@@ -8917,7 +8920,7 @@ function formatStorageWorkflowSnippet() {
         with:
           role-to-assume: \${{ vars.FRO_BOT_S3_ROLE_TO_ASSUME }}
           aws-region: \${{ vars.FRO_BOT_S3_REGION }}
-      - uses: fro-bot/agent@77f2bad7d68ac38279cd0fa28f38b26a0cd15dfb
+      - uses: fro-bot/agent@83ed683da24111bd1474eb4bda39715ed5799bc2
         with:
           s3-backup: true
           s3-bucket: \${{ vars.FRO_BOT_S3_BUCKET }}
@@ -9138,7 +9141,6 @@ var STORAGE_VARIABLE_NAMES = {
   prefix: "FRO_BOT_S3_PREFIX",
   expectedBucketOwner: "FRO_BOT_S3_EXPECTED_BUCKET_OWNER"
 };
-var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.118.2";
 var manifestSchema = z6.object({
   owner: z6.string().min(1),
   repo: z6.string().min(1),
@@ -9190,8 +9192,8 @@ function assertCanonicalPath(field, value, mustEndWithSlash) {
   }
 }
 function validateManifest(manifest) {
-  if (manifest.key_layout_version !== KNOWN_KEY_LAYOUT_VERSION) {
-    throw new Error(`Unknown handoff manifest key_layout_version '${manifest.key_layout_version}'; expected ${KNOWN_KEY_LAYOUT_VERSION}.`);
+  if (!isKnownKeyLayoutVersion(manifest.key_layout_version)) {
+    throw new Error(`Unknown handoff manifest key_layout_version '${manifest.key_layout_version}'; expected ${KEY_LAYOUT_VERSION}.`);
   }
   assertRepoFormat(`${manifest.owner}/${manifest.repo}`);
   assertCanonicalPath("s3_prefix", manifest.s3_prefix, false);
@@ -11934,8 +11936,29 @@ function validateGatewayHost(host) {
   return host;
 }
 
+// src/commands/gateway/volume.ts
+var GATEWAY_COMPOSE_PROJECT_NAME = "fro-bot";
+var MITMPROXY_CERTS_VOLUME = `${GATEWAY_COMPOSE_PROJECT_NAME}_mitmproxy-certs`;
+var VOLUME_EXISTS_SENTINEL = "EXISTS";
+var VOLUME_MISSING_SENTINEL = "MISSING";
+function volumeProbeCommand(volume) {
+  return `docker volume inspect ${volume} >/dev/null 2>&1 && echo ${VOLUME_EXISTS_SENTINEL} || echo ${VOLUME_MISSING_SENTINEL}`;
+}
+function checkVolumeProbeResult(volume, result) {
+  if (result.exitCode !== 0) {
+    return `Could not verify Docker volume ${volume} on the gateway host (exit ${result.exitCode}): ${result.stderr.trim() || "unknown error"}`;
+  }
+  const sentinel = result.stdout.trim();
+  if (sentinel === VOLUME_EXISTS_SENTINEL) {
+    return;
+  }
+  if (sentinel === VOLUME_MISSING_SENTINEL) {
+    return `Docker volume ${volume} does not exist on the gateway host; refusing to continue (it would be created empty as a side effect).`;
+  }
+  return `Could not verify Docker volume ${volume} on the gateway host: unrecognized probe output`;
+}
+
 // src/commands/gateway/backup.ts
-var MITMPROXY_CERTS_VOLUME = "mitmproxy-certs";
 var CA_CERT_FILE = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE = "mitmproxy-ca.pem";
 var DEFAULT_OUTPUT = "apps/gateway/.local/mitmproxy-ca.tar";
@@ -11948,7 +11971,7 @@ async function backupGatewayCa(opts, spawn = defaultSpawn3, printErr) {
     return { ok: false, error: "Only CA backup is currently supported; --no-include-ca is not accepted" };
   }
   validateGatewayHost(opts.host);
-  const sshCmd = [
+  const sshCommand = (remote) => [
     "ssh",
     "-o",
     "BatchMode=yes",
@@ -11956,13 +11979,28 @@ async function backupGatewayCa(opts, spawn = defaultSpawn3, printErr) {
     "StrictHostKeyChecking=yes",
     ...buildKnownHostsArgs(),
     `root@${opts.host}`,
-    `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`
+    remote
   ];
   const env = {
     PATH: process.env.PATH ?? "/usr/bin:/bin",
     HOME: process.env.HOME ?? "/tmp",
     ...process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}
   };
+  const probe = spawn(sshCommand(volumeProbeCommand(MITMPROXY_CERTS_VOLUME)), { env, stdout: "pipe", stderr: "pipe" });
+  const [probeStdout, probeStderr, probeExit] = await Promise.all([
+    new Response(probe.stdout).text(),
+    new Response(probe.stderr).text(),
+    probe.exited
+  ]);
+  const probeError = checkVolumeProbeResult(MITMPROXY_CERTS_VOLUME, {
+    stdout: probeStdout,
+    stderr: probeStderr,
+    exitCode: probeExit
+  });
+  if (probeError !== undefined) {
+    return { ok: false, error: probeError };
+  }
+  const sshCmd = sshCommand(`docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`);
   const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
   const [tarBytes, stderrText, exitCode] = await Promise.all([
     new Response(child.stdout).arrayBuffer(),
@@ -12231,7 +12269,6 @@ function registerGatewayLogs(cli) {
 
 // src/commands/gateway/restore.ts
 import { z as z25 } from "zod";
-var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
 var COMPOSE_PROJECT_DIR4 = "/opt/gateway/deploy";
@@ -12300,6 +12337,11 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
   if (archiveError !== undefined) {
     return { ok: false, error: archiveError };
   }
+  const probeResult = await spawnText(spawn, sshCommand(opts.host, volumeProbeCommand(MITMPROXY_CERTS_VOLUME)), env);
+  const probeError = checkVolumeProbeResult(MITMPROXY_CERTS_VOLUME, probeResult);
+  if (probeError !== undefined) {
+    return { ok: false, error: probeError };
+  }
   const mktempResult = await spawnText(spawn, sshCommand(opts.host, "mktemp -t gateway-ca-restore-XXXXXX.tar"), env);
   if (mktempResult.exitCode !== 0) {
     return {
@@ -12336,7 +12378,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
       };
       return primaryError;
     }
-    const extractResult = await spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/dst -v ${tmpRemote}:/src.tar:ro alpine sh -c 'tar -xf /src.tar -C /dst'`), env);
+    const extractResult = await spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/dst -v ${tmpRemote}:/src.tar:ro alpine sh -c 'tar -xf /src.tar -C /dst'`), env);
     if (extractResult.exitCode !== 0) {
       primaryError = {
         ok: false,
@@ -12353,8 +12395,8 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
       return primaryError;
     }
     const [certResult, keyResult] = await Promise.all([
-      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/src:ro alpine cat /src/${CA_CERT_FILE2}`), env),
-      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME2}:/src:ro alpine cat /src/${CA_KEY_FILE2}`), env)
+      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine cat /src/${CA_CERT_FILE2}`), env),
+      spawnText(spawn, sshCommand(opts.host, `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine cat /src/${CA_KEY_FILE2}`), env)
     ]);
     if (certResult.exitCode !== 0 || keyResult.exitCode !== 0) {
       primaryError = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",