@marcusrbrown/infra 0.26.0 → 0.26.1

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.26.0",
+  version: "0.26.1",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -12129,6 +12129,7 @@ function getGatewayDeployEnv() {
     GATEWAY_OPERATOR_PUSH_VAPID_PRIVATE_KEY: process.env.GATEWAY_OPERATOR_PUSH_VAPID_PRIVATE_KEY ?? "",
     GATEWAY_OPERATOR_PUSH_VAPID_SUBJECT: process.env.GATEWAY_OPERATOR_PUSH_VAPID_SUBJECT ?? "",
     GATEWAY_OPERATOR_PUSH_VAPID_KEY_VERSION: process.env.GATEWAY_OPERATOR_PUSH_VAPID_KEY_VERSION ?? "",
+    GATEWAY_BINDER_ALLOWLIST: process.env.GATEWAY_BINDER_ALLOWLIST ?? "",
     GATEWAY_VPC_IP: process.env.GATEWAY_VPC_IP ?? "",
     DASHBOARD_VPC_IP: process.env.DASHBOARD_VPC_IP ?? "",
     GATEWAY_IMAGE_DIGEST: process.env.GATEWAY_IMAGE_DIGEST ?? "",
@@ -12448,7 +12449,176 @@ function registerGatewayRestore(cli) {
 
 // src/commands/gateway/status.ts
 import { z as z26 } from "zod";
+
+// src/commands/gateway/workspace-memory.ts
 var COMPOSE_PROJECT_DIR5 = "/opt/gateway/deploy";
+var MIB = 1024 * 1024;
+var READYZ_PROBE_HEADROOM_BYTES = 64 * MIB;
+var OPENCODE_STATES = ["starting", "ready", "down", "degraded"];
+var SECTION_MARKERS = {
+  id: "@@ws-id@@",
+  inspect: "@@ws-inspect@@",
+  cgroup: "@@ws-cgroup@@",
+  readyz: "@@ws-readyz@@"
+};
+var READYZ_SKIPPED_SENTINEL = "@@ws-readyz-skipped@@";
+var READYZ_URL = "http://127.0.0.1:9100/readyz";
+function buildReadyzProbeSnippet(url = READYZ_URL) {
+  return `fetch("${url}",{signal:AbortSignal.timeout(3000)}).then(r=>r.text()).then(t=>process.stdout.write(t)).catch(()=>{})`;
+}
+function buildWorkspaceProbeScript() {
+  return [
+    `id=$(docker compose --project-directory ${COMPOSE_PROJECT_DIR5} ps -q workspace)`,
+    `echo ${SECTION_MARKERS.id}`,
+    'echo "$id"',
+    `echo ${SECTION_MARKERS.inspect}`,
+    `docker inspect --format '{{.HostConfig.Memory}} {{.State.OOMKilled}} {{.RestartCount}} {{.State.StartedAt}}' "$id"`,
+    `echo ${SECTION_MARKERS.cgroup}`,
+    'docker exec "$id" cat /sys/fs/cgroup/memory.current /sys/fs/cgroup/memory.events',
+    `echo ${SECTION_MARKERS.readyz}`,
+    `limit=$(docker inspect --format '{{.HostConfig.Memory}}' "$id")`,
+    'cur=$(docker exec "$id" cat /sys/fs/cgroup/memory.current)',
+    "run=no",
+    `case "$limit" in ''|*[!0-9]*) ;; *)`,
+    `  case "$cur" in ''|*[!0-9]*) ;; *)`,
+    `    if [ "$limit" -gt 0 ] && [ $(( limit - cur )) -gt ${READYZ_PROBE_HEADROOM_BYTES} ]; then run=yes; fi ;;`,
+    "  esac ;;",
+    "esac",
+    'if [ "$run" = yes ]; then',
+    `  docker exec "$id" node -e '${buildReadyzProbeSnippet()}'`,
+    "else",
+    `  echo ${READYZ_SKIPPED_SENTINEL}`,
+    "fi",
+    "exit 0"
+  ].join(`
+`);
+}
+function splitSections(stdoutText) {
+  const markers = new Set(Object.values(SECTION_MARKERS));
+  const sections = new Map;
+  let current;
+  for (const line of stdoutText.split(`
+`)) {
+    const trimmed = line.trim();
+    if (markers.has(trimmed)) {
+      if (sections.has(trimmed))
+        return;
+      current = [];
+      sections.set(trimmed, current);
+    } else if (current !== undefined) {
+      current.push(trimmed);
+    }
+  }
+  return sections;
+}
+function parseCount(raw) {
+  if (raw === undefined || !/^\d+$/.test(raw))
+    return;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) ? value : undefined;
+}
+function parseOpencodeState(body) {
+  if (body.length === 0)
+    return "unknown";
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("opencode" in parsed))
+    return "unknown";
+  return OPENCODE_STATES.find((state) => state === parsed.opencode) ?? "unknown";
+}
+var unknownWorkspace = (reason) => ({ status: "unknown", reason });
+function parseWorkspaceProbeOutput(stdoutText) {
+  const sections = splitSections(stdoutText);
+  const idLines = sections?.get(SECTION_MARKERS.id);
+  const inspectLines = sections?.get(SECTION_MARKERS.inspect);
+  const cgroupLines = sections?.get(SECTION_MARKERS.cgroup);
+  const readyzLines = sections?.get(SECTION_MARKERS.readyz);
+  if (!idLines || !inspectLines || !cgroupLines || !readyzLines)
+    return unknownWorkspace("incomplete probe output");
+  const ids = idLines.filter((line) => line.length > 0);
+  if (ids.length !== 1 || !/^[\da-f]{12,64}$/i.test(ids[0] ?? "")) {
+    return unknownWorkspace("workspace container not found");
+  }
+  const inspectFields = inspectLines.filter((line) => line.length > 0).join(" ").split(/\s+/);
+  const [memoryRaw, oomKilledRaw, restartRaw, startedAt] = inspectFields;
+  const limitBytes = parseCount(memoryRaw);
+  const restartCount = parseCount(restartRaw);
+  if (inspectFields.length !== 4 || limitBytes === undefined || restartCount === undefined || oomKilledRaw !== "true" && oomKilledRaw !== "false" || startedAt === undefined || !/^\d{4}-\d\d-\d\dT/.test(startedAt)) {
+    return unknownWorkspace("unparsable docker inspect output");
+  }
+  const cgroup = cgroupLines.filter((line) => line.length > 0);
+  const currentBytes = parseCount(cgroup[0]);
+  const events = new Map;
+  for (const line of cgroup.slice(1)) {
+    const [key, value] = line.split(/\s+/);
+    if (key !== undefined && value !== undefined)
+      events.set(key, value);
+  }
+  const maxEvents = parseCount(events.get("max"));
+  const oomKills = parseCount(events.get("oom_kill"));
+  if (currentBytes === undefined || maxEvents === undefined || oomKills === undefined) {
+    return unknownWorkspace("unparsable cgroup memory output");
+  }
+  const probeAllowed = limitBytes > 0 && limitBytes - currentBytes > READYZ_PROBE_HEADROOM_BYTES;
+  let opencode;
+  if (readyzLines.includes(READYZ_SKIPPED_SENTINEL))
+    opencode = "skipped";
+  else if (probeAllowed)
+    opencode = parseOpencodeState(readyzLines.join("").trim());
+  else
+    opencode = "unknown";
+  if (opencode === undefined)
+    return unknownWorkspace("unparsable readyz body");
+  return {
+    status: "ok",
+    limitBytes,
+    currentBytes,
+    maxEvents,
+    oomKills,
+    oomKilled: oomKilledRaw === "true",
+    restartCount,
+    startedAt,
+    opencode
+  };
+}
+var formatMiB = (bytes) => `${Math.round(bytes / MIB)}`;
+function formatOpencode(status) {
+  if (status.opencode !== "skipped")
+    return status.opencode;
+  if (status.limitBytes === 0)
+    return "skipped (no limit)";
+  if (status.limitBytes - status.currentBytes <= READYZ_PROBE_HEADROOM_BYTES) {
+    return `skipped (within ${READYZ_PROBE_HEADROOM_BYTES / MIB} MiB of the limit)`;
+  }
+  return "skipped (memory read unavailable)";
+}
+function formatWorkspaceMemory(status) {
+  if (status.status === "unknown")
+    return [`Workspace memory: unknown (${status.reason})`];
+  return [
+    "Workspace memory",
+    `  Limit:       ${status.limitBytes === 0 ? "none" : `${formatMiB(status.limitBytes)} MiB`}`,
+    `  Usage:       ${formatMiB(status.currentBytes)} MiB`,
+    `  Max events:  ${status.maxEvents}`,
+    `  OOM kills:   ${status.oomKills} (counted since the container last started)`,
+    `  Restarts:    ${status.restartCount} (started ${status.startedAt})`,
+    `  OOMKilled:   ${status.oomKilled}`,
+    `  OpenCode:    ${formatOpencode(status)}`
+  ];
+}
+function formatWorkspaceSummary(status) {
+  if (status.status === "unknown")
+    return "workspace=unknown";
+  const mem = status.limitBytes === 0 ? `mem=${formatMiB(status.currentBytes)}MiB limit=none` : `mem=${formatMiB(status.currentBytes)}/${formatMiB(status.limitBytes)}MiB`;
+  return `workspace ${mem} oom_kills=${status.oomKills} opencode=${status.opencode}`;
+}
+
+// src/commands/gateway/status.ts
+var WORKSPACE_PROBE_TIMEOUT_MS = 1e4;
 function parseComposePsOutput2(stdoutText) {
   const trimmed = stdoutText.trim();
   if (trimmed.length === 0)
@@ -12534,9 +12704,55 @@ async function getGatewayComposeStatus(host, spawn = defaultSpawn5) {
   const ok = isAllRunning2(services);
   return { ok, services };
 }
-async function getGatewayStatusSummary(host) {
-  const result = await getGatewayComposeStatus(host);
-  if (!result.ok || result.services.length === 0) {
+async function getGatewayWorkspaceStatus(host, spawn = defaultSpawn5, timeoutMs = WORKSPACE_PROBE_TIMEOUT_MS) {
+  validateGatewayHost(host);
+  const knownHostsArgs = buildKnownHostsArgs();
+  const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.GATEWAY_SSH_KEY);
+  const sshCmd = [
+    "ssh",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    ...knownHostsArgs,
+    ...identityArgs,
+    `root@${host}`,
+    buildWorkspaceProbeScript()
+  ];
+  const env = {
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
+    HOME: process.env.HOME ?? "/tmp",
+    ...process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}
+  };
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), timeoutMs);
+  });
+  try {
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const collected = Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    collected.catch(() => {
+      return;
+    });
+    const outcome = await Promise.race([collected, timedOut]);
+    if (outcome === "timeout") {
+      child.kill?.();
+      return unknownWorkspace(`timed out after ${Math.round(timeoutMs / 1000)}s`);
+    }
+    const [stdoutText, , exitCode] = outcome;
+    if (exitCode !== 0)
+      return unknownWorkspace(`SSH command failed (exit ${exitCode})`);
+    return parseWorkspaceProbeOutput(stdoutText);
+  } catch {
+    return unknownWorkspace("SSH command could not run");
+  } finally {
+    clearTimeout(timer);
+    cleanup();
+  }
+}
+async function getGatewayStatusSummary(host, spawn) {
+  const result = await getGatewayComposeStatus(host, spawn);
+  if (result.services.length === 0) {
     const errorMsg = result.error ?? "No services reported";
     return {
       app: "gateway",
@@ -12548,16 +12764,19 @@ async function getGatewayStatusSummary(host) {
     };
   }
   const rows = result.services.map((s) => `${s.service}:${s.state}/${s.health}`).join(", ");
+  const workspace = await getGatewayWorkspaceStatus(host, spawn);
+  const prefix = result.ok ? `OK: ${rows}` : `DEGRADED: ${rows}`;
   return {
     app: "gateway",
-    http: `OK: ${rows}`,
+    http: `${prefix}; ${formatWorkspaceSummary(workspace)}`,
     lastDeploy: "\u2014",
     version: "\u2014",
     contentHash: "\u2014",
-    usageStats: "\u2014"
+    usageStats: "\u2014",
+    workspace
   };
 }
-async function gatewayStatusAction(options, ctx, spawn) {
+async function gatewayStatusAction(options, ctx, spawn, workspaceTimeoutMs) {
   const hostEnvKey = options.key ?? "GATEWAY_HOST";
   const host = process.env[hostEnvKey];
   if (!host) {
@@ -12565,14 +12784,24 @@ async function gatewayStatusAction(options, ctx, spawn) {
     ctx.process.exit(1);
     return;
   }
-  ctx.console.log("Gateway status");
-  ctx.console.log("");
+  const json = options.json === true;
+  if (!json) {
+    ctx.console.log("Gateway status");
+    ctx.console.log("");
+  }
   const result = await getGatewayComposeStatus(host, spawn);
   if (!result.ok && result.services.length === 0) {
     ctx.console.error(`Error: ${result.error ?? "Unknown error"}`);
     ctx.process.exit(1);
     return;
   }
+  if (json) {
+    const workspace = await getGatewayWorkspaceStatus(host, spawn, workspaceTimeoutMs);
+    ctx.console.log(JSON.stringify({ ok: result.ok, services: result.services, workspace }));
+    if (!result.ok)
+      ctx.process.exit(1);
+    return;
+  }
   ctx.console.log("Service          State      Health");
   ctx.console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   for (const row of result.services) {
@@ -12581,6 +12810,11 @@ async function gatewayStatusAction(options, ctx, spawn) {
     ctx.console.log(`${svc} ${state} ${row.health}`);
   }
   ctx.console.log("");
+  const workspace = await getGatewayWorkspaceStatus(host, spawn, workspaceTimeoutMs);
+  for (const line of formatWorkspaceMemory(workspace)) {
+    ctx.console.log(line);
+  }
+  ctx.console.log("");
   if (result.ok) {
     ctx.console.log("Status: OK");
   } else {
@@ -12589,7 +12823,7 @@ async function gatewayStatusAction(options, ctx, spawn) {
   }
 }
 function registerGatewayStatus(cli) {
-  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z26.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
+  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z26.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).option("--json", z26.boolean().describe("Output a single JSON object with ok, services and the structured workspace memory status.")).action((options, ctx) => gatewayStatusAction(options, ctx));
 }
 
 // src/commands/gateway/index.ts
@@ -14123,7 +14357,7 @@ function registerStatus(cli, dependencies = {
   getVpnStatusSummary,
   getBrokerStatusSummary
 }) {
-  cli.command("status", "Show status of all deployments").option("--json", z37.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z37.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+  cli.command("status", "Show status of all deployments").option("--json", z37.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects. The gateway object also carries a structured workspace field.")).option("--verbose", z37.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
 }
 
 // src/cli.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",