@marcusrbrown/infra 0.4.10 → 0.5.0

package/src/commands/cliproxy/status.test.ts

@@ -1,9 +1,11 @@
 import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
 
+import {createCapturedCtx, expectCapturedToInclude, MockProcessExit} from '../../__test__/mcp-ctx-fixture'
 import {
   checkHttpReachability,
   checkUsageStats,
   checkVersion,
+  cliproxyStatusAction,
   formatDurationMs,
   formatUsageSummaryLine,
   levelLabel,
@@ -307,3 +309,81 @@ describe('cliproxy status helpers', () => {
     })
   })
 })
+
+describe('cliproxyStatusAction (Tier-2 ctx capture, failure-path parity)', () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Tier-2: routes unexpected thrown error through ctx.console.error + ctx.process.exit(1)', async () => {
+    // Trigger an unexpected error by having ctx.console.log throw on first call
+    const {ctx, captured} = createCapturedCtx()
+    let callCount = 0
+    const originalLog = ctx.console.log
+    ctx.console.log = (...args: unknown[]) => {
+      callCount++
+      if (callCount === 1) {
+        throw new Error('Unexpected internal error during status output')
+      }
+
+      originalLog(...args)
+    }
+
+    globalThis.fetch = createFetchImplementation(async () => new Response('ok', {status: 200}))
+
+    await expect(cliproxyStatusAction({url: 'https://cliproxy.example.com'}, ctx)).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Unexpected internal error')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})
+
+describe('cliproxyStatusAction (Tier-2 ctx capture)', () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode A: captures CLIProxyAPI status header to ctx.stdout', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('ok', {status: 200}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyStatusAction({url: 'https://cliproxy.example.com'}, ctx)
+
+    expect(expectCapturedToInclude(captured, 'CLIProxyAPI status')).toBe(true)
+    expect(expectCapturedToInclude(captured, 'HTTP reachability')).toBe(true)
+    expect(expectCapturedToInclude(captured, 'Summary:')).toBe(true)
+  })
+
+  it('Mode A: calls ctx.process.exit(1) on HTTP error', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    let threw: unknown
+    try {
+      await cliproxyStatusAction({url: 'https://cliproxy.example.com'}, ctx)
+    } catch (error) {
+      threw = error
+    }
+
+    expect(threw).toBeInstanceOf(MockProcessExit)
+    expect(captured.exit?.code).toBe(1)
+    expect(expectCapturedToInclude(captured, 'ERROR')).toBe(true)
+  })
+
+  it('Mode A: shows management key warning when no key provided', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('ok', {status: 200}))
+
+    const savedKey = process.env.CLIPROXY_MANAGEMENT_KEY
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+    try {
+      const {ctx, captured} = createCapturedCtx()
+      await cliproxyStatusAction({url: 'https://cliproxy.example.com'}, ctx)
+
+      expect(expectCapturedToInclude(captured, 'CLIPROXY_MANAGEMENT_KEY')).toBe(true)
+    } finally {
+      if (savedKey !== undefined) process.env.CLIPROXY_MANAGEMENT_KEY = savedKey
+    }
+  })
+})

package/src/commands/cliproxy/status.ts

@@ -1,8 +1,12 @@
 import type {goke} from 'goke'
+import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
 
 import {z} from 'zod'
 
+/** Minimal ctx surface consumed by cliproxy status actions. Satisfied by both GokeExecutionContext and CapturedCtx. */
+// ActionCtx imported from lib/action-ctx — single source of truth for action ctx shape
+
 declare const process: {
   env: Record<string, string | undefined>
   exitCode?: number
@@ -197,13 +201,13 @@ export async function checkVersion(baseUrl: string, key: string): Promise<CheckR
   }
 }
 
-function printCheckResult(result: CheckResult): void {
-  console.log(`[${levelLabel(result.level)}] ${result.title}`)
-  console.log(`  ${result.summary}`)
+function printCheckResult(result: CheckResult, ctx: ActionCtx): void {
+  ctx.console.log(`[${levelLabel(result.level)}] ${result.title}`)
+  ctx.console.log(`  ${result.summary}`)
 
   if (result.details && result.details.length > 0) {
     for (const detail of result.details) {
-      console.log(`  - ${detail}`)
+      ctx.console.log(`  - ${detail}`)
     }
   }
 }
@@ -247,6 +251,71 @@ export async function getCliproxyStatusSummary(baseUrl: string, key: string, ver
   }
 }
 
+export interface StatusOptions {
+  url?: string
+  key?: string
+  verbose?: boolean
+}
+
+export async function cliproxyStatusAction(options: StatusOptions, ctx: ActionCtx): Promise<void> {
+  let errorCount = 0
+  try {
+    const verbose = options.verbose === true
+    const baseUrl = stripTrailingSlash(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
+    const managementKey = options.key ?? process.env.CLIPROXY_MANAGEMENT_KEY
+
+    ctx.console.log('CLIProxyAPI status')
+    ctx.console.log('')
+
+    const results: CheckResult[] = [await checkHttpReachability(baseUrl, verbose)]
+
+    let capturedUsageResult: CheckResult | undefined
+
+    if (managementKey) {
+      const [usageResult, versionResult] = await Promise.all([
+        checkUsageStats(baseUrl, managementKey),
+        checkVersion(baseUrl, managementKey),
+      ])
+
+      capturedUsageResult = usageResult
+      results.push(usageResult, versionResult)
+    } else {
+      results.push({
+        title: 'Management checks',
+        level: 'warning',
+        summary:
+          'CLIPROXY_MANAGEMENT_KEY is not set. Skipping usage stats and version checks. Provide --key or set env var.',
+      })
+    }
+
+    for (const result of results) {
+      printCheckResult(result, ctx)
+      ctx.console.log('')
+    }
+
+    errorCount = results.filter(result => result.level === 'error').length
+    const warningCount = results.filter(result => result.level === 'warning').length
+
+    ctx.console.log(`Summary: ${results.length} checks, ${errorCount} errors, ${warningCount} warnings`)
+
+    if (capturedUsageResult) {
+      const usageLine = formatUsageSummaryLine(capturedUsageResult)
+      if (usageLine) {
+        ctx.console.log(usageLine)
+      }
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+    return
+  }
+
+  if (errorCount > 0) {
+    ctx.process.exit(1)
+  }
+}
+
 export function registerCliproxyStatus(cli: ReturnType<typeof goke>): void {
   cli
     .command('cliproxy status', 'Show operational health of CLIProxyAPI and its management endpoints.')
@@ -261,54 +330,5 @@ export function registerCliproxyStatus(cli: ReturnType<typeof goke>): void {
       z.string().describe('Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.'),
     )
     .option('--verbose', 'Enable verbose output for all commands')
-    .action(async options => {
-      const verbose = options.verbose === true
-      const baseUrl = stripTrailingSlash(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
-      const managementKey = options.key ?? process.env.CLIPROXY_MANAGEMENT_KEY
-
-      console.log('CLIProxyAPI status')
-      console.log('')
-
-      const results: CheckResult[] = [await checkHttpReachability(baseUrl, verbose)]
-
-      let capturedUsageResult: CheckResult | undefined
-
-      if (managementKey) {
-        const [usageResult, versionResult] = await Promise.all([
-          checkUsageStats(baseUrl, managementKey),
-          checkVersion(baseUrl, managementKey),
-        ])
-
-        capturedUsageResult = usageResult
-        results.push(usageResult, versionResult)
-      } else {
-        results.push({
-          title: 'Management checks',
-          level: 'warning',
-          summary:
-            'CLIPROXY_MANAGEMENT_KEY is not set. Skipping usage stats and version checks. Provide --key or set env var.',
-        })
-      }
-
-      for (const result of results) {
-        printCheckResult(result)
-        console.log('')
-      }
-
-      const errorCount = results.filter(result => result.level === 'error').length
-      const warningCount = results.filter(result => result.level === 'warning').length
-
-      console.log(`Summary: ${results.length} checks, ${errorCount} errors, ${warningCount} warnings`)
-
-      if (capturedUsageResult) {
-        const usageLine = formatUsageSummaryLine(capturedUsageResult)
-        if (usageLine) {
-          console.log(usageLine)
-        }
-      }
-
-      if (errorCount > 0) {
-        process.exitCode = 1
-      }
-    })
+    .action(cliproxyStatusAction)
 }

package/src/commands/gateway/backup.test.ts

@@ -2,7 +2,8 @@ import {statSync, writeFileSync} from 'node:fs'
 
 import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
 
-import {backupGatewayCa, type BackupSpawnFn} from './backup'
+import {createCapturedCtx, expectCapturedToInclude, MockProcessExit} from '../../__test__/mcp-ctx-fixture'
+import {backupGatewayCa, gatewayBackupAction, type BackupSpawnFn} from './backup'
 
 // ─── SpawnFn helpers ──────────────────────────────────────────────────────────
 
@@ -286,3 +287,67 @@ describe('backupGatewayCa — SEC1: tmp file created with mode 0600 atomically',
     }
   })
 })
+
+// ─── Tier-2: gatewayBackupAction ctx capture ─────────────────────────────────
+
+describe('gatewayBackupAction — ctx capture (Tier-2)', () => {
+  let originalEnv: Record<string, string | undefined>
+  let tmpOutput: string
+
+  beforeEach(() => {
+    originalEnv = {GATEWAY_HOST: process.env.GATEWAY_HOST}
+    process.env.GATEWAY_HOST = 'gateway.example.com'
+    tmpOutput = `/tmp/test-action-backup-${Date.now()}.tar`
+  })
+
+  afterEach(async () => {
+    if (originalEnv.GATEWAY_HOST === undefined) {
+      delete process.env.GATEWAY_HOST
+    } else {
+      process.env.GATEWAY_HOST = originalEnv.GATEWAY_HOST
+    }
+    try {
+      ;(await Bun.file(tmpOutput).exists()) && Bun.spawnSync(['rm', '-f', tmpOutput])
+    } catch {
+      // ignore
+    }
+  })
+
+  it('routes success message to ctx.console.log (stdout)', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    await gatewayBackupAction({output: tmpOutput, includeCa: true}, ctx, makeSpawnOk(new Uint8Array([1, 2, 3])))
+
+    expect(expectCapturedToInclude(captured, 'CA backup written to')).toBe(true)
+  })
+
+  it('routes sensitive-content warning to ctx.process.stderr.write', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    await gatewayBackupAction({output: tmpOutput, includeCa: true}, ctx, makeSpawnOk(new Uint8Array([1, 2, 3])))
+
+    const stderrText = captured.stderr.join('')
+    expect(stderrText.toLowerCase().includes('sensitive')).toBe(true)
+  })
+
+  it('routes error to ctx.console.error and calls ctx.process.exit(1) when GATEWAY_HOST is unset', async () => {
+    delete process.env.GATEWAY_HOST
+    const {ctx, captured} = createCapturedCtx()
+
+    await expect(gatewayBackupAction({output: tmpOutput, includeCa: true}, ctx)).rejects.toBeInstanceOf(MockProcessExit)
+
+    expect(captured.stderr.join('').includes('GATEWAY_HOST')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+
+  it('routes backup failure to ctx.console.error and calls ctx.process.exit(1)', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    await expect(
+      gatewayBackupAction({output: tmpOutput, includeCa: true}, ctx, makeSpawnError('Connection refused')),
+    ).rejects.toBeInstanceOf(MockProcessExit)
+
+    expect(captured.stderr.join('').toLowerCase().includes('backup failed')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+})

package/src/commands/gateway/backup.ts

@@ -1,9 +1,10 @@
 import type {goke} from 'goke'
 
+import type {ActionCtx} from '../../lib/action-ctx'
+
 import {closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync} from 'node:fs'
 
 import {z} from 'zod'
-
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -12,6 +13,10 @@ declare const process: {
   stderr: {write: (msg: string) => void}
 }
 
+// ─── Minimal ctx interface (subset of GokeExecutionContext used by this action) ─
+
+// ActionCtx imported from lib/action-ctx — single source of truth for action ctx shape
+
 const MITMPROXY_CERTS_VOLUME = 'mitmproxy-certs'
 const CA_CERT_FILE = 'mitmproxy-ca-cert.pem'
 const CA_KEY_FILE = 'mitmproxy-ca.pem'
@@ -134,6 +139,38 @@ export async function backupGatewayCa(
   return {ok: true, output: opts.output, bytesWritten: tarBytes.byteLength}
 }
 
+// ─── Action (exported for direct testing) ────────────────────────────────────
+
+export async function gatewayBackupAction(
+  options: {output?: string | undefined; includeCa?: boolean | undefined},
+  ctx: ActionCtx,
+  spawn?: BackupSpawnFn,
+): Promise<void> {
+  const hostEnvKey = 'GATEWAY_HOST'
+  const host = process.env[hostEnvKey]
+
+  if (!host) {
+    ctx.console.error(`Gateway host not set. Export ${hostEnvKey} before running backup.`)
+    ctx.process.exit(1)
+    return
+  }
+
+  const output = typeof options.output === 'string' ? options.output : DEFAULT_OUTPUT
+  const includeCa = options.includeCa !== false
+
+  const result = await backupGatewayCa({host, output, includeCa}, spawn, (msg: string) =>
+    ctx.process.stderr.write(`${msg}\n`),
+  )
+
+  if (!result.ok) {
+    ctx.console.error(`Backup failed: ${result.error}`)
+    ctx.process.exit(1)
+    return
+  }
+
+  ctx.console.log(`CA backup written to: ${output}`)
+}
+
 // ─── Command registration ─────────────────────────────────────────────────────
 
 export function registerGatewayBackup(cli: ReturnType<typeof goke>): void {
@@ -162,27 +199,5 @@ export function registerGatewayBackup(cli: ReturnType<typeof goke>): void {
     .example('infra gateway backup --include-ca')
     .example('# Back up the CA to a custom path')
     .example('infra gateway backup --output /secure/backup/mitmproxy-ca.tar')
-    .action(async options => {
-      const hostEnvKey = 'GATEWAY_HOST'
-      const host = process.env[hostEnvKey]
-
-      if (!host) {
-        console.error(`Gateway host not set. Export ${hostEnvKey} before running backup.`)
-        process.exitCode = 1
-        return
-      }
-
-      const output = typeof options.output === 'string' ? options.output : DEFAULT_OUTPUT
-      const includeCa = options.includeCa !== false
-
-      const result = await backupGatewayCa({host, output, includeCa})
-
-      if (!result.ok) {
-        console.error(`Backup failed: ${result.error}`)
-        process.exitCode = 1
-        return
-      }
-
-      console.log(`CA backup written to: ${output}`)
-    })
+    .action(gatewayBackupAction)
 }

package/src/commands/gateway/status.test.ts

@@ -1,6 +1,7 @@
 import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
 
-import {parseComposePs, type ComposePsEntry, type ServiceRow} from './status'
+import {createCapturedCtx, expectCapturedToInclude, MockProcessExit} from '../../__test__/mcp-ctx-fixture'
+import {gatewayStatusAction, parseComposePs, parseComposePsOutput, type ComposePsEntry, type ServiceRow} from './status'
 
 // ─── parseComposePs ──────────────────────────────────────────────────────────
 
@@ -257,3 +258,226 @@ describe('getGatewayComposeStatus', () => {
     expect(result.error).toContain('SSH')
   })
 })
+
+// ─── parseComposePsOutput ─────────────────────────────────────────────────────
+
+// Realistic fixture shape matching live droplet output
+const ndjsonFixture = [
+  String.raw`{"Command":"\"docker-entrypoint.sh\"","CreatedAt":"2026-05-20 08:20:18 +0000 UTC","ExitCode":0,"Health":"healthy","ID":"01e1a16f5752","Image":"fro-bot-gateway","Labels":"","LocalVolumes":"0","Mounts":"","Name":"fro-bot-gateway-1","Names":"fro-bot-gateway-1","Networks":"gateway_default","Ports":"","Project":"gateway","Publishers":null,"RunningFor":"2 hours ago","Service":"gateway","Size":"0B","State":"running","Status":"Up 2 hours (healthy)"}`,
+  String.raw`{"Command":"\"mitmproxy\"","CreatedAt":"2026-05-20 08:20:18 +0000 UTC","ExitCode":0,"Health":"healthy","ID":"02b2c27f6863","Image":"fro-bot-mitmproxy","Labels":"","LocalVolumes":"0","Mounts":"","Name":"fro-bot-mitmproxy-1","Names":"fro-bot-mitmproxy-1","Networks":"gateway_default","Ports":"","Project":"gateway","Publishers":null,"RunningFor":"2 hours ago","Service":"mitmproxy","Size":"0B","State":"running","Status":"Up 2 hours (healthy)"}`,
+  String.raw`{"Command":"\"sleep infinity\"","CreatedAt":"2026-05-20 08:20:18 +0000 UTC","ExitCode":0,"Health":"","ID":"03c3d38g7974","Image":"fro-bot-workspace","Labels":"","LocalVolumes":"0","Mounts":"","Name":"fro-bot-workspace-1","Names":"fro-bot-workspace-1","Networks":"gateway_default","Ports":"","Project":"gateway","Publishers":null,"RunningFor":"2 hours ago","Service":"workspace","Size":"0B","State":"running","Status":"Up 2 hours"}`,
+]
+
+describe('parseComposePsOutput', () => {
+  it('parses NDJSON with 3 lines into 3 entries with correct Name/State/Health', () => {
+    const raw = ndjsonFixture.join('\n')
+    const entries = parseComposePsOutput(raw)
+
+    expect(entries).toHaveLength(3)
+    expect(entries[0]?.Name).toBe('fro-bot-gateway-1')
+    expect(entries[0]?.State).toBe('running')
+    expect(entries[0]?.Health).toBe('healthy')
+    expect(entries[1]?.Name).toBe('fro-bot-mitmproxy-1')
+    expect(entries[1]?.State).toBe('running')
+    expect(entries[1]?.Health).toBe('healthy')
+    expect(entries[2]?.Name).toBe('fro-bot-workspace-1')
+    expect(entries[2]?.State).toBe('running')
+    expect(entries[2]?.Health).toBe('')
+  })
+
+  it('parses legacy single JSON array format', () => {
+    const raw = JSON.stringify([
+      {Name: 'fro-bot-gateway-1', State: 'running', Health: 'healthy'},
+      {Name: 'fro-bot-mitmproxy-1', State: 'running', Health: 'healthy'},
+    ])
+    const entries = parseComposePsOutput(raw)
+
+    expect(entries).toHaveLength(2)
+    expect(entries[0]?.Name).toBe('fro-bot-gateway-1')
+    expect(entries[1]?.Name).toBe('fro-bot-mitmproxy-1')
+  })
+
+  it('returns empty array for empty string', () => {
+    expect(parseComposePsOutput('')).toEqual([])
+  })
+
+  it('returns empty array for whitespace-only input', () => {
+    expect(parseComposePsOutput('   \n  \n  ')).toEqual([])
+  })
+
+  it('parses a single NDJSON line', () => {
+    const raw = ndjsonFixture.at(0) ?? ''
+    const entries = parseComposePsOutput(raw)
+
+    expect(entries).toHaveLength(1)
+    expect(entries[0]?.Name).toBe('fro-bot-gateway-1')
+  })
+
+  it('handles trailing newline correctly', () => {
+    const raw = `${ndjsonFixture.join('\n')}\n`
+    const entries = parseComposePsOutput(raw)
+
+    expect(entries).toHaveLength(3)
+  })
+
+  it('throws on a malformed NDJSON line', () => {
+    const raw = `${ndjsonFixture[0]}\nnot-valid-json\n${ndjsonFixture[2]}`
+
+    expect(() => parseComposePsOutput(raw)).toThrow()
+  })
+})
+
+// ─── getGatewayComposeStatus — NDJSON integration ────────────────────────────
+
+describe('getGatewayComposeStatus — NDJSON stdout', () => {
+  it('parses NDJSON docker compose ps output and returns correct services', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+
+    const ndjsonOutput = ndjsonFixture.join('\n')
+    const result = await getGatewayComposeStatus('gateway.example.com', makeSpawnOk(ndjsonOutput))
+
+    expect(result.ok).toBe(true)
+    expect(result.services).toHaveLength(3)
+    expect(result.services[0]).toEqual({service: 'fro-bot-gateway-1', state: 'running', health: 'healthy'})
+    expect(result.services[1]).toEqual({service: 'fro-bot-mitmproxy-1', state: 'running', health: 'healthy'})
+    expect(result.services[2]).toEqual({service: 'fro-bot-workspace-1', state: 'running', health: 'n-a'})
+  })
+
+  it('returns ok=false with error message when NDJSON contains a malformed line', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+
+    const badOutput = `${ndjsonFixture[0]}\nnot-valid-json`
+    const result = await getGatewayComposeStatus('gateway.example.com', makeSpawnOk(badOutput))
+
+    expect(result.ok).toBe(false)
+    expect(result.error).toContain('Failed to parse docker compose ps output')
+  })
+})
+
+// ─── Tier-2: gatewayStatusAction ctx capture ─────────────────────────────────
+
+type StatusSpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+) => {
+  stdout: ReadableStream<Uint8Array>
+  stderr: ReadableStream<Uint8Array>
+  exited: Promise<number>
+}
+
+function makeStatusSpawnOk(jsonOutput: string): StatusSpawnFn {
+  return (_cmd, _opts) => {
+    const encoder = new TextEncoder()
+    return {
+      stdout: new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(jsonOutput))
+          controller.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(controller) {
+          controller.close()
+        },
+      }),
+      exited: Promise.resolve(0),
+    }
+  }
+}
+
+function makeStatusSpawnError(message: string): StatusSpawnFn {
+  return (_cmd, _opts) => {
+    const encoder = new TextEncoder()
+    return {
+      stdout: new ReadableStream({
+        start(controller) {
+          controller.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(message))
+          controller.close()
+        },
+      }),
+      exited: Promise.resolve(1),
+    }
+  }
+}
+
+describe('gatewayStatusAction — ctx capture (Tier-2)', () => {
+  let originalEnv: Record<string, string | undefined>
+
+  beforeEach(() => {
+    originalEnv = {GATEWAY_HOST: process.env.GATEWAY_HOST}
+    process.env.GATEWAY_HOST = 'gateway.example.com'
+  })
+
+  afterEach(() => {
+    if (originalEnv.GATEWAY_HOST === undefined) {
+      delete process.env.GATEWAY_HOST
+    } else {
+      process.env.GATEWAY_HOST = originalEnv.GATEWAY_HOST
+    }
+  })
+
+  it('routes "Status: OK" to ctx.console.log when all services are running', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    const psOutput = JSON.stringify([
+      {Name: 'gateway', State: 'running', Health: 'healthy'},
+      {Name: 'mitmproxy', State: 'running', Health: 'healthy'},
+    ])
+
+    await gatewayStatusAction({key: undefined}, ctx, makeStatusSpawnOk(psOutput))
+
+    expect(expectCapturedToInclude(captured, 'Status: OK')).toBe(true)
+  })
+
+  it('routes "Gateway status" header to ctx.console.log', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    const psOutput = JSON.stringify([{Name: 'gateway', State: 'running', Health: 'healthy'}])
+
+    await gatewayStatusAction({key: undefined}, ctx, makeStatusSpawnOk(psOutput))
+
+    expect(expectCapturedToInclude(captured, 'Gateway status')).toBe(true)
+  })
+
+  it('routes error to ctx.console.error and calls ctx.process.exit(1) when SSH fails', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    await expect(
+      gatewayStatusAction({key: undefined}, ctx, makeStatusSpawnError('Connection refused')),
+    ).rejects.toBeInstanceOf(MockProcessExit)
+
+    expect(captured.stderr.join('').includes('Error')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+
+  it('routes error to ctx.console.error and calls ctx.process.exit(1) when GATEWAY_HOST is unset', async () => {
+    delete process.env.GATEWAY_HOST
+    const {ctx, captured} = createCapturedCtx()
+
+    await expect(gatewayStatusAction({key: undefined}, ctx)).rejects.toBeInstanceOf(MockProcessExit)
+
+    expect(captured.stderr.join('').includes('GATEWAY_HOST')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+
+  it('routes "Status: DEGRADED" to ctx.console.log and exits 1 when a service is not running', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    const psOutput = JSON.stringify([
+      {Name: 'gateway', State: 'exited', Health: ''},
+      {Name: 'mitmproxy', State: 'running', Health: 'healthy'},
+    ])
+
+    await expect(gatewayStatusAction({key: undefined}, ctx, makeStatusSpawnOk(psOutput))).rejects.toBeInstanceOf(
+      MockProcessExit,
+    )
+
+    expect(expectCapturedToInclude(captured, 'DEGRADED')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+})