@marcusrbrown/infra 0.4.11 → 0.5.0

package/src/commands/cliproxy/config.ts

@@ -1,8 +1,13 @@
 import type {goke} from 'goke'
 
+import type {ActionCtx} from '../../lib/action-ctx'
 import {chmodSync} from 'node:fs'
+
 import {z} from 'zod'
 
+/** Minimal ctx surface consumed by cliproxy config actions. Satisfied by both GokeExecutionContext and CapturedCtx. */
+// ActionCtx imported from lib/action-ctx — single source of truth for action ctx shape
+
 const DEFAULT_CLIPROXY_URL = 'https://cliproxy.fro.bot'
 const HTTP_TIMEOUT_MS = 10_000
 
@@ -132,6 +137,83 @@ export function formatConfigAsColumns(payload: unknown): string {
     .join('\n')
 }
 
+export interface ConfigGetOptions {
+  url?: string
+  key?: string
+  output?: string
+  json?: boolean
+}
+
+export async function cliproxyConfigGetAction(options: ConfigGetOptions, ctx: ActionCtx): Promise<unknown> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const endpoint = `${baseUrl}/v0/management/config`
+    const payload = await requestJson(endpoint, {
+      method: 'GET',
+      headers: managementHeaders(managementKey),
+    })
+
+    const jsonOutput = JSON.stringify(payload, null, 2)
+
+    if (options.output) {
+      try {
+        await Bun.write(options.output, jsonOutput)
+        chmodSync(options.output, 0o600)
+        ctx.console.log(`✓ Config written to ${options.output}`)
+      } catch (error: unknown) {
+        const message = error instanceof Error ? error.message : String(error)
+        ctx.console.error(`Failed to write config to ${options.output}: ${message}`)
+        ctx.process.exit(1)
+        return undefined // unreachable
+      }
+    } else if (options.json) {
+      ctx.console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
+      ctx.console.log(jsonOutput)
+    } else {
+      ctx.console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
+      ctx.console.log(formatConfigAsColumns(payload))
+    }
+
+    return payload
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+    return undefined // unreachable; satisfies TS that all paths return
+  }
+}
+
+export interface ConfigSetOptions {
+  url?: string
+  key?: string
+}
+
+export async function cliproxyConfigSetAction(
+  field: string,
+  value: string,
+  options: ConfigSetOptions,
+  ctx: ActionCtx,
+): Promise<void> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const request = buildSetRequest(baseUrl, field, value)
+
+    const payload = await requestJson(request.endpoint, {
+      method: 'PUT',
+      headers: managementHeaders(managementKey),
+      body: request.body,
+    })
+
+    ctx.console.log(JSON.stringify(payload, null, 2))
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+  }
+}
+
 export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
   cli
     .command('cliproxy config get', 'Fetch current CLIProxyAPI config as JSON.')
@@ -154,34 +236,7 @@ export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
         .describe('Write config JSON to a file instead of stdout. File permissions set to 0600 (owner-read-only).'),
     )
     .option('--json', 'Output raw JSON instead of aligned key: value columns.')
-    .action(async options => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const endpoint = `${baseUrl}/v0/management/config`
-      const payload = await requestJson(endpoint, {
-        method: 'GET',
-        headers: managementHeaders(managementKey),
-      })
-
-      const jsonOutput = JSON.stringify(payload, null, 2)
-
-      if (options.output) {
-        try {
-          await Bun.write(options.output, jsonOutput)
-          chmodSync(options.output, 0o600)
-          console.log(`✓ Config written to ${options.output}`)
-        } catch (error: unknown) {
-          const message = error instanceof Error ? error.message : String(error)
-          throw new Error(`Failed to write config to ${options.output}: ${message}`)
-        }
-      } else if (options.json) {
-        console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
-        console.log(jsonOutput)
-      } else {
-        console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
-        console.log(formatConfigAsColumns(payload))
-      }
-    })
+    .action(cliproxyConfigGetAction)
 
   cli
     .command(
@@ -203,17 +258,5 @@ export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
     .example('infra cliproxy config set debug true')
     .example('infra cliproxy config set request-retry 5')
     .example('infra cliproxy config set proxy-url https://proxy.example.com')
-    .action(async (field, value, options) => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const request = buildSetRequest(baseUrl, field, value)
-
-      const payload = await requestJson(request.endpoint, {
-        method: 'PUT',
-        headers: managementHeaders(managementKey),
-        body: request.body,
-      })
-
-      console.log(JSON.stringify(payload, null, 2))
-    })
+    .action(cliproxyConfigSetAction)
 }

package/src/commands/cliproxy/keys.test.ts

@@ -0,0 +1,326 @@
+import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
+
+import {createCapturedCtx, expectCapturedToInclude} from '../../__test__/mcp-ctx-fixture'
+import {cliproxyKeysAddAction, cliproxyKeysListAction, cliproxyKeysRemoveAction, toStringArray} from './keys'
+
+const originalFetch = globalThis.fetch
+
+type FetchReplacement = (url: string, init?: RequestInit) => Promise<Response>
+
+function createFetchImplementation(handler: FetchReplacement): typeof fetch {
+  return Object.assign(
+    (input: string | URL | Request, init?: RequestInit) => {
+      if (typeof input !== 'string') {
+        throw new TypeError(`Unexpected non-string fetch input: ${String(input)}`)
+      }
+
+      return handler(input, init)
+    },
+    {preconnect: originalFetch.preconnect},
+  )
+}
+
+describe('toStringArray', () => {
+  it('returns string array as-is', () => {
+    expect(toStringArray(['a', 'b', 'c'])).toEqual(['a', 'b', 'c'])
+  })
+
+  it('filters non-string items from array', () => {
+    expect(toStringArray(['a', 1, null, 'b'])).toEqual(['a', 'b'])
+  })
+
+  it('extracts api-keys from object', () => {
+    expect(toStringArray({'api-keys': ['x', 'y']})).toEqual(['x', 'y'])
+  })
+
+  it('extracts api_keys from object (underscore variant)', () => {
+    expect(toStringArray({api_keys: ['x', 'y']})).toEqual(['x', 'y'])
+  })
+
+  it('returns empty array for null', () => {
+    expect(toStringArray(null)).toEqual([])
+  })
+
+  it('returns empty array for unrecognized shape', () => {
+    expect(toStringArray({other: 'stuff'})).toEqual([])
+  })
+})
+
+describe('cliproxyKeysListAction (Mode C, Tier-2 ctx capture)', () => {
+  beforeEach(() => {
+    globalThis.fetch = createFetchImplementation(async () => {
+      throw new Error('Unexpected fetch call')
+    })
+  })
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode C: captures numbered list to ctx.stdout and returns key array', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify(['sk-live-aaa', 'sk-live-bbb']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    const result = await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    // Tier-2: stdout contains formatted list
+    expect(expectCapturedToInclude(captured, 'sk-live-aaa')).toBe(true)
+    expect(expectCapturedToInclude(captured, '1.')).toBe(true)
+    expect(expectCapturedToInclude(captured, '2.')).toBe(true)
+
+    // Mode C: action returns the parsed array
+    expect(Array.isArray(result)).toBe(true)
+    expect(result).toEqual(['sk-live-aaa', 'sk-live-bbb'])
+  })
+
+  it('Mode C: security warning goes to ctx.stderr', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify(['sk-live-aaa']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    const stderrText = captured.stderr.join('')
+    expect(stderrText).toContain('API keys')
+  })
+
+  it('Mode C: returns empty array and prints "No API keys configured" when list is empty', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify([]), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    const result = await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(expectCapturedToInclude(captured, 'No API keys configured')).toBe(true)
+    expect(result).toEqual([])
+  })
+
+  it('Mode C: --json flag outputs JSON array to ctx.stdout', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify(['sk-live-aaa']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    const result = await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key', json: true}, ctx)
+
+    const stdoutText = captured.stdout.join('')
+    const parsed = JSON.parse(stdoutText)
+    expect(parsed).toEqual(['sk-live-aaa'])
+    expect(result).toEqual(['sk-live-aaa'])
+  })
+})
+
+describe('cliproxyKeysAddAction (Mode A, positional arg, Tier-2 ctx capture)', () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode A: captures success message to ctx.stdout after adding key', async () => {
+    let putCalled = false
+    globalThis.fetch = createFetchImplementation(async (_url, init) => {
+      if (init?.method === 'PUT') {
+        putCalled = true
+        return new Response(JSON.stringify(['sk-live-existing', 'sk-live-new']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        })
+      }
+
+      // GET current keys
+      return new Response(JSON.stringify(['sk-live-existing']), {
+        status: 200,
+        headers: {'content-type': 'application/json'},
+      })
+    })
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysAddAction('sk-live-new', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(putCalled).toBe(true)
+    expect(expectCapturedToInclude(captured, 'sk-live-new')).toBe(true)
+    expect(expectCapturedToInclude(captured, 'Added key')).toBe(true)
+  })
+
+  it('Mode A: skips PUT when key already present', async () => {
+    let putCalled = false
+    globalThis.fetch = createFetchImplementation(async (_url, init) => {
+      if (init?.method === 'PUT') {
+        putCalled = true
+        return new Response('{}', {status: 200})
+      }
+
+      return new Response(JSON.stringify(['sk-live-existing']), {
+        status: 200,
+        headers: {'content-type': 'application/json'},
+      })
+    })
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysAddAction('sk-live-existing', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(putCalled).toBe(false)
+    expect(expectCapturedToInclude(captured, 'already present')).toBe(true)
+  })
+})
+
+describe('cliproxyKeysRemoveAction (Mode A, positional arg, Tier-2 ctx capture)', () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode A: captures DELETE response to ctx.stdout', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify({removed: true}), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysRemoveAction('sk-live-old', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(expectCapturedToInclude(captured, 'removed')).toBe(true)
+  })
+})
+
+describe('cliproxyKeysListAction (Tier-2 failure-path parity)', () => {
+  const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalManagementKey === undefined) {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    } else {
+      process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+    }
+  })
+
+  it('Tier-2: missing CLIPROXY_MANAGEMENT_KEY routes to ctx.console.error + exit(1)', async () => {
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(cliproxyKeysListAction({url: 'https://cliproxy.example.com'}, ctx)).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Management API key')
+    expect(captured.exit).toEqual({code: 1})
+  })
+
+  it('Tier-2: HTTP 500 response routes to ctx.console.error + exit(1)', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('server error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('HTTP 500')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})
+
+describe('cliproxyKeysAddAction (Tier-2 failure-path parity)', () => {
+  const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalManagementKey === undefined) {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    } else {
+      process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+    }
+  })
+
+  it('Tier-2: missing CLIPROXY_MANAGEMENT_KEY routes to ctx.console.error + exit(1)', async () => {
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysAddAction('sk-live-new', {url: 'https://cliproxy.example.com'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Management API key')
+    expect(captured.exit).toEqual({code: 1})
+  })
+
+  it('Tier-2: HTTP 500 on GET routes to ctx.console.error + exit(1)', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('server error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysAddAction('sk-live-new', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('HTTP 500')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})
+
+describe('cliproxyKeysRemoveAction (Tier-2 failure-path parity)', () => {
+  const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalManagementKey === undefined) {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    } else {
+      process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+    }
+  })
+
+  it('Tier-2: missing CLIPROXY_MANAGEMENT_KEY routes to ctx.console.error + exit(1)', async () => {
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysRemoveAction('sk-live-old', {url: 'https://cliproxy.example.com'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Management API key')
+    expect(captured.exit).toEqual({code: 1})
+  })
+
+  it('Tier-2: HTTP 500 response routes to ctx.console.error + exit(1)', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('server error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysRemoveAction('sk-live-old', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('HTTP 500')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})

package/src/commands/cliproxy/keys.ts

@@ -1,7 +1,12 @@
 import type {goke} from 'goke'
 
+import type {ActionCtx} from '../../lib/action-ctx'
+
 import {z} from 'zod'
 
+/** Minimal ctx surface consumed by cliproxy keys actions. Satisfied by both GokeExecutionContext and CapturedCtx. */
+// ActionCtx imported from lib/action-ctx — single source of truth for action ctx shape
+
 const DEFAULT_CLIPROXY_URL = 'https://cliproxy.fro.bot'
 const HTTP_TIMEOUT_MS = 10_000
 
@@ -64,6 +69,114 @@ export function toStringArray(payload: unknown): string[] {
   return []
 }
 
+export interface KeysListOptions {
+  url?: string
+  key?: string
+  json?: boolean
+}
+
+export async function cliproxyKeysListAction(options: KeysListOptions, ctx: ActionCtx): Promise<string[]> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const endpoint = `${baseUrl}/v0/management/api-keys`
+    const payload = await requestJson(endpoint, {
+      method: 'GET',
+      headers: managementHeaders(managementKey),
+    })
+
+    const keys = toStringArray(payload)
+    ctx.console.error('⚠️  Output contains API keys — avoid logging or storing in shared locations')
+
+    if (options.json) {
+      ctx.console.log(JSON.stringify(keys, null, 2))
+    } else if (keys.length === 0) {
+      ctx.console.log('No API keys configured')
+    } else {
+      for (const [index, apiKey] of keys.entries()) {
+        ctx.console.log(`${index + 1}. ${apiKey}`)
+      }
+    }
+
+    return keys
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+    return [] // unreachable; satisfies TS that all paths return
+  }
+}
+
+export interface KeysAddOptions {
+  url?: string
+  key?: string
+}
+
+export async function cliproxyKeysAddAction(
+  apiKeyToAdd: string,
+  options: KeysAddOptions,
+  ctx: ActionCtx,
+): Promise<void> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const endpoint = `${baseUrl}/v0/management/api-keys`
+
+    const currentPayload = await requestJson(endpoint, {
+      method: 'GET',
+      headers: managementHeaders(managementKey),
+    })
+    const currentKeys = toStringArray(currentPayload)
+
+    if (currentKeys.includes(apiKeyToAdd)) {
+      ctx.console.log('Key already present; no update required.')
+      return
+    }
+
+    const nextKeys = [...currentKeys, apiKeyToAdd]
+    await requestJson(endpoint, {
+      method: 'PUT',
+      headers: managementHeaders(managementKey),
+      body: JSON.stringify(nextKeys),
+    })
+
+    ctx.console.log(`Added key "${apiKeyToAdd}". Current key count: ${nextKeys.length}.`)
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+  }
+}
+
+export interface KeysRemoveOptions {
+  url?: string
+  key?: string
+}
+
+export async function cliproxyKeysRemoveAction(
+  apiKeyToRemove: string,
+  options: KeysRemoveOptions,
+  ctx: ActionCtx,
+): Promise<void> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const params = new URLSearchParams({value: apiKeyToRemove})
+    const endpoint = `${baseUrl}/v0/management/api-keys?${params.toString()}`
+
+    const payload = await requestJson(endpoint, {
+      method: 'DELETE',
+      headers: managementHeaders(managementKey),
+    })
+
+    ctx.console.log(JSON.stringify(payload, null, 2))
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+  }
+}
+
 export function registerCliproxyKeys(cli: ReturnType<typeof goke>): void {
   cli
     .command('cliproxy keys list', 'List CLIProxyAPI API keys from the management API.')
@@ -80,28 +193,7 @@ export function registerCliproxyKeys(cli: ReturnType<typeof goke>): void {
       z.string().describe('Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.'),
     )
     .option('--json', 'Output raw JSON array instead of a numbered list.')
-    .action(async options => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const endpoint = `${baseUrl}/v0/management/api-keys`
-      const payload = await requestJson(endpoint, {
-        method: 'GET',
-        headers: managementHeaders(managementKey),
-      })
-
-      const keys = toStringArray(payload)
-      console.error('⚠️  Output contains API keys — avoid logging or storing in shared locations')
-
-      if (options.json) {
-        console.log(JSON.stringify(keys, null, 2))
-      } else if (keys.length === 0) {
-        console.log('No API keys configured')
-      } else {
-        for (const [index, key] of keys.entries()) {
-          console.log(`${index + 1}. ${key}`)
-        }
-      }
-    })
+    .action(cliproxyKeysListAction)
 
   cli
     .command(
@@ -122,31 +214,7 @@ export function registerCliproxyKeys(cli: ReturnType<typeof goke>): void {
     )
     .example('# Add a new API key to the current key set')
     .example('infra cliproxy keys add sk-live-123')
-    .action(async (apiKeyToAdd, options) => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const endpoint = `${baseUrl}/v0/management/api-keys`
-
-      const currentPayload = await requestJson(endpoint, {
-        method: 'GET',
-        headers: managementHeaders(managementKey),
-      })
-      const currentKeys = toStringArray(currentPayload)
-
-      if (currentKeys.includes(apiKeyToAdd)) {
-        console.log('Key already present; no update required.')
-        return
-      }
-
-      const nextKeys = [...currentKeys, apiKeyToAdd]
-      await requestJson(endpoint, {
-        method: 'PUT',
-        headers: managementHeaders(managementKey),
-        body: JSON.stringify(nextKeys),
-      })
-
-      console.log(`Added key "${apiKeyToAdd}". Current key count: ${nextKeys.length}.`)
-    })
+    .action(cliproxyKeysAddAction)
 
   cli
     .command('cliproxy keys remove <key>', 'Remove an API key via management API endpoint query parameter.')
@@ -164,17 +232,5 @@ export function registerCliproxyKeys(cli: ReturnType<typeof goke>): void {
     )
     .example('# Remove an API key from CLIProxyAPI')
     .example('infra cliproxy keys remove sk-live-123')
-    .action(async (apiKeyToRemove, options) => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const params = new URLSearchParams({value: apiKeyToRemove})
-      const endpoint = `${baseUrl}/v0/management/api-keys?${params.toString()}`
-
-      const payload = await requestJson(endpoint, {
-        method: 'DELETE',
-        headers: managementHeaders(managementKey),
-      })
-
-      console.log(JSON.stringify(payload, null, 2))
-    })
+    .action(cliproxyKeysRemoveAction)
 }