@marcusrbrown/infra 0.4.11 → 0.6.0

package/src/commands/cliproxy/config.ts

@@ -1,8 +1,13 @@
 import type {goke} from 'goke'
 
+import type {ActionCtx} from '../../lib/action-ctx'
 import {chmodSync} from 'node:fs'
+
 import {z} from 'zod'
 
+/** Minimal ctx surface consumed by cliproxy config actions. Satisfied by both GokeExecutionContext and CapturedCtx. */
+// ActionCtx imported from lib/action-ctx — single source of truth for action ctx shape
+
 const DEFAULT_CLIPROXY_URL = 'https://cliproxy.fro.bot'
 const HTTP_TIMEOUT_MS = 10_000
 
@@ -132,6 +137,83 @@ export function formatConfigAsColumns(payload: unknown): string {
     .join('\n')
 }
 
+export interface ConfigGetOptions {
+  url?: string
+  key?: string
+  output?: string
+  json?: boolean
+}
+
+export async function cliproxyConfigGetAction(options: ConfigGetOptions, ctx: ActionCtx): Promise<unknown> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const endpoint = `${baseUrl}/v0/management/config`
+    const payload = await requestJson(endpoint, {
+      method: 'GET',
+      headers: managementHeaders(managementKey),
+    })
+
+    const jsonOutput = JSON.stringify(payload, null, 2)
+
+    if (options.output) {
+      try {
+        await Bun.write(options.output, jsonOutput)
+        chmodSync(options.output, 0o600)
+        ctx.console.log(`✓ Config written to ${options.output}`)
+      } catch (error: unknown) {
+        const message = error instanceof Error ? error.message : String(error)
+        ctx.console.error(`Failed to write config to ${options.output}: ${message}`)
+        ctx.process.exit(1)
+        return undefined // unreachable
+      }
+    } else if (options.json) {
+      ctx.console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
+      ctx.console.log(jsonOutput)
+    } else {
+      ctx.console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
+      ctx.console.log(formatConfigAsColumns(payload))
+    }
+
+    return payload
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+    return undefined // unreachable; satisfies TS that all paths return
+  }
+}
+
+export interface ConfigSetOptions {
+  url?: string
+  key?: string
+}
+
+export async function cliproxyConfigSetAction(
+  field: string,
+  value: string,
+  options: ConfigSetOptions,
+  ctx: ActionCtx,
+): Promise<void> {
+  try {
+    const baseUrl = resolveBaseUrl(options.url)
+    const managementKey = resolveManagementKey(options.key)
+    const request = buildSetRequest(baseUrl, field, value)
+
+    const payload = await requestJson(request.endpoint, {
+      method: 'PUT',
+      headers: managementHeaders(managementKey),
+      body: request.body,
+    })
+
+    ctx.console.log(JSON.stringify(payload, null, 2))
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.console.error(message)
+    ctx.process.exit(1)
+  }
+}
+
 export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
   cli
     .command('cliproxy config get', 'Fetch current CLIProxyAPI config as JSON.')
@@ -154,34 +236,7 @@ export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
         .describe('Write config JSON to a file instead of stdout. File permissions set to 0600 (owner-read-only).'),
     )
     .option('--json', 'Output raw JSON instead of aligned key: value columns.')
-    .action(async options => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const endpoint = `${baseUrl}/v0/management/config`
-      const payload = await requestJson(endpoint, {
-        method: 'GET',
-        headers: managementHeaders(managementKey),
-      })
-
-      const jsonOutput = JSON.stringify(payload, null, 2)
-
-      if (options.output) {
-        try {
-          await Bun.write(options.output, jsonOutput)
-          chmodSync(options.output, 0o600)
-          console.log(`✓ Config written to ${options.output}`)
-        } catch (error: unknown) {
-          const message = error instanceof Error ? error.message : String(error)
-          throw new Error(`Failed to write config to ${options.output}: ${message}`)
-        }
-      } else if (options.json) {
-        console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
-        console.log(jsonOutput)
-      } else {
-        console.error('⚠️  Output may contain API keys — avoid logging or storing in shared locations')
-        console.log(formatConfigAsColumns(payload))
-      }
-    })
+    .action(cliproxyConfigGetAction)
 
   cli
     .command(
@@ -203,17 +258,5 @@ export function registerCliproxyConfig(cli: ReturnType<typeof goke>): void {
     .example('infra cliproxy config set debug true')
     .example('infra cliproxy config set request-retry 5')
     .example('infra cliproxy config set proxy-url https://proxy.example.com')
-    .action(async (field, value, options) => {
-      const baseUrl = resolveBaseUrl(options.url)
-      const managementKey = resolveManagementKey(options.key)
-      const request = buildSetRequest(baseUrl, field, value)
-
-      const payload = await requestJson(request.endpoint, {
-        method: 'PUT',
-        headers: managementHeaders(managementKey),
-        body: request.body,
-      })
-
-      console.log(JSON.stringify(payload, null, 2))
-    })
+    .action(cliproxyConfigSetAction)
 }

package/src/commands/cliproxy/host.test.ts

@@ -0,0 +1,73 @@
+import {describe, expect, it} from 'bun:test'
+
+import {validateCliproxyHost} from './host'
+
+// ─── validateCliproxyHost ─────────────────────────────────────────────────────
+
+describe('validateCliproxyHost', () => {
+  // ── Valid inputs ────────────────────────────────────────────────────────────
+
+  it('accepts a standard FQDN', () => {
+    expect(() => validateCliproxyHost('cliproxy.fro.bot')).not.toThrow()
+    expect(validateCliproxyHost('cliproxy.fro.bot')).toBe('cliproxy.fro.bot')
+  })
+
+  it('accepts localhost', () => {
+    expect(() => validateCliproxyHost('localhost')).not.toThrow()
+  })
+
+  it('accepts an IPv4 address', () => {
+    expect(() => validateCliproxyHost('147.182.133.210')).not.toThrow()
+  })
+
+  it('accepts a single-character hostname', () => {
+    expect(() => validateCliproxyHost('a')).not.toThrow()
+  })
+
+  it('accepts a hostname with hyphens', () => {
+    expect(() => validateCliproxyHost('my-cliproxy.prod.example.com')).not.toThrow()
+  })
+
+  // ── Injection attacks ───────────────────────────────────────────────────────
+
+  it('rejects a leading-hyphen value (ProxyCommand injection vector)', () => {
+    expect(() => validateCliproxyHost('-oProxyCommand=evil')).toThrow('Invalid CLIPROXY_DOMAIN')
+  })
+
+  it('rejects a value with shell metacharacters (semicolon)', () => {
+    expect(() => validateCliproxyHost('cliproxy.fro.bot;rm -rf')).toThrow('Invalid CLIPROXY_DOMAIN')
+  })
+
+  it('rejects a value with shell metacharacters (backtick)', () => {
+    expect(() => validateCliproxyHost('cliproxy.fro.bot`id`')).toThrow('Invalid CLIPROXY_DOMAIN')
+  })
+
+  it('rejects a value with spaces', () => {
+    expect(() => validateCliproxyHost('cliproxy fro.bot')).toThrow('Invalid CLIPROXY_DOMAIN')
+  })
+
+  it('rejects a value with an at-sign', () => {
+    expect(() => validateCliproxyHost('user@cliproxy.fro.bot')).toThrow('Invalid CLIPROXY_DOMAIN')
+  })
+
+  // ── Empty / blank ───────────────────────────────────────────────────────────
+
+  it('rejects an empty string', () => {
+    expect(() => validateCliproxyHost('')).toThrow('Invalid CLIPROXY_DOMAIN')
+  })
+
+  // ── Error message sanitization ──────────────────────────────────────────────
+
+  it('truncates the invalid value in the error message to ~30 chars', () => {
+    const longMalicious = `-oProxyCommand=${'A'.repeat(100)}`
+    let message = ''
+    try {
+      validateCliproxyHost(longMalicious)
+    } catch (error) {
+      message = error instanceof Error ? error.message : String(error)
+    }
+    // The excerpt in the message should not exceed 30 chars of the original value
+    expect(message).toContain('Invalid CLIPROXY_DOMAIN')
+    expect(message.length).toBeLessThan(longMalicious.length + 50)
+  })
+})

package/src/commands/cliproxy/host.ts

@@ -0,0 +1,31 @@
+// ─── Cliproxy host validation ─────────────────────────────────────────────────
+//
+// Validates CLIPROXY_DOMAIN values before they are passed as ssh argv arguments.
+// A value starting with `-` would be interpreted by ssh as an option flag,
+// enabling ProxyCommand injection and local code execution.
+
+const VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i
+
+/**
+ * Validates a candidate CLIPROXY_DOMAIN value against a strict hostname allowlist.
+ *
+ * Accepts: hostnames, FQDNs, IPv4 addresses, `localhost`.
+ * Rejects: empty strings, values starting with `-`, and anything containing
+ * characters outside `[A-Za-z0-9.-]`.
+ *
+ * @throws {Error} with a sanitized excerpt of the invalid value.
+ * @returns The validated host string (unchanged).
+ */
+export function validateCliproxyHost(host: string): string {
+  if (!host) {
+    throw new Error('Invalid CLIPROXY_DOMAIN: value is empty')
+  }
+
+  if (!VALID_HOST_RE.test(host)) {
+    // Truncate to 30 chars and strip non-printable bytes before echoing back
+    const excerpt = host.slice(0, 30).replaceAll(/[^\u0020-\u007E]/g, '?')
+    throw new Error(`Invalid CLIPROXY_DOMAIN: "${excerpt}" — must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`}`)
+  }
+
+  return host
+}

package/src/commands/cliproxy/keys.test.ts

@@ -0,0 +1,326 @@
+import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
+
+import {createCapturedCtx, expectCapturedToInclude} from '../../__test__/mcp-ctx-fixture'
+import {cliproxyKeysAddAction, cliproxyKeysListAction, cliproxyKeysRemoveAction, toStringArray} from './keys'
+
+const originalFetch = globalThis.fetch
+
+type FetchReplacement = (url: string, init?: RequestInit) => Promise<Response>
+
+function createFetchImplementation(handler: FetchReplacement): typeof fetch {
+  return Object.assign(
+    (input: string | URL | Request, init?: RequestInit) => {
+      if (typeof input !== 'string') {
+        throw new TypeError(`Unexpected non-string fetch input: ${String(input)}`)
+      }
+
+      return handler(input, init)
+    },
+    {preconnect: originalFetch.preconnect},
+  )
+}
+
+describe('toStringArray', () => {
+  it('returns string array as-is', () => {
+    expect(toStringArray(['a', 'b', 'c'])).toEqual(['a', 'b', 'c'])
+  })
+
+  it('filters non-string items from array', () => {
+    expect(toStringArray(['a', 1, null, 'b'])).toEqual(['a', 'b'])
+  })
+
+  it('extracts api-keys from object', () => {
+    expect(toStringArray({'api-keys': ['x', 'y']})).toEqual(['x', 'y'])
+  })
+
+  it('extracts api_keys from object (underscore variant)', () => {
+    expect(toStringArray({api_keys: ['x', 'y']})).toEqual(['x', 'y'])
+  })
+
+  it('returns empty array for null', () => {
+    expect(toStringArray(null)).toEqual([])
+  })
+
+  it('returns empty array for unrecognized shape', () => {
+    expect(toStringArray({other: 'stuff'})).toEqual([])
+  })
+})
+
+describe('cliproxyKeysListAction (Mode C, Tier-2 ctx capture)', () => {
+  beforeEach(() => {
+    globalThis.fetch = createFetchImplementation(async () => {
+      throw new Error('Unexpected fetch call')
+    })
+  })
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode C: captures numbered list to ctx.stdout and returns key array', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify(['sk-live-aaa', 'sk-live-bbb']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    const result = await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    // Tier-2: stdout contains formatted list
+    expect(expectCapturedToInclude(captured, 'sk-live-aaa')).toBe(true)
+    expect(expectCapturedToInclude(captured, '1.')).toBe(true)
+    expect(expectCapturedToInclude(captured, '2.')).toBe(true)
+
+    // Mode C: action returns the parsed array
+    expect(Array.isArray(result)).toBe(true)
+    expect(result).toEqual(['sk-live-aaa', 'sk-live-bbb'])
+  })
+
+  it('Mode C: security warning goes to ctx.stderr', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify(['sk-live-aaa']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    const stderrText = captured.stderr.join('')
+    expect(stderrText).toContain('API keys')
+  })
+
+  it('Mode C: returns empty array and prints "No API keys configured" when list is empty', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify([]), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    const result = await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(expectCapturedToInclude(captured, 'No API keys configured')).toBe(true)
+    expect(result).toEqual([])
+  })
+
+  it('Mode C: --json flag outputs JSON array to ctx.stdout', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify(['sk-live-aaa']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    const result = await cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key', json: true}, ctx)
+
+    const stdoutText = captured.stdout.join('')
+    const parsed = JSON.parse(stdoutText)
+    expect(parsed).toEqual(['sk-live-aaa'])
+    expect(result).toEqual(['sk-live-aaa'])
+  })
+})
+
+describe('cliproxyKeysAddAction (Mode A, positional arg, Tier-2 ctx capture)', () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode A: captures success message to ctx.stdout after adding key', async () => {
+    let putCalled = false
+    globalThis.fetch = createFetchImplementation(async (_url, init) => {
+      if (init?.method === 'PUT') {
+        putCalled = true
+        return new Response(JSON.stringify(['sk-live-existing', 'sk-live-new']), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        })
+      }
+
+      // GET current keys
+      return new Response(JSON.stringify(['sk-live-existing']), {
+        status: 200,
+        headers: {'content-type': 'application/json'},
+      })
+    })
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysAddAction('sk-live-new', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(putCalled).toBe(true)
+    expect(expectCapturedToInclude(captured, 'sk-live-new')).toBe(true)
+    expect(expectCapturedToInclude(captured, 'Added key')).toBe(true)
+  })
+
+  it('Mode A: skips PUT when key already present', async () => {
+    let putCalled = false
+    globalThis.fetch = createFetchImplementation(async (_url, init) => {
+      if (init?.method === 'PUT') {
+        putCalled = true
+        return new Response('{}', {status: 200})
+      }
+
+      return new Response(JSON.stringify(['sk-live-existing']), {
+        status: 200,
+        headers: {'content-type': 'application/json'},
+      })
+    })
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysAddAction('sk-live-existing', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(putCalled).toBe(false)
+    expect(expectCapturedToInclude(captured, 'already present')).toBe(true)
+  })
+})
+
+describe('cliproxyKeysRemoveAction (Mode A, positional arg, Tier-2 ctx capture)', () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  it('Mode A: captures DELETE response to ctx.stdout', async () => {
+    globalThis.fetch = createFetchImplementation(
+      async () =>
+        new Response(JSON.stringify({removed: true}), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        }),
+    )
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyKeysRemoveAction('sk-live-old', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx)
+
+    expect(expectCapturedToInclude(captured, 'removed')).toBe(true)
+  })
+})
+
+describe('cliproxyKeysListAction (Tier-2 failure-path parity)', () => {
+  const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalManagementKey === undefined) {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    } else {
+      process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+    }
+  })
+
+  it('Tier-2: missing CLIPROXY_MANAGEMENT_KEY routes to ctx.console.error + exit(1)', async () => {
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(cliproxyKeysListAction({url: 'https://cliproxy.example.com'}, ctx)).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Management API key')
+    expect(captured.exit).toEqual({code: 1})
+  })
+
+  it('Tier-2: HTTP 500 response routes to ctx.console.error + exit(1)', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('server error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysListAction({url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('HTTP 500')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})
+
+describe('cliproxyKeysAddAction (Tier-2 failure-path parity)', () => {
+  const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalManagementKey === undefined) {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    } else {
+      process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+    }
+  })
+
+  it('Tier-2: missing CLIPROXY_MANAGEMENT_KEY routes to ctx.console.error + exit(1)', async () => {
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysAddAction('sk-live-new', {url: 'https://cliproxy.example.com'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Management API key')
+    expect(captured.exit).toEqual({code: 1})
+  })
+
+  it('Tier-2: HTTP 500 on GET routes to ctx.console.error + exit(1)', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('server error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysAddAction('sk-live-new', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('HTTP 500')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})
+
+describe('cliproxyKeysRemoveAction (Tier-2 failure-path parity)', () => {
+  const originalManagementKey = process.env.CLIPROXY_MANAGEMENT_KEY
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalManagementKey === undefined) {
+      delete process.env.CLIPROXY_MANAGEMENT_KEY
+    } else {
+      process.env.CLIPROXY_MANAGEMENT_KEY = originalManagementKey
+    }
+  })
+
+  it('Tier-2: missing CLIPROXY_MANAGEMENT_KEY routes to ctx.console.error + exit(1)', async () => {
+    delete process.env.CLIPROXY_MANAGEMENT_KEY
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysRemoveAction('sk-live-old', {url: 'https://cliproxy.example.com'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('Management API key')
+    expect(captured.exit).toEqual({code: 1})
+  })
+
+  it('Tier-2: HTTP 500 response routes to ctx.console.error + exit(1)', async () => {
+    globalThis.fetch = createFetchImplementation(async () => new Response('server error', {status: 500}))
+
+    const {ctx, captured} = createCapturedCtx()
+    await expect(
+      cliproxyKeysRemoveAction('sk-live-old', {url: 'https://cliproxy.example.com', key: 'mgmt-key'}, ctx),
+    ).rejects.toMatchObject({
+      name: 'MockProcessExit',
+      code: 1,
+    })
+    expect(captured.stderr.join('')).toContain('HTTP 500')
+    expect(captured.exit).toEqual({code: 1})
+  })
+})