@marcusrbrown/infra 0.9.17 → 0.10.0

package/src/commands/vpn/shared.test.ts

@@ -0,0 +1,334 @@
+import {describe, expect, it} from 'bun:test'
+
+import {getVpnStatusSummary, parseWgShowOutput, type WgShowResult} from './shared'
+
+// ─── parseWgShowOutput ────────────────────────────────────────────────────────
+
+describe('parseWgShowOutput', () => {
+  it('parses wg show output with interface and peers', () => {
+    const output = [
+      'interface: wg0',
+      '  public key: abc123pubkey==',
+      '  private key: (hidden)',
+      '  listening port: 51820',
+      '',
+      'peer: PEER1PUBKEY==',
+      '  endpoint: 10.0.0.1:12345',
+      '  allowed ips: 10.8.0.2/32',
+      '  latest handshake: 1 minute, 30 seconds ago',
+      '  transfer: 1.23 MiB received, 4.56 MiB sent',
+    ].join('\n')
+
+    const result = parseWgShowOutput(output)
+
+    expect(result.interfaceUp).toBe(true)
+    expect(result.serverPublicKey).toBe('abc123pubkey==')
+    expect(result.peerCount).toBe(1)
+  })
+
+  it('parses wg show output with no peers', () => {
+    const output = [
+      'interface: wg0',
+      '  public key: serverpubkey==',
+      '  private key: (hidden)',
+      '  listening port: 51820',
+    ].join('\n')
+
+    const result = parseWgShowOutput(output)
+
+    expect(result.interfaceUp).toBe(true)
+    expect(result.serverPublicKey).toBe('serverpubkey==')
+    expect(result.peerCount).toBe(0)
+  })
+
+  it('parses wg show output with multiple peers', () => {
+    const output = [
+      'interface: wg0',
+      '  public key: serverpubkey==',
+      '  private key: (hidden)',
+      '  listening port: 51820',
+      '',
+      'peer: PEER1PUBKEY==',
+      '  allowed ips: 10.8.0.2/32',
+      '',
+      'peer: PEER2PUBKEY==',
+      '  allowed ips: 10.8.0.3/32',
+      '',
+      'peer: PEER3PUBKEY==',
+      '  allowed ips: 10.8.0.4/32',
+    ].join('\n')
+
+    const result = parseWgShowOutput(output)
+
+    expect(result.interfaceUp).toBe(true)
+    expect(result.peerCount).toBe(3)
+  })
+
+  it('returns interfaceUp=false for empty output', () => {
+    const result = parseWgShowOutput('')
+
+    expect(result.interfaceUp).toBe(false)
+    expect(result.serverPublicKey).toBeUndefined()
+    expect(result.peerCount).toBe(0)
+  })
+
+  it('returns interfaceUp=false when output has no interface: line', () => {
+    const result = parseWgShowOutput('some random output without interface line')
+
+    expect(result.interfaceUp).toBe(false)
+  })
+})
+
+// ─── getVpnStatusSummary — SSH-only (no AWS client) ──────────────────────────
+
+type SpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+) => {
+  stdout: ReadableStream<Uint8Array>
+  stderr: ReadableStream<Uint8Array>
+  exited: Promise<number>
+}
+
+function makeSpawnOk(output: string): SpawnFn {
+  return (_cmd, _opts) => {
+    const encoder = new TextEncoder()
+    return {
+      stdout: new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(output))
+          controller.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(controller) {
+          controller.close()
+        },
+      }),
+      exited: Promise.resolve(0),
+    }
+  }
+}
+
+function makeSpawnError(message: string): SpawnFn {
+  return (_cmd, _opts) => {
+    const encoder = new TextEncoder()
+    return {
+      stdout: new ReadableStream({
+        start(controller) {
+          controller.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(message))
+          controller.close()
+        },
+      }),
+      exited: Promise.resolve(1),
+    }
+  }
+}
+
+describe('getVpnStatusSummary', () => {
+  it('returns a structured summary with app=vpn when wg show succeeds', async () => {
+    const wgOutput = [
+      'interface: wg0',
+      '  public key: serverpubkey==',
+      '  private key: (hidden)',
+      '  listening port: 51820',
+      '',
+      'peer: PEER1PUBKEY==',
+      '  allowed ips: 10.8.0.2/32',
+    ].join('\n')
+
+    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnOk(wgOutput))
+
+    expect(summary.app).toBe('vpn')
+    expect(summary.http).toContain('OK')
+  })
+
+  it('includes the server public key in the http field', async () => {
+    const wgOutput = [
+      'interface: wg0',
+      '  public key: MYPUBLICKEY==',
+      '  private key: (hidden)',
+      '  listening port: 51820',
+    ].join('\n')
+
+    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnOk(wgOutput))
+
+    expect(summary.http).toContain('MYPUBLICKEY==')
+  })
+
+  it('returns error summary when SSH fails', async () => {
+    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnError('Connection refused'))
+
+    expect(summary.app).toBe('vpn')
+    expect(summary.http).toContain('ERROR')
+  })
+
+  it('rejects an invalid host before spawning SSH', async () => {
+    const neverSpawn: SpawnFn = () => {
+      throw new Error('spawn must not be called for an invalid host')
+    }
+
+    await expect(getVpnStatusSummary('-oProxyCommand=evil', neverSpawn)).rejects.toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects a host with shell metacharacters before spawning SSH', async () => {
+    const neverSpawn: SpawnFn = () => {
+      throw new Error('spawn must not be called for an invalid host')
+    }
+
+    await expect(getVpnStatusSummary('vpn.example.com;rm -rf', neverSpawn)).rejects.toThrow('Invalid VPN_HOST')
+  })
+
+  it('does NOT import or construct a Lightsail/AWS client (SSH-only)', async () => {
+    // This test verifies the module source does not reference AWS SDK.
+    // We import the module and check it doesn't have AWS client construction.
+    // The real assertion is structural: getVpnStatusSummary only uses SSH.
+    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
+    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnOk(wgOutput))
+
+    // If this resolves without AWS credentials, it's SSH-only.
+    expect(summary.app).toBe('vpn')
+  })
+
+  it('SSH user contract: connects as ubuntu@host, not root@host', async () => {
+    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(wgOutput))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
+
+    const destination = capturedCmd.find(arg => arg.includes('@'))
+    expect(destination).toBeDefined()
+    expect(destination).toMatch(/^ubuntu@/)
+    expect(destination).not.toMatch(/^root@/)
+  })
+
+  it('privilege contract: wg show wg0 is prefixed with sudo', async () => {
+    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(wgOutput))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
+
+    // The last element of the SSH command is the remote command to run
+    const remoteCmd = capturedCmd.at(-1)
+    expect(remoteCmd).toMatch(/^sudo wg show wg0/)
+  })
+
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(wgOutput))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking', async () => {
+    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(wgOutput))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
+// ─── WgShowResult type export check ──────────────────────────────────────────
+
+describe('WgShowResult type', () => {
+  it('has the expected shape', () => {
+    const result: WgShowResult = {
+      interfaceUp: true,
+      serverPublicKey: 'key==',
+      peerCount: 2,
+    }
+    expect(result.interfaceUp).toBe(true)
+    expect(result.serverPublicKey).toBe('key==')
+    expect(result.peerCount).toBe(2)
+  })
+})

package/src/commands/vpn/shared.ts

@@ -0,0 +1,158 @@
+import type {StatusSummary} from '../status'
+
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
+import {redactHost} from '../../lib/redact'
+import {validateVpnHost} from './host'
+
+declare const process: {
+  env: Record<string, string | undefined>
+}
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+export interface WgShowResult {
+  interfaceUp: boolean
+  serverPublicKey?: string
+  peerCount: number
+}
+
+export type SpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+) => {
+  stdout: ReadableStream<Uint8Array>
+  stderr: ReadableStream<Uint8Array>
+  exited: Promise<number>
+}
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+/**
+ * Parse `wg show wg0` output into a structured result.
+ *
+ * Pure function — no IO.
+ */
+export function parseWgShowOutput(output: string): WgShowResult {
+  const trimmed = output.trim()
+
+  if (!trimmed || !trimmed.includes('interface:')) {
+    return {interfaceUp: false, peerCount: 0}
+  }
+
+  // Extract server public key from "  public key: <key>" line
+  // Use a possessive-style pattern to avoid backtracking: match leading spaces,
+  // then the literal label, then capture the key (non-space chars).
+  const pubKeyMatch = /^ +public key: +(\S+)/m.exec(trimmed)
+  const serverPublicKey = pubKeyMatch?.[1]?.trim()
+
+  // Count peer blocks
+  const peerCount = (trimmed.match(/^peer:/gm) ?? []).length
+
+  return {
+    interfaceUp: true,
+    serverPublicKey,
+    peerCount,
+  }
+}
+
+// ─── SSH-backed status fetch ──────────────────────────────────────────────────
+
+function defaultSpawn(
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+): ReturnType<SpawnFn> {
+  return Bun.spawn(cmd, opts) as ReturnType<SpawnFn>
+}
+
+export interface VpnStatusResult {
+  ok: boolean
+  wgShow?: WgShowResult
+  error?: string
+}
+
+/**
+ * Fetch VPN status via SSH + `wg show wg0`.
+ *
+ * SSH-only — never calls the Lightsail/AWS API.
+ * Validates host before constructing any SSH argv.
+ */
+export async function getVpnWgStatus(host: string, spawn: SpawnFn = defaultSpawn): Promise<VpnStatusResult> {
+  validateVpnHost(host)
+
+  const sshCmd = [
+    'ssh',
+    '-o',
+    'BatchMode=yes',
+    '-o',
+    'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
+    `ubuntu@${host}`,
+    'sudo wg show wg0',
+  ]
+
+  const env: Record<string, string> = {
+    PATH: process.env.PATH ?? '/usr/bin:/bin',
+    HOME: process.env.HOME ?? '/tmp',
+    ...(process.env.SSH_AUTH_SOCK ? {SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK} : {}),
+  }
+
+  const child = spawn(sshCmd, {env, stdout: 'pipe', stderr: 'pipe'})
+
+  const [stdoutText, stderrText, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ])
+
+  if (exitCode !== 0) {
+    const redacted = redactHost(stderrText.trim(), host) || 'unknown error'
+    return {
+      ok: false,
+      error: `SSH command failed (exit ${exitCode}): ${redacted}`,
+    }
+  }
+
+  const wgShow = parseWgShowOutput(stdoutText)
+
+  return {ok: wgShow.interfaceUp, wgShow}
+}
+
+// ─── Unified status aggregator export ────────────────────────────────────────
+
+/**
+ * Get a structured VPN status summary for the unified status dashboard.
+ *
+ * SSH + `wg show` only — never calls the Lightsail/AWS API.
+ * The MCP runtime needs no AWS credentials to call this function.
+ *
+ * @param host - The VPN box hostname or IP (validated before SSH).
+ * @param spawn - Injectable spawn function (defaults to Bun.spawn).
+ */
+export async function getVpnStatusSummary(host: string, spawn?: SpawnFn): Promise<StatusSummary> {
+  const result = await getVpnWgStatus(host, spawn)
+
+  if (!result.ok || !result.wgShow) {
+    const errorMsg = result.error ?? 'WireGuard interface not up'
+    return {
+      app: 'vpn',
+      http: `ERROR: ${errorMsg}`,
+      lastDeploy: '—',
+      version: '—',
+      contentHash: '—',
+      usageStats: '—',
+    }
+  }
+
+  const {wgShow} = result
+  const pubKeyInfo = wgShow.serverPublicKey ? ` pubkey:${wgShow.serverPublicKey}` : ''
+  const peerInfo = `${wgShow.peerCount} peer(s)`
+
+  return {
+    app: 'vpn',
+    http: `OK: wg0 up,${pubKeyInfo} ${peerInfo}`,
+    lastDeploy: '—',
+    version: '—',
+    contentHash: '—',
+    usageStats: '—',
+  }
+}

package/src/commands/vpn/status.test.ts

@@ -0,0 +1,142 @@
+import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
+
+import {createCapturedCtx, expectCapturedToInclude, MockProcessExit} from '../../__test__/mcp-ctx-fixture'
+import {vpnStatusAction} from './status'
+
+// ─── SpawnFn helpers ──────────────────────────────────────────────────────────
+
+type SpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
+) => {
+  stdout: ReadableStream<Uint8Array>
+  stderr: ReadableStream<Uint8Array>
+  exited: Promise<number>
+}
+
+function makeSpawnOk(output: string): SpawnFn {
+  return (_cmd, _opts) => {
+    const encoder = new TextEncoder()
+    return {
+      stdout: new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(output))
+          controller.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(controller) {
+          controller.close()
+        },
+      }),
+      exited: Promise.resolve(0),
+    }
+  }
+}
+
+function makeSpawnError(message: string): SpawnFn {
+  return (_cmd, _opts) => {
+    const encoder = new TextEncoder()
+    return {
+      stdout: new ReadableStream({
+        start(controller) {
+          controller.close()
+        },
+      }),
+      stderr: new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(message))
+          controller.close()
+        },
+      }),
+      exited: Promise.resolve(1),
+    }
+  }
+}
+
+// ─── vpnStatusAction ctx capture ─────────────────────────────────────────────
+
+describe('vpnStatusAction — ctx capture', () => {
+  let originalEnv: Record<string, string | undefined>
+
+  beforeEach(() => {
+    originalEnv = {VPN_HOST: process.env.VPN_HOST}
+    process.env.VPN_HOST = '1.2.3.4'
+  })
+
+  afterEach(() => {
+    if (originalEnv.VPN_HOST === undefined) {
+      delete process.env.VPN_HOST
+    } else {
+      process.env.VPN_HOST = originalEnv.VPN_HOST
+    }
+  })
+
+  it('routes "Status: OK" to ctx.console.log when wg0 is up', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    const wgOutput = [
+      'interface: wg0',
+      '  public key: serverpubkey==',
+      '  private key: (hidden)',
+      '  listening port: 51820',
+    ].join('\n')
+
+    await vpnStatusAction({key: undefined}, ctx, makeSpawnOk(wgOutput))
+
+    expect(expectCapturedToInclude(captured, 'Status: OK')).toBe(true)
+  })
+
+  it('routes "VPN status" header to ctx.console.log', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
+
+    await vpnStatusAction({key: undefined}, ctx, makeSpawnOk(wgOutput))
+
+    expect(expectCapturedToInclude(captured, 'VPN status')).toBe(true)
+  })
+
+  it('surfaces the server public key in the output', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    const wgOutput = 'interface: wg0\n  public key: MYPUBLICKEY==\n  private key: (hidden)\n  listening port: 51820\n'
+
+    await vpnStatusAction({key: undefined}, ctx, makeSpawnOk(wgOutput))
+
+    expect(expectCapturedToInclude(captured, 'MYPUBLICKEY==')).toBe(true)
+  })
+
+  it('routes error to ctx.console.error and calls ctx.process.exit(1) when SSH fails', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    await expect(vpnStatusAction({key: undefined}, ctx, makeSpawnError('Connection refused'))).rejects.toBeInstanceOf(
+      MockProcessExit,
+    )
+
+    expect(captured.stderr.join('').includes('Error')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+
+  it('routes error to ctx.console.error and calls ctx.process.exit(1) when VPN_HOST is unset', async () => {
+    delete process.env.VPN_HOST
+    const {ctx, captured} = createCapturedCtx()
+
+    await expect(vpnStatusAction({key: undefined}, ctx)).rejects.toBeInstanceOf(MockProcessExit)
+
+    expect(captured.stderr.join('').includes('VPN_HOST')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+
+  it('routes "Status: DEGRADED" to ctx.console.log and exits 1 when wg0 is down', async () => {
+    const {ctx, captured} = createCapturedCtx()
+
+    // wg show output without "interface:" line means interface is down
+    await expect(
+      vpnStatusAction({key: undefined}, ctx, makeSpawnOk('wg: The requested operation is not possible')),
+    ).rejects.toBeInstanceOf(MockProcessExit)
+
+    expect(expectCapturedToInclude(captured, 'DEGRADED')).toBe(true)
+    expect(captured.exit?.code).toBe(1)
+  })
+})