@marcusrbrown/infra 0.9.4 → 0.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/commands/cliproxy/login.test.ts

@@ -239,6 +239,107 @@ describe('cliproxy login', () => {
     })
   })
 
+  describe('host forwarding into ssh argv', () => {
+    it('forwards resolved host from CLIPROXY_DOMAIN env var into ssh argv', async () => {
+      const {cliproxyLoginAction} = await import('./login')
+      const {spawnFn, calls} = makeSpawnOk(0)
+      setValidEnv()
+      process.env.CLIPROXY_DOMAIN = 'env-host.example.com'
+
+      await cliproxyLoginAction('claude', {}, spawnFn)
+
+      expect(calls).toHaveLength(1)
+      expect(calls[0]!.cmd).toContain('root@env-host.example.com')
+    })
+
+    it('forwards resolved host from --host option into ssh argv', async () => {
+      const {cliproxyLoginAction} = await import('./login')
+      const {spawnFn, calls} = makeSpawnOk(0)
+      setValidEnv()
+      delete process.env.CLIPROXY_DOMAIN
+
+      await cliproxyLoginAction('claude', {host: 'flag-host.example.com'}, spawnFn)
+
+      expect(calls).toHaveLength(1)
+      expect(calls[0]!.cmd).toContain('root@flag-host.example.com')
+    })
+  })
+
+  describe('non-zero exit propagation', () => {
+    it('throws with exit code in message when remote ssh exits non-zero', async () => {
+      const {cliproxyLoginAction} = await import('./login')
+      const {spawnFn, calls} = makeSpawnOk(17)
+      setValidEnv()
+
+      await expect(cliproxyLoginAction('claude', {}, spawnFn)).rejects.toThrow(
+        'Remote login command failed with exit code 17',
+      )
+      expect(calls).toHaveLength(1)
+    })
+  })
+
+  describe('ssh spawn contract', () => {
+    it('happy path — claude: spawn argv and options match ssh boundary contract', async () => {
+      const {cliproxyLoginAction} = await import('./login')
+      const {spawnFn, calls} = makeSpawnOk(0)
+      setValidEnv()
+      process.env.SSH_AUTH_SOCK = '/tmp/contract-test.sock'
+      const capturedPath = process.env.PATH!
+      const capturedHome = process.env.HOME!
+
+      await cliproxyLoginAction('claude', {}, spawnFn)
+
+      expect(calls).toHaveLength(1)
+      const {cmd, opts} = calls[0]!
+      const spawnOpts = opts as Parameters<SpawnFn>[1]
+
+      // SSH flags
+      expect(cmd).toContain('-tt')
+      expect(cmd).toContain('BatchMode=yes')
+      expect(cmd).toContain('ConnectTimeout=10')
+
+      // stdio inheritance
+      expect(spawnOpts.stdin).toBe('inherit')
+      expect(spawnOpts.stdout).toBe('inherit')
+      expect(spawnOpts.stderr).toBe('inherit')
+
+      // forwarded env vars
+      expect(spawnOpts.env.PATH).toBe(capturedPath)
+      expect(spawnOpts.env.HOME).toBe(capturedHome)
+      expect(spawnOpts.env.SSH_AUTH_SOCK).toBe('/tmp/contract-test.sock')
+    })
+
+    it('happy path — codex: spawn argv and options match ssh boundary contract', async () => {
+      const {cliproxyLoginAction} = await import('./login')
+      const {spawnFn, calls} = makeSpawnOk(0)
+      setValidEnv()
+      process.env.SSH_AUTH_SOCK = '/tmp/contract-test.sock'
+      const capturedPath = process.env.PATH!
+      const capturedHome = process.env.HOME!
+
+      await cliproxyLoginAction('codex', {}, spawnFn)
+
+      expect(calls).toHaveLength(1)
+      const {cmd, opts} = calls[0]!
+      const spawnOpts = opts as Parameters<SpawnFn>[1]
+
+      // SSH flags
+      expect(cmd).toContain('-tt')
+      expect(cmd).toContain('BatchMode=yes')
+      expect(cmd).toContain('ConnectTimeout=10')
+
+      // stdio inheritance
+      expect(spawnOpts.stdin).toBe('inherit')
+      expect(spawnOpts.stdout).toBe('inherit')
+      expect(spawnOpts.stderr).toBe('inherit')
+
+      // forwarded env vars
+      expect(spawnOpts.env.PATH).toBe(capturedPath)
+      expect(spawnOpts.env.HOME).toBe(capturedHome)
+      expect(spawnOpts.env.SSH_AUTH_SOCK).toBe('/tmp/contract-test.sock')
+    })
+  })
+
   describe('anti-phishing notice', () => {
     let logLines: string[]
     let originalLog: typeof console.log

package/src/commands/cliproxy/setup/preview.test.ts

@@ -37,7 +37,7 @@ describe('formatDryRunPreview', () => {
     expect(preview).toContain('Planned secrets:')
     expect(preview).toContain('OPENCODE_AUTH_JSON')
     expect(preview).toContain('OPENCODE_CONFIG')
-    expect(preview).toContain('OMO_PROVIDERS')
+    expect(preview).not.toContain('OMO_PROVIDERS')
   })
 
   it('renders planned variables', () => {

package/src/commands/cliproxy/setup/templates.test.ts

@@ -123,7 +123,6 @@ describe('getHarnessTemplate', () => {
     expect(template.secrets.map((entry: SecretAssignment) => entry.name)).toEqual([
       'OPENCODE_AUTH_JSON',
       'OPENCODE_CONFIG',
-      'OMO_PROVIDERS',
     ])
     expect(template.variables.map((entry: VariableAssignment) => entry.name)).toEqual(['FRO_BOT_MODEL'])
   })
@@ -135,11 +134,11 @@ describe('getHarnessTemplate', () => {
     expect(modelEntry?.value).toMatch(/^anthropic\//)
   })
 
-  it('uses the expected OMO_PROVIDERS default value', () => {
+  it('does not include an OMO_PROVIDERS secret', () => {
     const template = getHarnessTemplate('opencode', {keyValue: 'sk-test'})
-    const providersEntry = template.secrets.find((entry: SecretAssignment) => entry.name === 'OMO_PROVIDERS')
+    const secretNames = template.secrets.map((entry: SecretAssignment) => entry.name)
 
-    expect(providersEntry?.value).toBe('claude-max20')
+    expect(secretNames).not.toContain('OMO_PROVIDERS')
   })
 
   it('writes an OPENCODE_CONFIG baseURL with the /v1 suffix', () => {
@@ -183,11 +182,11 @@ describe('getHarnessTemplate provider-aware', () => {
       expect(configEntry?.value).toBe(ANTHROPIC_ONLY_CONFIG)
     })
 
-    it('no providers/model args → OMO_PROVIDERS is claude-max20', () => {
+    it('no providers/model args → OMO_PROVIDERS is not emitted', () => {
       const template = getHarnessTemplate('opencode', {keyValue: 'test-key'})
-      const entry = template.secrets.find((e: SecretAssignment) => e.name === 'OMO_PROVIDERS')
+      const secretNames = template.secrets.map((e: SecretAssignment) => e.name)
 
-      expect(entry?.value).toBe('claude-max20')
+      expect(secretNames).not.toContain('OMO_PROVIDERS')
     })
 
     it('no providers/model args → FRO_BOT_MODEL is anthropic/claude-sonnet-4-6', () => {
@@ -234,15 +233,15 @@ describe('getHarnessTemplate provider-aware', () => {
       expect(configEntry?.value).toBe('{"provider":{"openai":{"options":{"baseURL":"https://cliproxy.fro.bot/v1"}}}}')
     })
 
-    it("providers: ['openai'], model: 'openai/gpt-5.4-mini' → OMO_PROVIDERS is openai", () => {
+    it("providers: ['openai'], model: 'openai/gpt-5.4-mini' → OMO_PROVIDERS is not emitted", () => {
       const template = getHarnessTemplate('opencode', {
         keyValue: 'sk-openai-key',
         providers: ['openai'],
         model: 'openai/gpt-5.4-mini',
       })
-      const entry = template.secrets.find((e: SecretAssignment) => e.name === 'OMO_PROVIDERS')
+      const secretNames = template.secrets.map((e: SecretAssignment) => e.name)
 
-      expect(entry?.value).toBe('openai')
+      expect(secretNames).not.toContain('OMO_PROVIDERS')
     })
 
     it("providers: ['openai'], model: 'openai/gpt-5.4-mini' → FRO_BOT_MODEL is openai/gpt-5.4-mini", () => {
@@ -294,15 +293,15 @@ describe('getHarnessTemplate provider-aware', () => {
       )
     })
 
-    it("providers: ['anthropic', 'openai'] → OMO_PROVIDERS is claude-max20,openai", () => {
+    it("providers: ['anthropic', 'openai'] → OMO_PROVIDERS is not emitted", () => {
       const template = getHarnessTemplate('opencode', {
         keyValue: 'sk-dual',
         providers: ['anthropic', 'openai'],
         model: 'openai/gpt-5.4-mini',
       })
-      const entry = template.secrets.find((e: SecretAssignment) => e.name === 'OMO_PROVIDERS')
+      const secretNames = template.secrets.map((e: SecretAssignment) => e.name)
 
-      expect(entry?.value).toBe('claude-max20,openai')
+      expect(secretNames).not.toContain('OMO_PROVIDERS')
     })
 
     it("providers: ['anthropic', 'openai'] → FRO_BOT_MODEL is the supplied model", () => {

package/src/commands/cliproxy/setup/templates.ts

@@ -25,13 +25,6 @@ export interface HarnessTemplate {
 
 const DEFAULT_CLIPROXY_URL = 'https://cliproxy.fro.bot'
 
-// OMO_PROVIDERS token map — template/harness concern, not a provider concern.
-// Keyed by ProviderId but lives here because it drives harness template construction.
-const OMO_TOKEN: Record<ProviderId, string> = {
-  anthropic: 'claude-max20',
-  openai: 'openai',
-}
-
 export function stripTrailingSlash(value: string): string {
   return value.endsWith('/') ? value.slice(0, -1) : value
 }
@@ -78,8 +71,6 @@ export function getHarnessTemplate(
       providerConfig[p] = {options: {baseURL: `${baseUrl}/v1`}}
     }
 
-    const omoProviders = providers.map(p => OMO_TOKEN[p]).join(',')
-
     return {
       secrets: [
         {
@@ -90,10 +81,6 @@ export function getHarnessTemplate(
           name: 'OPENCODE_CONFIG',
           value: JSON.stringify({provider: providerConfig}),
         },
-        {
-          name: 'OMO_PROVIDERS',
-          value: omoProviders,
-        },
       ],
       variables: [
         {

package/src/commands/cliproxy/setup/workflow-analyzer.test.ts

@@ -230,14 +230,36 @@ describe('cliproxy setup helpers', () => {
       expect(Object.keys(dualResult)).toEqual(['kind', 'stepsWithGaps'])
     })
 
-    it('REQUIRED_OPENCODE_INPUTS covers exactly auth-json, opencode-config, omo-providers, model (no enable-omo)', () => {
-      // Infer the required inputs from fixture-based testing: a workflow with exactly
-      // these four inputs and no others (besides github-token and prompt) passes with zero gaps.
-      const result = analyzeFroBotWorkflow(WORKFLOW_WITH_OPENAI_MODEL)
+    it('REQUIRED_OPENCODE_INPUTS covers exactly auth-json, opencode-config, model (no omo-providers, no enable-omo)', () => {
+      // A workflow that wires auth-json, opencode-config, model (but NOT omo-providers) must
+      // pass with zero gaps — omo-providers is vestigial and must not be required.
+      const workflowWithoutOmo = `      - uses: fro-bot/agent@abc123
+        with:
+          github-token: \${{ secrets.FRO_BOT_PAT }}
+          auth-json: \${{ secrets.OPENCODE_AUTH_JSON }}
+          model: \${{ vars.FRO_BOT_MODEL }}
+          opencode-config: \${{ secrets.OPENCODE_CONFIG }}
+          prompt: \${{ env.PROMPT }}
+`
+      const result = analyzeFroBotWorkflow(workflowWithoutOmo)
+
+      expect(result.kind).toBe('analyzed')
+      if (result.kind !== 'analyzed') throw new Error('unreachable')
+      // Zero gaps confirms omo-providers is NOT required.
+      expect(result.stepsWithGaps).toEqual([])
+    })
+
+    it('a workflow missing only omo-providers (but with auth-json, opencode-config, model) is not flagged', () => {
+      const workflowWithoutOmo = `      - uses: fro-bot/agent@abc123
+        with:
+          auth-json: \${{ secrets.OPENCODE_AUTH_JSON }}
+          opencode-config: \${{ secrets.OPENCODE_CONFIG }}
+          model: \${{ vars.FRO_BOT_MODEL }}
+`
+      const result = analyzeFroBotWorkflow(workflowWithoutOmo)
 
       expect(result.kind).toBe('analyzed')
       if (result.kind !== 'analyzed') throw new Error('unreachable')
-      // Zero gaps confirms the four inputs in the fixture are sufficient — enable-omo is NOT required.
       expect(result.stepsWithGaps).toEqual([])
     })
   })

package/src/commands/cliproxy/setup/workflow-analyzer.ts

@@ -23,7 +23,7 @@ export type FroBotWorkflowCheck =
 // For proxy-routed providers configured via OPENCODE_CONFIG.provider.<name>.options.baseURL,
 // the fro-bot/agent action honors auth.json directly (regardless of oMo state).
 // Source: fro-bot/agent@v0.44.3+ action.yaml lines 99-104; verified by librarian 2026-05-25.
-const REQUIRED_OPENCODE_INPUTS = ['auth-json', 'opencode-config', 'omo-providers', 'model'] as const
+const REQUIRED_OPENCODE_INPUTS = ['auth-json', 'opencode-config', 'model'] as const
 type RequiredOpencodeInput = (typeof REQUIRED_OPENCODE_INPUTS)[number]
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -129,7 +129,6 @@ export function formatWorkflowSnippet(missingInputs: readonly string[]): string
   const inputMap = {
     'auth-json': 'auth-json: ${{ secrets.OPENCODE_AUTH_JSON }}',
     'opencode-config': 'opencode-config: ${{ secrets.OPENCODE_CONFIG }}',
-    'omo-providers': 'omo-providers: ${{ secrets.OMO_PROVIDERS }}',
     model: 'model: ${{ vars.FRO_BOT_MODEL }}',
   } satisfies Record<RequiredOpencodeInput, string>
   /* eslint-enable no-template-curly-in-string */

package/src/commands/cliproxy/setup.test.ts

@@ -2038,7 +2038,7 @@ describe('post-write readback verification', () => {
 
   it('happy path: readback returns all written names → no new warning emitted', async () => {
     // Pre-write list is empty; post-write readback returns all written names
-    // The opencode harness writes: OPENCODE_AUTH_JSON, OPENCODE_CONFIG, OMO_PROVIDERS (secrets)
+    // The opencode harness writes: OPENCODE_AUTH_JSON, OPENCODE_CONFIG (secrets)
     // and FRO_BOT_MODEL (variable)
     let callCount = 0
     const {deps} = makeDeps(async (_repo, kind) => {
@@ -2048,7 +2048,7 @@ describe('post-write readback verification', () => {
         return []
       }
       // Post-write readback: return all written names
-      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG', 'OMO_PROVIDERS']
+      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG']
       return ['FRO_BOT_MODEL']
     })
 
@@ -2068,7 +2068,7 @@ describe('post-write readback verification', () => {
       callCount++
       if (callCount <= 2) return []
       // Post-write: secret readback missing OPENCODE_AUTH_JSON
-      if (kind === 'secret') return ['OPENCODE_CONFIG', 'OMO_PROVIDERS']
+      if (kind === 'secret') return ['OPENCODE_CONFIG']
       return ['FRO_BOT_MODEL']
     })
 
@@ -2088,7 +2088,7 @@ describe('post-write readback verification', () => {
     const {deps} = makeDeps(async (_repo, kind) => {
       callCount++
       if (callCount <= 2) return []
-      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG', 'OMO_PROVIDERS']
+      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG']
       // Variable readback missing FRO_BOT_MODEL
       return []
     })
@@ -2102,12 +2102,12 @@ describe('post-write readback verification', () => {
   })
 
   it('partial visibility: readback shows some but not all written names → warning lists exactly the absent names', async () => {
-    // Post-write: OPENCODE_CONFIG and OMO_PROVIDERS present, OPENCODE_AUTH_JSON absent
+    // Post-write: OPENCODE_CONFIG present, OPENCODE_AUTH_JSON absent
     let callCount = 0
     const {deps} = makeDeps(async (_repo, kind) => {
       callCount++
       if (callCount <= 2) return []
-      if (kind === 'secret') return ['OPENCODE_CONFIG', 'OMO_PROVIDERS'] // OPENCODE_AUTH_JSON absent
+      if (kind === 'secret') return ['OPENCODE_CONFIG'] // OPENCODE_AUTH_JSON absent
       return ['FRO_BOT_MODEL']
     })
 
@@ -2117,9 +2117,8 @@ describe('post-write readback verification', () => {
     expect(mismatchWarnings.length).toBeGreaterThan(0)
     // Must name OPENCODE_AUTH_JSON (absent)
     expect(mismatchWarnings.some(m => m.includes('OPENCODE_AUTH_JSON'))).toBe(true)
-    // Must NOT name OPENCODE_CONFIG or OMO_PROVIDERS (they ARE present)
+    // Must NOT name OPENCODE_CONFIG (it IS present)
     expect(mismatchWarnings.some(m => m.includes('OPENCODE_CONFIG'))).toBe(false)
-    expect(mismatchWarnings.some(m => m.includes('OMO_PROVIDERS'))).toBe(false)
   })
 
   it('cannot verify: listExistingGhNames throws on post-write call → softer warning, command does NOT throw, rollback NOT fired', async () => {
@@ -2268,7 +2267,7 @@ describe('post-write readback verification', () => {
         return []
       }
       // Post-write readback: all names present
-      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG', 'OMO_PROVIDERS']
+      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG']
       return ['FRO_BOT_MODEL']
     })
 
@@ -2338,7 +2337,7 @@ describe('non-interactive overwrite warning concurrency caveat', () => {
   it('--force overwrite with a collision present → warning carries the last-write-wins concurrency caveat', async () => {
     // OPENCODE_AUTH_JSON already exists → collision on the opencode secret set → overwrite warning fires.
     const deps = makeDeps(async (_repo, kind) => {
-      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG', 'OMO_PROVIDERS']
+      if (kind === 'secret') return ['OPENCODE_AUTH_JSON', 'OPENCODE_CONFIG']
       return ['FRO_BOT_MODEL']
     })
 

package/src/commands/cliproxy/setup.ts

@@ -350,7 +350,7 @@ export async function buildNonInteractivePlan(
   // Check BEFORE verifyModelsAvailable to avoid a network call when the gate will reject anyway.
   if (requiresDestructiveProviderChangeConfirmation(providers) && !options.force) {
     throw new Error(
-      `Refusing destructive provider change on ${options.repo ?? ''} without --force. Selected providers ${providers.join(', ')} would overwrite existing GitHub secret values (OPENCODE_AUTH_JSON, OPENCODE_CONFIG, OMO_PROVIDERS, FRO_BOT_MODEL). Note: --force authorizes overwriting these GitHub secret values; it does NOT rotate the underlying CLIProxyAPI proxy bearer token (which is preserved byte-for-byte when --key is supplied).`,
+      `Refusing destructive provider change on ${options.repo ?? ''} without --force. Selected providers ${providers.join(', ')} would overwrite existing GitHub secret values (OPENCODE_AUTH_JSON, OPENCODE_CONFIG, FRO_BOT_MODEL). Note: --force authorizes overwriting these GitHub secret values; it does NOT rotate the underlying CLIProxyAPI proxy bearer token (which is preserved byte-for-byte when --key is supplied).`,
     )
   }