@marcusrbrown/infra 0.9.7 → 0.9.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/commands/cliproxy/status.test.ts

@@ -717,3 +717,125 @@ describe('management auth probe (ban-awareness)', () => {
     expect(managementFetchUrls.length).toBe(1)
   })
 })
+
+// ─── Ambient management key trusted-URL binding ───────────────────────────────
+
+describe('cliproxyStatusAction — ambient key does not follow agent-supplied URLs', () => {
+  let originalEnv: Record<string, string | undefined>
+
+  beforeEach(() => {
+    originalEnv = {
+      CLIPROXY_URL: process.env.CLIPROXY_URL,
+      CLIPROXY_MANAGEMENT_KEY: process.env.CLIPROXY_MANAGEMENT_KEY,
+    }
+    process.env.CLIPROXY_MANAGEMENT_KEY = 'secret-ambient-key'
+    delete process.env.CLIPROXY_URL
+  })
+
+  afterEach(() => {
+    for (const [k, v] of Object.entries(originalEnv)) {
+      if (v === undefined) {
+        delete process.env[k]
+      } else {
+        process.env[k] = v
+      }
+    }
+    globalThis.fetch = originalFetch
+  })
+
+  it('does NOT send the ambient management key to a non-trusted --url override', async () => {
+    const capturedRequestsByHost: Record<string, string[]> = {}
+
+    globalThis.fetch = createFetchImplementation(async (url, init) => {
+      const {hostname} = new URL(url)
+      const hdrs = init?.headers
+      const key = hdrs instanceof Headers ? hdrs.get('x-management-key') : null
+
+      if (!capturedRequestsByHost[hostname]) capturedRequestsByHost[hostname] = []
+      if (key) capturedRequestsByHost[hostname].push(key)
+
+      if (url.includes('/healthz')) return new Response('ok', {status: 200})
+      if (url.includes('/v0/management/'))
+        return new Response('[]', {status: 200, headers: {'content-type': 'application/json'}})
+      return new Response('ok', {status: 200})
+    })
+
+    const {ctx} = createCapturedCtx()
+    try {
+      await cliproxyStatusAction({url: 'https://evil.example.com'}, ctx)
+    } catch {
+      // exit(1) expected or not — either way, we just care about key leakage
+    }
+
+    // The ambient secret key must NOT appear in any request to the evil host
+    expect(capturedRequestsByHost['evil.example.com'] ?? []).not.toContain('secret-ambient-key')
+  })
+
+  it('still uses the ambient key when --url matches the default trusted URL', async () => {
+    const capturedManagementKeys: string[] = []
+
+    globalThis.fetch = createFetchImplementation(async (url, init) => {
+      const hdrs = init?.headers
+      const key = hdrs instanceof Headers ? hdrs.get('x-management-key') : null
+      if (url.includes('/v0/management/') && key) capturedManagementKeys.push(key)
+
+      if (url.includes('/healthz')) return new Response('ok', {status: 200})
+      if (url.includes('/v0/management/config'))
+        return new Response('{}', {status: 200, headers: {'content-type': 'application/json'}})
+      if (url.includes('/v0/management/usage-queue'))
+        return new Response('[]', {status: 200, headers: {'content-type': 'application/json'}})
+      if (url.includes('/v0/management/latest-version'))
+        return new Response(JSON.stringify({'latest-version': 'v1.0.0'}), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        })
+      return new Response('ok', {status: 200})
+    })
+
+    const {ctx} = createCapturedCtx()
+    // Default URL is https://cliproxy.fro.bot — pass it explicitly
+    await cliproxyStatusAction({url: 'https://cliproxy.fro.bot'}, ctx)
+
+    expect(capturedManagementKeys).toContain('secret-ambient-key')
+  })
+
+  it('uses an explicit --key even when --url is a non-trusted host', async () => {
+    const capturedManagementKeys: string[] = []
+
+    globalThis.fetch = createFetchImplementation(async (url, init) => {
+      const hdrs = init?.headers
+      const key = hdrs instanceof Headers ? hdrs.get('x-management-key') : null
+      if (url.includes('/v0/management/') && key) capturedManagementKeys.push(key)
+
+      if (url.includes('/healthz')) return new Response('ok', {status: 200})
+      if (url.includes('/v0/management/config'))
+        return new Response('{}', {status: 200, headers: {'content-type': 'application/json'}})
+      if (url.includes('/v0/management/usage-queue'))
+        return new Response('[]', {status: 200, headers: {'content-type': 'application/json'}})
+      if (url.includes('/v0/management/latest-version'))
+        return new Response(JSON.stringify({'latest-version': 'v1.0.0'}), {
+          status: 200,
+          headers: {'content-type': 'application/json'},
+        })
+      return new Response('ok', {status: 200})
+    })
+
+    const {ctx} = createCapturedCtx()
+    await cliproxyStatusAction({url: 'https://other-cliproxy.example.com', key: 'explicit-key'}, ctx)
+
+    expect(capturedManagementKeys).toContain('explicit-key')
+  })
+
+  it('falls through to the no-key warning path when URL is untrusted and no --key given', async () => {
+    globalThis.fetch = createFetchImplementation(async url => {
+      if (url.includes('/healthz')) return new Response('ok', {status: 200})
+      return new Response('[]', {status: 200})
+    })
+
+    const {ctx, captured} = createCapturedCtx()
+    await cliproxyStatusAction({url: 'https://other-cliproxy.example.com'}, ctx)
+
+    const output = [...captured.stdout, ...captured.stderr].join('\n')
+    expect(output).toMatch(/CLIPROXY_MANAGEMENT_KEY|no key|skipping/i)
+  })
+})

package/src/commands/cliproxy/status.ts

@@ -385,7 +385,16 @@ export async function cliproxyStatusAction(options: StatusOptions, ctx: ActionCt
   try {
     const verbose = options.verbose === true
     const baseUrl = stripTrailingSlash(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
-    const managementKey = options.key ?? process.env.CLIPROXY_MANAGEMENT_KEY
+
+    // Trusted URL: the canonical configured/default host, trailing-slash-normalized.
+    // Ambient env keys must ONLY follow to this trusted destination to prevent
+    // secret exfiltration when an agent passes an attacker-controlled --url.
+    const trustedUrl = stripTrailingSlash(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL)
+    const urlIsExplicitlyOverridden = options.url !== undefined && baseUrl !== trustedUrl
+
+    // An explicit --key is always honored (operator knows what they're doing).
+    // An ambient env key is only forwarded when the resolved baseUrl is trusted.
+    const managementKey = options.key ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_MANAGEMENT_KEY)
 
     ctx.console.log('CLIProxyAPI status')
     ctx.console.log('')

package/src/commands/gateway/host.test.ts

@@ -58,7 +58,7 @@ describe('validateGatewayHost', () => {
 
   // ── Error message sanitization ──────────────────────────────────────────────
 
-  it('truncates the invalid value in the error message to ~30 chars', () => {
+  it('omits the rejected value entirely from the error message', () => {
     const longMalicious = `-oProxyCommand=${'A'.repeat(100)}`
     let message = ''
     try {
@@ -66,8 +66,24 @@ describe('validateGatewayHost', () => {
     } catch (error) {
       message = error instanceof Error ? error.message : String(error)
     }
-    // The excerpt in the message should not exceed 30 chars of the original value
+    // The value is never echoed (it may be a misdirected secret) — only the constraint is shown.
     expect(message).toContain('Invalid GATEWAY_HOST')
-    expect(message.length).toBeLessThan(longMalicious.length + 50)
+    expect(message).not.toContain('ProxyCommand')
+    expect(message).not.toContain('AAAA')
+  })
+
+  // ── Secret value redaction ───────────────────────────────────────────────────
+
+  it('does not echo the rejected value in the error message', () => {
+    const secretValue = 'AWS_SECRET_KEY=AKIA1234567890EXAMPLE'
+    let message = ''
+    try {
+      validateGatewayHost(secretValue)
+    } catch (error) {
+      message = error instanceof Error ? error.message : String(error)
+    }
+    expect(message).toContain('Invalid GATEWAY_HOST')
+    expect(message).not.toContain('AKIA1234567890EXAMPLE')
+    expect(message).not.toContain('AWS_SECRET_KEY')
   })
 })

package/src/commands/gateway/host.ts

@@ -13,7 +13,8 @@ const VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i
  * Rejects: empty strings, values starting with `-`, and anything containing
  * characters outside `[A-Za-z0-9.-]`.
  *
- * @throws {Error} with a sanitized excerpt of the invalid value.
+ * @throws {Error} when empty or not a valid hostname. The rejected value is
+ *   never included in the message (it may be a misdirected secret).
  * @returns The validated host string (unchanged).
  */
 export function validateGatewayHost(host: string): string {
@@ -22,9 +23,10 @@ export function validateGatewayHost(host: string): string {
   }
 
   if (!VALID_HOST_RE.test(host)) {
-    // Truncate to 30 chars and strip non-printable bytes before echoing back
-    const excerpt = host.slice(0, 30).replaceAll(/[^\u0020-\u007E]/g, '?')
-    throw new Error(`Invalid GATEWAY_HOST: "${excerpt}" — must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`}`)
+    // Do NOT echo the value — it may be a secret that was redirected via --key
+    throw new Error(
+      `Invalid GATEWAY_HOST: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`,
+    )
   }
 
   return host

package/src/commands/gateway/status.test.ts

@@ -481,3 +481,70 @@ describe('gatewayStatusAction — ctx capture (Tier-2)', () => {
     expect(captured.exit?.code).toBe(1)
   })
 })
+
+// ─── SSH error redaction — host value must not leak in returned error strings ──
+
+describe('getGatewayComposeStatus — SSH error redaction', () => {
+  it('does not include the resolved host value in the error when SSH fails', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+    const secretLookingHost = 'TOPSECRETHOSTNAME'
+
+    const mockSpawn = (_cmd: string[], _opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'}) => {
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(encoder.encode(''))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(encoder.encode(`ssh: Could not resolve hostname ${secretLookingHost}: Name or service not known`))
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(255),
+      }
+    }
+
+    const result = await getGatewayComposeStatus(secretLookingHost, mockSpawn)
+
+    expect(result.ok).toBe(false)
+    expect(result.error).toBeDefined()
+    expect(result.error).not.toContain(secretLookingHost)
+  })
+
+  it('does not leak the host even when OpenSSH lowercases it in stderr', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+    // A misdirected secret-shaped value passes the hostname regex and becomes the host;
+    // OpenSSH lowercases it in the "Could not resolve hostname" stderr line.
+    const secretHost = 'AKIAIOSFODNN7EXAMPLE'
+
+    const mockSpawn = (_cmd: string[], _opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'}) => {
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(
+              encoder.encode(`ssh: Could not resolve hostname ${secretHost.toLowerCase()}: Name or service not known`),
+            )
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(255),
+      }
+    }
+
+    const result = await getGatewayComposeStatus(secretHost, mockSpawn)
+
+    expect(result.ok).toBe(false)
+    expect(result.error).not.toContain(secretHost)
+    expect(result.error).not.toContain(secretHost.toLowerCase())
+  })
+})

package/src/commands/gateway/status.ts

@@ -1,11 +1,10 @@
 import type {goke} from 'goke'
 import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
-
 import {z} from 'zod'
 
+import {redactHost} from '../../lib/redact'
 // ─── Minimal ctx interface (subset of GokeExecutionContext used by this action) ─
-
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -128,10 +127,11 @@ export async function getGatewayComposeStatus(
   ])
 
   if (exitCode !== 0) {
+    const redacted = redactHost(stderrText.trim(), host) || 'unknown error'
     return {
       ok: false,
       services: [],
-      error: `SSH command failed (exit ${exitCode}): ${stderrText.trim() || 'unknown error'}`,
+      error: `SSH command failed (exit ${exitCode}): ${redacted}`,
     }
   }
 
@@ -140,7 +140,11 @@ export async function getGatewayComposeStatus(
   try {
     entries = parseComposePsOutput(stdoutText)
   } catch {
-    return {ok: false, services: [], error: `Failed to parse docker compose ps output: ${stdoutText.slice(0, 200)}`}
+    return {
+      ok: false,
+      services: [],
+      error: `Failed to parse docker compose ps output: ${redactHost(stdoutText.slice(0, 200), host)}`,
+    }
   }
 
   const services = parseComposePs(entries)

package/src/commands/mcp.test.ts

@@ -23,12 +23,9 @@
  * //   proc.kill()
  */
 
-import type {CallToolResult} from '@modelcontextprotocol/sdk/types.js'
-
 import {createMcpAction} from '@goke/mcp'
 import {Client} from '@modelcontextprotocol/sdk/client'
 import {InMemoryTransport} from '@modelcontextprotocol/sdk/inMemory.js'
-import {CallToolResultSchema} from '@modelcontextprotocol/sdk/types.js'
 import {afterAll, beforeAll, describe, expect, test} from 'bun:test'
 import {goke} from 'goke'
 
@@ -41,11 +38,20 @@ import {registerUmamiCommands} from './umami'
 
 // ─── Tool name constants ──────────────────────────────────────────────────────
 
-/** Derived from the production MCP_ALLOWLIST — spaces replaced by underscores. */
-const EXPECTED_TOOLS = [...MCP_ALLOWLIST].map(name => name.replaceAll(' ', '_')).sort()
+/**
+ * The MCP tool surface, pinned as an INDEPENDENT literal (deliberately NOT
+ * derived from MCP_ALLOWLIST) so allowlist drift surfaces as a test failure —
+ * per the Tier-1 test bar in packages/cli/AGENTS.md. Five read-only status tools.
+ */
+const EXPECTED_TOOLS = ['cliproxy_status', 'gateway_status', 'keeweb_status', 'status', 'umami_status'].sort()
 
-/** The 9 CLI-only commands that must NOT appear in the MCP tool list. */
+/**
+ * CLI-only commands that must NOT appear in the MCP tool list: the
+ * non-interactive/streaming-only commands plus the source-gated sensitive
+ * commands (mutating or secret-disclosing).
+ */
 const CLI_ONLY_TOOLS = [
+  // Non-interactive / streaming — excluded since before the source-gate change
   'cliproxy_deploy',
   'cliproxy_login',
   'cliproxy_open',
@@ -57,6 +63,13 @@ const CLI_ONLY_TOOLS = [
   'keeweb_open',
   'umami_deploy',
   'umami_logs',
+  // Source-gated sensitive commands (mutating or secret-disclosing)
+  'gateway_backup',
+  'cliproxy_keys_list',
+  'cliproxy_keys_add',
+  'cliproxy_keys_remove',
+  'cliproxy_config_get',
+  'cliproxy_config_set',
 ].sort()
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -73,14 +86,6 @@ function buildTestCli(): ReturnType<typeof goke> {
   return cli
 }
 
-/** Extract all text block content from a CallToolResult, joined by newline. */
-function allText(result: CallToolResult): string {
-  return result.content
-    .filter((block): block is {type: 'text'; text: string} => block.type === 'text')
-    .map(block => block.text)
-    .join('\n')
-}
-
 // ─── Suite ────────────────────────────────────────────────────────────────────
 
 describe('mcp integration (Tier-1, in-process)', () => {
@@ -123,286 +128,11 @@ describe('mcp integration (Tier-1, in-process)', () => {
     expect(names).toEqual(EXPECTED_TOOLS)
   })
 
-  test('cli-only commands are absent from the tool list', async () => {
+  test('source-gated sensitive commands are absent from the MCP tool list', async () => {
     const result = await client.listTools()
     const names = new Set(result.tools.map((t: {name: string}) => t.name))
     for (const excluded of CLI_ONLY_TOOLS) {
       expect(names.has(excluded)).toBe(false)
     }
   })
-
-  // ── Mode B contract: gateway_backup ───────────────────────────────────────
-  //
-  // gateway_backup reads GATEWAY_HOST before attempting any SSH call.
-  // When GATEWAY_HOST is unset the action exits synchronously with a
-  // well-known error message — no network contact is made.
-  // The MCP layer must wrap that failure as an error CallToolResult
-  // (isError: true) rather than throwing, and the content must contain
-  // the exact error message from gatewayBackupAction so we catch contract
-  // regressions if the message ever changes.
-
-  test('gateway_backup wraps missing-GATEWAY_HOST as an error CallToolResult with the known message', async () => {
-    const originalHost = process.env.GATEWAY_HOST
-
-    try {
-      // Delete GATEWAY_HOST to trigger the fast synchronous error path inside
-      // gatewayBackupAction — no SSH or network call is made.
-      delete process.env.GATEWAY_HOST
-
-      const rawResult = await client.callTool(
-        {
-          name: 'gateway_backup',
-          arguments: {},
-        },
-        CallToolResultSchema,
-      )
-
-      const result: CallToolResult = CallToolResultSchema.parse(rawResult)
-
-      // The MCP layer must surface the error as a content block, not a thrown exception.
-      expect(result.isError).toBe(true)
-      expect(result.content.length).toBeGreaterThan(0)
-
-      // The content must carry the exact contract-bearing error string from
-      // gatewayBackupAction. This assertion fails if the error message changes.
-      expect(allText(result)).toContain('Gateway host not set. Export GATEWAY_HOST before running backup.')
-    } finally {
-      if (originalHost === undefined) {
-        delete process.env.GATEWAY_HOST
-      } else {
-        process.env.GATEWAY_HOST = originalHost
-      }
-    }
-  })
-
-  // ── Mode C contract: cliproxy_keys_list ───────────────────────────────────
-  //
-  // Mode C: when a command returns structured data AND prints to stdout,
-  // the CallToolResult must contain BOTH a stdout text block AND a
-  // stringified return-value text block.
-  test('cliproxy_keys_list returns BOTH stdout block AND structured return block (Mode C contract)', async () => {
-    const originalFetch = globalThis.fetch
-    const originalKey = process.env.CLIPROXY_MANAGEMENT_KEY
-
-    try {
-      process.env.CLIPROXY_MANAGEMENT_KEY = 'test-management-key'
-
-      globalThis.fetch = (async (_url: string | URL | Request, _init?: RequestInit): Promise<Response> => {
-        return new Response(JSON.stringify(['fro-bot-test1', 'fro-bot-test2']), {
-          status: 200,
-          headers: {'content-type': 'application/json'},
-        })
-      }) as typeof fetch
-
-      const rawResult = await client.callTool(
-        {
-          name: 'cliproxy_keys_list',
-          arguments: {},
-        },
-        CallToolResultSchema,
-      )
-
-      const result: CallToolResult = CallToolResultSchema.parse(rawResult)
-
-      // Mode C contract: at least 2 content blocks (stdout text + structured return)
-      expect(result.content.length).toBeGreaterThanOrEqual(2)
-
-      const text = allText(result)
-
-      // One block must contain the formatted stdout (key names printed by the action)
-      expect(text).toContain('fro-bot-test1')
-
-      // One block must contain the stringified return value (JSON array of key names)
-      const hasStructuredReturn = result.content.some(block => {
-        if (block.type !== 'text') return false
-        try {
-          const parsed = JSON.parse(block.text) as unknown
-          return Array.isArray(parsed) && parsed.includes('fro-bot-test1') && parsed.includes('fro-bot-test2')
-        } catch {
-          return false
-        }
-      })
-      expect(hasStructuredReturn).toBe(true)
-    } finally {
-      globalThis.fetch = originalFetch
-      if (originalKey === undefined) {
-        delete process.env.CLIPROXY_MANAGEMENT_KEY
-      } else {
-        process.env.CLIPROXY_MANAGEMENT_KEY = originalKey
-      }
-    }
-  })
-
-  // ── Positional-arg routing: cliproxy_keys_add ─────────────────────────────
-  //
-  // The MCP inputSchema for cliproxy_keys_add has a single required property
-  // `key` (derived from the command's positional `<key>` argument). This test
-  // proves that goke routes the MCP argument value through to the action's
-  // positional parameter (apiKeyToAdd) by asserting the key name appears in
-  // the action's output text.
-  //
-  // Verified inputSchema (empirical): { properties: { key: { type: "string",
-  //   description: "Management API key…" }, url: { type: "string" } },
-  //   required: ["key"] }
-
-  test('cliproxy_keys_add routes the positional key argument through MCP', async () => {
-    const originalFetch = globalThis.fetch
-    const originalKey = process.env.CLIPROXY_MANAGEMENT_KEY
-
-    try {
-      process.env.CLIPROXY_MANAGEMENT_KEY = 'test-management-key'
-
-      globalThis.fetch = (async (_url: string | URL | Request, _init?: RequestInit): Promise<Response> => {
-        const method = typeof _init?.method === 'string' ? _init.method.toUpperCase() : 'GET'
-        if (method === 'GET') {
-          // Return empty current key list so the new key is not already present
-          return new Response(JSON.stringify([]), {
-            status: 200,
-            headers: {'content-type': 'application/json'},
-          })
-        }
-
-        // PUT response — the action ignores the body and logs the new count
-        return new Response(JSON.stringify(['tier1-test-key']), {
-          status: 200,
-          headers: {'content-type': 'application/json'},
-        })
-      }) as typeof fetch
-
-      const rawResult = await client.callTool(
-        {
-          name: 'cliproxy_keys_add',
-          // `key` is the positional <key> arg (the API key to add).
-          // Verified from listTools() inputSchema — required property.
-          arguments: {key: 'tier1-test-key'},
-        },
-        CallToolResultSchema,
-      )
-
-      const result: CallToolResult = CallToolResultSchema.parse(rawResult)
-
-      expect(result.isError).not.toBe(true)
-      // The action logs `Added key "tier1-test-key"` — presence proves the
-      // positional arg was correctly routed from the MCP call.
-      expect(allText(result)).toContain('tier1-test-key')
-    } finally {
-      globalThis.fetch = originalFetch
-      if (originalKey === undefined) {
-        delete process.env.CLIPROXY_MANAGEMENT_KEY
-      } else {
-        process.env.CLIPROXY_MANAGEMENT_KEY = originalKey
-      }
-    }
-  })
-
-  // ── Positional-arg routing: cliproxy_keys_remove ──────────────────────────
-  //
-  // The MCP inputSchema for cliproxy_keys_remove has a required property `key`
-  // (derived from the positional `<key>` argument). The action issues a DELETE
-  // request with `?value=<apiKeyToRemove>` and logs the response. The fetch mock
-  // echoes back the query-parameter value so we can assert it was routed correctly.
-  //
-  // Verified inputSchema (empirical): { properties: { key: { type: "string" },
-  //   url: { type: "string" } }, required: ["key"] }
-
-  test('cliproxy_keys_remove routes the positional key argument through MCP', async () => {
-    const originalFetch = globalThis.fetch
-    const originalKey = process.env.CLIPROXY_MANAGEMENT_KEY
-
-    try {
-      process.env.CLIPROXY_MANAGEMENT_KEY = 'test-management-key'
-
-      globalThis.fetch = (async (_url: string | URL | Request, _init?: RequestInit): Promise<Response> => {
-        // The action appends ?value=<apiKeyToRemove> — echo it back in the
-        // response body so the assertion can verify positional routing.
-        const urlStr = typeof _url === 'string' ? _url : _url instanceof URL ? _url.href : (_url as Request).url
-        const url = new URL(urlStr)
-        const removedKey = url.searchParams.get('value') ?? 'unknown'
-        return new Response(JSON.stringify({removed: removedKey}), {
-          status: 200,
-          headers: {'content-type': 'application/json'},
-        })
-      }) as typeof fetch
-
-      const rawResult = await client.callTool(
-        {
-          name: 'cliproxy_keys_remove',
-          // `key` is the positional <key> arg (the API key to remove).
-          // Verified from listTools() inputSchema — required property.
-          arguments: {key: 'tier1-test-remove-key'},
-        },
-        CallToolResultSchema,
-      )
-
-      const result: CallToolResult = CallToolResultSchema.parse(rawResult)
-
-      expect(result.isError).not.toBe(true)
-      // The response includes the echoed ?value= param — proves the positional
-      // arg was routed to the DELETE URL query parameter.
-      expect(allText(result)).toContain('tier1-test-remove-key')
-    } finally {
-      globalThis.fetch = originalFetch
-      if (originalKey === undefined) {
-        delete process.env.CLIPROXY_MANAGEMENT_KEY
-      } else {
-        process.env.CLIPROXY_MANAGEMENT_KEY = originalKey
-      }
-    }
-  })
-
-  // ── Positional-arg routing: cliproxy_config_set ───────────────────────────
-  //
-  // The MCP inputSchema for cliproxy_config_set has two required properties:
-  // `field` and `value` (both positional). The action PUT-s `{value: <parsed>}`
-  // to the field-specific endpoint and logs the response JSON. Returning the
-  // value in the mock response lets us assert both positionals were routed.
-  //
-  // Verified inputSchema (empirical): { properties: { field: { type: "string",
-  //   description: "Positional argument field" }, value: { type: "string",
-  //   description: "Positional argument value" }, url: …, key: … },
-  //   required: ["field","value"] }
-
-  test('cliproxy_config_set routes both positional arguments (field and value) through MCP', async () => {
-    const originalFetch = globalThis.fetch
-    const originalKey = process.env.CLIPROXY_MANAGEMENT_KEY
-
-    try {
-      process.env.CLIPROXY_MANAGEMENT_KEY = 'test-management-key'
-
-      globalThis.fetch = (async (_url: string | URL | Request, _init?: RequestInit): Promise<Response> => {
-        // Echo back the parsed body so we can assert the value was routed.
-        // The action sends {value: <parsedValue>}. We return it as-is.
-        const body = _init?.body
-        const parsed: unknown = body ? JSON.parse(String(body)) : {}
-        return new Response(JSON.stringify(parsed), {
-          status: 200,
-          headers: {'content-type': 'application/json'},
-        })
-      }) as typeof fetch
-
-      const rawResult = await client.callTool(
-        {
-          name: 'cliproxy_config_set',
-          // `field` and `value` are the positional args from `<field> <value>`.
-          // `proxy-url` is a string-type mutable field — no parsing needed.
-          arguments: {field: 'proxy-url', value: 'tier1-test-url'},
-        },
-        CallToolResultSchema,
-      )
-
-      const result: CallToolResult = CallToolResultSchema.parse(rawResult)
-
-      expect(result.isError).not.toBe(true)
-      // The response echoes back {value: "tier1-test-url"} — presence of the
-      // value proves positional routing worked end-to-end.
-      expect(allText(result)).toContain('tier1-test-url')
-    } finally {
-      globalThis.fetch = originalFetch
-      if (originalKey === undefined) {
-        delete process.env.CLIPROXY_MANAGEMENT_KEY
-      } else {
-        process.env.CLIPROXY_MANAGEMENT_KEY = originalKey
-      }
-    }
-  })
 })

package/src/commands/mcp.ts

@@ -4,6 +4,7 @@ import {createMcpAction} from '@goke/mcp'
 /**
  * Commands intentionally excluded from MCP exposure (not in MCP_ALLOWLIST):
  *
+ * Infrastructure / streaming (deferred or not MCP-suitable):
  * - `gateway deploy`   — subprocess streaming (Bun.spawn with stdout: 'inherit'), deferred to MCP v2 (#291)
  * - `cliproxy deploy`  — subprocess streaming, deferred to MCP v2 (#291)
  * - `keeweb deploy`    — subprocess streaming, deferred to MCP v2 (#291)
@@ -15,16 +16,23 @@ import {createMcpAction} from '@goke/mcp'
  * - `keeweb open`      — host-machine side effect (spawns local browser, requires user intent)
  * - `umami deploy`     — intentionally CLI-only: mutates live deployment and requires environment approval
  * - `umami logs`       — intentionally CLI-only: streams logs that may emit sensitive data (DB passwords, app secrets)
+ *
+ * Source-gated sensitive commands (security — CLI-only, never MCP-exposed):
+ * - `gateway backup`       — secret-bearing: writes CA private key material to a tarball; CLI-only
+ * - `cliproxy keys list`   — secret-disclosing: prints live bearer tokens in plaintext; CLI-only
+ * - `cliproxy keys add`    — mutating: creates live bearer tokens on the proxy; CLI-only
+ * - `cliproxy keys remove` — mutating: revokes live bearer tokens on the proxy; CLI-only
+ * - `cliproxy config get`  — secret-disclosing: dumps management config incl. management key; CLI-only
+ * - `cliproxy config set`  — mutating: overwrites CLIProxyAPI runtime config; CLI-only
+ *
+ * A defense-in-depth backstop also denies these in opencode.jsonc `permission`
+ * so that even if MCP_ALLOWLIST were mistakenly re-expanded, opencode's native
+ * tool permission check would block execution. Both layers are enforced by
+ * the `gates every sensitive infra MCP tool` test in conventions.test.ts.
  */
 export const MCP_ALLOWLIST: ReadonlySet<string> = new Set([
   'gateway status',
-  'gateway backup',
   'cliproxy status',
-  'cliproxy keys list',
-  'cliproxy keys add',
-  'cliproxy keys remove',
-  'cliproxy config get',
-  'cliproxy config set',
   'keeweb status',
   'umami status',
   'status',

package/src/commands/umami/host.test.ts

@@ -48,7 +48,7 @@ describe('validateUmamiHost', () => {
     expect(() => validateUmamiHost('')).toThrow('Invalid UMAMI_DOMAIN')
   })
 
-  it('truncates the invalid value in the error message to ~30 chars', () => {
+  it('omits the rejected value entirely from the error message', () => {
     const longMalicious = `-oProxyCommand=${'A'.repeat(100)}`
     let message = ''
     try {
@@ -56,7 +56,24 @@ describe('validateUmamiHost', () => {
     } catch (error) {
       message = error instanceof Error ? error.message : String(error)
     }
+    // The value is never echoed (it may be a misdirected secret) — only the constraint is shown.
     expect(message).toContain('Invalid UMAMI_DOMAIN')
-    expect(message.length).toBeLessThan(longMalicious.length + 50)
+    expect(message).not.toContain('ProxyCommand')
+    expect(message).not.toContain('AAAA')
+  })
+
+  // ── Secret value redaction ───────────────────────────────────────────────────
+
+  it('does not echo the rejected value in the error message', () => {
+    const secretValue = 'AWS_SECRET_KEY=AKIA1234567890EXAMPLE'
+    let message = ''
+    try {
+      validateUmamiHost(secretValue)
+    } catch (error) {
+      message = error instanceof Error ? error.message : String(error)
+    }
+    expect(message).toContain('Invalid UMAMI_DOMAIN')
+    expect(message).not.toContain('AKIA1234567890EXAMPLE')
+    expect(message).not.toContain('AWS_SECRET_KEY')
   })
 })

package/src/commands/umami/host.ts

@@ -13,7 +13,8 @@ const VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i
  * Rejects: empty strings, values starting with `-`, and anything containing
  * characters outside `[A-Za-z0-9.-]`.
  *
- * @throws {Error} with a sanitized excerpt of the invalid value.
+ * @throws {Error} when empty or not a valid hostname. The rejected value is
+ *   never included in the message (it may be a misdirected secret).
  * @returns The validated host string (unchanged).
  */
 export function validateUmamiHost(host: string): string {
@@ -22,9 +23,10 @@ export function validateUmamiHost(host: string): string {
   }
 
   if (!VALID_HOST_RE.test(host)) {
-    // Truncate to 30 chars and strip non-printable bytes before echoing back
-    const excerpt = host.slice(0, 30).replaceAll(/[^\u0020-\u007E]/g, '?')
-    throw new Error(`Invalid UMAMI_DOMAIN: "${excerpt}" — must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`}`)
+    // Do NOT echo the value — it may be a secret that was redirected via --key
+    throw new Error(
+      `Invalid UMAMI_DOMAIN: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`,
+    )
   }
 
   return host

package/src/commands/umami/status.test.ts

@@ -385,3 +385,68 @@ describe('status command', () => {
     expect(captured.exit).toBeNull()
   })
 })
+
+// ─── SSH error redaction — host value must not leak in returned error strings ──
+
+describe('getUmamiComposeStatus — SSH error redaction', () => {
+  it('does not include the resolved host value in the error when SSH fails', async () => {
+    const {getUmamiComposeStatus} = await import('./status')
+    const secretLookingHost = 'TOPSECRETHOSTNAME'
+
+    const mockSpawn = (_cmd: string[], _opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'}) => {
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(encoder.encode(''))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(encoder.encode(`ssh: Could not resolve hostname ${secretLookingHost}: Name or service not known`))
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(255),
+      }
+    }
+
+    const result = await getUmamiComposeStatus(secretLookingHost, mockSpawn)
+
+    expect(result.ok).toBe(false)
+    expect(result.error).toBeDefined()
+    expect(result.error).not.toContain(secretLookingHost)
+  })
+
+  it('does not leak the host even when OpenSSH lowercases it in stderr', async () => {
+    const {getUmamiComposeStatus} = await import('./status')
+    const secretHost = 'AKIAIOSFODNN7EXAMPLE'
+
+    const mockSpawn = (_cmd: string[], _opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'}) => {
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.enqueue(
+              encoder.encode(`ssh: Could not resolve hostname ${secretHost.toLowerCase()}: Name or service not known`),
+            )
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(255),
+      }
+    }
+
+    const result = await getUmamiComposeStatus(secretHost, mockSpawn)
+
+    expect(result.ok).toBe(false)
+    expect(result.error).not.toContain(secretHost)
+    expect(result.error).not.toContain(secretHost.toLowerCase())
+  })
+})

package/src/commands/umami/status.ts

@@ -1,9 +1,9 @@
 import type {goke} from 'goke'
 import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
-
 import {z} from 'zod'
 
+import {redactHost} from '../../lib/redact'
 import {validateUmamiHost} from './host'
 
 declare const process: {
@@ -124,7 +124,7 @@ export async function getUmamiComposeStatus(host: string, spawn: SpawnFn = defau
     return {
       ok: false,
       services: [],
-      error: `SSH command failed (exit ${exitCode}): ${stderrText.trim() || 'unknown error'}`,
+      error: `SSH command failed (exit ${exitCode}): ${redactHost(stderrText.trim(), host) || 'unknown error'}`,
     }
   }
 
@@ -133,7 +133,11 @@ export async function getUmamiComposeStatus(host: string, spawn: SpawnFn = defau
   try {
     entries = parseComposePsOutput(stdoutText)
   } catch {
-    return {ok: false, services: [], error: `Failed to parse docker compose ps output: ${stdoutText.slice(0, 200)}`}
+    return {
+      ok: false,
+      services: [],
+      error: `Failed to parse docker compose ps output: ${redactHost(stdoutText.slice(0, 200), host)}`,
+    }
   }
 
   const services = parseComposePs(entries)

package/src/conventions.test.ts

@@ -1,11 +1,44 @@
 import {relative, resolve} from 'node:path'
 import {describe, expect, it} from 'bun:test'
 import {parse as parseYaml} from 'yaml'
+import {MCP_ALLOWLIST} from './commands/mcp'
 
 const REPO_ROOT = resolve(import.meta.dir, '../../..')
 const INTERNAL_ORGS = new Set(['marcusrbrown'])
 const ALLOWED_SHELL_SCRIPTS = new Set(['apps/keeweb/deploy.sh'])
 
+// ---------------------------------------------------------------------------
+// MCP drift-guard: sensitive tool set (two-layer security model)
+// ---------------------------------------------------------------------------
+//
+// These 6 commands are source-gated: they are NOT in MCP_ALLOWLIST and are
+// therefore never registered as MCP tools. They remain CLI-only.
+//
+// WHY each is source-gated (primary layer — MCP_ALLOWLIST exclusion):
+//   cliproxy keys add    — mutating: creates live bearer tokens on the proxy
+//   cliproxy keys remove — mutating: revokes live bearer tokens
+//   cliproxy config set  — mutating: overwrites CLIProxyAPI runtime config
+//   gateway backup       — secret-bearing: writes CA private key material to a tarball
+//   cliproxy keys list   — secret-disclosing: prints live bearer tokens in plaintext
+//   cliproxy config get  — secret-disclosing: dumps management config incl. management key
+//
+// Defense-in-depth (secondary layer — opencode.jsonc `permission: deny`):
+// Even if MCP_ALLOWLIST were mistakenly re-expanded, opencode's native tool
+// permission check provides a backstop that denies these tool calls centrally
+// before execution. Both layers must stay in sync; the test below enforces it.
+//
+// A conventions test below asserts every entry (a) is NOT in MCP_ALLOWLIST
+// (source-gated out) and (b) is still denied in opencode.jsonc under the
+// prefixed tool id (defense-in-depth backstop).
+const SENSITIVE_MCP_COMMANDS: readonly string[] = [
+  'cliproxy keys add',
+  'cliproxy keys remove',
+  'cliproxy config set',
+  'gateway backup',
+  'cliproxy keys list',
+  'cliproxy config get',
+]
+
 // Accepted version-comment forms on SHA-pinned `uses:` lines:
 //   # v6.0.2                        (semver tag)
 //   # renovate-changesets@0.2.31    (scoped release tag)
@@ -242,6 +275,53 @@ describe('repo conventions', () => {
     const offenders = files.map(f => relative(REPO_ROOT, f)).filter(f => !ALLOWED_SHELL_SCRIPTS.has(f))
     expect(offenders).toEqual([])
   })
+
+  it('gates every sensitive infra MCP tool in opencode.jsonc', async () => {
+    // Parse opencode.jsonc tolerantly: it uses JSONC syntax (// line comments,
+    // trailing commas). Strategy:
+    //   1. Strip full-line comments — lines whose first non-whitespace is `//`.
+    //      This avoids breaking the `https://` in the $schema string value.
+    //   2. Strip trailing commas before `}` or `]`.
+    //   3. JSON.parse the result.
+    const jsoncText = await Bun.file(resolve(REPO_ROOT, 'opencode.jsonc')).text()
+    const stripped = jsoncText
+      .split('\n')
+      .map(line => (/^\s*\/\//.test(line) ? '' : line))
+      .join('\n')
+      .replaceAll(/,(\s*[}\]])/g, '$1')
+    const opencode = JSON.parse(stripped) as {permission?: Record<string, unknown>}
+
+    // Parse sanity: permission block must be present (catches a broken parse).
+    // opencode permission-checks MCP tool calls via the `permission` map (tool ids
+    // `<server>_<tool>`); we assert the canonical `permission: "deny"` form here.
+    const permission = opencode.permission ?? {}
+    expect(Object.keys(permission).length).toBeGreaterThan(0)
+
+    const violations: string[] = []
+    for (const cmd of SENSITIVE_MCP_COMMANDS) {
+      // (a) Primary gate: the command must NOT be in MCP_ALLOWLIST (source-gated out).
+      //     If someone re-adds it to the allowlist, this catches the regression immediately.
+      if (MCP_ALLOWLIST.has(cmd)) {
+        violations.push(
+          `'${cmd}' is in SENSITIVE_MCP_COMMANDS AND in MCP_ALLOWLIST — source-gate regression: remove it from MCP_ALLOWLIST`,
+        )
+      }
+      // (b) Defense-in-depth backstop: the tool must still be denied in opencode.jsonc.
+      //     This catches the case where MCP_ALLOWLIST is mistakenly re-expanded.
+      //     The infra MCP server converts command names to tool names with underscores,
+      //     and OpenCode prefixes with the server name, giving "infra_<underscored>".
+      const toolId = `infra_${cmd.replaceAll(' ', '_')}`
+      if (permission[toolId] !== 'deny') {
+        violations.push(
+          `${toolId}: not denied in opencode.jsonc permission (found: ${JSON.stringify(permission[toolId])}) — defense-in-depth backstop missing`,
+        )
+      }
+    }
+    expect(
+      violations,
+      `Sensitive infra MCP tools must be source-gated (not in MCP_ALLOWLIST) and denied in opencode.jsonc:\n${violations.join('\n')}`,
+    ).toEqual([])
+  })
 })
 
 // ---------------------------------------------------------------------------

package/src/lib/redact.ts

@@ -0,0 +1,21 @@
+/**
+ * Redact every occurrence of a host value from text, case-insensitively.
+ *
+ * Used to scrub a resolved SSH host out of error output before it surfaces to an
+ * MCP consumer. The host can be a misdirected secret (an agent may point the
+ * `--key` env-var selector at, e.g., `AWS_SECRET_ACCESS_KEY`), so its value must
+ * never appear in returned errors.
+ *
+ * Two subtleties this handles that a plain `replaceAll(host, ...)` does not:
+ *   1. OpenSSH lowercases the hostname in "Could not resolve hostname <name>"
+ *      stderr, so the match must be case-insensitive.
+ *   2. Validated hosts contain `.` and `-`, which are regex-significant, so the
+ *      host is escaped before building the matcher (no over-redaction).
+ *
+ * An empty/falsy host is a no-op (an empty matcher would match everywhere).
+ */
+export function redactHost(text: string, host: string): string {
+  if (!host) return text
+  const escaped = host.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
+  return text.replaceAll(new RegExp(escaped, 'gi'), '<host>')
+}