@mycadet/assistant 0.12.9 → 0.12.10

package/src/__tests__/credential-health-service.test.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setCloudAssistantId } from "../config/env.js";
 import { useFaultableSecureKeyMap } from "./helpers/secure-keys.js";
 
 // ── Mutable state for mocks ──────────────────────────────────────────
@@ -266,6 +267,7 @@ describe("credential-health-service", () => {
     managedPingOutcome = { kind: "status", status: 200 };
     assistantKeyVerdict = "valid";
     cloudClientAvailable = true;
+    setCloudAssistantId(undefined);
   });
 
   test("returns empty report when no providers exist", async () => {
@@ -780,13 +782,20 @@ describe("credential-health-service", () => {
     // carries the repair.
     const assistantKeyResult = checkAssistantApiKey;
 
-    test("is missing_token when no key is stored, connected or not", async () => {
+    test("is not reported when the workspace was never connected", async () => {
+      expect(await assistantKeyResult()).toBeNull();
+    });
+
+    test("is missing_token when a cloud identity exists without a key", async () => {
+      setCloudAssistantId("11111111-2222-4333-8444-555555555555");
+
       const result = await assistantKeyResult();
       expect(result!.status).toBe("missing_token");
       expect(result!.canAutoRecover).toBe(true);
     });
 
     test("is healthy when the cloud accepts the stored key", async () => {
+      setCloudAssistantId("11111111-2222-4333-8444-555555555555");
       secureKeyValues.set(KEY, "stored-key");
       assistantKeyVerdict = "valid";
 
@@ -794,6 +803,7 @@ describe("credential-health-service", () => {
     });
 
     test("is revoked when the cloud rejects the stored key", async () => {
+      setCloudAssistantId("11111111-2222-4333-8444-555555555555");
       secureKeyValues.set(KEY, "stored-key");
       assistantKeyVerdict = "rejected";
 
@@ -809,6 +819,7 @@ describe("credential-health-service", () => {
     // error, transport failure) must degrade to `unreachable`, which the
     // heartbeat drops before notifying.
     test("an unsettled platform answer is unreachable, never revoked", async () => {
+      setCloudAssistantId("11111111-2222-4333-8444-555555555555");
       secureKeyValues.set(KEY, "stored-key");
       assistantKeyVerdict = "unknown";
 
@@ -816,12 +827,14 @@ describe("credential-health-service", () => {
     });
 
     test("an unreadable credential store is unreachable, never revoked", async () => {
+      setCloudAssistantId("11111111-2222-4333-8444-555555555555");
       markUnreachable(KEY);
 
       expect((await assistantKeyResult())!.status).toBe("unreachable");
     });
 
     test("is unreachable when the cloud client cannot be built", async () => {
+      setCloudAssistantId("11111111-2222-4333-8444-555555555555");
       secureKeyValues.set(KEY, "stored-key");
       cloudClientAvailable = false;
 

package/src/__tests__/credential-record-retire.test.ts

@@ -21,7 +21,7 @@ import {
   setCredentialRecordBackend,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
-import { getDataDir } from "../util/platform.js";
+import { getDataDir } from "../util/layout.js";
 
 function leftoverPath(): string {
   return join(getDataDir(), "credentials", "metadata.json");

package/src/__tests__/credential-record-write-through.test.ts

@@ -11,7 +11,7 @@ import {
   setCredentialRecordBackend,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
-import { getDataDir } from "../util/platform.js";
+import { getDataDir } from "../util/layout.js";
 
 function makeBackend(): CredentialRecordBackend & {
   store: Map<string, CredentialRecord>;

package/src/__tests__/credential-security-invariants.test.ts

@@ -142,151 +142,6 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
     );
     expect(browserSrc).not.toContain("getCredentialValue");
   });
-
-  test("secure-keys is only imported by authorized modules", () => {
-    // Hard boundary: only these production files may import from secure-keys.
-    // Any new import must be reviewed for secret-leak risk and added here.
-    const ALLOWED_IMPORTERS = new Set([
-      "credential-execution/prompted-credential.ts", // shared prompt-action persistence (stores secret via setSecureKeyAsync)
-      "daemon/chat-credential-redaction.ts", // chat sentinel enrichment — scoped read ONLY of credentials a `credentials reveal` command in the same turn already printed to stdout; value byte-compared at persist and discarded, never persisted or logged
-
-      "tools/credentials/broker.ts", // brokered credential access
-      "tools/network/web-search.ts", // web search API key lookup
-      "tools/network/web-fetch.ts", // web fetch provider (Firecrawl) API key lookup
-      "daemon/handlers/config-telegram.ts", // Telegram bot token management
-      "daemon/handlers/config-vercel.ts", // Vercel API token management
-      "runtime/routes/integrations/twilio.ts", // Twilio credential management (HTTP control-plane)
-      "security/token-manager.ts", // OAuth token refresh flow
-      "tools/network/script-proxy/session-manager.ts", // proxy credential injection at runtime
-      "calls/call-domain.ts", // caller identity resolution (user phone number lookup)
-      "calls/twilio-config.ts", // call infrastructure credential lookup
-      "calls/twilio-provider.ts", // call infrastructure credential lookup
-      "calls/twilio-rest.ts", // Twilio REST API credential lookup
-      "calls/fish-audio-client.ts", // Fish Audio TTS API key lookup
-      "runtime/channel-invite-transports/telegram.ts", // Telegram invite transport bot token lookup
-      "cli/lib/daemon-credential-client.ts", // CLI-to-daemon credential routing intermediary
-      "messaging/providers/telegram-bot/adapter.ts", // Telegram bot token lookup for connectivity check
-      "messaging/providers/slack/api.ts", // Slack Web API client (bot token for direct sends)
-      "messaging/providers/telegram-bot/api.ts", // Telegram Bot API client (bot token for direct sends)
-      "messaging/providers/discord/api.ts", // Discord REST client (bot token for direct sends)
-      "runtime/channel-readiness-service.ts", // channel readiness probes for Telegram connectivity
-      "telegram/webhook-health.ts", // Telegram webhook health sweep — reads bot_token to call getWebhookInfo (Bot API authenticates via the token in the URL path) and checks webhook_secret for existence only; neither value is logged, persisted, or returned
-      "messaging/providers/whatsapp/adapter.ts", // WhatsApp credential lookup for connectivity check
-      "messaging/providers/whatsapp/api.ts", // WhatsApp Cloud API client (bot token for direct sends)
-      "messaging/providers/slack/adapter.ts", // Slack bot token lookup for Socket Mode connectivity check
-      "credential-health/credential-health-service.ts", // proactive credential health monitoring
-      "providers/inference/credential-slot-repair.ts", // boot repair: copies the shared openai-compatible slot value into per-connection slots (get/set of provider API keys only; values never logged or returned)
-      "runtime/routes/inference-provider-connection-routes.ts", // connection delete removes its dedicated per-connection key slot (deleteSecureKeyAsync only; no reads)
-      "daemon/handlers/config-slack-channel.ts", // Slack channel config credential management
-      "daemon/handlers/config-discord-channel.ts", // Discord channel bot token management
-      "providers/cloud-proxy/context.ts", // cloud proxy API key lookup for provider initialization
-      "cloud/client.ts", // cloud client credential store fallback for standalone CLI auth
-      "mcp/mcp-header-store.ts", // MCP static auth header persistence (credential store CRUD + legacy migration)
-      "mcp/mcp-oauth-provider.ts", // MCP OAuth token/client/discovery persistence
-      "messaging/providers/slack/auth.ts", // canonical Slack auth resolver (bot/user token lookup for adapter + routes)
-      "mcp/client.ts", // MCP client cached-token lookup
-      "oauth/token-persistence.ts", // OAuth token persistence (set/delete tokens)
-      "oauth/credential-token-resolver.ts", // centralized access-token key resolution for OAuth and manual-token providers
-      "oauth/connection-resolver.ts", // resolve OAuthConnection from oauth-store (access_token lookup)
-      "runtime/routes/secret-routes.ts", // HTTP secret management routes (set/delete secrets)
-      "acp/acp-claude-oauth.ts", // Connect Claude OAuth token vault-store helper (stores access token plus broker-owned refresh/expiry companions via setSecureKeyAsync)
-      "runtime/routes/acp-claude-auth-routes.ts", // Connect Claude Code daemon OAuth flow (stores OAuth token in vault)
-      "runtime/routes/migration-routes.ts", // migration import credential restore
-      "daemon/conversation-messaging.ts", // credential storage during session messaging
-      "runtime/routes/settings-routes.ts", // settings routes OAuth credential lookup (client_secret)
-      "oauth/oauth-store.ts", // OAuth provider disconnect (delete stored tokens)
-      "oauth/manual-token-connection.ts", // manual-token provider backfill (credential store existence check)
-      "workspace/provider-commit-message-generator.ts", // commit message generation provider key lookup
-      "cli/commands/image-generation.ts", // CLI image-generation command API key lookup
-      "config/bundled-skills/image-studio/tools/media-generate-image.ts", // image generation tool API key lookup
-      "config/bundled-skills/media-processing/tools/analyze-keyframes.ts", // keyframe analysis tool API key lookup
-      "providers/registry.ts", // provider registry API key lookup for initialization
-      "providers/inference/resolve-auth.ts", // provider_connection auth resolver (api_key path reads vault, mirrors registry.ts)
-      "providers/inference/codex-token-refresh.ts", // Codex OAuth token refresh (reads/writes access_token, refresh_token, expires_at)
-      "providers/inference/service-account-token.ts", // Google service-account JWT exchange (reads service-account JSON, writes token_cache blob)
-      "providers/inference/chatgpt-subscription-credentials.ts", // ChatGPT subscription sign-in token storage, shared by the daemon routes and the CLI (setSecureKeyAsync only; no reads)
-      "providers/provider-availability.ts", // provider availability API key check
-      "media/image-credentials.ts", // shared image-gen credential resolver (provider API key lookup)
-      "persistence/embeddings/embedding-backend.ts", // embedding backend API key lookup
-      "persistence/llm-request-log-source-clickhouse.ts", // ClickHouse read source — lazy lookup of clickhouse:url + clickhouse:password + cadet:platform_assistant_id for self-scoped mirror reads
-      "persistence/llm-request-log-sink-clickhouse.ts", // ClickHouse write sink — lazy lookup of clickhouse:url + clickhouse:password + cadet:platform_assistant_id for self-scoped log writes
-      "persistence/compaction-log-store-clickhouse.ts", // ClickHouse compaction log writer — lazy lookup of clickhouse:url + clickhouse:password + cadet:platform_assistant_id for self-scoped event writes
-      "config/cloud-identity.ts", // assistant API key lookup for platform identity validate
-      "config/cloud-rehydration.ts", // startup rehydration of platform base URL from the credential store and ids from platform validate
-      "workspace/migrations/006-services-config.ts", // services config migration reads provider API keys
-      "workspace/migrations/018-rekey-compound-credential-keys.ts", // re-key compound credential storage keys
-      "daemon/conversation-process.ts", // masked provider key display
-      "daemon/handlers/config-model.ts", // masked provider key display
-      "providers/speech-to-text/resolve.ts", // STT provider API key lookup
-      "calls/telephony-tts-capability.ts", // TTS provider API key availability check (presence only)
-      "credential-execution/ces-runtime.ts", // CES runtime owns the daemon CES connection (setCesClient/onCesClientChanged/reconnect wiring at startup)
-      "runtime/routes/credential-prompt-routes.ts", // Route for secure credential prompt (stores secret via setSecureKeyAsync)
-      "runtime/routes/credential-routes.ts", // CLI credential management routes (CLI-migrated to IPC)
-      "runtime/routes/sanity-routes.ts", // Sanity connect/discover routes (reads stored api_token from credential store)
-      "runtime/routes/cloud-routes.ts", // CLI platform connect/disconnect/status routes (CLI-migrated to IPC)
-      "runtime/routes/roadmap-routes.ts", // signs public-roadmap calls with the assistant API key (outbound Authorization header only; the value never reaches a response, a log, or the CLI process)
-      "inbound/cloud-callback-registration.ts", // managed API key lookup for callback registration
-      "tts/providers/elevenlabs-provider.ts", // ElevenLabs TTS API key lookup
-      "tts/providers/deepgram-provider.ts", // Deepgram TTS API key lookup
-      "tts/providers/xai-provider.ts", // xAI TTS API key lookup
-      "credential-health/credential-health-service.ts", // credential health check reads access tokens for liveness pings
-      "cli/commands/keys.ts", // CLI provider key management
-      "cli/commands/oauth/connect.ts", // CLI OAuth connect stored-secret verification
-      "runtime/routes/identity-routes.ts", // health/readyz endpoint checks CES connectivity via getCesClient
-      "tools/executor.ts", // CES approval bridge resolves the CES RPC client via getCesClient
-      "tools/network/web-fetch.ts", // Firecrawl /scrape BYOK fetch provider API key lookup (firecrawl provider key)
-      "workspace/default-provider-ensure.ts", // legacy anthropic echo disambiguation (vault key presence check)
-      "providers/inference/connection-availability.ts", // shared (provider, connection) availability status (credential presence check only; value never leaves the helper)
-      "plugin-api/resolve-credential.ts", // plugin-facing resolveCredential: reveal-equivalent plaintext read, scoped to the in-context plugin's own service
-      "tools/credentials/store.ts", // shared credential write path (setSecureKeyAsync only; no reads) behind credentials/set and plugin-facing storeCredential
-      "email/byo-email-credential.ts", // BYO email provider configuration check (credential presence only; value never leaves the helper)
-    ]);
-
-    const thisDir = dirname(fileURLToPath(import.meta.url));
-    const srcDir = resolve(thisDir, "..");
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { readdirSync, statSync } = require("node:fs");
-
-    // Recursively collect all .ts files in src/ (excluding __tests__)
-    function collectTsFiles(dir: string, files: string[] = []): string[] {
-      for (const entry of readdirSync(dir)) {
-        const full = join(dir, entry);
-        if (entry === "__tests__" || entry === "node_modules") {
-          continue;
-        }
-        const s = statSync(full);
-        if (s.isDirectory()) {
-          collectTsFiles(full, files);
-        } else if (
-          entry.endsWith(".ts") &&
-          !entry.endsWith(".d.ts") &&
-          !entry.endsWith(".test.ts")
-        ) {
-          files.push(full);
-        }
-      }
-      return files;
-    }
-
-    const allFiles = collectTsFiles(srcDir);
-    const unauthorizedImporters: string[] = [];
-
-    for (const filePath of allFiles) {
-      const content = readFileSync(filePath, "utf-8");
-      // Check for any import from the secure-keys module (static import, dynamic import(), or require())
-      if (
-        content.match(/from\s+['"].*secure-keys/) ||
-        content.match(/(?:import|require)\s*\(\s*['"].*secure-keys/)
-      ) {
-        const relative = filePath.slice(srcDir.length + 1);
-        if (!ALLOWED_IMPORTERS.has(relative)) {
-          unauthorizedImporters.push(relative);
-        }
-      }
-    }
-
-    expect(unauthorizedImporters).toEqual([]);
-  });
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/custom-profile-ensure.test.ts

@@ -110,7 +110,7 @@ describe("ensureCompleteCustomProfiles", () => {
       llm: {
         default: distinctiveDefault,
         profiles: {
-          balanced: { source: "managed", status: "disabled" },
+          balanced: { provider: "cadet", status: "disabled" },
           ab: {
             source: "user",
             mix: [

package/src/__tests__/default-profile-catalog-fallback.test.ts

@@ -25,7 +25,6 @@ import {
   getEffectiveProfile,
   getEffectiveProfiles,
   getEffectiveProfilesForProvider,
-  INVARIANT_PROFILE_NAMES,
   MANAGED_PROFILE_NAMES,
   MANAGED_PROFILE_TEMPLATES,
   PROFILE_IMPLS,
@@ -51,7 +50,6 @@ describe("fallbackProfile pointers on the cadet column", () => {
       const backup = CODE_DEFAULT_PROFILE_ENTRIES[FALLBACK_PROFILE_BY_KEY[key]];
       expect(backup).toBeDefined();
       expect(backup.provider).toBe("cadet");
-      expect(backup.source).toBe("managed");
       // Single hop: a backup never declares a fallback of its own.
       expect(backup.fallbackProfile).toBeUndefined();
     }
@@ -106,7 +104,6 @@ describe("managed-column-only scoping", () => {
     for (const key of BACKUP_PROFILE_KEYS) {
       expect(effective[key]).toBeDefined();
       expect(effective[key]?.provider).toBe("cadet");
-      expect(effective[key]?.source).toBe("managed");
     }
     // The seeder inserts missing managed keys in MANAGED_PROFILE_TEMPLATES
     // order, which is what places backups after the primaries in
@@ -161,13 +158,13 @@ describe("managed-column-only scoping", () => {
   test("a persisted managed stub does not resurrect a backup off the cloud column", () => {
     // A `config get` -> `config set` round-trip on a cloud install can
     // leave a thin managed stub for a backup in `llm.profiles`
-    // (`normalizeCloudProfileWrites`). The stub is the workspace's slot for
+    // The stub is the workspace's slot for
     // a code-owned body, not a profile, so once the column has no body behind
     // it the name must stop being listed rather than resolve to a
     // providerless entry the pickers would offer and `LLMSchema` would
     // reject.
     const workspace: Record<string, ProfileEntry> = {
-      "balanced-backup": { source: "managed" },
+      "balanced-backup": { provider: "cadet" },
     };
     for (const provider of ["anthropic", "chatgpt"] as const) {
       const effective = getEffectiveProfilesForProvider(
@@ -196,7 +193,6 @@ describe("managed-column-only scoping", () => {
     // that name and keeps its own body.
     const workspace: Record<string, ProfileEntry> = {
       "balanced-backup": {
-        source: "user",
         provider: "anthropic",
         model: "claude-opus-4-7",
       },
@@ -237,15 +233,14 @@ describe("effective-profile machinery", () => {
     // label/status/topP whitelist from a cloud stub, and not a user-owned
     // shadow. Disabling a backup through a hand-edited config would strand
     // the primary's fallback exactly when it is needed.
-    for (const source of ["managed", "user"] as const) {
+    {
       const workspace: Record<string, ProfileEntry> = {
         "balanced-backup": {
-          source,
+          provider: "cadet",
           label: "My Backup",
           status: "disabled",
           topP: 0.7,
           // Stale content drift on disk must lose to the code default body.
-          provider: "anthropic",
           model: "claude-sonnet-4-6",
           maxTokens: 1,
         },
@@ -261,14 +256,9 @@ describe("effective-profile machinery", () => {
     }
   });
 
-  test("backup profiles are delete-protected like the other managed defaults", () => {
-    // Membership in these sets is what wires the route-level deletion
-    // rejection (`rejectCloudProfileDeletion`, `handleCreateProfile`) and
-    // the commitConfigWrite invariant guard
-    // (`assertInvariantProfilesPreserved`).
+  test("backup names are reserved like the other managed defaults", () => {
     for (const key of BACKUP_PROFILE_KEYS) {
       expect(MANAGED_PROFILE_NAMES.has(key)).toBe(true);
-      expect(INVARIANT_PROFILE_NAMES.has(key)).toBe(true);
     }
   });
 });

package/src/__tests__/deterministic-verification-control-plane.test.ts

@@ -150,7 +150,6 @@ describe("Call session mode metadata", () => {
 
     const { conversationId } = getOrCreateConversation("test-conv-mode");
     const session = createCallSession({
-      direction: "inbound",
       conversationId,
       provider: "twilio",
       fromNumber: "+15551234567",
@@ -179,7 +178,6 @@ describe("Call session mode metadata", () => {
       "test-conv-mode-default",
     );
     const session = createCallSession({
-      direction: "inbound",
       conversationId,
       provider: "twilio",
       fromNumber: "+15551234567",

package/src/__tests__/dictation-profile-store.test.ts

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 import {
-  loadConfig,
+  getConfig,
   resetCache,
   resolveProfile,
   setStorePathOverride,
@@ -34,17 +34,17 @@ function writeConfig(config: unknown): void {
   writeFileSync(testFilePath, JSON.stringify(config, null, 2));
 }
 
-describe("loadConfig", () => {
+describe("getConfig", () => {
   test("returns default config when file is missing or malformed", () => {
     // Missing file
-    let config = loadConfig();
+    let config = getConfig();
     expect(config.profiles).toHaveLength(1);
     expect(config.profiles[0].id).toBe("general");
 
     // Malformed JSON
     resetCache();
     writeFileSync(testFilePath, "not json");
-    config = loadConfig();
+    config = getConfig();
     expect(config.profiles[0].id).toBe("general");
   });
 
@@ -57,7 +57,7 @@ describe("loadConfig", () => {
         { id: "casual", name: "Casual" },
       ],
     });
-    const config = loadConfig();
+    const config = getConfig();
     expect(config.profiles).toHaveLength(2);
     expect(config.defaultProfileId).toBe("work");
   });
@@ -81,7 +81,7 @@ describe("loadConfig", () => {
         },
       ],
     });
-    const config = loadConfig();
+    const config = getConfig();
     expect(config.profiles[0].stylePrompt!.length).toBe(2000);
     expect(config.profiles[0].dictionary).toHaveLength(1);
     expect(config.profiles[0].snippets).toHaveLength(1);

package/src/__tests__/disk-usage.test.ts

@@ -1,40 +1,10 @@
-import { execFile } from "node:child_process";
-import {
-  existsSync,
-  mkdtempSync,
-  rmSync,
-  statfsSync,
-  writeFileSync,
-} from "node:fs";
-import { join } from "node:path";
-import { promisify } from "node:util";
+import { statfsSync } from "node:fs";
 import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 
-// Captured at module scope: the preload cleans up its env var between suites.
 const PRELOAD_WS = process.env.CADET_WORKSPACE_DIR!;
-
 const MIB = 1024 * 1024;
 const round2 = (b: number) => Math.round((b / MIB) * 100) / 100;
 
-const execFileAsync = promisify(execFile);
-
-/** Same measurement the module under test performs, done for real. */
-async function duBytes(paths: string[]): Promise<number> {
-  const existing = paths.filter((p) => existsSync(p));
-  if (existing.length === 0) {
-    return 0;
-  }
-  const { stdout } = await execFileAsync("du", ["-sb", ...existing]);
-  let total = 0;
-  for (const line of stdout.trim().split("\n")) {
-    const size = parseInt(line.split("\t")[0], 10);
-    if (!isNaN(size) && size > 0) {
-      total += size;
-    }
-  }
-  return total;
-}
-
 interface StatfsSnapshot {
   total: number;
   free: number;
@@ -81,171 +51,65 @@ function expectWithinStatfsWindow(
   expect(usage.usedMb).toBeLessThanOrEqual(usedHi);
 }
 
-const { __resetDiskUsageCacheForTests, getDiskUsageInfo, parseK8sMemoryBytes } =
+const { getDiskUsageInfo, parseK8sMemoryBytes } =
   await import("../util/disk-usage.js");
 
-// Env knobs the sampler reads at call time; no module mocking needed.
 const ENV_VARS = [
   "CADET_MINIKUBE_STORAGE_SIZE",
   "IS_CONTAINERIZED",
   "IS_CLOUD",
 ] as const;
 
-afterAll(() => {
-  for (const v of ENV_VARS) {
-    delete process.env[v];
+function clearEnvironment(): void {
+  for (const name of ENV_VARS) {
+    delete process.env[name];
   }
-});
+  process.env.CADET_WORKSPACE_DIR = PRELOAD_WS;
+}
 
-// `du -sb` of an empty directory is 0, which the sampler treats as
-// unmeasurable — seed real bytes so the du-backed branches have data.
-const PAYLOAD = join(PRELOAD_WS, "bulk.bin");
+afterAll(clearEnvironment);
 
-describe("disk usage sampler", () => {
-  beforeEach(() => {
-    for (const v of ENV_VARS) {
-      delete process.env[v];
-    }
-    process.env.CADET_WORKSPACE_DIR = PRELOAD_WS;
-    writeFileSync(PAYLOAD, Buffer.alloc(512 * 1024));
-    __resetDiskUsageCacheForTests();
-  });
+async function expectFilesystemUsage(): Promise<void> {
+  const before = statfsSnapshot(PRELOAD_WS);
+  const usage = await getDiskUsageInfo();
+  const after = statfsSnapshot(PRELOAD_WS);
+  expect(usage).not.toBeNull();
+  expectWithinStatfsWindow(usage!, PRELOAD_WS, before, after);
+}
 
-  test("reports real statfs usage", async () => {
-    const before = statfsSnapshot(PRELOAD_WS);
-    const usage = await getDiskUsageInfo();
-    const after = statfsSnapshot(PRELOAD_WS);
+describe("disk usage sampler", () => {
+  beforeEach(clearEnvironment);
 
-    expect(usage).not.toBeNull();
-    expectWithinStatfsWindow(usage!, PRELOAD_WS, before, after);
-  });
+  test("reports real filesystem usage", expectFilesystemUsage);
 
   test("falls back to root when the workspace path does not exist", async () => {
     process.env.CADET_WORKSPACE_DIR = "/tmp/does-not-exist-disk-usage-test";
     try {
-      const usage = await getDiskUsageInfo();
-      expect(usage?.path).toBe("/");
+      expect((await getDiskUsageInfo())?.path).toBe("/");
     } finally {
-      // Restore rather than delete: the sampler reads the workspace at call
-      // time and later tests still need the preload's workspace.
       process.env.CADET_WORKSPACE_DIR = PRELOAD_WS;
     }
   });
 
-  test("uses PVC capacity and du usage when the host filesystem is larger", async () => {
-    // A 1MiB PVC is always smaller than the real host filesystem, so the
-    // hostPath detection fires and capacity is the quota, usage is `du`.
+  test("reports the backing filesystem rather than a minikube quota", async () => {
     process.env.CADET_MINIKUBE_STORAGE_SIZE = "1Mi";
-
-    const before = statfsSnapshot(PRELOAD_WS);
-    const usage = await getDiskUsageInfo();
-    const after = statfsSnapshot(PRELOAD_WS);
-
-    // totalMb === 1 is the fixed-cap branch signature (the sampler's du ran).
-    // A failed du spawn under CI load is a legal statfs fallback — asserted
-    // with the window instead of failing the run.
-    if (usage!.totalMb === 1) {
-      // The 512KiB payload must show up in the measurement.
-      expect(usage!.usedMb).toBeGreaterThanOrEqual(0.49);
-      expect(
-        Math.abs(usage!.freeMb - Math.max(0, 1 - usage!.usedMb)),
-      ).toBeLessThanOrEqual(0.02);
-    } else {
-      expectWithinStatfsWindow(usage!, PRELOAD_WS, before, after);
-    }
+    await expectFilesystemUsage();
   });
 
-  test("adds /data to du usage when it exists separately", async () => {
-    process.env.CADET_MINIKUBE_STORAGE_SIZE = "1Mi";
-    const workspaceOnly = round2(await duBytes([PRELOAD_WS]));
-
-    const before = statfsSnapshot(PRELOAD_WS);
-    const usage = await getDiskUsageInfo();
-    const after = statfsSnapshot(PRELOAD_WS);
-
-    if (usage!.totalMb !== 1) {
-      // Sampler's du spawn failed under load → legal statfs fallback.
-      expectWithinStatfsWindow(usage!, PRELOAD_WS, before, after);
-      return;
-    }
-    // The impl's path set is workspace + /data (when /data exists). It can
-    // only be >= the workspace-only floor; equality holds on machines
-    // without /data.
-    expect(usage!.usedMb).toBeGreaterThanOrEqual(workspaceOnly);
-  });
-
-  test("a PVC at least as large as the filesystem reports statfs directly", async () => {
-    // 1TiB is larger than any test filesystem: the hostPath detection must
-    // NOT fire, so the sampler trusts statfs instead of `du`.
-    process.env.CADET_MINIKUBE_STORAGE_SIZE = "1Ti";
-    const before = statfsSnapshot(PRELOAD_WS);
-    const usage = await getDiskUsageInfo();
-    const after = statfsSnapshot(PRELOAD_WS);
-
-    expect(usage).not.toBeNull();
-    expectWithinStatfsWindow(usage!, PRELOAD_WS, before, after);
-  });
-
-  test("measures workspace du usage on a local Docker hatch", async () => {
+  test("reports the backing filesystem for local Docker volumes", async () => {
     process.env.IS_CONTAINERIZED = "1";
-
-    const before = statfsSnapshot(PRELOAD_WS);
-    const usage = await getDiskUsageInfo();
-    const after = statfsSnapshot(PRELOAD_WS);
-
-    expect(usage).not.toBeNull();
-    expect(usage!.path).toBe(PRELOAD_WS);
-    // The 512KiB payload must show up whether usage came from du or (if the
-    // du spawn failed under load) the statfs fallback — both exceed it.
-    expect(usage!.usedMb).toBeGreaterThanOrEqual(0.49);
-    // host-free consistency: capacity is usage + free in both branches.
-    expect(
-      Math.abs(usage!.totalMb - (usage!.usedMb + usage!.freeMb)),
-    ).toBeLessThanOrEqual(0.02);
-    // Free space is the host's own statfs number in both branches.
-    expect(usage!.freeMb).toBeGreaterThanOrEqual(
-      round2(Math.min(before.free, after.free)) - 0.01,
-    );
-    expect(usage!.freeMb).toBeLessThanOrEqual(
-      round2(Math.max(before.free, after.free)) + 0.01,
-    );
+    await expectFilesystemUsage();
   });
 
-  test("does not use du for cloud-managed containerized instances", async () => {
+  test("reports filesystem usage for cloud-managed containers", async () => {
     process.env.IS_CONTAINERIZED = "1";
     process.env.IS_CLOUD = "1";
-    const before = statfsSnapshot(PRELOAD_WS);
-    const usage = await getDiskUsageInfo();
-    const after = statfsSnapshot(PRELOAD_WS);
-
-    // CSI-backed PVCs report the volume accurately: pure statfs numbers.
-    expect(usage).not.toBeNull();
-    expectWithinStatfsWindow(usage!, PRELOAD_WS, before, after);
-  });
-
-  test("falls back to statfs when du has nothing to measure", async () => {
-    // An empty workspace du's to 0, which the sampler cannot report as usage.
-    const emptyWs = mkdtempSync(join("/tmp", "disk-usage-empty-"));
-    process.env.IS_CONTAINERIZED = "1";
-    process.env.CADET_WORKSPACE_DIR = emptyWs;
-    try {
-      const before = statfsSnapshot(emptyWs);
-      const usage = await getDiskUsageInfo();
-      const after = statfsSnapshot(emptyWs);
-
-      expect(usage).not.toBeNull();
-      expectWithinStatfsWindow(usage!, emptyWs, before, after);
-    } finally {
-      process.env.CADET_WORKSPACE_DIR = PRELOAD_WS;
-      rmSync(emptyWs, { recursive: true, force: true });
-    }
+    await expectFilesystemUsage();
   });
 
   test("returns null for malformed Kubernetes memory strings", () => {
-    expect(parseK8sMemoryBytes("")).toBeNull();
-    expect(parseK8sMemoryBytes("abc")).toBeNull();
-    expect(parseK8sMemoryBytes("12Zi")).toBeNull();
-    expect(parseK8sMemoryBytes("-1Gi")).toBeNull();
-    expect(parseK8sMemoryBytes("0Gi")).toBeNull();
+    for (const value of ["", "abc", "12Zi", "-1Gi", "0Gi"]) {
+      expect(parseK8sMemoryBytes(value)).toBeNull();
+    }
   });
 });

package/src/__tests__/docker-signing-key-bootstrap.test.ts

@@ -23,7 +23,7 @@ const {
   _resetSigningKeyForTesting,
 } = await import("../runtime/auth/token-service.js");
 const { CURRENT_POLICY_EPOCH } = await import("../runtime/auth/policy.js");
-const { getDeprecatedDir } = await import("../util/platform.js");
+const { getDeprecatedDir } = await import("../util/layout.js");
 
 const VALID_HEX_KEY = "ab".repeat(32); // 64 hex chars = 32 bytes