@mycadet/assistant 0.13.0-dev.202610231952.fa65022 → 0.13.0-dev.202610241003.f9cbe80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/assistant",
-  "version": "0.13.0-dev.202610231952.fa65022",
+  "version": "0.13.0-dev.202610241003.f9cbe80",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vargasjr-dev/mycadet-temp.git"

package/src/__tests__/plugin-api-store-credential.test.ts

@@ -33,6 +33,7 @@ import {
   getCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
 import { storeCredentialValue } from "../tools/credentials/store.js";
+import { useMemorySecureKeys } from "./helpers/secure-keys.js";
 
 // Real metadata store backed by a temp file. A mock.module on metadata-store
 // or secure-keys would replace the whole module namespace, so only the secure
@@ -69,6 +70,9 @@ beforeEach(() => {
   }
   mkdirSync(TEST_DIR, { recursive: true });
   _setMetadataPath(META_PATH);
+  // Belt-and-suspenders vs the module spies: if a spy ever fails to
+  // intercept, seeded credentials land in a memory backend, not the vault.
+  useMemorySecureKeys();
 
   secureStore = new Map();
   writeSucceeds = true;

package/src/__tests__/test-preload-verifier.ts

@@ -66,3 +66,21 @@ if (
     `CADET_WORKSPACE_DIR resolves to ${resolvedWorkspace}, which is not under ${tmpRoot}`,
   );
 }
+
+// The main preload also strands CES credential-RPC discovery: the socket dir
+// must be set AND resolve under tmpdir (deleting the var is not enough —
+// discovery falls back to the hardcoded /run/ces-bootstrap).
+const cesSocketDir = process.env.CES_BOOTSTRAP_SOCKET_DIR?.trim();
+if (!cesSocketDir) {
+  fail("CES_BOOTSTRAP_SOCKET_DIR is not set after main preload");
+}
+
+const resolvedCesSocket = canonicalize(cesSocketDir);
+if (
+  resolvedCesSocket !== tmpRoot &&
+  !resolvedCesSocket.startsWith(tmpRoot + sep)
+) {
+  fail(
+    `CES_BOOTSTRAP_SOCKET_DIR resolves to ${resolvedCesSocket}, which is not under ${tmpRoot}`,
+  );
+}

package/src/__tests__/test-preload.ts

@@ -49,13 +49,17 @@ if (fixturesDir) {
   cpSync(join(fixturesDir, "migrated"), testDir, { recursive: true });
 }
 
-// Prevent tests from routing credential writes through the real CES
-// (Credential Execution Service). Without this, setSecureKeyAsync() in
-// containerized environments writes to the live credential store.
+// Prevent tests from routing credential ops through the real CES. The HTTP
+// failover arm dies with IS_CONTAINERIZED/CES_CREDENTIAL_URL; the RPC primary
+// dies with a dead per-process socket dir — deleting the var is not enough,
+// discovery falls back to the hardcoded /run/ces-bootstrap, which fronts the
+// real vault on containerized dev machines.
 const savedIsContainerized = process.env.IS_CONTAINERIZED;
 const savedCesCredentialUrl = process.env.CES_CREDENTIAL_URL;
 delete process.env.IS_CONTAINERIZED;
 delete process.env.CES_CREDENTIAL_URL;
+const savedCesBootstrapSocketDir = process.env.CES_BOOTSTRAP_SOCKET_DIR;
+process.env.CES_BOOTSTRAP_SOCKET_DIR = join(tmpRoot, "ces-bootstrap-absent");
 
 // A test runs daemon code in-process, so it acts as the main daemon for the
 // event hub's publish routing (a non-daemon forwards publishes over IPC to a
@@ -91,6 +95,9 @@ afterAll(() => {
   if (savedCesCredentialUrl !== undefined) {
     process.env.CES_CREDENTIAL_URL = savedCesCredentialUrl;
   }
+  if (savedCesBootstrapSocketDir !== undefined) {
+    process.env.CES_BOOTSTRAP_SOCKET_DIR = savedCesBootstrapSocketDir;
+  }
   try {
     rmSync(tmpRoot, { recursive: true, force: true });
   } catch {

package/src/cli/commands/__tests__/keys.test.ts

@@ -17,6 +17,8 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { Command } from "commander";
 
+import { useMemorySecureKeys } from "../../../__tests__/helpers/secure-keys.js";
+
 // ---------------------------------------------------------------------------
 // Mock state
 // ---------------------------------------------------------------------------
@@ -68,6 +70,8 @@ let savedConversationId: string | undefined;
 let savedSkillContextJson: string | undefined;
 
 beforeEach(() => {
+  // Any stray direct secure-keys write lands in memory, not the vault.
+  useMemorySecureKeys();
   mockSetSecureKeyViaDaemon = mock(() => Promise.resolve({ ok: true }));
   mockDeleteSecureKeyViaDaemon = mock(
     (): Promise<DeleteResultStub> => Promise.resolve({ result: "deleted" }),