@mycadet/cli 0.12.10 → 0.12.11

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {

package/src/__tests__/cloud-login-poll.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "bun:test";
+import { pollingCloudLogin } from "../lib/cloud-login-poll.js";
+
+const login = {
+  request_id: "a".repeat(64),
+  poll_secret: "b".repeat(64),
+  verification_uri: "https://example.com/account/cli?request=test",
+  user_code: "AAAAAAAA",
+  interval: 1,
+};
+
+describe("terminal login polling", () => {
+  test("prints the browser URL/code and waits for approval using a private poll secret", async () => {
+    const logs: string[] = [];
+    const bodies: unknown[] = [];
+    let polls = 0;
+    const request = async (url: string | URL | Request, init?: RequestInit) => {
+      bodies.push(init?.body);
+      if (String(url).endsWith("/start")) return Response.json(login);
+      return ++polls === 1
+        ? Response.json({ status: "pending" }, { status: 202 })
+        : Response.json({ session_token: "session-test" });
+    };
+    expect(
+      await pollingCloudLogin("https://cloud.example.com", {
+        fetch: request,
+        log: (line) => logs.push(line),
+      }),
+    ).toBe("session-test");
+    expect(polls).toBe(2);
+    expect(logs.join("\n")).toContain(login.verification_uri);
+    expect(logs.join("\n")).toContain(login.user_code);
+    expect(logs.join("\n")).not.toContain(login.poll_secret);
+    expect(JSON.parse(String(bodies[1]))).toEqual({
+      request_id: login.request_id,
+      poll_secret: login.poll_secret,
+    });
+  });
+
+  test("times out even while a network request is hung", async () => {
+    const request = async (_url: unknown, init?: RequestInit) =>
+      new Promise<Response>((_resolve, reject) => {
+        init?.signal?.addEventListener(
+          "abort",
+          () => reject(new Error("aborted")),
+          { once: true },
+        );
+      });
+    await expect(
+      pollingCloudLogin("https://example.com", {
+        fetch: request,
+        timeoutMs: 20,
+      }),
+    ).rejects.toThrow("Login timed out after 5 minutes");
+  });
+
+  test("expired approval fails without returning a token", async () => {
+    const request = async (url: unknown) =>
+      String(url).endsWith("/start")
+        ? Response.json(login)
+        : Response.json({}, { status: 410 });
+    await expect(
+      pollingCloudLogin("https://example.com", {
+        fetch: request,
+        log: () => {},
+      }),
+    ).rejects.toThrow("expired");
+  });
+});

package/src/__tests__/devices.test.ts

@@ -26,6 +26,7 @@ const ORIGINAL_FETCH = globalThis.fetch;
 
 import { createHash } from "node:crypto";
 
+import * as stepRunner from "../lib/step-runner.js";
 import { devices } from "../commands/devices.js";
 import { saveAssistantEntry } from "../lib/assistant-config.js";
 import { computeDeviceId } from "../lib/guardian-token.js";
@@ -102,6 +103,67 @@ describe("cadet devices", () => {
     stubFetch(() => jsonResponse({ error: "unexpected" }, 500));
   });
 
+  test("Docker devices list and revoke execute inside the gateway without a host port", async () => {
+    saveAssistantEntry({
+      assistantId: "docker-fixture",
+      cloud: "docker",
+      runtimeUrl: "https://tunnel.example",
+    });
+    const calls: string[][] = [];
+    const docker = spyOn(stepRunner, "execOutput").mockImplementation(
+      async (_command, args) => {
+        calls.push(args);
+        return JSON.stringify({
+          status: 200,
+          body: args.some((arg) => arg.endsWith("/revoke"))
+            ? '{"revoked":true}'
+            : '{"devices":[]}',
+        });
+      },
+    );
+    try {
+      process.argv = ["bun", "cadet", "devices", "docker-fixture", "--json"];
+      expect((await runDevices()).exited).toBe(false);
+      process.argv = [
+        "bun",
+        "cadet",
+        "devices",
+        "revoke",
+        "fixture-device",
+        "docker-fixture",
+        "--yes",
+        "--json",
+      ];
+      expect((await runDevices()).exited).toBe(false);
+      expect(calls).toHaveLength(2);
+      expect(calls[0].slice(0, 2)).toEqual(["exec", "docker-fixture-gateway"]);
+      expect(calls[0]).toContain("http://127.0.0.1:7830/v1/devices");
+      expect(calls[1]).toContain("http://127.0.0.1:7830/v1/devices/revoke");
+      expect(fetchCalls).toHaveLength(0);
+    } finally {
+      docker.mockRestore();
+    }
+  });
+
+  test("Docker gateway output rejects malformed status and body fields", async () => {
+    saveAssistantEntry({
+      assistantId: "docker-invalid",
+      cloud: "docker",
+      runtimeUrl: "https://tunnel.example",
+    });
+    const docker = spyOn(stepRunner, "execOutput").mockResolvedValue(
+      '{"status":"200","body":{}}',
+    );
+    try {
+      process.argv = ["bun", "cadet", "devices", "docker-invalid", "--json"];
+      const result = await runDevices();
+      expect(result.exited).toBe(true);
+      expect(result.errors).toContain("could not reach the gateway");
+    } finally {
+      docker.mockRestore();
+    }
+  });
+
   afterEach(() => {
     process.argv = [...ORIGINAL_ARGV];
     globalThis.fetch = ORIGINAL_FETCH;

package/src/__tests__/ensure-binary.test.ts

@@ -180,3 +180,55 @@ describe("readLineText", () => {
     expect(await pending).toBe("");
   });
 });
+
+test("a Mac without Homebrew asks separately before bootstrapping and installing nginx", async () => {
+  const installs: string[][] = [];
+  let homebrew = false;
+  let nginx = false;
+  let brewPrompts = 0;
+  const version = await ensureBinaryInstalled({
+    binary: "nginx",
+    purpose: "the tunnel edge",
+    platform: "darwin",
+    packages: { brew: ["brew", "install", "nginx"] },
+    manualHint: "install nginx",
+    probe: () => (nginx ? "nginx 1.2" : null),
+    pmAvailable: (pm) => pm === "brew" && homebrew,
+    confirmInstall: async () => true,
+    confirmHomebrewInstall: async () => {
+      brewPrompts++;
+      return true;
+    },
+    runInstall: (argv) => {
+      installs.push(argv);
+      if (argv[0] === "/bin/bash") homebrew = true;
+      if (argv[0] === "brew") nginx = true;
+      return true;
+    },
+  });
+  expect(version).toBe("nginx 1.2");
+  expect(brewPrompts).toBe(1);
+  expect(installs.length).toBe(2);
+  expect(installs[1]).toEqual(["brew", "install", "nginx"]);
+});
+
+test("declining Homebrew runs no installer", async () => {
+  const installs: string[][] = [];
+  const result = await ensureBinaryInstalled({
+    binary: "ngrok",
+    purpose: "a tunnel",
+    platform: "darwin",
+    packages: { brew: ["brew", "install", "ngrok/ngrok/ngrok"] },
+    manualHint: "install ngrok",
+    probe: () => null,
+    pmAvailable: () => false,
+    confirmInstall: async () => true,
+    confirmHomebrewInstall: async () => false,
+    runInstall: (argv) => {
+      installs.push(argv);
+      return true;
+    },
+  });
+  expect(result).toBeNull();
+  expect(installs).toEqual([]);
+});

package/src/__tests__/hatch-next-steps.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+
+import { logHatchNextSteps } from "../lib/hatch-next-steps";
+
+function captureNextSteps(): string[] {
+  const lines: string[] = [];
+  logHatchNextSteps((message) => lines.push(message));
+  return lines;
+}
+
+describe("logHatchNextSteps", () => {
+  test("names the production binary in a production environment", () => {
+    const prev = process.env.CADET_ENVIRONMENT;
+    try {
+      process.env.CADET_ENVIRONMENT = "production";
+      const lines = captureNextSteps();
+      expect(lines.join("\n")).toContain("`cadet client`");
+      expect(lines.join("\n")).toContain("`cadet tunnel`");
+      expect(lines.join("\n")).not.toContain("cadet-dev");
+    } finally {
+      if (prev === undefined) delete process.env.CADET_ENVIRONMENT;
+      else process.env.CADET_ENVIRONMENT = prev;
+    }
+  });
+
+  test("names the environment-suffixed binary in dev", () => {
+    const prev = process.env.CADET_ENVIRONMENT;
+    try {
+      process.env.CADET_ENVIRONMENT = "dev";
+      const lines = captureNextSteps();
+      expect(lines.join("\n")).toContain("`cadet-dev client`");
+      expect(lines.join("\n")).toContain("`cadet-dev tunnel`");
+    } finally {
+      if (prev === undefined) delete process.env.CADET_ENVIRONMENT;
+      else process.env.CADET_ENVIRONMENT = prev;
+    }
+  });
+});

package/src/__tests__/multi-local.test.ts

@@ -43,14 +43,14 @@ afterAll(() => {
 
 function writeLockfile(data: unknown): void {
   writeFileSync(
-    join(testDir, ".cadet.lock.json"),
+    join(testDir, "lockfile.json"),
     JSON.stringify(data, null, 2),
   );
 }
 
 function readLockfileRaw(): Record<string, unknown> {
   return JSON.parse(
-    readFileSync(join(testDir, ".cadet.lock.json"), "utf-8"),
+    readFileSync(join(testDir, "lockfile.json"), "utf-8"),
   ) as Record<string, unknown>;
 }
 
@@ -67,7 +67,7 @@ const makeEntry = (
 
 function resetLockfile(): void {
   try {
-    rmSync(join(testDir, ".cadet.lock.json"));
+    rmSync(join(testDir, "lockfile.json"));
   } catch {
     // file may not exist
   }

package/src/__tests__/nginx-ingress.test.ts

@@ -76,6 +76,7 @@ import {
   MAX_PRESERVED_MODULE_PRELOADS,
   ensureTunnelEdge,
   EDGE_TEMPLATE_VERSION,
+  findWebDistDir,
   startRemoteWebIngress,
   stopContainerTunnelEdge,
   stopIngressNginx,
@@ -456,9 +457,7 @@ describe("buildRemoteWebIndexHtml", () => {
     expect(result).toContain(
       'window.__CADET_CONFIG__={"remote":"docker","apiBaseUrl":"/v1"}',
     );
-    expect(result.indexOf('"webUrl"')).toBeLessThan(
-      result.indexOf('"docker"'),
-    );
+    expect(result.indexOf('"webUrl"')).toBeLessThan(result.indexOf('"docker"'));
   });
 
   test("escapes config JSON before embedding it in a script tag", () => {
@@ -530,21 +529,13 @@ describe("buildRemoteWebIndexHtml", () => {
 
 describe("cloudWebHubUrl", () => {
   test("maps build environments to their cloud SPA base", () => {
-    expect(cloudWebHubUrl("production")).toBe(
-      "https://mycadet.ai/assistant",
-    );
+    expect(cloudWebHubUrl("production")).toBe("https://mycadet.ai/assistant");
     expect(cloudWebHubUrl("staging")).toBe(
       "https://staging.mycadet.ai/assistant",
     );
-    expect(cloudWebHubUrl("dev")).toBe(
-      "https://dev.mycadet.ai/assistant",
-    );
-    expect(cloudWebHubUrl("local")).toBe(
-      "https://dev.mycadet.ai/assistant",
-    );
-    expect(cloudWebHubUrl(undefined)).toBe(
-      "https://dev.mycadet.ai/assistant",
-    );
+    expect(cloudWebHubUrl("dev")).toBe("https://dev.mycadet.ai/assistant");
+    expect(cloudWebHubUrl("local")).toBe("https://dev.mycadet.ai/assistant");
+    expect(cloudWebHubUrl(undefined)).toBe("https://dev.mycadet.ai/assistant");
   });
 });
 
@@ -846,14 +837,19 @@ const PRODUCTION_HUB_URL = "https://mycadet.ai/assistant";
 
 /**
  * Mirror of the SPA config fingerprint the edge records in its ingress state
- * (sha256 over the edge template version and the injected config JSON). Pins
+ * (sha256 over the template, injected config, bundle directory and index). Pins
  * both the injected config shape and the hash format; assumes the
  * production-pinned environment. The version itself is imported rather than
  * mirrored: bumping it is the correct response to any template edit, so a
  * copy here would fail every such edit without naming a defect.
  */
 function spaConfigHash(
-  opts: { assistantName?: string; assistantId?: string } = {},
+  opts: {
+    assistantName?: string;
+    assistantId?: string;
+    indexHtml?: string;
+    webDistDir?: string;
+  } = {},
 ): string {
   return createHash("sha256")
     .update(
@@ -866,6 +862,8 @@ function spaConfigHash(
           ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
           hubUrl: PRODUCTION_HUB_URL,
         },
+        webDistDir: opts.webDistDir ?? findWebDistDir(),
+        indexHtml: opts.indexHtml ?? FAKE_INDEX_HTML,
       }),
     )
     .digest("hex");
@@ -1247,6 +1245,7 @@ describe("startRemoteWebIngress", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
+    mockWebDistPresent();
     const pid = mockRunningEdge(ws, {
       listenPort: 7845,
       gatewayPort: 7830,
@@ -1300,6 +1299,44 @@ describe("startRemoteWebIngress", () => {
     expect(spawnMock).not.toHaveBeenCalled();
   });
 
+  for (const drift of ["indexHtml", "webDistDir"] as const) {
+    test(`restarts a detached edge when the web bundle ${drift} changes`, async () => {
+      const ws = makeWorkspace();
+      mockNginxInstalled();
+      mockNginxSpawn();
+      mockWebDistPresent();
+      const pid = mockRunningEdge(ws, {
+        listenPort: 7845,
+        includeWebApp: true,
+        gatewayPort: 7830,
+        remoteWebConfigHash: spaConfigHash({
+          ...(drift === "indexHtml"
+            ? {
+                indexHtml:
+                  '<html><head><script src="/assistant/assets/old.js"></script></head></html>',
+              }
+            : { webDistDir: "/old-release/dist" }),
+        }),
+      });
+      const edge = mockKillableNginx(pid);
+      const result = await startRemoteWebIngress({
+        workspaceDir: ws,
+        gatewayPort: 7830,
+      });
+      expect(result).toMatchObject({ status: "started", listenPort: 7845 });
+      expect(edge.killed()).toBe(true);
+      expect(readConfig(ws).ingress?.nginx?.remoteWebConfigHash).toBe(
+        spaConfigHash(),
+      );
+      expect(
+        realFs.readFileSync(
+          join(ws, "data", "ingress", "assistant-index.html"),
+          "utf-8",
+        ),
+      ).not.toContain("old.js");
+    });
+  }
+
   test("restarts the edge when the injected SPA config drifts from the recorded one", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
@@ -1801,6 +1838,7 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
+    mockWebDistPresent();
     const pid = mockRunningEdge(ws, {
       listenPort: 7845,
       includeWebApp: true,

package/src/__tests__/ps-cloud-status.test.ts

@@ -262,7 +262,8 @@ describe("cadet ps — platform status line", () => {
     // children of an assistant row…
     expect(output).toContain("ngrok");
     expect(output).not.toContain("└ ngrok");
-    expect(output).toContain("nginx edge");
+    expect(output).toContain("nginx");
+    expect(output).toContain("port ");
     // …the type column distinguishes the three process kinds…
     expect(output).toContain("🧑‍🚀 Assistant");
     expect(output).toContain("🚇 Tunnel");

package/src/__tests__/setup.test.ts

@@ -62,7 +62,7 @@ function writeLockfile(entry: AssistantEntry): void {
   const lockfileDir = process.env.CADET_LOCKFILE_DIR!;
   mkdirSync(lockfileDir, { recursive: true });
   writeFileSync(
-    join(lockfileDir, ".cadet.lock.json"),
+    join(lockfileDir, "lockfile.json"),
     JSON.stringify(
       {
         assistants: [entry],
@@ -119,6 +119,10 @@ function installFetchStub(
       });
     }
 
+    if (url.endsWith("/v1/config/llm/default-provider")) {
+      return Response.json({ provider: "anthropic" });
+    }
+
     if (url.endsWith("/v1/secrets/read")) {
       return new Response(JSON.stringify({ found: false }), {
         status: 200,
@@ -189,7 +193,9 @@ describe("setup command", () => {
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer guardian-token",
     );
@@ -245,7 +251,9 @@ describe("setup command", () => {
     // gate instead of burning retry attempts against it.
     expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/readyz");
     expect(fetchCalls[1].url).toBe("http://127.0.0.1:3000/v1/guardian/init");
-    expect(fetchCalls[2].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[2].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[2].headers.get("Authorization")).toBe(
       "Bearer leased-guardian-token",
     );
@@ -288,7 +296,9 @@ describe("setup command", () => {
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("https://assistant.example/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "https://assistant.example/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer entry-token",
     );