@mycadet/cli 0.12.10 → 0.12.11

package/src/__tests__/tunnel-startup-summary.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, test } from "bun:test";
+import { createServer } from "node:net";
+
+import { findAvailableIngressPort } from "../lib/nginx-ingress";
+import { edgeServedRemote } from "../lib/nginx-ingress";
+import { summarizeStartupFailure } from "../lib/tunnel";
+
+function portOf(server: ReturnType<typeof createServer>): number {
+  const addr = server.address();
+  return typeof addr === "object" && addr !== null ? addr.port : -1;
+}
+
+describe("summarizeStartupFailure", () => {
+  test("names an nginx emerg line over generic log noise", () => {
+    const log = [
+      "Starting ngrok tunnel to localhost:7840...",
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain("[emerg]");
+  });
+
+  test("names an ngrok error code", () => {
+    expect(
+      summarizeStartupFailure(
+        "agent started\nERR_NGROK_4018: Authentication failed",
+      ),
+    ).toContain("ERR_NGROK_4018");
+  });
+
+  test("the last matching line wins", () => {
+    const log = [
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+      "nginx: [emerg] bind() to 0.0.0.0:7841 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain(":7841");
+  });
+
+  test("falls back to the last non-empty line when nothing error-shaped appears", () => {
+    expect(summarizeStartupFailure("first line\nsome plain output")).toBe(
+      "some plain output",
+    );
+  });
+
+  test("an empty log summarizes to null", () => {
+    expect(summarizeStartupFailure("")).toBeNull();
+    expect(summarizeStartupFailure("\n  \n")).toBeNull();
+  });
+
+  test("long lines are capped", () => {
+    const long = `nginx: [emerg] ${"x".repeat(400)}`;
+    const summary = summarizeStartupFailure(long) ?? "";
+    expect(summary.length).toBeLessThanOrEqual(201);
+    expect(summary.endsWith("…")).toBe(true);
+  });
+});
+
+describe("findAvailableIngressPort", () => {
+  test("skips a port a foreign listener already holds", async () => {
+    const blocker = createServer();
+    await new Promise<void>((resolve) => {
+      blocker.listen(0, "127.0.0.1", resolve);
+    });
+    const occupied = portOf(blocker);
+    try {
+      const port = await findAvailableIngressPort(occupied);
+      expect(port).toBe(occupied + 1);
+    } finally {
+      await new Promise<void>((resolve) => blocker.close(() => resolve()));
+    }
+  });
+
+  test("returns null when the whole band is busy", async () => {
+    const scout = createServer();
+    await new Promise<void>((resolve) => scout.listen(0, "127.0.0.1", resolve));
+    const base = portOf(scout);
+    await new Promise<void>((resolve) => scout.close(() => resolve()));
+    // Hold both ports of a 2-port band with fresh listeners.
+    const first = createServer();
+    const second = createServer();
+    await new Promise<void>((resolve) =>
+      first.listen(base, "127.0.0.1", resolve),
+    );
+    await new Promise<void>((resolve) =>
+      second.listen(base + 1, "127.0.0.1", resolve),
+    );
+    try {
+      expect(await findAvailableIngressPort(base, 2)).toBeNull();
+    } finally {
+      await new Promise<void>((resolve) => first.close(() => resolve()));
+      await new Promise<void>((resolve) => second.close(() => resolve()));
+    }
+  });
+});
+
+describe("edgeServedRemote", () => {
+  test("a docker cadet is stamped truthfully", () => {
+    expect(edgeServedRemote("docker")).toBe("docker");
+  });
+
+  test("a custom cadet keeps its kind", () => {
+    expect(edgeServedRemote("custom")).toBe("custom");
+  });
+
+  test("local, paired, cloud, and unknown entries read as custom so the remote-gateway machinery always runs", () => {
+    expect(edgeServedRemote("local")).toBe("custom");
+    expect(edgeServedRemote("paired")).toBe("custom");
+    expect(edgeServedRemote("cloud")).toBe("custom");
+    expect(edgeServedRemote(undefined)).toBe("custom");
+  });
+});

package/src/__tests__/tunnel-stop.test.ts

@@ -0,0 +1,226 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import {
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as processes from "../lib/process.js";
+import {
+  TAILSCALE_PROVIDER,
+  stopTailscaleTunnel,
+  type TailscaleDeps,
+} from "../lib/tunnels/tailscale.js";
+import * as ngrok from "../lib/tunnels/ngrok.js";
+import { tunnel } from "../commands/tunnel.js";
+import {
+  readRootProcesses,
+  saveAssistantEntry,
+  stampRootProcess,
+  findAssistantByName,
+} from "../lib/assistant-config.js";
+
+const originalArgv = process.argv;
+const originalLock = process.env.CADET_LOCKFILE_DIR;
+const originalConfig = process.env.XDG_CONFIG_HOME;
+let root = "";
+let workspace = "";
+let stop: ReturnType<typeof spyOn<typeof processes, "stopProcess">>;
+let identity: ReturnType<
+  typeof spyOn<typeof processes, "readProcessCommandLine">
+>;
+let logs: ReturnType<typeof spyOn<typeof console, "log">>;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "cadet-tunnel-stop-"));
+  workspace = join(root, "instance", "workspace");
+  mkdirSync(workspace, { recursive: true });
+  process.env.CADET_LOCKFILE_DIR = root;
+  process.env.XDG_CONFIG_HOME = root;
+  saveAssistantEntry({
+    assistantId: "fixture",
+    name: "fixture",
+    cloud: "local",
+    runtimeUrl: "http://127.0.0.1:7830",
+    ingressUrl: "https://old.ngrok.app",
+    resources: {
+      instanceDir: join(root, "instance"),
+      gatewayPort: 7830,
+      daemonPort: 7821,
+      cesPort: 8090,
+      qdrantPort: 6333,
+    },
+  });
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify({
+      ingress: {
+        publicBaseUrl: "https://old.ngrok.app",
+        lastTunnel: {
+          provider: "ngrok",
+          publicBaseUrl: "https://old.ngrok.app",
+        },
+      },
+    }),
+  );
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "ngrok",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  stampRootProcess("app", { pid: 424243, startedAt: new Date().toISOString() });
+  ngrok.saveNgrokDomain("old.ngrok.app");
+  stop = spyOn(processes, "stopProcess").mockResolvedValue(true);
+  identity = spyOn(processes, "readProcessCommandLine").mockReturnValue(
+    "ngrok http 7840",
+  );
+  logs = spyOn(console, "log").mockImplementation(() => {});
+  process.argv = ["bun", "cadet", "tunnel", "stop", "fixture"];
+});
+afterEach(() => {
+  stop.mockRestore();
+  identity.mockRestore();
+  logs.mockRestore();
+  process.argv = originalArgv;
+  if (originalLock === undefined) delete process.env.CADET_LOCKFILE_DIR;
+  else process.env.CADET_LOCKFILE_DIR = originalLock;
+  if (originalConfig === undefined) delete process.env.XDG_CONFIG_HOME;
+  else process.env.XDG_CONFIG_HOME = originalConfig;
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("stop terminates the owned agent and clears ingress, retaining nginx and domain; repeated stop is harmless", async () => {
+  await tunnel();
+  expect(stop).toHaveBeenCalledWith(424242, "tunnel");
+  expect(readRootProcesses().tunnel).toBeUndefined();
+  expect(readRootProcesses().app?.pid).toBe(424243);
+  expect(findAssistantByName("fixture")?.ingressUrl).toBeUndefined();
+  expect(
+    JSON.parse(readFileSync(join(workspace, "config.json"), "utf8")).ingress
+      .publicBaseUrl,
+  ).toBeUndefined();
+  expect(ngrok.loadNgrokDomain()).toBe("old.ngrok.app");
+  await tunnel();
+  expect(stop).toHaveBeenCalledTimes(1);
+});
+test("a recycled PID is not signaled and its stale record is cleared", async () => {
+  identity.mockReturnValue("unrelated-process");
+  await tunnel();
+  expect(stop).not.toHaveBeenCalled();
+  expect(readRootProcesses().tunnel).toBeUndefined();
+});
+test("another assistant's tunnel is left intact", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "ngrok",
+    assistantId: "another",
+    startedAt: new Date().toISOString(),
+  });
+  await expect(tunnel()).rejects.toThrow("belongs to 'another'");
+  expect(stop).not.toHaveBeenCalled();
+  expect(readRootProcesses().tunnel?.assistantId).toBe("another");
+});
+test("failure to stop retains process and ingress state", async () => {
+  stop.mockResolvedValue(false);
+  await expect(tunnel()).rejects.toThrow("Could not stop ngrok");
+  expect(readRootProcesses().tunnel?.pid).toBe(424242);
+  expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+    "https://old.ngrok.app",
+  );
+});
+
+test("Cloudflare dispatch stops cloudflared and clears its ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "cloudflare",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  identity.mockReturnValue(
+    "/usr/local/bin/cloudflared tunnel --url http://localhost:7840",
+  );
+  await tunnel();
+  expect(stop).toHaveBeenCalledWith(424242, "tunnel");
+  expect(readRootProcesses().tunnel).toBeUndefined();
+  expect(findAssistantByName("fixture")?.ingressUrl).toBeUndefined();
+});
+
+test("Tailscale dispatch disables serve and preserves a separate webhook ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "tailscale",
+    previous: {
+      pid: 424240,
+      provider: "ngrok",
+      assistantId: "fixture",
+      startedAt: new Date().toISOString(),
+    },
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify({
+      ingress: {
+        publicBaseUrl: "https://old.ngrok.app",
+        pairingTunnel: { provider: "tailscale" },
+      },
+    }),
+  );
+  const calls: string[][] = [];
+  const deps: TailscaleDeps = {
+    findBinary: async () => "tailscale",
+    run: (_bin, args) => {
+      calls.push(args);
+      return { status: 0, stdout: "", stderr: "" };
+    },
+  };
+  const provider = spyOn(TAILSCALE_PROVIDER, "stop").mockImplementation(
+    (opts) => stopTailscaleTunnel(opts, deps),
+  );
+  try {
+    await tunnel();
+    expect(calls).toEqual([["serve", "--https=443", "off"]]);
+    expect(stop).not.toHaveBeenCalled();
+    expect(readRootProcesses().tunnel?.pid).toBe(424240);
+    expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+      "https://old.ngrok.app",
+    );
+    const state = JSON.parse(
+      readFileSync(join(workspace, "config.json"), "utf8"),
+    );
+    expect(state.ingress.publicBaseUrl).toBe("https://old.ngrok.app");
+    expect(state.ingress.pairingTunnel).toBeUndefined();
+  } finally {
+    provider.mockRestore();
+  }
+});
+
+test("Tailscale shutdown failure preserves the recorded tunnel and ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "tailscale",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  const deps: TailscaleDeps = {
+    findBinary: async () => "tailscale",
+    run: () => ({ status: 1, stdout: "", stderr: "permission denied" }),
+  };
+  const provider = spyOn(TAILSCALE_PROVIDER, "stop").mockImplementation(
+    (opts) => stopTailscaleTunnel(opts, deps),
+  );
+  try {
+    await expect(tunnel()).rejects.toThrow("Could not stop tailscale serve");
+    expect(readRootProcesses().tunnel?.provider).toBe("tailscale");
+    expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+      "https://old.ngrok.app",
+    );
+  } finally {
+    provider.mockRestore();
+  }
+});

package/src/__tests__/tunnel.test.ts

@@ -53,6 +53,10 @@ const runCloudflareTunnelMock = mock<
 mock.module("../lib/tunnels/cloudflare.js", () => ({
   ...realCloudflareTunnel,
   runCloudflareTunnel: runCloudflareTunnelMock,
+  CLOUDFLARE_PROVIDER: {
+    ...realCloudflareTunnel.CLOUDFLARE_PROVIDER,
+    run: runCloudflareTunnelMock,
+  },
 }));
 
 const runNgrokTunnelMock = mock<typeof ngrok.runNgrokTunnel>(async () =>
@@ -61,6 +65,7 @@ const runNgrokTunnelMock = mock<typeof ngrok.runNgrokTunnel>(async () =>
 mock.module("../lib/tunnels/ngrok", () => ({
   ...realNgrok,
   runNgrokTunnel: runNgrokTunnelMock,
+  NGROK_PROVIDER: { ...realNgrok.NGROK_PROVIDER, run: runNgrokTunnelMock },
 }));
 
 const runTailscaleTunnelMock = mock<typeof tailscaleTunnel.runTailscaleTunnel>(
@@ -69,6 +74,10 @@ const runTailscaleTunnelMock = mock<typeof tailscaleTunnel.runTailscaleTunnel>(
 mock.module("../lib/tunnels/tailscale.js", () => ({
   ...realTailscaleTunnel,
   runTailscaleTunnel: runTailscaleTunnelMock,
+  TAILSCALE_PROVIDER: {
+    ...realTailscaleTunnel.TAILSCALE_PROVIDER,
+    run: runTailscaleTunnelMock,
+  },
 }));
 
 const notifyGatewayOfPublicUrlMock = mock<
@@ -1705,6 +1714,7 @@ describe("tunnel background mode", () => {
     mock.module("../lib/tunnels/ngrok", () => ({
       ...realNgrok,
       runNgrokTunnel: runNgrokTunnelMock,
+      NGROK_PROVIDER: { ...realNgrok.NGROK_PROVIDER, run: runNgrokTunnelMock },
     }));
     mock.module("../lib/nginx-ingress.js", () => ({
       ...realNginxIngress,
@@ -1780,7 +1790,7 @@ describe("tunnel background mode", () => {
 
     expect(logs).toContain("Tunnel established: https://foo.ngrok.app");
     expect(logs).toContain("Running in background (pid 9999)");
-    expect(logs).toContain("Stop with: kill 9999");
+    expect(logs).toContain("Stop with: cadet tunnel stop");
 
     // The parent hands the actual tunnel workflow off to the child: it never
     // runs the provider or edge setup itself.
@@ -1818,7 +1828,7 @@ describe("tunnel background mode", () => {
     const { exited, errors } = await runTunnelExpectingExit1();
 
     expect(exited).toBe(true);
-    expect(errors).toContain("exited during startup (exit code 1)");
+    expect(errors).toContain("Error (1): tunnel process exited during startup");
     expect(runNgrokTunnelMock).not.toHaveBeenCalled();
   });
 

package/src/commands/devices.ts

@@ -13,6 +13,7 @@
  * that runs the assistant (server side).
  */
 
+import { z } from "zod";
 import { createHash } from "node:crypto";
 
 import type { DeviceRecord } from "@mycadet/local-mode";
@@ -33,8 +34,16 @@ import {
   canPromptForConfirmation,
   confirmAction,
 } from "../lib/confirm-action.js";
+import { GATEWAY_INTERNAL_PORT } from "../lib/environments/paths.js";
+import { execOutput } from "../lib/step-runner.js";
+import { dockerResourceNames } from "../lib/docker.js";
 import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 
+const dockerGatewayResponseSchema = z.object({
+  status: z.number().int().min(200).max(599),
+  body: z.string(),
+});
+
 function printUsage(): void {
   console.log(`cadet devices [beta] - List and revoke devices paired to a local assistant
 
@@ -81,6 +90,9 @@ function resolveLoopbackBase(entry: AssistantEntry): string {
     process.exit(1);
   }
 
+  if (entry.cloud === "docker")
+    return `http://127.0.0.1:${GATEWAY_INTERNAL_PORT}`;
+
   const base =
     entry.localUrl ||
     (entry.resources?.gatewayPort
@@ -96,6 +108,31 @@ function resolveLoopbackBase(entry: AssistantEntry): string {
   return base.replace(/\/+$/, "");
 }
 
+/** Docker host management enters the gateway network namespace before calling loopback-only routes. */
+async function deviceRequest(
+  entry: AssistantEntry,
+  url: string,
+  init: RequestInit,
+): Promise<Response> {
+  if (entry.cloud !== "docker") return loopbackSafeFetch(url, init);
+  const script = `const r = await fetch(process.argv[1], {...JSON.parse(process.argv[2]), signal: AbortSignal.timeout(10000)}); console.log(JSON.stringify({status:r.status, body:await r.text()}));`;
+  const output = await execOutput(
+    "docker",
+    [
+      "exec",
+      dockerResourceNames(entry.assistantId).gatewayContainer,
+      "bun",
+      "-e",
+      script,
+      url,
+      JSON.stringify(init),
+    ],
+    { timeoutMs: 15000 },
+  );
+  const result = dockerGatewayResponseSchema.parse(JSON.parse(output));
+  return new Response(result.body, { status: result.status });
+}
+
 /**
  * The hashed device id the gateway stores for THIS machine's own guardian
  * credential (`leaseGuardianToken` registers it device-bound as
@@ -122,7 +159,7 @@ async function listDevices(
 
   let response: Response;
   try {
-    response = await loopbackSafeFetch(`${base}/v1/devices`, {
+    response = await deviceRequest(entry, `${base}/v1/devices`, {
       method: "GET",
       headers: getClientRegistrationHeaders(CLI_INTERFACE_ID),
     });
@@ -239,7 +276,7 @@ async function revokeDevice(
 
   let response: Response;
   try {
-    response = await loopbackSafeFetch(`${base}/v1/devices/revoke`, {
+    response = await deviceRequest(entry, `${base}/v1/devices/revoke`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -281,38 +318,37 @@ async function revokeDevice(
 
 export const devices = Object.assign(
   async function devices(): Promise<void> {
-  const rawArgs = process.argv.slice(3);
-
-  if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
-    printUsage();
-    return;
-  }
+    const rawArgs = process.argv.slice(3);
 
-  const jsonOutput = rawArgs.includes("--json");
-  const args = rawArgs.filter((a) => a !== "--json");
-
-  if (args[0] === "revoke") {
-    const rest = args.slice(1);
-    const yes = rest.includes("--yes");
-    const positionals = rest.filter((a) => !a.startsWith("-"));
-    const hashedDeviceId = positionals[0];
-    if (!hashedDeviceId) {
-      console.error("Error: a hashedDeviceId is required to revoke.");
+    if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
       printUsage();
-      process.exit(1);
+      return;
     }
-    const nameArg = positionals.slice(1).join(" ") || undefined;
+
+    const jsonOutput = rawArgs.includes("--json");
+    const args = rawArgs.filter((a) => a !== "--json");
+
+    if (args[0] === "revoke") {
+      const rest = args.slice(1);
+      const yes = rest.includes("--yes");
+      const positionals = rest.filter((a) => !a.startsWith("-"));
+      const hashedDeviceId = positionals[0];
+      if (!hashedDeviceId) {
+        console.error("Error: a hashedDeviceId is required to revoke.");
+        printUsage();
+        process.exit(1);
+      }
+      const nameArg = positionals.slice(1).join(" ") || undefined;
+      const entry = resolveTargetAssistant(nameArg);
+      const base = resolveLoopbackBase(entry);
+      await revokeDevice(entry, base, hashedDeviceId, yes, jsonOutput);
+      return;
+    }
+
+    const nameArg = parseAssistantTargetArg(args, []);
     const entry = resolveTargetAssistant(nameArg);
     const base = resolveLoopbackBase(entry);
-    await revokeDevice(entry, base, hashedDeviceId, yes, jsonOutput);
-    return;
-  }
-
-  const nameArg = parseAssistantTargetArg(args, []);
-  const entry = resolveTargetAssistant(nameArg);
-  const base = resolveLoopbackBase(entry);
-  await listDevices(entry, base, jsonOutput);
-},
+    await listDevices(entry, base, jsonOutput);
+  },
   { description: "List or revoke devices paired to a local assistant [beta]" },
 );
-