@mycadet/cli 0.12.10 → 0.13.0-dev.202610171617.9ea363e

package/src/__tests__/tunnel-startup-summary.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, test } from "bun:test";
+import { createServer } from "node:net";
+
+import { findAvailableIngressPort } from "../lib/nginx-ingress";
+import { edgeServedRemote } from "../lib/nginx-ingress";
+import { summarizeStartupFailure } from "../lib/tunnel";
+
+function portOf(server: ReturnType<typeof createServer>): number {
+  const addr = server.address();
+  return typeof addr === "object" && addr !== null ? addr.port : -1;
+}
+
+describe("summarizeStartupFailure", () => {
+  test("names an nginx emerg line over generic log noise", () => {
+    const log = [
+      "Starting ngrok tunnel to localhost:7840...",
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain("[emerg]");
+  });
+
+  test("names an ngrok error code", () => {
+    expect(
+      summarizeStartupFailure(
+        "agent started\nERR_NGROK_4018: Authentication failed",
+      ),
+    ).toContain("ERR_NGROK_4018");
+  });
+
+  test("the last matching line wins", () => {
+    const log = [
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+      "nginx: [emerg] bind() to 0.0.0.0:7841 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain(":7841");
+  });
+
+  test("falls back to the last non-empty line when nothing error-shaped appears", () => {
+    expect(summarizeStartupFailure("first line\nsome plain output")).toBe(
+      "some plain output",
+    );
+  });
+
+  test("an empty log summarizes to null", () => {
+    expect(summarizeStartupFailure("")).toBeNull();
+    expect(summarizeStartupFailure("\n  \n")).toBeNull();
+  });
+
+  test("long lines are capped", () => {
+    const long = `nginx: [emerg] ${"x".repeat(400)}`;
+    const summary = summarizeStartupFailure(long) ?? "";
+    expect(summary.length).toBeLessThanOrEqual(201);
+    expect(summary.endsWith("…")).toBe(true);
+  });
+});
+
+describe("findAvailableIngressPort", () => {
+  test("skips a port a foreign listener already holds", async () => {
+    const blocker = createServer();
+    await new Promise<void>((resolve) => {
+      blocker.listen(0, "127.0.0.1", resolve);
+    });
+    const occupied = portOf(blocker);
+    try {
+      const port = await findAvailableIngressPort(occupied);
+      expect(port).toBe(occupied + 1);
+    } finally {
+      await new Promise<void>((resolve) => blocker.close(() => resolve()));
+    }
+  });
+
+  test("returns null when the whole band is busy", async () => {
+    const scout = createServer();
+    await new Promise<void>((resolve) => scout.listen(0, "127.0.0.1", resolve));
+    const base = portOf(scout);
+    await new Promise<void>((resolve) => scout.close(() => resolve()));
+    // Hold both ports of a 2-port band with fresh listeners.
+    const first = createServer();
+    const second = createServer();
+    await new Promise<void>((resolve) =>
+      first.listen(base, "127.0.0.1", resolve),
+    );
+    await new Promise<void>((resolve) =>
+      second.listen(base + 1, "127.0.0.1", resolve),
+    );
+    try {
+      expect(await findAvailableIngressPort(base, 2)).toBeNull();
+    } finally {
+      await new Promise<void>((resolve) => first.close(() => resolve()));
+      await new Promise<void>((resolve) => second.close(() => resolve()));
+    }
+  });
+});
+
+describe("edgeServedRemote", () => {
+  test("a docker cadet is stamped truthfully", () => {
+    expect(edgeServedRemote("docker")).toBe("docker");
+  });
+
+  test("a custom cadet keeps its kind", () => {
+    expect(edgeServedRemote("custom")).toBe("custom");
+  });
+
+  test("local, paired, cloud, and unknown entries read as custom so the remote-gateway machinery always runs", () => {
+    expect(edgeServedRemote("local")).toBe("custom");
+    expect(edgeServedRemote("paired")).toBe("custom");
+    expect(edgeServedRemote("cloud")).toBe("custom");
+    expect(edgeServedRemote(undefined)).toBe("custom");
+  });
+});

package/src/__tests__/tunnel-stop.test.ts

@@ -0,0 +1,226 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import {
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as processes from "../lib/process.js";
+import {
+  TAILSCALE_PROVIDER,
+  stopTailscaleTunnel,
+  type TailscaleDeps,
+} from "../lib/tunnels/tailscale.js";
+import * as ngrok from "../lib/tunnels/ngrok.js";
+import { tunnel } from "../commands/tunnel.js";
+import {
+  readRootProcesses,
+  saveAssistantEntry,
+  stampRootProcess,
+  findAssistantByName,
+} from "../lib/assistant-config.js";
+
+const originalArgv = process.argv;
+const originalLock = process.env.CADET_LOCKFILE_DIR;
+const originalConfig = process.env.XDG_CONFIG_HOME;
+let root = "";
+let workspace = "";
+let stop: ReturnType<typeof spyOn<typeof processes, "stopProcess">>;
+let identity: ReturnType<
+  typeof spyOn<typeof processes, "readProcessCommandLine">
+>;
+let logs: ReturnType<typeof spyOn<typeof console, "log">>;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "cadet-tunnel-stop-"));
+  workspace = join(root, "instance", "workspace");
+  mkdirSync(workspace, { recursive: true });
+  process.env.CADET_LOCKFILE_DIR = root;
+  process.env.XDG_CONFIG_HOME = root;
+  saveAssistantEntry({
+    assistantId: "fixture",
+    name: "fixture",
+    cloud: "local",
+    runtimeUrl: "http://127.0.0.1:7830",
+    ingressUrl: "https://old.ngrok.app",
+    resources: {
+      instanceDir: join(root, "instance"),
+      gatewayPort: 7830,
+      daemonPort: 7821,
+      cesPort: 8090,
+      qdrantPort: 6333,
+    },
+  });
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify({
+      ingress: {
+        publicBaseUrl: "https://old.ngrok.app",
+        lastTunnel: {
+          provider: "ngrok",
+          publicBaseUrl: "https://old.ngrok.app",
+        },
+      },
+    }),
+  );
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "ngrok",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  stampRootProcess("app", { pid: 424243, startedAt: new Date().toISOString() });
+  ngrok.saveNgrokDomain("old.ngrok.app");
+  stop = spyOn(processes, "stopProcess").mockResolvedValue(true);
+  identity = spyOn(processes, "readProcessCommandLine").mockReturnValue(
+    "ngrok http 7840",
+  );
+  logs = spyOn(console, "log").mockImplementation(() => {});
+  process.argv = ["bun", "cadet", "tunnel", "stop", "fixture"];
+});
+afterEach(() => {
+  stop.mockRestore();
+  identity.mockRestore();
+  logs.mockRestore();
+  process.argv = originalArgv;
+  if (originalLock === undefined) delete process.env.CADET_LOCKFILE_DIR;
+  else process.env.CADET_LOCKFILE_DIR = originalLock;
+  if (originalConfig === undefined) delete process.env.XDG_CONFIG_HOME;
+  else process.env.XDG_CONFIG_HOME = originalConfig;
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("stop terminates the owned agent and clears ingress, retaining nginx and domain; repeated stop is harmless", async () => {
+  await tunnel();
+  expect(stop).toHaveBeenCalledWith(424242, "tunnel");
+  expect(readRootProcesses().tunnel).toBeUndefined();
+  expect(readRootProcesses().app?.pid).toBe(424243);
+  expect(findAssistantByName("fixture")?.ingressUrl).toBeUndefined();
+  expect(
+    JSON.parse(readFileSync(join(workspace, "config.json"), "utf8")).ingress
+      .publicBaseUrl,
+  ).toBeUndefined();
+  expect(ngrok.loadNgrokDomain()).toBe("old.ngrok.app");
+  await tunnel();
+  expect(stop).toHaveBeenCalledTimes(1);
+});
+test("a recycled PID is not signaled and its stale record is cleared", async () => {
+  identity.mockReturnValue("unrelated-process");
+  await tunnel();
+  expect(stop).not.toHaveBeenCalled();
+  expect(readRootProcesses().tunnel).toBeUndefined();
+});
+test("another assistant's tunnel is left intact", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "ngrok",
+    assistantId: "another",
+    startedAt: new Date().toISOString(),
+  });
+  await expect(tunnel()).rejects.toThrow("belongs to 'another'");
+  expect(stop).not.toHaveBeenCalled();
+  expect(readRootProcesses().tunnel?.assistantId).toBe("another");
+});
+test("failure to stop retains process and ingress state", async () => {
+  stop.mockResolvedValue(false);
+  await expect(tunnel()).rejects.toThrow("Could not stop ngrok");
+  expect(readRootProcesses().tunnel?.pid).toBe(424242);
+  expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+    "https://old.ngrok.app",
+  );
+});
+
+test("Cloudflare dispatch stops cloudflared and clears its ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "cloudflare",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  identity.mockReturnValue(
+    "/usr/local/bin/cloudflared tunnel --url http://localhost:7840",
+  );
+  await tunnel();
+  expect(stop).toHaveBeenCalledWith(424242, "tunnel");
+  expect(readRootProcesses().tunnel).toBeUndefined();
+  expect(findAssistantByName("fixture")?.ingressUrl).toBeUndefined();
+});
+
+test("Tailscale dispatch disables serve and preserves a separate webhook ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "tailscale",
+    previous: {
+      pid: 424240,
+      provider: "ngrok",
+      assistantId: "fixture",
+      startedAt: new Date().toISOString(),
+    },
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify({
+      ingress: {
+        publicBaseUrl: "https://old.ngrok.app",
+        pairingTunnel: { provider: "tailscale" },
+      },
+    }),
+  );
+  const calls: string[][] = [];
+  const deps: TailscaleDeps = {
+    findBinary: async () => "tailscale",
+    run: (_bin, args) => {
+      calls.push(args);
+      return { status: 0, stdout: "", stderr: "" };
+    },
+  };
+  const provider = spyOn(TAILSCALE_PROVIDER, "stop").mockImplementation(
+    (opts) => stopTailscaleTunnel(opts, deps),
+  );
+  try {
+    await tunnel();
+    expect(calls).toEqual([["serve", "--https=443", "off"]]);
+    expect(stop).not.toHaveBeenCalled();
+    expect(readRootProcesses().tunnel?.pid).toBe(424240);
+    expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+      "https://old.ngrok.app",
+    );
+    const state = JSON.parse(
+      readFileSync(join(workspace, "config.json"), "utf8"),
+    );
+    expect(state.ingress.publicBaseUrl).toBe("https://old.ngrok.app");
+    expect(state.ingress.pairingTunnel).toBeUndefined();
+  } finally {
+    provider.mockRestore();
+  }
+});
+
+test("Tailscale shutdown failure preserves the recorded tunnel and ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "tailscale",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  const deps: TailscaleDeps = {
+    findBinary: async () => "tailscale",
+    run: () => ({ status: 1, stdout: "", stderr: "permission denied" }),
+  };
+  const provider = spyOn(TAILSCALE_PROVIDER, "stop").mockImplementation(
+    (opts) => stopTailscaleTunnel(opts, deps),
+  );
+  try {
+    await expect(tunnel()).rejects.toThrow("Could not stop tailscale serve");
+    expect(readRootProcesses().tunnel?.provider).toBe("tailscale");
+    expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+      "https://old.ngrok.app",
+    );
+  } finally {
+    provider.mockRestore();
+  }
+});

package/src/__tests__/tunnel.test.ts

@@ -53,6 +53,10 @@ const runCloudflareTunnelMock = mock<
 mock.module("../lib/tunnels/cloudflare.js", () => ({
   ...realCloudflareTunnel,
   runCloudflareTunnel: runCloudflareTunnelMock,
+  CLOUDFLARE_PROVIDER: {
+    ...realCloudflareTunnel.CLOUDFLARE_PROVIDER,
+    run: runCloudflareTunnelMock,
+  },
 }));
 
 const runNgrokTunnelMock = mock<typeof ngrok.runNgrokTunnel>(async () =>
@@ -61,6 +65,7 @@ const runNgrokTunnelMock = mock<typeof ngrok.runNgrokTunnel>(async () =>
 mock.module("../lib/tunnels/ngrok", () => ({
   ...realNgrok,
   runNgrokTunnel: runNgrokTunnelMock,
+  NGROK_PROVIDER: { ...realNgrok.NGROK_PROVIDER, run: runNgrokTunnelMock },
 }));
 
 const runTailscaleTunnelMock = mock<typeof tailscaleTunnel.runTailscaleTunnel>(
@@ -69,6 +74,10 @@ const runTailscaleTunnelMock = mock<typeof tailscaleTunnel.runTailscaleTunnel>(
 mock.module("../lib/tunnels/tailscale.js", () => ({
   ...realTailscaleTunnel,
   runTailscaleTunnel: runTailscaleTunnelMock,
+  TAILSCALE_PROVIDER: {
+    ...realTailscaleTunnel.TAILSCALE_PROVIDER,
+    run: runTailscaleTunnelMock,
+  },
 }));
 
 const notifyGatewayOfPublicUrlMock = mock<
@@ -82,7 +91,12 @@ mock.module("../lib/tunnels/gateway-notify.js", () => ({
 const EDGE_PORT = 18080;
 
 const ensureTunnelEdgeMock = mock<typeof nginxIngress.ensureTunnelEdge>(
-  async () => ({ port: EDGE_PORT, started: true, includesWebApp: true }),
+  async () => ({
+    port: EDGE_PORT,
+    started: true,
+    includesWebApp: true,
+    shellMode: "web",
+  }),
 );
 const getNginxVersionMock = mock<typeof nginxIngress.getNginxVersion>(
   () => "nginx version (test)",
@@ -123,7 +137,7 @@ function makeCloudEntry(assistantId = "cloud-1"): AssistantEntry {
   return {
     assistantId,
     runtimeUrl: `https://runtime.example.com/${assistantId}`,
-    cloud: "cadet",
+    cloud: "cloud",
   };
 }
 
@@ -280,6 +294,7 @@ describe("tunnel edge targeting", () => {
       port: EDGE_PORT,
       started: true,
       includesWebApp: true,
+      shellMode: "web",
     });
   });
 
@@ -794,6 +809,7 @@ describe("tunnel edge targeting", () => {
       port: EDGE_PORT,
       started: false,
       includesWebApp: false,
+      shellMode: "web",
     });
 
     const logs = await runTunnelCapturingLogs();
@@ -1705,6 +1721,7 @@ describe("tunnel background mode", () => {
     mock.module("../lib/tunnels/ngrok", () => ({
       ...realNgrok,
       runNgrokTunnel: runNgrokTunnelMock,
+      NGROK_PROVIDER: { ...realNgrok.NGROK_PROVIDER, run: runNgrokTunnelMock },
     }));
     mock.module("../lib/nginx-ingress.js", () => ({
       ...realNginxIngress,
@@ -1734,6 +1751,7 @@ describe("tunnel background mode", () => {
       port: EDGE_PORT,
       started: true,
       includesWebApp: true,
+      shellMode: "web",
     });
     const configHome = mkdtempSync(join(tmpdir(), "cadet-tunnel-xdg-"));
     tempDirs.push(configHome);
@@ -1780,7 +1798,7 @@ describe("tunnel background mode", () => {
 
     expect(logs).toContain("Tunnel established: https://foo.ngrok.app");
     expect(logs).toContain("Running in background (pid 9999)");
-    expect(logs).toContain("Stop with: kill 9999");
+    expect(logs).toContain("Stop with: cadet tunnel stop");
 
     // The parent hands the actual tunnel workflow off to the child: it never
     // runs the provider or edge setup itself.
@@ -1818,7 +1836,7 @@ describe("tunnel background mode", () => {
     const { exited, errors } = await runTunnelExpectingExit1();
 
     expect(exited).toBe(true);
-    expect(errors).toContain("exited during startup (exit code 1)");
+    expect(errors).toContain("Error (1): tunnel process exited during startup");
     expect(runNgrokTunnelMock).not.toHaveBeenCalled();
   });
 

package/src/__tests__/upgrade-local.test.ts

@@ -55,7 +55,7 @@ mock.module("../lib/assistant-config", () => ({
 }));
 
 const createBackupMock = mock<typeof backupOps.createBackup>(
-  async () => "/tmp/local-pre-upgrade.vbundle",
+  async () => "/tmp/local-pre-upgrade.tar.gz",
 );
 const pruneOldBackupsMock = mock<typeof backupOps.pruneOldBackups>(() => {});
 const restoreBackupMock = mock<typeof backupOps.restoreBackup>(
@@ -238,7 +238,7 @@ beforeEach(() => {
   loadAllAssistantsMock.mockReturnValue([entry]);
   saveAssistantEntryMock.mockReset();
   createBackupMock.mockReset();
-  createBackupMock.mockResolvedValue("/tmp/local-pre-upgrade.vbundle");
+  createBackupMock.mockResolvedValue("/tmp/local-pre-upgrade.tar.gz");
   pruneOldBackupsMock.mockReset();
   pruneOldBackupsMock.mockReturnValue(undefined);
   restoreBackupMock.mockReset();
@@ -372,7 +372,7 @@ describe("cadet upgrade local", () => {
     await upgrade();
 
     expect(loopbackSafeFetchMock).toHaveBeenCalledWith(
-      "http://127.0.0.1:7830/healthz?include=migrations",
+      "http://127.0.0.1:7830/healthz",
       expect.any(Object),
     );
     expect(createBackupMock).toHaveBeenCalledWith(
@@ -382,14 +382,6 @@ describe("cadet upgrade local", () => {
         prefix: "local-assistant-pre-upgrade",
       }),
     );
-    expect(saveAssistantEntryMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        previousVersion: "v0.8.11",
-        previousDbMigrationVersion: 12,
-        previousWorkspaceMigrationId: "011-test",
-        preUpgradeBackupPath: "/tmp/local-pre-upgrade.vbundle",
-      }),
-    );
     expect(stopLocalProcessesMock).toHaveBeenCalledWith(
       expect.objectContaining({
         instanceDir: tempDir,
@@ -446,6 +438,24 @@ describe("cadet upgrade local", () => {
     expect(consoleLogSpy.mock.calls.flat().join("\n")).toContain("upgraded to");
   });
 
+  test("failed safety backup aborts before runtime installation or service replacement", async () => {
+    createBackupMock.mockResolvedValue(null);
+    await expect(upgrade()).rejects.toThrow("process.exit(1)");
+    expect(ensureLocalRuntimeMock).not.toHaveBeenCalled();
+    expect(stopLocalProcessesMock).not.toHaveBeenCalled();
+    expect(startLocalDaemonMock).not.toHaveBeenCalled();
+  });
+
+  test("failed target startup restores prior runtime selection and all roots before restarting", async () => {
+    startLocalDaemonMock.mockRejectedValueOnce(new Error("target startup failed"));
+    await expect(upgrade()).rejects.toThrow("process.exit(1)");
+    expect(restoreBackupMock).toHaveBeenCalledWith("http://127.0.0.1:7830", "local-assistant", "/tmp/local-pre-upgrade.tar.gz", { resume: false });
+    expect(startLocalDaemonMock).toHaveBeenCalledTimes(2);
+    expect(startCesMock).toHaveBeenCalledTimes(2);
+    expect(stopLocalProcessesMock).toHaveBeenCalledTimes(2);
+    expect(waitForReadyMock).toHaveBeenCalled();
+  });
+
   test("skips restart when the local assistant is already on the target version", async () => {
     loopbackSafeFetchMock.mockResolvedValue({
       ok: true,

package/src/__tests__/upgrade-replay-env.test.ts

@@ -156,10 +156,10 @@ describe("buildReplayState", () => {
     expect(state.signingKey).toBe("sign-key");
   });
 
-  test("generates fresh secrets when missing from captured env", () => {
+  test("generates a service token but preserves file-backed signing identity when env is absent", () => {
     const state = buildReplayState({}, {});
     expect(state.bootstrapSecret).toBeUndefined();
     expect(state.cesServiceToken).toMatch(/^[0-9a-f]{64}$/);
-    expect(state.signingKey).toMatch(/^[0-9a-f]{64}$/);
+    expect(state.signingKey).toBeUndefined();
   });
 });