@mycadet/cli 0.12.10 → 0.13.0-dev.202610171617.9ea363e

package/src/__tests__/gateway-token.test.ts

@@ -0,0 +1,267 @@
+/**
+ * Command-level tests for `cadet gateway token get/refresh`.
+ *
+ * Resolution: the assistant id is OPTIONAL — resolveTargetAssistant falls
+ * back to the active (or sole) assistant, so `cadet gateway token refresh`
+ * works with no arguments.
+ *
+ * Self-heal: a spent credential (401 — expired/revoked refresh token) or a
+ * missing token file (404) triggers an in-place re-provision via the
+ * gateway's bootstrap reset — the same machinery `cadet wake
+ * --repair-guardian` runs. It must NEVER suggest `cadet hatch`: hatching
+ * creates a different assistant.
+ */
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { gatewayToken } from "../commands/gateway/token.js";
+import {
+  saveAssistantEntry,
+  setActiveAssistant,
+} from "../lib/assistant-config.js";
+import {
+  loadGuardianToken,
+  saveGuardianToken,
+} from "../lib/guardian-token.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
+import { withPreconnect } from "./helpers/http.js";
+
+const ORIGINAL_LOCKFILE_DIR = process.env.CADET_LOCKFILE_DIR;
+const ORIGINAL_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
+const ORIGINAL_ENVIRONMENT = process.env.CADET_ENVIRONMENT;
+const ORIGINAL_ARGV = [...process.argv];
+const REAL_FETCH = globalThis.fetch;
+
+let tempHome: string;
+
+function seedLocalEntry(overrides: Record<string, unknown> = {}): void {
+  saveAssistantEntry({
+    assistantId: "px",
+    name: "Prime Quail",
+    runtimeUrl: "http://127.0.0.1:7830",
+    localUrl: "http://127.0.0.1:7830",
+    cloud: "local",
+    paired: false,
+    ...overrides,
+  });
+}
+
+/**
+ * Run `gatewayToken()` with console.log + console.error + process.exit
+ * spied; return the captured streams and whether the run exited 1.
+ */
+async function runGatewayToken(): Promise<{
+  exited: boolean;
+  logs: string;
+  errors: string;
+}> {
+  const logs: string[] = [];
+  const errors: string[] = [];
+  const logSpy = spyOn(console, "log").mockImplementation(
+    (...a: unknown[]) => {
+      logs.push(a.join(" "));
+    },
+  );
+  const errSpy = spyOn(console, "error").mockImplementation(
+    (...a: unknown[]) => {
+      errors.push(a.join(" "));
+    },
+  );
+  const exitSpy = spyOn(process, "exit").mockImplementation(
+    (code?: number | string | undefined): never => {
+      throw new Error(`exit:${code ?? 0}`);
+    },
+  );
+  let exited = false;
+  try {
+    await gatewayToken();
+  } catch (e) {
+    exited = e instanceof Error && e.message === "exit:1";
+  } finally {
+    logSpy.mockRestore();
+    errSpy.mockRestore();
+    exitSpy.mockRestore();
+  }
+  return { exited, logs: logs.join("\n"), errors: errors.join("\n") };
+}
+
+/** Fetch double covering the repair choreography (readyz/reset/init). */
+function mockRepairFetch(initBody: object): void {
+  globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+    const url = String(input);
+    if (url.endsWith("/readyz")) {
+      return new Response("", { status: 404 }); // no starting gate — proceed
+    }
+    if (url.endsWith("/v1/guardian/reset-bootstrap")) {
+      return new Response("{}", { status: 200 });
+    }
+    if (url.endsWith("/v1/guardian/init")) {
+      return new Response(JSON.stringify(initBody), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    }
+    throw new Error(`unexpected fetch: ${url}`);
+  });
+}
+
+const FRESH_LEASE = {
+  guardianPrincipalId: "principal-new",
+  accessToken: "fresh-acc",
+  accessTokenExpiresAt: Date.now() + 60 * 60 * 1000,
+  refreshToken: "fresh-ref",
+  refreshTokenExpiresAt: Date.now() + 365 * 24 * 60 * 60 * 1000,
+  refreshAfter: Date.now() + 48 * 60 * 60 * 1000,
+  isNew: false,
+};
+
+describe("gateway token command", () => {
+  beforeEach(() => {
+    tempHome = mkdtempSync(join(tmpdir(), "gateway-token-test-"));
+    process.env.CADET_LOCKFILE_DIR = tempHome;
+    process.env.XDG_CONFIG_HOME = tempHome;
+    delete process.env.CADET_ENVIRONMENT;
+  });
+
+  afterEach(() => {
+    process.argv = [...ORIGINAL_ARGV];
+    globalThis.fetch = REAL_FETCH;
+    if (ORIGINAL_LOCKFILE_DIR === undefined)
+      delete process.env.CADET_LOCKFILE_DIR;
+    else process.env.CADET_LOCKFILE_DIR = ORIGINAL_LOCKFILE_DIR;
+    if (ORIGINAL_CONFIG_HOME === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = ORIGINAL_CONFIG_HOME;
+    if (ORIGINAL_ENVIRONMENT === undefined) delete process.env.CADET_ENVIRONMENT;
+    else process.env.CADET_ENVIRONMENT = ORIGINAL_ENVIRONMENT;
+    rmSync(tempHome, { recursive: true, force: true });
+  });
+
+  afterAll(() => {
+    globalThis.fetch = REAL_FETCH;
+  });
+
+  test("refresh without a name targets the sole assistant and prints the refreshed token", async () => {
+    seedLocalEntry();
+    saveGuardianToken("px", makeGuardianTokenData());
+    let sawRefresh = false;
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.endsWith("/v1/guardian/refresh")) {
+        sawRefresh = true;
+        return new Response(JSON.stringify({ accessToken: "new-acc" }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
+      }
+      throw new Error(`unexpected fetch: ${url}`);
+    });
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs, errors } = await runGatewayToken();
+
+    expect(sawRefresh).toBe(true);
+    expect(exited).toBe(false);
+    expect(logs).toContain("new-acc");
+    expect(loadGuardianToken("px")?.accessToken).toBe("new-acc");
+    expect(`${logs}\n${errors}`).not.toContain("hatch");
+  });
+
+  test("get without a name targets the active assistant", async () => {
+    seedLocalEntry();
+    saveAssistantEntry({
+      assistantId: "py",
+      name: "Other Box",
+      runtimeUrl: "http://127.0.0.1:7831",
+      localUrl: "http://127.0.0.1:7831",
+      cloud: "local",
+      paired: false,
+    });
+    setActiveAssistant("py");
+    saveGuardianToken(
+      "py",
+      makeGuardianTokenData({ accessToken: "active-token" }),
+    );
+
+    process.argv = ["bun", "cadet", "gateway", "token", "get"];
+    const { exited, logs } = await runGatewayToken();
+
+    expect(exited).toBe(false);
+    expect(logs).toContain("active-token");
+  });
+
+  test("an unknown name is a strict-match error", async () => {
+    seedLocalEntry();
+    saveGuardianToken("px", makeGuardianTokenData());
+
+    process.argv = ["bun", "cadet", "gateway", "token", "get", "nope"];
+    const { exited, errors } = await runGatewayToken();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("No assistant found with name or ID 'nope'");
+  });
+
+  test("refresh self-heals an expired credential via the bootstrap reset", async () => {
+    seedLocalEntry({ guardianBootstrapSecret: "boot-secret-1" });
+    saveGuardianToken(
+      "px",
+      makeGuardianTokenData({
+        refreshTokenExpiresAt: new Date(Date.now() - 1000).toISOString(),
+      }),
+    );
+    mockRepairFetch(FRESH_LEASE);
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs, errors } = await runGatewayToken();
+
+    expect(exited).toBe(false);
+    expect(errors).toContain(
+      "Re-provisioned guardian token (this revoked other devices' paired tokens).",
+    );
+    expect(logs).toContain("fresh-acc");
+    expect(loadGuardianToken("px")?.accessToken).toBe("fresh-acc");
+    expect(`${logs}\n${errors}`).not.toContain("hatch");
+  });
+
+  test("refresh reports repair failure and never suggests hatching", async () => {
+    seedLocalEntry({ guardianBootstrapSecret: "boot-secret-1" });
+    saveGuardianToken(
+      "px",
+      makeGuardianTokenData({
+        refreshTokenExpiresAt: new Date(Date.now() - 1000).toISOString(),
+      }),
+    );
+    // Malformed 200 lease → GuardianLeasePermanentError → no retries.
+    mockRepairFetch({});
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs, errors } = await runGatewayToken();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("Guardian token could not be re-provisioned.");
+    expect(errors).toContain("--repair-guardian");
+    expect(errors).toContain("CADET_REFRESH_ERROR=");
+    expect(`${logs}\n${errors}`).not.toContain("hatch");
+  });
+
+  test("refresh re-provisions when the token file is missing entirely", async () => {
+    seedLocalEntry({ guardianBootstrapSecret: "boot-secret-1" });
+    mockRepairFetch(FRESH_LEASE);
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs } = await runGatewayToken();
+
+    expect(exited).toBe(false);
+    expect(logs).toContain("fresh-acc");
+    expect(loadGuardianToken("px")?.accessToken).toBe("fresh-acc");
+  });
+});

package/src/__tests__/hatch-next-steps.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+
+import { logHatchNextSteps } from "../lib/hatch-next-steps";
+
+function captureNextSteps(): string[] {
+  const lines: string[] = [];
+  logHatchNextSteps((message) => lines.push(message));
+  return lines;
+}
+
+describe("logHatchNextSteps", () => {
+  test("names the production binary in a production environment", () => {
+    const prev = process.env.CADET_ENVIRONMENT;
+    try {
+      process.env.CADET_ENVIRONMENT = "production";
+      const lines = captureNextSteps();
+      expect(lines.join("\n")).toContain("`cadet client`");
+      expect(lines.join("\n")).toContain("`cadet tunnel`");
+      expect(lines.join("\n")).not.toContain("cadet-dev");
+    } finally {
+      if (prev === undefined) delete process.env.CADET_ENVIRONMENT;
+      else process.env.CADET_ENVIRONMENT = prev;
+    }
+  });
+
+  test("names the environment-suffixed binary in dev", () => {
+    const prev = process.env.CADET_ENVIRONMENT;
+    try {
+      process.env.CADET_ENVIRONMENT = "dev";
+      const lines = captureNextSteps();
+      expect(lines.join("\n")).toContain("`cadet-dev client`");
+      expect(lines.join("\n")).toContain("`cadet-dev tunnel`");
+    } finally {
+      if (prev === undefined) delete process.env.CADET_ENVIRONMENT;
+      else process.env.CADET_ENVIRONMENT = prev;
+    }
+  });
+});

package/src/__tests__/host-teleport-docker.test.ts

@@ -0,0 +1,371 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import * as tar from "tar";
+import {
+  restoreHostTeleportTarget,
+  TeleportRecoveryError,
+} from "../lib/host-teleport.js";
+import { dockerResourceNames } from "../lib/docker.js";
+import { DOCKER_STATEFUL_SET_SPEC } from "../lib/statefulset.js";
+import { packRoot, STATE_ROOTS } from "../lib/root-backup.js";
+import type { AssistantEntry } from "../lib/assistant-config.js";
+import { mockCommands } from "./commands-mock.js";
+
+const entry: AssistantEntry = {
+  assistantId: "destination",
+  cloud: "docker",
+  runtimeUrl: "http://localhost:7830",
+  containerInfo: {
+    assistantImage: "image-assistant",
+    gatewayImage: "image-gateway",
+    cesImage: "image-ces",
+    assistantPort: 7821,
+  },
+};
+const names = dockerResourceNames(entry.assistantId);
+const containers = {
+  assistant: names.assistantContainer,
+  gateway: names.gatewayContainer,
+  "credential-executor": names.cesContainer,
+};
+const services: Array<keyof typeof containers> = ["assistant", "gateway", "credential-executor"];
+const rootContainer = {
+  workspace: names.assistantContainer,
+  "gateway-security": names.gatewayContainer,
+  "ces-security": names.cesContainer,
+  "ces-data": names.cesContainer,
+};
+let directory: string, archive: string, recovery: string;
+let commands: ReturnType<typeof mockCommands>;
+let log: ReturnType<typeof spyOn>;
+let failReadiness: boolean, failEveryWrite: boolean, writes: number;
+let states: Map<string, ReturnType<typeof inspection>>;
+function inspection(service: keyof typeof containers) {
+  const spec = DOCKER_STATEFUL_SET_SPEC.containers.find(
+    (item) => item.internalName === service,
+  )!;
+  return {
+    Id: `${service}-id`,
+    Image: `image-${service}`,
+    State: { Status: "exited", Running: false },
+    Config: {
+      User: "1001:1001",
+      Env: [
+        "ACTOR_TOKEN_SIGNING_KEY=" + "07".repeat(32),
+        "CES_SERVICE_TOKEN=internal-test-token",
+        "RUNTIME_HTTP_PORT=7821",
+        "GATEWAY_PORT=7830",
+        "GUARDIAN_BOOTSTRAP_SECRET=bootstrap-test-secret",
+      ],
+    },
+    HostConfig: {
+      NetworkMode:
+        service === "assistant" ? names.network : "container:assistant-id",
+    },
+    Mounts: spec.volumeMounts.map((mount) => ({
+      Type: "volume",
+      Name: DOCKER_STATEFUL_SET_SPEC.volumeClaimTemplates
+        .find((volume) => volume.name === mount.volumeName)!
+        .dockerVolume(entry.assistantId),
+      Source: "/remote/volume",
+      Destination: mount.mountPath,
+      RW: !mount.readOnly,
+    })),
+  };
+}
+const previousDataHome = process.env.XDG_DATA_HOME;
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), "teleport-docker-"));
+  process.env.XDG_DATA_HOME = directory;
+  archive = join(directory, "source.tar.gz");
+  recovery = join(directory, "recovery.tar.gz");
+  for (const flavor of ["source", "original", "volumes"]) {
+    for (const root of STATE_ROOTS) {
+      await mkdir(join(directory, flavor, root), { recursive: true });
+      await writeFile(
+        join(directory, flavor, root, "value"),
+        flavor === "volumes" ? "original" : flavor,
+        { mode: 0o600 },
+      );
+    }
+    await writeFile(
+      join(directory, flavor, "gateway-security", "actor-token-signing-key"),
+      Buffer.alloc(32, flavor === "source" ? 9 : 7),
+    );
+    await writeFile(
+      join(directory, flavor, "ces-security", "keys.enc"),
+      flavor === "source" ? "source ciphertext" : "original ciphertext",
+      { mode: 0o600 },
+    );
+  }
+  await packRoot(join(directory, "source"), archive);
+  await packRoot(join(directory, "original"), recovery);
+  states = new Map(
+    services.map((service) => [
+      containers[service],
+      inspection(service),
+    ]),
+  );
+  failReadiness = false;
+  failEveryWrite = false;
+  writes = 0;
+  log = spyOn(console, "log").mockImplementation(() => {});
+  commands = mockCommands();
+  commands.on(
+    "docker",
+    (args) => args[0] === "inspect",
+    ({ args }) => {
+      const state = states.get(args.at(-1)!);
+      if (!state) {
+        return { code: 1, stderr: "No such container" };
+      }
+      if (args.includes("--format")) {
+        return {
+          stdout:
+            args[2] === "{{.State.Status}}"
+              ? state.State.Status
+              : String(state.State.Running),
+        };
+      }
+      return { stdout: JSON.stringify([state]) };
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "rm",
+    ({ args }) => {
+      const state = states.get(args[1]!);
+      if (!state) {
+        return { code: 1, stderr: "No such container" };
+      }
+      expect(state.State.Running).toBe(false);
+      states.delete(args[1]!);
+      return {};
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "create",
+    ({ args }) => {
+      const container = args[args.indexOf("--name") + 1]!;
+      const service = services.find((service) => containers[service] === container)!;
+      const state = inspection(service);
+      state.Config.Env = args.flatMap((value, index) =>
+        value === "-e" ? [args[index + 1]!] : [],
+      );
+      states.set(container, state);
+      return {};
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "start",
+    ({ args }) => {
+      const state = states.get(args[1]!)!;
+      state.State.Running = true;
+      state.State.Status = "running";
+      return {};
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "kill",
+    ({ args }) => {
+      expect(args[1]).toBe("--signal=SIGTERM");
+      const state = states.get(args.at(-1)!)!;
+      state.State.Running = false;
+      state.State.Status = "exited";
+      return {};
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "cp",
+    async ({ args }) => {
+      const root = STATE_ROOTS.find((root) => args[1]!.includes(`:/${root}/`))!;
+      expect(
+        states.get(rootContainer[root])!.State
+          .Running,
+      ).toBe(false);
+      await cp(join(directory, "volumes", root), args[2]!, { recursive: true });
+      return {};
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "run" && args.includes("-i"),
+    async ({ args, input }) => {
+      const mount = args[args.indexOf("--mount") + 1]!;
+      const root = STATE_ROOTS.find(
+        (root) =>
+          states
+            .get(rootContainer[root])!
+            .Mounts.find((item) => item.Destination === `/${root}`)?.Name ===
+          mount.split("src=")[1]!.split(",")[0]!,
+      )!;
+      expect([...states.values()].every((state) => !state.State.Running)).toBe(
+        true,
+      );
+      expect(args).toContain("--network=none");
+      expect(args).toContain("--user=0");
+      expect(args).toContain("1001:1001");
+      expect(args[args.indexOf("-ec") + 1]).toContain('chown -R "$1" /restore');
+      writes++;
+      if (failEveryWrite) {
+        return { code: 1, stderr: "injected volume write failure" };
+      }
+      const rootDir = join(directory, "volumes", root);
+      await rm(rootDir, { recursive: true });
+      await mkdir(rootDir);
+      await pipeline(
+        Readable.from([input]),
+        tar.x({ cwd: rootDir, preserveOwner: false }),
+      );
+      return {};
+    },
+  );
+  commands.on(
+    "docker",
+    (args) => args[0] === "exec",
+    () =>
+      failReadiness
+        ? { code: 2, stdout: "migration_failed", stderr: "migration_failed" }
+        : { stdout: "ready" },
+  );
+});
+afterEach(async () => {
+  if (previousDataHome === undefined) {
+    delete process.env.XDG_DATA_HOME;
+  } else {
+    process.env.XDG_DATA_HOME = previousDataHome;
+  }
+  commands.restore();
+  log.mockRestore();
+  await rm(directory, { recursive: true, force: true });
+});
+
+test("recreates immutable identity overrides and imports all roots before first start", async () => {
+  await restoreHostTeleportTarget(entry, archive, recovery);
+  for (const root of STATE_ROOTS) {
+    expect(
+      await readFile(join(directory, "volumes", root, "value"), "utf8"),
+    ).toBe("source");
+  }
+  expect(
+    await readFile(
+      join(directory, "volumes", "ces-security", "keys.enc"),
+      "utf8",
+    ),
+  ).toBe("source ciphertext");
+  expect(
+    await readFile(
+      join(directory, "volumes", "gateway-security", "actor-token-signing-key"),
+    ),
+  ).toEqual(Buffer.alloc(32, 9));
+  expect(
+    [...states.values()].every(
+      (state) =>
+        !state.Config.Env.some((value) =>
+          value.startsWith("ACTOR_TOKEN_SIGNING_KEY="),
+        ),
+    ),
+  ).toBe(true);
+  const firstStart = commands.calls.findIndex(
+    (request) => request.args[0] === "start",
+  );
+  const installs = commands.calls
+    .map((request, index) => ({ request, index }))
+    .filter(
+      ({ request }) => request.args[0] === "run" && request.args.includes("-i"),
+    );
+  expect(installs).toHaveLength(4);
+  expect(installs.every(({ index }) => index < firstStart)).toBe(true);
+});
+test("readiness failure restores original ciphertext, gateway identity, and stopped containers", async () => {
+  failReadiness = true;
+  await expect(
+    restoreHostTeleportTarget(entry, archive, recovery),
+  ).rejects.toThrow("did not become ready");
+  for (const root of STATE_ROOTS) {
+    expect(
+      await readFile(join(directory, "volumes", root, "value"), "utf8"),
+    ).toBe("original");
+  }
+  expect(
+    await readFile(
+      join(directory, "volumes", "ces-security", "keys.enc"),
+      "utf8",
+    ),
+  ).toBe("original ciphertext");
+  expect([...states.values()].every((state) => !state.State.Running)).toBe(
+    true,
+  );
+  expect(states.get(names.gatewayContainer)!.Config.Env).toContain(
+    "ACTOR_TOKEN_SIGNING_KEY=" + "07".repeat(32),
+  );
+});
+test("unrecoverable writes leave services stopped and report the retained recovery tar", async () => {
+  failEveryWrite = true;
+  await expect(
+    restoreHostTeleportTarget(entry, archive, recovery),
+  ).rejects.toBeInstanceOf(TeleportRecoveryError);
+  expect([...states.values()].every((state) => !state.State.Running)).toBe(
+    true,
+  );
+  expect(writes).toBeGreaterThan(1);
+});
+test("customized persistent mounts are rejected before container removal or volume writes", async () => {
+  states.get(names.cesContainer)!.Mounts[0]!.Name = "custom-security";
+  await expect(
+    restoreHostTeleportTarget(entry, archive, recovery),
+  ).rejects.toThrow("customized Docker mounts");
+  expect(commands.calls.some((request) => request.args[0] === "rm")).toBe(
+    false,
+  );
+  expect(writes).toBe(0);
+});
+test("legacy vbundle is rejected before touching destination containers", async () => {
+  await expect(
+    restoreHostTeleportTarget(
+      entry,
+      join(directory, "legacy.vbundle"),
+      recovery,
+    ),
+  ).rejects.toThrow("vellum-to-cadet");
+  expect(commands.calls).toHaveLength(0);
+});
+
+test("reads the remote Docker runtime version through in-container health instead of host ports", async () => {
+  const { readHostRuntimeVersion } = await import("../lib/host-teleport.js");
+  commands.on(
+    "docker",
+    (args) => args[0] === "exec" && args.at(-1)?.endsWith("/healthz") === true,
+    ({ args }) => {
+      expect(args[1]).toBe(names.gatewayContainer);
+      expect(args.at(-1)).toBe("http://127.0.0.1:7830/healthz");
+      return { stdout: JSON.stringify({ version: "0.12.9" }) };
+    },
+  );
+  expect(await readHostRuntimeVersion(entry)).toBe("0.12.9");
+});
+
+test("sleeping remote Docker runtime uses its recorded image tag for the version guard", async () => {
+  const { readHostRuntimeVersion } = await import("../lib/host-teleport.js");
+  commands.on("docker", (args) => args[0] === "exec", {
+    code: 1,
+    stderr: "container is stopped",
+  });
+  expect(
+    await readHostRuntimeVersion({
+      ...entry,
+      containerInfo: {
+        ...entry.containerInfo!,
+        gatewayImage: "mycadet/gateway:0.12.8",
+      },
+    }),
+  ).toBe("0.12.8");
+});