@mycadet/cli 0.12.10 → 0.13.0-dev.202610171617.9ea363e

package/src/__tests__/root-signing-key.test.ts

@@ -0,0 +1,50 @@
+import { afterEach, expect, test } from "bun:test";
+import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { persistRootSigningKey } from "../lib/root-signing-key.js";
+const directories: string[] = [];
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "root-signing-key-"));
+  directories.push(root);
+  return root;
+}
+afterEach(() => {
+  for (const root of directories.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+test("persists the raw key privately so offline capture retains installation identity", () => {
+  const root = fixture();
+  persistRootSigningKey(root, "07".repeat(32));
+  const file = join(root, "gateway-security", "actor-token-signing-key");
+  expect(readFileSync(file)).toEqual(Buffer.alloc(32, 7));
+  if (process.platform !== "win32") {
+    expect(statSync(file).mode & 0o777).toBe(0o600);
+  }
+});
+test("replaces a key file link without changing its target", () => {
+  const root = fixture();
+  persistRootSigningKey(root, "07".repeat(32));
+  const target = join(root, "other");
+  writeFileSync(target, "unchanged");
+  const file = join(root, "gateway-security", "actor-token-signing-key");
+  rmSync(file);
+  symlinkSync(target, file);
+  persistRootSigningKey(root, "09".repeat(32));
+  expect(readFileSync(target, "utf8")).toBe("unchanged");
+  expect(readFileSync(file)).toEqual(Buffer.alloc(32, 9));
+});
+test("rejects invalid key data before writing service state", () => {
+  const root = fixture();
+  expect(() => persistRootSigningKey(root, "bad")).toThrow(
+    "Invalid gateway signing key",
+  );
+});

package/src/__tests__/setup.test.ts

@@ -62,7 +62,7 @@ function writeLockfile(entry: AssistantEntry): void {
   const lockfileDir = process.env.CADET_LOCKFILE_DIR!;
   mkdirSync(lockfileDir, { recursive: true });
   writeFileSync(
-    join(lockfileDir, ".cadet.lock.json"),
+    join(lockfileDir, "lockfile.json"),
     JSON.stringify(
       {
         assistants: [entry],
@@ -119,6 +119,10 @@ function installFetchStub(
       });
     }
 
+    if (url.endsWith("/v1/config/llm/default-provider")) {
+      return Response.json({ provider: "anthropic" });
+    }
+
     if (url.endsWith("/v1/secrets/read")) {
       return new Response(JSON.stringify({ found: false }), {
         status: 200,
@@ -189,7 +193,9 @@ describe("setup command", () => {
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer guardian-token",
     );
@@ -245,7 +251,9 @@ describe("setup command", () => {
     // gate instead of burning retry attempts against it.
     expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/readyz");
     expect(fetchCalls[1].url).toBe("http://127.0.0.1:3000/v1/guardian/init");
-    expect(fetchCalls[2].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[2].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[2].headers.get("Authorization")).toBe(
       "Bearer leased-guardian-token",
     );
@@ -283,12 +291,14 @@ describe("setup command", () => {
       assistantId: "assistant-123",
       runtimeUrl: "https://assistant.example",
       bearerToken: "entry-token",
-      cloud: "cadet",
+      cloud: "cloud",
     });
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("https://assistant.example/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "https://assistant.example/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer entry-token",
     );
@@ -300,7 +310,7 @@ describe("setup command", () => {
       assistantId: "assistant-123",
       runtimeUrl: "https://assistant.example",
       bearerToken: "entry-token",
-      cloud: "cadet",
+      cloud: "cloud",
     });
     saveGuardianToken(
       "assistant-123",
@@ -329,7 +339,7 @@ describe("setup command", () => {
       assistantId: "assistant-123",
       runtimeUrl: "https://assistant.example",
       bearerToken: "entry-token",
-      cloud: "cadet",
+      cloud: "cloud",
     });
     saveGuardianToken(
       "assistant-123",

package/src/__tests__/shell-mode.test.ts

@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  readRootProcesses,
+  stampRootProcess,
+} from "../lib/assistant-config.js";
+import {
+  DEFAULT_SHELL_MODE,
+  readShellMode,
+  saveShellMode,
+} from "../lib/ingress-config.js";
+
+// Create a temp directory and set CADET_LOCKFILE_DIR so the real lockfile
+// helpers resolve inside it (the root-process-lockfile.test.ts pattern).
+let testDir: string;
+
+beforeEach(() => {
+  testDir = mkdtempSync(join(tmpdir(), "cadet-shell-mode-test-"));
+  mkdirSync(join(testDir, "config"), { recursive: true });
+  process.env.CADET_LOCKFILE_DIR = join(testDir, "config");
+});
+
+afterEach(() => {
+  delete process.env.CADET_LOCKFILE_DIR;
+  rmSync(testDir, { recursive: true, force: true });
+});
+
+function lockfile(): Record<string, unknown> {
+  return JSON.parse(
+    readFileSync(join(testDir, "config", "lockfile.json"), "utf-8"),
+  ) as Record<string, unknown>;
+}
+
+describe("ingress shell mode setting", () => {
+  test("an absent lockfile reads as the web default", () => {
+    expect(readShellMode()).toBe("web");
+  });
+
+  test("a lockfile without the key reads as the web default", () => {
+    stampRootProcess("app", {
+      pid: 7840,
+      startedAt: "2026-10-16T00:00:00.000Z",
+    });
+    expect(readShellMode()).toBe(DEFAULT_SHELL_MODE);
+    expect(readShellMode()).toBe("web");
+  });
+
+  test("saves and reads back the app mode", () => {
+    saveShellMode("app");
+    expect(readShellMode()).toBe("app");
+    saveShellMode("web");
+    expect(readShellMode()).toBe("web");
+  });
+
+  test("saving lands at the lockfile root beside the app record", () => {
+    stampRootProcess("app", {
+      pid: 7840,
+      startedAt: "2026-10-16T00:00:00.000Z",
+    });
+    saveShellMode("app");
+    const saved = lockfile();
+    expect(saved.edgeShell).toBe("app");
+    // The lifecycle-scoped nginx record the setting configures survives.
+    expect(readRootProcesses().app?.pid).toBe(7840);
+  });
+
+  test("an unrecognized value fails loudly instead of defaulting", () => {
+    writeFileSync(
+      join(testDir, "config", "lockfile.json"),
+      JSON.stringify({ edgeShell: "aps" }) + "\n",
+    );
+    expect(() => readShellMode()).toThrow('must be "web" or "app"');
+  });
+});

package/src/__tests__/sleep.test.ts

@@ -216,6 +216,12 @@ describe("sleep command", () => {
     expect(stopProcessByPidFileMock).toHaveBeenCalledTimes(3);
   });
 
+  test("default sleep passes the non-escalating service stopper", async () => {
+    process.argv = ["bun", "cadet", "sleep", "sleep-test"];
+    await sleep();
+    expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(1, join(assistantRootDir, "workspace", "cadet.pid"), "assistant", undefined, 45_000, realProcess.stopProcessGracefully);
+  });
+
   test("force stops the assistant even when an active call lease exists", async () => {
     writeLeaseFile(["call-active-1"]);
     process.argv = ["bun", "cadet", "sleep", "sleep-test", "--force"];
@@ -238,6 +244,7 @@ describe("sleep command", () => {
       "assistant",
       undefined,
       45_000,
+      expect.any(Function),
     );
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       2,
@@ -245,12 +252,16 @@ describe("sleep command", () => {
       "gateway",
       undefined,
       7000,
+      expect.any(Function),
     );
     // The CES sibling is stopped by its PID file; a no-op when absent.
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       3,
       join(assistantRootDir, "ces.pid"),
       "credential-executor",
+      undefined,
+      45_000,
+      expect.any(Function),
     );
   });