@mycadet/cli 0.12.10 → 0.13.0

package/src/__tests__/tunnel-startup-summary.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, test } from "bun:test";
+import { createServer } from "node:net";
+
+import { findAvailableIngressPort } from "../lib/nginx-ingress";
+import { edgeServedRemote } from "../lib/nginx-ingress";
+import { summarizeStartupFailure } from "../lib/tunnel";
+
+function portOf(server: ReturnType<typeof createServer>): number {
+  const addr = server.address();
+  return typeof addr === "object" && addr !== null ? addr.port : -1;
+}
+
+describe("summarizeStartupFailure", () => {
+  test("names an nginx emerg line over generic log noise", () => {
+    const log = [
+      "Starting ngrok tunnel to localhost:7840...",
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain("[emerg]");
+  });
+
+  test("names an ngrok error code", () => {
+    expect(
+      summarizeStartupFailure(
+        "agent started\nERR_NGROK_4018: Authentication failed",
+      ),
+    ).toContain("ERR_NGROK_4018");
+  });
+
+  test("the last matching line wins", () => {
+    const log = [
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+      "nginx: [emerg] bind() to 0.0.0.0:7841 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain(":7841");
+  });
+
+  test("falls back to the last non-empty line when nothing error-shaped appears", () => {
+    expect(summarizeStartupFailure("first line\nsome plain output")).toBe(
+      "some plain output",
+    );
+  });
+
+  test("an empty log summarizes to null", () => {
+    expect(summarizeStartupFailure("")).toBeNull();
+    expect(summarizeStartupFailure("\n  \n")).toBeNull();
+  });
+
+  test("long lines are capped", () => {
+    const long = `nginx: [emerg] ${"x".repeat(400)}`;
+    const summary = summarizeStartupFailure(long) ?? "";
+    expect(summary.length).toBeLessThanOrEqual(201);
+    expect(summary.endsWith("…")).toBe(true);
+  });
+});
+
+describe("findAvailableIngressPort", () => {
+  test("skips a port a foreign listener already holds", async () => {
+    const blocker = createServer();
+    await new Promise<void>((resolve) => {
+      blocker.listen(0, "127.0.0.1", resolve);
+    });
+    const occupied = portOf(blocker);
+    try {
+      const port = await findAvailableIngressPort(occupied);
+      expect(port).toBe(occupied + 1);
+    } finally {
+      await new Promise<void>((resolve) => blocker.close(() => resolve()));
+    }
+  });
+
+  test("returns null when the whole band is busy", async () => {
+    const scout = createServer();
+    await new Promise<void>((resolve) => scout.listen(0, "127.0.0.1", resolve));
+    const base = portOf(scout);
+    await new Promise<void>((resolve) => scout.close(() => resolve()));
+    // Hold both ports of a 2-port band with fresh listeners.
+    const first = createServer();
+    const second = createServer();
+    await new Promise<void>((resolve) =>
+      first.listen(base, "127.0.0.1", resolve),
+    );
+    await new Promise<void>((resolve) =>
+      second.listen(base + 1, "127.0.0.1", resolve),
+    );
+    try {
+      expect(await findAvailableIngressPort(base, 2)).toBeNull();
+    } finally {
+      await new Promise<void>((resolve) => first.close(() => resolve()));
+      await new Promise<void>((resolve) => second.close(() => resolve()));
+    }
+  });
+});
+
+describe("edgeServedRemote", () => {
+  test("a docker cadet is stamped truthfully", () => {
+    expect(edgeServedRemote("docker")).toBe("docker");
+  });
+
+  test("a custom cadet keeps its kind", () => {
+    expect(edgeServedRemote("custom")).toBe("custom");
+  });
+
+  test("local, paired, cloud, and unknown entries read as custom so the remote-gateway machinery always runs", () => {
+    expect(edgeServedRemote("local")).toBe("custom");
+    expect(edgeServedRemote("paired")).toBe("custom");
+    expect(edgeServedRemote("cloud")).toBe("custom");
+    expect(edgeServedRemote(undefined)).toBe("custom");
+  });
+});

package/src/__tests__/tunnel-stop.test.ts

@@ -0,0 +1,226 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import {
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as processes from "../lib/process.js";
+import {
+  TAILSCALE_PROVIDER,
+  stopTailscaleTunnel,
+  type TailscaleDeps,
+} from "../lib/tunnels/tailscale.js";
+import * as ngrok from "../lib/tunnels/ngrok.js";
+import { tunnel } from "../commands/tunnel.js";
+import {
+  readRootProcesses,
+  saveAssistantEntry,
+  stampRootProcess,
+  findAssistantByName,
+} from "../lib/assistant-config.js";
+
+const originalArgv = process.argv;
+const originalLock = process.env.CADET_LOCKFILE_DIR;
+const originalConfig = process.env.XDG_CONFIG_HOME;
+let root = "";
+let workspace = "";
+let stop: ReturnType<typeof spyOn<typeof processes, "stopProcess">>;
+let identity: ReturnType<
+  typeof spyOn<typeof processes, "readProcessCommandLine">
+>;
+let logs: ReturnType<typeof spyOn<typeof console, "log">>;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "cadet-tunnel-stop-"));
+  workspace = join(root, "instance", "workspace");
+  mkdirSync(workspace, { recursive: true });
+  process.env.CADET_LOCKFILE_DIR = root;
+  process.env.XDG_CONFIG_HOME = root;
+  saveAssistantEntry({
+    assistantId: "fixture",
+    name: "fixture",
+    cloud: "local",
+    runtimeUrl: "http://127.0.0.1:7830",
+    ingressUrl: "https://old.ngrok.app",
+    resources: {
+      instanceDir: join(root, "instance"),
+      gatewayPort: 7830,
+      daemonPort: 7821,
+      cesPort: 8090,
+      qdrantPort: 6333,
+    },
+  });
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify({
+      ingress: {
+        publicBaseUrl: "https://old.ngrok.app",
+        lastTunnel: {
+          provider: "ngrok",
+          publicBaseUrl: "https://old.ngrok.app",
+        },
+      },
+    }),
+  );
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "ngrok",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  stampRootProcess("app", { pid: 424243, startedAt: new Date().toISOString() });
+  ngrok.saveNgrokDomain("old.ngrok.app");
+  stop = spyOn(processes, "stopProcess").mockResolvedValue(true);
+  identity = spyOn(processes, "readProcessCommandLine").mockReturnValue(
+    "ngrok http 7840",
+  );
+  logs = spyOn(console, "log").mockImplementation(() => {});
+  process.argv = ["bun", "cadet", "tunnel", "stop", "fixture"];
+});
+afterEach(() => {
+  stop.mockRestore();
+  identity.mockRestore();
+  logs.mockRestore();
+  process.argv = originalArgv;
+  if (originalLock === undefined) delete process.env.CADET_LOCKFILE_DIR;
+  else process.env.CADET_LOCKFILE_DIR = originalLock;
+  if (originalConfig === undefined) delete process.env.XDG_CONFIG_HOME;
+  else process.env.XDG_CONFIG_HOME = originalConfig;
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("stop terminates the owned agent and clears ingress, retaining nginx and domain; repeated stop is harmless", async () => {
+  await tunnel();
+  expect(stop).toHaveBeenCalledWith(424242, "tunnel");
+  expect(readRootProcesses().tunnel).toBeUndefined();
+  expect(readRootProcesses().app?.pid).toBe(424243);
+  expect(findAssistantByName("fixture")?.ingressUrl).toBeUndefined();
+  expect(
+    JSON.parse(readFileSync(join(workspace, "config.json"), "utf8")).ingress
+      .publicBaseUrl,
+  ).toBeUndefined();
+  expect(ngrok.loadNgrokDomain()).toBe("old.ngrok.app");
+  await tunnel();
+  expect(stop).toHaveBeenCalledTimes(1);
+});
+test("a recycled PID is not signaled and its stale record is cleared", async () => {
+  identity.mockReturnValue("unrelated-process");
+  await tunnel();
+  expect(stop).not.toHaveBeenCalled();
+  expect(readRootProcesses().tunnel).toBeUndefined();
+});
+test("another assistant's tunnel is left intact", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "ngrok",
+    assistantId: "another",
+    startedAt: new Date().toISOString(),
+  });
+  await expect(tunnel()).rejects.toThrow("belongs to 'another'");
+  expect(stop).not.toHaveBeenCalled();
+  expect(readRootProcesses().tunnel?.assistantId).toBe("another");
+});
+test("failure to stop retains process and ingress state", async () => {
+  stop.mockResolvedValue(false);
+  await expect(tunnel()).rejects.toThrow("Could not stop ngrok");
+  expect(readRootProcesses().tunnel?.pid).toBe(424242);
+  expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+    "https://old.ngrok.app",
+  );
+});
+
+test("Cloudflare dispatch stops cloudflared and clears its ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "cloudflare",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  identity.mockReturnValue(
+    "/usr/local/bin/cloudflared tunnel --url http://localhost:7840",
+  );
+  await tunnel();
+  expect(stop).toHaveBeenCalledWith(424242, "tunnel");
+  expect(readRootProcesses().tunnel).toBeUndefined();
+  expect(findAssistantByName("fixture")?.ingressUrl).toBeUndefined();
+});
+
+test("Tailscale dispatch disables serve and preserves a separate webhook ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "tailscale",
+    previous: {
+      pid: 424240,
+      provider: "ngrok",
+      assistantId: "fixture",
+      startedAt: new Date().toISOString(),
+    },
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify({
+      ingress: {
+        publicBaseUrl: "https://old.ngrok.app",
+        pairingTunnel: { provider: "tailscale" },
+      },
+    }),
+  );
+  const calls: string[][] = [];
+  const deps: TailscaleDeps = {
+    findBinary: async () => "tailscale",
+    run: (_bin, args) => {
+      calls.push(args);
+      return { status: 0, stdout: "", stderr: "" };
+    },
+  };
+  const provider = spyOn(TAILSCALE_PROVIDER, "stop").mockImplementation(
+    (opts) => stopTailscaleTunnel(opts, deps),
+  );
+  try {
+    await tunnel();
+    expect(calls).toEqual([["serve", "--https=443", "off"]]);
+    expect(stop).not.toHaveBeenCalled();
+    expect(readRootProcesses().tunnel?.pid).toBe(424240);
+    expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+      "https://old.ngrok.app",
+    );
+    const state = JSON.parse(
+      readFileSync(join(workspace, "config.json"), "utf8"),
+    );
+    expect(state.ingress.publicBaseUrl).toBe("https://old.ngrok.app");
+    expect(state.ingress.pairingTunnel).toBeUndefined();
+  } finally {
+    provider.mockRestore();
+  }
+});
+
+test("Tailscale shutdown failure preserves the recorded tunnel and ingress", async () => {
+  stampRootProcess("tunnel", {
+    pid: 424242,
+    provider: "tailscale",
+    assistantId: "fixture",
+    startedAt: new Date().toISOString(),
+  });
+  const deps: TailscaleDeps = {
+    findBinary: async () => "tailscale",
+    run: () => ({ status: 1, stdout: "", stderr: "permission denied" }),
+  };
+  const provider = spyOn(TAILSCALE_PROVIDER, "stop").mockImplementation(
+    (opts) => stopTailscaleTunnel(opts, deps),
+  );
+  try {
+    await expect(tunnel()).rejects.toThrow("Could not stop tailscale serve");
+    expect(readRootProcesses().tunnel?.provider).toBe("tailscale");
+    expect(findAssistantByName("fixture")?.ingressUrl).toBe(
+      "https://old.ngrok.app",
+    );
+  } finally {
+    provider.mockRestore();
+  }
+});

package/src/__tests__/tunnel.test.ts

@@ -53,6 +53,10 @@ const runCloudflareTunnelMock = mock<
 mock.module("../lib/tunnels/cloudflare.js", () => ({
   ...realCloudflareTunnel,
   runCloudflareTunnel: runCloudflareTunnelMock,
+  CLOUDFLARE_PROVIDER: {
+    ...realCloudflareTunnel.CLOUDFLARE_PROVIDER,
+    run: runCloudflareTunnelMock,
+  },
 }));
 
 const runNgrokTunnelMock = mock<typeof ngrok.runNgrokTunnel>(async () =>
@@ -61,6 +65,7 @@ const runNgrokTunnelMock = mock<typeof ngrok.runNgrokTunnel>(async () =>
 mock.module("../lib/tunnels/ngrok", () => ({
   ...realNgrok,
   runNgrokTunnel: runNgrokTunnelMock,
+  NGROK_PROVIDER: { ...realNgrok.NGROK_PROVIDER, run: runNgrokTunnelMock },
 }));
 
 const runTailscaleTunnelMock = mock<typeof tailscaleTunnel.runTailscaleTunnel>(
@@ -69,6 +74,10 @@ const runTailscaleTunnelMock = mock<typeof tailscaleTunnel.runTailscaleTunnel>(
 mock.module("../lib/tunnels/tailscale.js", () => ({
   ...realTailscaleTunnel,
   runTailscaleTunnel: runTailscaleTunnelMock,
+  TAILSCALE_PROVIDER: {
+    ...realTailscaleTunnel.TAILSCALE_PROVIDER,
+    run: runTailscaleTunnelMock,
+  },
 }));
 
 const notifyGatewayOfPublicUrlMock = mock<
@@ -123,7 +132,7 @@ function makeCloudEntry(assistantId = "cloud-1"): AssistantEntry {
   return {
     assistantId,
     runtimeUrl: `https://runtime.example.com/${assistantId}`,
-    cloud: "cadet",
+    cloud: "cloud",
   };
 }
 
@@ -1705,6 +1714,7 @@ describe("tunnel background mode", () => {
     mock.module("../lib/tunnels/ngrok", () => ({
       ...realNgrok,
       runNgrokTunnel: runNgrokTunnelMock,
+      NGROK_PROVIDER: { ...realNgrok.NGROK_PROVIDER, run: runNgrokTunnelMock },
     }));
     mock.module("../lib/nginx-ingress.js", () => ({
       ...realNginxIngress,
@@ -1780,7 +1790,7 @@ describe("tunnel background mode", () => {
 
     expect(logs).toContain("Tunnel established: https://foo.ngrok.app");
     expect(logs).toContain("Running in background (pid 9999)");
-    expect(logs).toContain("Stop with: kill 9999");
+    expect(logs).toContain("Stop with: cadet tunnel stop");
 
     // The parent hands the actual tunnel workflow off to the child: it never
     // runs the provider or edge setup itself.
@@ -1818,7 +1828,7 @@ describe("tunnel background mode", () => {
     const { exited, errors } = await runTunnelExpectingExit1();
 
     expect(exited).toBe(true);
-    expect(errors).toContain("exited during startup (exit code 1)");
+    expect(errors).toContain("Error (1): tunnel process exited during startup");
     expect(runNgrokTunnelMock).not.toHaveBeenCalled();
   });
 

package/src/__tests__/upgrade-local.test.ts

@@ -55,7 +55,7 @@ mock.module("../lib/assistant-config", () => ({
 }));
 
 const createBackupMock = mock<typeof backupOps.createBackup>(
-  async () => "/tmp/local-pre-upgrade.vbundle",
+  async () => "/tmp/local-pre-upgrade.tar.gz",
 );
 const pruneOldBackupsMock = mock<typeof backupOps.pruneOldBackups>(() => {});
 const restoreBackupMock = mock<typeof backupOps.restoreBackup>(
@@ -238,7 +238,7 @@ beforeEach(() => {
   loadAllAssistantsMock.mockReturnValue([entry]);
   saveAssistantEntryMock.mockReset();
   createBackupMock.mockReset();
-  createBackupMock.mockResolvedValue("/tmp/local-pre-upgrade.vbundle");
+  createBackupMock.mockResolvedValue("/tmp/local-pre-upgrade.tar.gz");
   pruneOldBackupsMock.mockReset();
   pruneOldBackupsMock.mockReturnValue(undefined);
   restoreBackupMock.mockReset();
@@ -372,7 +372,7 @@ describe("cadet upgrade local", () => {
     await upgrade();
 
     expect(loopbackSafeFetchMock).toHaveBeenCalledWith(
-      "http://127.0.0.1:7830/healthz?include=migrations",
+      "http://127.0.0.1:7830/healthz",
       expect.any(Object),
     );
     expect(createBackupMock).toHaveBeenCalledWith(
@@ -382,14 +382,6 @@ describe("cadet upgrade local", () => {
         prefix: "local-assistant-pre-upgrade",
       }),
     );
-    expect(saveAssistantEntryMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        previousVersion: "v0.8.11",
-        previousDbMigrationVersion: 12,
-        previousWorkspaceMigrationId: "011-test",
-        preUpgradeBackupPath: "/tmp/local-pre-upgrade.vbundle",
-      }),
-    );
     expect(stopLocalProcessesMock).toHaveBeenCalledWith(
       expect.objectContaining({
         instanceDir: tempDir,
@@ -446,6 +438,24 @@ describe("cadet upgrade local", () => {
     expect(consoleLogSpy.mock.calls.flat().join("\n")).toContain("upgraded to");
   });
 
+  test("failed safety backup aborts before runtime installation or service replacement", async () => {
+    createBackupMock.mockResolvedValue(null);
+    await expect(upgrade()).rejects.toThrow("process.exit(1)");
+    expect(ensureLocalRuntimeMock).not.toHaveBeenCalled();
+    expect(stopLocalProcessesMock).not.toHaveBeenCalled();
+    expect(startLocalDaemonMock).not.toHaveBeenCalled();
+  });
+
+  test("failed target startup restores prior runtime selection and all roots before restarting", async () => {
+    startLocalDaemonMock.mockRejectedValueOnce(new Error("target startup failed"));
+    await expect(upgrade()).rejects.toThrow("process.exit(1)");
+    expect(restoreBackupMock).toHaveBeenCalledWith("http://127.0.0.1:7830", "local-assistant", "/tmp/local-pre-upgrade.tar.gz", { resume: false });
+    expect(startLocalDaemonMock).toHaveBeenCalledTimes(2);
+    expect(startCesMock).toHaveBeenCalledTimes(2);
+    expect(stopLocalProcessesMock).toHaveBeenCalledTimes(2);
+    expect(waitForReadyMock).toHaveBeenCalled();
+  });
+
   test("skips restart when the local assistant is already on the target version", async () => {
     loopbackSafeFetchMock.mockResolvedValue({
       ok: true,

package/src/__tests__/upgrade-replay-env.test.ts

@@ -156,10 +156,10 @@ describe("buildReplayState", () => {
     expect(state.signingKey).toBe("sign-key");
   });
 
-  test("generates fresh secrets when missing from captured env", () => {
+  test("generates a service token but preserves file-backed signing identity when env is absent", () => {
     const state = buildReplayState({}, {});
     expect(state.bootstrapSecret).toBeUndefined();
     expect(state.cesServiceToken).toMatch(/^[0-9a-f]{64}$/);
-    expect(state.signingKey).toMatch(/^[0-9a-f]{64}$/);
+    expect(state.signingKey).toBeUndefined();
   });
 });

package/src/__tests__/upgrade-root-recovery.test.ts

@@ -0,0 +1,185 @@
+import { afterAll, beforeEach, expect, spyOn, test } from "bun:test";
+import * as backups from "../lib/backup-ops.js";
+import * as docker from "../lib/docker.js";
+import * as lifecycle from "../lib/upgrade-lifecycle.js";
+import * as config from "../lib/assistant-config.js";
+import { mockCommands } from "./commands-mock.js";
+import * as loopback from "../lib/loopback-fetch.js";
+
+const capture = spyOn(backups, "createBackup");
+const images = spyOn(docker, "captureImageRefs");
+const pull = spyOn(docker, "pullImage");
+const wake = spyOn(docker, "wakeContainers");
+const save = spyOn(config, "saveAssistantEntry");
+const restore = spyOn(backups, "restoreBackup");
+const sleep = spyOn(docker, "sleepContainers");
+const stop = spyOn(docker, "stopContainers");
+const start = spyOn(docker, "startContainers");
+const fetch = spyOn(loopback, "loopbackSafeFetch");
+const res = docker.dockerResourceNames("recovery");
+const containerOptions = {
+  gatewayPort: 7830,
+  assistantPort: 3001,
+  imageTags: {
+    assistant: "assistant:old",
+    gateway: "gateway:old",
+    "credential-executor": "ces:old",
+  },
+  instanceName: "recovery",
+  res,
+};
+const events: string[] = [];
+beforeEach(() => {
+  events.length = 0;
+  capture.mockReset();
+  images.mockReset();
+  pull.mockReset();
+  wake.mockReset();
+  save.mockReset();
+  save.mockImplementation(() => {});
+  restore.mockReset();
+  sleep.mockReset();
+  stop.mockReset();
+  start.mockReset();
+  fetch.mockReset();
+  restore.mockImplementation(async () => {
+    events.push("restore-roots");
+    return true;
+  });
+  sleep.mockImplementation(async () => {
+    events.push("sleep");
+  });
+  stop.mockImplementation(async () => {
+    events.push("remove");
+  });
+  start.mockImplementation(async () => {
+    events.push("start-old-version");
+  });
+  fetch.mockImplementation(async () => {
+    events.push("check-ready");
+    return Response.json({ ready: true });
+  });
+});
+afterAll(() => {
+  for (const spy of [
+    restore,
+    sleep,
+    stop,
+    start,
+    fetch,
+    capture,
+    images,
+    pull,
+    wake,
+    save,
+  ])
+    spy.mockRestore();
+});
+
+test("failed-state recovery restores tar roots while stopped before restarting old services", async () => {
+  expect(
+    await lifecycle.attemptFailedStateRestore({
+      runtimeUrl: "http://127.0.0.1:1",
+      assistantId: "recovery",
+      backupPath: "pre-upgrade.tar.gz",
+      backupLabel: "pre-upgrade",
+      res,
+      containerOptions,
+    }),
+  ).toEqual({ restored: true, ready: true });
+  expect(restore).toHaveBeenCalledWith(
+    "http://127.0.0.1:1",
+    "recovery",
+    "pre-upgrade.tar.gz",
+    { resume: false },
+  );
+  expect(events).toEqual([
+    "restore-roots",
+    "sleep",
+    "remove",
+    "start-old-version",
+    "check-ready",
+  ]);
+});
+
+test("failed root restore does not restart a partial installation", async () => {
+  restore.mockResolvedValue(false);
+  expect(
+    await lifecycle.attemptFailedStateRestore({
+      runtimeUrl: "http://127.0.0.1:1",
+      assistantId: "recovery",
+      backupPath: "pre-upgrade.tar.gz",
+      backupLabel: "pre-upgrade",
+      res,
+      containerOptions,
+    }),
+  ).toEqual({ restored: false, ready: false });
+  expect(start).not.toHaveBeenCalled();
+  expect(stop).not.toHaveBeenCalled();
+  expect(fetch).not.toHaveBeenCalled();
+});
+
+test("versioned restore installs roots into stopped target containers before first startup", async () => {
+  const commands = mockCommands();
+  commands.on(
+    "docker",
+    (args) => args[0] === "inspect",
+    () => ({
+      stdout: JSON.stringify(["ACTOR_TOKEN_SIGNING_KEY=" + "01".repeat(32)]),
+    }),
+  );
+  const entry: config.AssistantEntry = {
+    assistantId: "recovery",
+    cloud: "docker",
+    runtimeUrl: "http://127.0.0.1:1",
+  };
+  capture.mockImplementation(async () => {
+    events.push("capture-safety");
+    return "/tmp/pre-rollback.tar.gz";
+  });
+  images.mockResolvedValue({
+    assistant: "assistant:current",
+    gateway: "gateway:current",
+    "credential-executor": "ces:current",
+  });
+  pull.mockResolvedValue(undefined);
+  start.mockImplementation(async (options) => {
+    expect(options.createOnly).toBe(true);
+    events.push("create-stopped-target");
+  });
+  wake.mockImplementation(async () => {
+    events.push("wake-restored-target");
+  });
+  fetch.mockImplementation(async (url) => {
+    if (String(url).includes("/healthz"))
+      return Response.json({ version: "0.12.11" });
+    if (String(url).includes("/readyz")) {
+      events.push("check-ready");
+      return Response.json({ ready: true });
+    }
+    return Response.json({});
+  });
+  try {
+    await lifecycle.performDockerRollback(entry, {
+      targetVersion: "0.12.10",
+      backupPath: "/tmp/source.tar.gz",
+    });
+    expect(restore).toHaveBeenCalledWith(
+      entry.runtimeUrl,
+      entry.assistantId,
+      "/tmp/source.tar.gz",
+      { resume: false },
+    );
+    expect(events).toEqual([
+      "capture-safety",
+      "sleep",
+      "remove",
+      "create-stopped-target",
+      "restore-roots",
+      "wake-restored-target",
+      "check-ready",
+    ]);
+  } finally {
+    commands.restore();
+  }
+});

package/src/__tests__/windows-lifecycle.test.ts

@@ -227,3 +227,28 @@ test("preserves PID tracking when process termination fails", async () => {
   expect(isProcessAlive(pidFile)).toEqual({ alive: true, pid: process.pid });
   rmSync(dir, { recursive: true, force: true });
 });
+
+test("graceful-only stop times out without SIGKILL or losing PID identity", async () => {
+  const originalKill = process.kill;
+  const calls: Array<NodeJS.Signals | number | undefined> = [];
+  process.kill = ((_pid: number, signal?: NodeJS.Signals | number) => {
+    calls.push(signal);
+    return true;
+  }) as typeof process.kill;
+  try {
+    expect(
+      await stopProcess(
+        4812,
+        "backup service",
+        0,
+        "linux",
+        undefined,
+        () => "cadet-daemon",
+        true,
+      ),
+    ).toBe(false);
+    expect(calls).toEqual([0, "SIGTERM", 0]);
+  } finally {
+    process.kill = originalKill;
+  }
+});