@mycadet/cli 0.12.10 → 0.13.0

package/src/__tests__/cloud-login-poll.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "bun:test";
+import { pollingCloudLogin } from "../lib/cloud-login-poll.js";
+
+const login = {
+  request_id: "a".repeat(64),
+  poll_secret: "b".repeat(64),
+  verification_uri: "https://example.com/account/cli?request=test",
+  user_code: "AAAAAAAA",
+  interval: 1,
+};
+
+describe("terminal login polling", () => {
+  test("prints the browser URL/code and waits for approval using a private poll secret", async () => {
+    const logs: string[] = [];
+    const bodies: unknown[] = [];
+    let polls = 0;
+    const request = async (url: string | URL | Request, init?: RequestInit) => {
+      bodies.push(init?.body);
+      if (String(url).endsWith("/start")) return Response.json(login);
+      return ++polls === 1
+        ? Response.json({ status: "pending" }, { status: 202 })
+        : Response.json({ session_token: "session-test" });
+    };
+    expect(
+      await pollingCloudLogin("https://cloud.example.com", {
+        fetch: request,
+        log: (line) => logs.push(line),
+      }),
+    ).toBe("session-test");
+    expect(polls).toBe(2);
+    expect(logs.join("\n")).toContain(login.verification_uri);
+    expect(logs.join("\n")).toContain(login.user_code);
+    expect(logs.join("\n")).not.toContain(login.poll_secret);
+    expect(JSON.parse(String(bodies[1]))).toEqual({
+      request_id: login.request_id,
+      poll_secret: login.poll_secret,
+    });
+  });
+
+  test("times out even while a network request is hung", async () => {
+    const request = async (_url: unknown, init?: RequestInit) =>
+      new Promise<Response>((_resolve, reject) => {
+        init?.signal?.addEventListener(
+          "abort",
+          () => reject(new Error("aborted")),
+          { once: true },
+        );
+      });
+    await expect(
+      pollingCloudLogin("https://example.com", {
+        fetch: request,
+        timeoutMs: 20,
+      }),
+    ).rejects.toThrow("Login timed out after 5 minutes");
+  });
+
+  test("expired approval fails without returning a token", async () => {
+    const request = async (url: unknown) =>
+      String(url).endsWith("/start")
+        ? Response.json(login)
+        : Response.json({}, { status: 410 });
+    await expect(
+      pollingCloudLogin("https://example.com", {
+        fetch: request,
+        log: () => {},
+      }),
+    ).rejects.toThrow("expired");
+  });
+});

package/src/__tests__/cloud-releases.test.ts

@@ -13,6 +13,8 @@ import {
   isStagingVersion,
 } from "../lib/version-compat.js";
 
+import { CADET_GITHUB_REPOSITORY } from "../lib/github-repository.js";
+
 const originalFetch = globalThis.fetch;
 
 function mockFetchJson(body: unknown, status = 200) {
@@ -207,3 +209,83 @@ describe("fetchLatestVersion", () => {
     expect(await fetchLatestVersion("preview")).toBeNull();
   });
 });
+
+describe("stable release fallback", () => {
+  function withGitHubFallback(cloudBody: unknown, cloudStatus = 200) {
+    const fetchMock = mock(async (url: RequestInfo | URL) => {
+      if (String(url).startsWith("https://api.github.com/")) {
+        return Response.json({
+          tag_name: "v0.12.11",
+          draft: false,
+          prerelease: false,
+        });
+      }
+      return Response.json(cloudBody, { status: cloudStatus });
+    });
+    globalThis.fetch = Object.assign(fetchMock, {
+      preconnect: originalFetch.preconnect,
+    });
+    return fetchMock;
+  }
+
+  test.each([
+    [404, { detail: "not found" }],
+    [503, { detail: "unavailable" }],
+    [200, []],
+    [200, { results: [] }],
+    [200, [{ version: "not-a-version" }]],
+    [200, [{ version: "0.13.0-preview.1" }]],
+    [200, [{ version: "0.13.0", is_stable: false }]],
+  ])("falls back for cloud status %s and body %j", async (status, body) => {
+    const fetchMock = withGitHubFallback(body, status);
+    expect(await fetchLatestVersion()).toBe("0.12.11");
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(String(fetchMock.mock.calls[1][0])).toBe(
+      `https://api.github.com/repos/${CADET_GITHUB_REPOSITORY}/releases/latest`,
+    );
+  });
+
+  test("falls back when the cloud request throws", async () => {
+    const fetchMock = withGitHubFallback([]);
+    globalThis.fetch = Object.assign(
+      mock(async (url: RequestInfo | URL) => {
+        if (!String(url).startsWith("https://api.github.com/")) {
+          throw new TypeError("fetch failed");
+        }
+        return fetchMock(url);
+      }),
+      { preconnect: originalFetch.preconnect },
+    );
+    expect(await fetchLatestVersion()).toBe("0.12.11");
+  });
+
+  test("does not contact GitHub when cloud discovery succeeds", async () => {
+    const fetchMock = withGitHubFallback([RELEASE]);
+    expect(await fetchLatestVersion()).toBe(RELEASE.version);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("does not substitute stable for an unavailable preview channel", async () => {
+    const fetchMock = withGitHubFallback([], 503);
+    expect(await fetchLatestVersion("preview")).toBeNull();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  test.each([
+    { tag_name: "v0.13.0", draft: true, prerelease: false },
+    { tag_name: "v0.13.0", draft: false, prerelease: true },
+    { tag_name: "v0.13.0-preview.1", draft: false, prerelease: false },
+    { tag_name: "not-a-version", draft: false, prerelease: false },
+    { tag_name: "v0.13.0" },
+  ])("rejects invalid GitHub stable release %j", async (body) => {
+    mockFetchJson(body);
+    expect(await fetchLatestVersion()).toBeNull();
+  });
+
+  test("returns null when both services fail", async () => {
+    mockFetchError();
+    expect(await fetchLatestVersion()).toBeNull();
+    mockFetchJson({ message: "rate limited" }, 403);
+    expect(await fetchLatestVersion()).toBeNull();
+  });
+});

package/src/__tests__/commands-mock.ts

@@ -0,0 +1,101 @@
+import type { ChildProcessWithoutNullStreams } from "node:child_process";
+import { EventEmitter } from "node:events";
+import * as childProcess from "node:child_process";
+import { PassThrough } from "node:stream";
+import { spyOn } from "bun:test";
+
+export interface CommandRequest {
+  command: string;
+  args: string[];
+  input: Buffer;
+}
+export interface CommandResponse {
+  stdout?: string;
+  stderr?: string;
+  code?: number;
+}
+
+/** requests-mock pattern at the subprocess boundary: explicit registrations, history and no fallthrough to real commands. */
+export function mockCommands() {
+  const calls: CommandRequest[] = [];
+  const handlers: Array<{
+    command: string;
+    match: (args: string[]) => boolean;
+    respond: (
+      request: CommandRequest,
+    ) => CommandResponse | Promise<CommandResponse>;
+  }> = [];
+  const implementation = (command: string, argsOrOptions: unknown = []) => {
+    const args: string[] = Array.isArray(argsOrOptions) ? argsOrOptions : [];
+    const request: CommandRequest = {
+      command,
+      args: [...args],
+      input: Buffer.alloc(0),
+    };
+    calls.push(request);
+    const handler = [...handlers]
+      .reverse()
+      .find((entry) => entry.command === command && entry.match(request.args));
+    if (!handler) throw new Error(`Unregistered command: ${command}`);
+    const stdin = new PassThrough(),
+      stdout = new PassThrough(),
+      stderr = new PassThrough();
+    const child = Object.assign(new EventEmitter(), {
+      stdin,
+      stdout,
+      stderr,
+      stdio: [stdin, stdout, stderr],
+      kill: () => true,
+    });
+    const chunks: Buffer[] = [];
+    stdin.on("data", (chunk: Buffer) => chunks.push(chunk));
+    const respond = async () => {
+      request.input = Buffer.concat(chunks);
+      try {
+        const result = await handler.respond(request);
+        stdout.end(result.stdout ?? "");
+        stderr.end(result.stderr ?? "");
+        child.emit("close", result.code ?? 0);
+      } catch (error) {
+        child.emit("error", error);
+        child.emit("close", 1);
+      }
+    };
+    if (request.args.includes("-i"))
+      stdin.once("finish", () => {
+        void respond();
+      });
+    else
+      queueMicrotask(() => {
+        void respond();
+      });
+    return child as unknown as ChildProcessWithoutNullStreams;
+  };
+  const spawn = spyOn(childProcess, "spawn").mockImplementation(
+    implementation as typeof childProcess.spawn,
+  );
+  return {
+    calls,
+    on(
+      command: string,
+      args: string[] | ((args: string[]) => boolean),
+      response:
+        | CommandResponse
+        | ((
+            request: CommandRequest,
+          ) => CommandResponse | Promise<CommandResponse>),
+    ) {
+      handlers.push({
+        command,
+        match:
+          typeof args === "function"
+            ? args
+            : (actual) => JSON.stringify(actual) === JSON.stringify(args),
+        respond: typeof response === "function" ? response : () => response,
+      });
+    },
+    restore() {
+      spawn.mockRestore();
+    },
+  };
+}

package/src/__tests__/debug.test.ts

@@ -18,7 +18,6 @@ process.env.CADET_LOCKFILE_DIR = testDir;
 
 import * as assistantConfig from "../lib/assistant-config.js";
 import * as guardianToken from "../lib/guardian-token.js";
-import * as localRuntimeClient from "../lib/local-runtime-client.js";
 import * as cloudClient from "../lib/cloud-client.js";
 import { withPreconnect } from "./helpers/http.js";
 import { makeGuardianTokenData } from "./helpers/guardian-token.js";
@@ -29,26 +28,9 @@ const resolveTargetMock = spyOn(
 ).mockImplementation(() => {
   throw new Error("process.exit:1");
 });
-const readCloudTokenMock = spyOn(
-  cloudClient,
-  "readCloudToken",
-).mockReturnValue("platform-token");
-const exportMock = spyOn(
-  localRuntimeClient,
-  "localRuntimeExportToGcs",
-).mockResolvedValue({ jobId: "job-1" });
-const identityMock = spyOn(
-  localRuntimeClient,
-  "localRuntimeIdentity",
-).mockResolvedValue({ version: "0.12.3" });
-const pollMock = spyOn(
-  localRuntimeClient,
-  "localRuntimePollJobStatus",
-).mockResolvedValue({
-  jobId: "job-1",
-  type: "export",
-  status: "complete",
-});
+const readCloudTokenMock = spyOn(cloudClient, "readCloudToken").mockReturnValue(
+  "platform-token",
+);
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
@@ -109,13 +91,9 @@ beforeEach(() => {
   );
   resolveTargetMock.mockReset();
   resolveTargetMock.mockReturnValue(LOCAL_ENTRY);
-  identityMock.mockReset();
-  identityMock.mockResolvedValue({ version: "0.12.3" });
   leaseGuardianTokenSpy.mockClear();
   readCloudTokenMock.mockReset();
   readCloudTokenMock.mockReturnValue("platform-token");
-  exportMock.mockClear();
-  pollMock.mockClear();
 });
 
 afterEach(() => {
@@ -125,40 +103,29 @@ afterEach(() => {
 
 afterAll(() => {
   resolveTargetMock.mockRestore();
-  identityMock.mockRestore();
   leaseGuardianTokenSpy.mockRestore();
   readCloudTokenMock.mockRestore();
-  exportMock.mockRestore();
-  pollMock.mockRestore();
   loadGuardianTokenSpy.mockRestore();
   rmSync(testDir, { recursive: true, force: true });
 });
 
 describe("cadet debug", () => {
-  test("mints the URL on the cloud, exports with the debug profile, and waits", async () => {
+  test("requests sanitized logs and uploads them without runtime export jobs", async () => {
     await debug();
-
-    expect(fetchCalls).toHaveLength(1);
-    expect(fetchCalls[0].url).toBe(
+    expect(fetchCalls.map((call) => call.url)).toEqual([
       "https://cloud.mycadet.ai/v1/assistants/11111111-2222-3333-4444-555555555555/debug-bundle-upload-url/",
+      "http://127.0.0.1:7821/v1/logs/export",
+      "https://storage.googleapis.com/b/signed",
+    ]);
+    expect(fetchCalls[1].init?.method).toBe("POST");
+    expect(new Headers(fetchCalls[1].init?.headers).get("Authorization")).toBe(
+      "Bearer local-token",
     );
-    expect(fetchCalls[0].init?.method).toBe("POST");
-    expect(
-      new Headers(fetchCalls[0].init?.headers).get("Cadet-Organization-Id"),
-    ).toBe("org-1");
-
-    expect(exportMock).toHaveBeenCalledTimes(1);
-    const [entry, token, params] = exportMock.mock.calls[0];
-    expect(entry).toBe(LOCAL_ENTRY);
-    expect(token).toBe("local-token");
-    expect(params).toEqual({
-      uploadUrl: "https://storage.googleapis.com/b/signed",
-      description: "debug bundle for Cadet staff",
-      profile: "debug",
-    });
-    expect(pollMock).toHaveBeenCalled();
-    // The daemon was checked for the debug profile before the cloud call.
-    expect(identityMock).toHaveBeenCalledTimes(1);
+    expect(fetchCalls[2].init?.method).toBe("PUT");
+    expect(new Headers(fetchCalls[2].init?.headers).has("Authorization")).toBe(
+      false,
+    );
+    expect(fetchCalls[2].init?.body).toBeInstanceOf(Blob);
   });
 
   test("passes an unquoted multi-word display name through to the shared resolver", async () => {
@@ -167,46 +134,6 @@ describe("cadet debug", () => {
     expect(resolveTargetMock).toHaveBeenCalledWith("Support Bot");
   });
 
-  test("refuses a daemon older than the debug profile before any URL is minted", async () => {
-    // Such a daemon strips `profile` and would upload the owner's
-    // credentials to the staff bucket.
-    identityMock.mockResolvedValue({ version: "0.12.2" });
-    const errors: string[] = [];
-    const errorSpy = spyOn(console, "error").mockImplementation((msg) => {
-      errors.push(String(msg));
-    });
-    try {
-      await expect(debug()).rejects.toThrow("process.exit:1");
-    } finally {
-      errorSpy.mockRestore();
-    }
-    expect(errors.join("\n")).toContain("0.12.3");
-    expect(fetchCalls).toHaveLength(0);
-    expect(exportMock).not.toHaveBeenCalled();
-  });
-
-  test("re-leases the guardian token when the daemon answers 401 mid-poll", async () => {
-    pollMock.mockReset();
-    let polls = 0;
-    pollMock.mockImplementation(async (_entry, token) => {
-      polls += 1;
-      if (polls === 1) {
-        throw new Error("Local job status check failed: 401 Unauthorized");
-      }
-      expect(token).toBe("leased-token");
-      return {
-        jobId: "job-1",
-        type: "export",
-        status: "complete",
-      };
-    });
-
-    await debug();
-
-    expect(leaseGuardianTokenSpy).toHaveBeenCalledTimes(1);
-    expect(polls).toBe(2);
-  });
-
   test("explains what to turn on when the cloud refuses", async () => {
     uploadUrlStatus = 403;
     const errors: string[] = [];
@@ -219,13 +146,12 @@ describe("cadet debug", () => {
       errorSpy.mockRestore();
     }
     expect(errors.join("\n")).toContain("Allow Staff Access");
-    expect(exportMock).not.toHaveBeenCalled();
   });
 
   test("refuses a Cadet-hosted assistant, which needs no bundle", async () => {
     resolveTargetMock.mockReturnValue({
       ...LOCAL_ENTRY,
-      cloud: "cadet",
+      cloud: "cloud",
     });
     const errorSpy = spyOn(console, "error").mockImplementation(() => {});
     try {

package/src/__tests__/devices.test.ts

@@ -26,6 +26,7 @@ const ORIGINAL_FETCH = globalThis.fetch;
 
 import { createHash } from "node:crypto";
 
+import * as stepRunner from "../lib/step-runner.js";
 import { devices } from "../commands/devices.js";
 import { saveAssistantEntry } from "../lib/assistant-config.js";
 import { computeDeviceId } from "../lib/guardian-token.js";
@@ -102,6 +103,67 @@ describe("cadet devices", () => {
     stubFetch(() => jsonResponse({ error: "unexpected" }, 500));
   });
 
+  test("Docker devices list and revoke execute inside the gateway without a host port", async () => {
+    saveAssistantEntry({
+      assistantId: "docker-fixture",
+      cloud: "docker",
+      runtimeUrl: "https://tunnel.example",
+    });
+    const calls: string[][] = [];
+    const docker = spyOn(stepRunner, "execOutput").mockImplementation(
+      async (_command, args) => {
+        calls.push(args);
+        return JSON.stringify({
+          status: 200,
+          body: args.some((arg) => arg.endsWith("/revoke"))
+            ? '{"revoked":true}'
+            : '{"devices":[]}',
+        });
+      },
+    );
+    try {
+      process.argv = ["bun", "cadet", "devices", "docker-fixture", "--json"];
+      expect((await runDevices()).exited).toBe(false);
+      process.argv = [
+        "bun",
+        "cadet",
+        "devices",
+        "revoke",
+        "fixture-device",
+        "docker-fixture",
+        "--yes",
+        "--json",
+      ];
+      expect((await runDevices()).exited).toBe(false);
+      expect(calls).toHaveLength(2);
+      expect(calls[0].slice(0, 2)).toEqual(["exec", "docker-fixture-gateway"]);
+      expect(calls[0]).toContain("http://127.0.0.1:7830/v1/devices");
+      expect(calls[1]).toContain("http://127.0.0.1:7830/v1/devices/revoke");
+      expect(fetchCalls).toHaveLength(0);
+    } finally {
+      docker.mockRestore();
+    }
+  });
+
+  test("Docker gateway output rejects malformed status and body fields", async () => {
+    saveAssistantEntry({
+      assistantId: "docker-invalid",
+      cloud: "docker",
+      runtimeUrl: "https://tunnel.example",
+    });
+    const docker = spyOn(stepRunner, "execOutput").mockResolvedValue(
+      '{"status":"200","body":{}}',
+    );
+    try {
+      process.argv = ["bun", "cadet", "devices", "docker-invalid", "--json"];
+      const result = await runDevices();
+      expect(result.exited).toBe(true);
+      expect(result.errors).toContain("could not reach the gateway");
+    } finally {
+      docker.mockRestore();
+    }
+  });
+
   afterEach(() => {
     process.argv = [...ORIGINAL_ARGV];
     globalThis.fetch = ORIGINAL_FETCH;
@@ -358,7 +420,7 @@ describe("cadet devices", () => {
     expect(fetchCalls).toHaveLength(0);
   });
 
-  test("host-gates a paired connection (points to the host / unpair)", async () => {
+  test("host-gates a paired connection (points to the host)", async () => {
     saveAssistantEntry({
       assistantId: "paired-box",
       name: "Paired Box",
@@ -371,7 +433,7 @@ describe("cadet devices", () => {
     const { exited, errors } = await runDevices();
 
     expect(exited).toBe(true);
-    expect(errors).toContain("cadet unpair");
+    expect(errors).toContain("cadet devices");
     expect(fetchCalls).toHaveLength(0);
   });
 

package/src/__tests__/ensure-binary.test.ts

@@ -180,3 +180,55 @@ describe("readLineText", () => {
     expect(await pending).toBe("");
   });
 });
+
+test("a Mac without Homebrew asks separately before bootstrapping and installing nginx", async () => {
+  const installs: string[][] = [];
+  let homebrew = false;
+  let nginx = false;
+  let brewPrompts = 0;
+  const version = await ensureBinaryInstalled({
+    binary: "nginx",
+    purpose: "the tunnel edge",
+    platform: "darwin",
+    packages: { brew: ["brew", "install", "nginx"] },
+    manualHint: "install nginx",
+    probe: () => (nginx ? "nginx 1.2" : null),
+    pmAvailable: (pm) => pm === "brew" && homebrew,
+    confirmInstall: async () => true,
+    confirmHomebrewInstall: async () => {
+      brewPrompts++;
+      return true;
+    },
+    runInstall: (argv) => {
+      installs.push(argv);
+      if (argv[0] === "/bin/bash") homebrew = true;
+      if (argv[0] === "brew") nginx = true;
+      return true;
+    },
+  });
+  expect(version).toBe("nginx 1.2");
+  expect(brewPrompts).toBe(1);
+  expect(installs.length).toBe(2);
+  expect(installs[1]).toEqual(["brew", "install", "nginx"]);
+});
+
+test("declining Homebrew runs no installer", async () => {
+  const installs: string[][] = [];
+  const result = await ensureBinaryInstalled({
+    binary: "ngrok",
+    purpose: "a tunnel",
+    platform: "darwin",
+    packages: { brew: ["brew", "install", "ngrok/ngrok/ngrok"] },
+    manualHint: "install ngrok",
+    probe: () => null,
+    pmAvailable: () => false,
+    confirmInstall: async () => true,
+    confirmHomebrewInstall: async () => false,
+    runInstall: (argv) => {
+      installs.push(argv);
+      return true;
+    },
+  });
+  expect(result).toBeNull();
+  expect(installs).toEqual([]);
+});