@mycadet/cli 0.12.10 → 0.13.0

package/src/__tests__/root-signing-key.test.ts

@@ -0,0 +1,50 @@
+import { afterEach, expect, test } from "bun:test";
+import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { persistRootSigningKey } from "../lib/root-signing-key.js";
+const directories: string[] = [];
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "root-signing-key-"));
+  directories.push(root);
+  return root;
+}
+afterEach(() => {
+  for (const root of directories.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+test("persists the raw key privately so offline capture retains installation identity", () => {
+  const root = fixture();
+  persistRootSigningKey(root, "07".repeat(32));
+  const file = join(root, "gateway-security", "actor-token-signing-key");
+  expect(readFileSync(file)).toEqual(Buffer.alloc(32, 7));
+  if (process.platform !== "win32") {
+    expect(statSync(file).mode & 0o777).toBe(0o600);
+  }
+});
+test("replaces a key file link without changing its target", () => {
+  const root = fixture();
+  persistRootSigningKey(root, "07".repeat(32));
+  const target = join(root, "other");
+  writeFileSync(target, "unchanged");
+  const file = join(root, "gateway-security", "actor-token-signing-key");
+  rmSync(file);
+  symlinkSync(target, file);
+  persistRootSigningKey(root, "09".repeat(32));
+  expect(readFileSync(target, "utf8")).toBe("unchanged");
+  expect(readFileSync(file)).toEqual(Buffer.alloc(32, 9));
+});
+test("rejects invalid key data before writing service state", () => {
+  const root = fixture();
+  expect(() => persistRootSigningKey(root, "bad")).toThrow(
+    "Invalid gateway signing key",
+  );
+});

package/src/__tests__/setup.test.ts

@@ -62,7 +62,7 @@ function writeLockfile(entry: AssistantEntry): void {
   const lockfileDir = process.env.CADET_LOCKFILE_DIR!;
   mkdirSync(lockfileDir, { recursive: true });
   writeFileSync(
-    join(lockfileDir, ".cadet.lock.json"),
+    join(lockfileDir, "lockfile.json"),
     JSON.stringify(
       {
         assistants: [entry],
@@ -119,6 +119,10 @@ function installFetchStub(
       });
     }
 
+    if (url.endsWith("/v1/config/llm/default-provider")) {
+      return Response.json({ provider: "anthropic" });
+    }
+
     if (url.endsWith("/v1/secrets/read")) {
       return new Response(JSON.stringify({ found: false }), {
         status: 200,
@@ -189,7 +193,9 @@ describe("setup command", () => {
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer guardian-token",
     );
@@ -245,7 +251,9 @@ describe("setup command", () => {
     // gate instead of burning retry attempts against it.
     expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/readyz");
     expect(fetchCalls[1].url).toBe("http://127.0.0.1:3000/v1/guardian/init");
-    expect(fetchCalls[2].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[2].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[2].headers.get("Authorization")).toBe(
       "Bearer leased-guardian-token",
     );
@@ -283,12 +291,14 @@ describe("setup command", () => {
       assistantId: "assistant-123",
       runtimeUrl: "https://assistant.example",
       bearerToken: "entry-token",
-      cloud: "cadet",
+      cloud: "cloud",
     });
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("https://assistant.example/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "https://assistant.example/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer entry-token",
     );
@@ -300,7 +310,7 @@ describe("setup command", () => {
       assistantId: "assistant-123",
       runtimeUrl: "https://assistant.example",
       bearerToken: "entry-token",
-      cloud: "cadet",
+      cloud: "cloud",
     });
     saveGuardianToken(
       "assistant-123",
@@ -329,7 +339,7 @@ describe("setup command", () => {
       assistantId: "assistant-123",
       runtimeUrl: "https://assistant.example",
       bearerToken: "entry-token",
-      cloud: "cadet",
+      cloud: "cloud",
     });
     saveGuardianToken(
       "assistant-123",

package/src/__tests__/sleep.test.ts

@@ -216,6 +216,12 @@ describe("sleep command", () => {
     expect(stopProcessByPidFileMock).toHaveBeenCalledTimes(3);
   });
 
+  test("default sleep passes the non-escalating service stopper", async () => {
+    process.argv = ["bun", "cadet", "sleep", "sleep-test"];
+    await sleep();
+    expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(1, join(assistantRootDir, "workspace", "cadet.pid"), "assistant", undefined, 45_000, realProcess.stopProcessGracefully);
+  });
+
   test("force stops the assistant even when an active call lease exists", async () => {
     writeLeaseFile(["call-active-1"]);
     process.argv = ["bun", "cadet", "sleep", "sleep-test", "--force"];
@@ -238,6 +244,7 @@ describe("sleep command", () => {
       "assistant",
       undefined,
       45_000,
+      expect.any(Function),
     );
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       2,
@@ -245,12 +252,16 @@ describe("sleep command", () => {
       "gateway",
       undefined,
       7000,
+      expect.any(Function),
     );
     // The CES sibling is stopped by its PID file; a no-op when absent.
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       3,
       join(assistantRootDir, "ces.pid"),
       "credential-executor",
+      undefined,
+      45_000,
+      expect.any(Function),
     );
   });