@mycadet/cli 0.12.11 → 0.13.0

package/README.md

@@ -14,6 +14,19 @@ bun run ./src/index.ts <command> [options]
 
 ## Commands
 
+### Version changes: `upgrade`, `restore`
+
+Use `cadet upgrade` to move to a newer release. Rollbacks must restore a backup
+through `cadet restore`; version changes and backup data belong to the same
+restore operation. The CLI has no standalone `rollback` command.
+
+```bash
+cadet restore my-assistant --from backup.tar.gz --version v1.2.3
+```
+
+Automatic failure recovery during an upgrade or restore uses the images and
+migration checkpoints captured in memory for that operation.
+
 ### Lifecycle: `ps`, `sleep`, `wake`
 
 Day-to-day process management for the assistant and gateway.

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -28,10 +28,10 @@ describe("tunnelHostForCloudHost", () => {
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
     expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+      "staging-tunnel.mycadet.ai",
     );
     expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+      "dev-tunnel.mycadet.ai",
     );
   });
 

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,7 +1,7 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
@@ -11,7 +11,7 @@ export function tunnelHostForCloudHost(host: string): string | null {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -28,10 +28,10 @@ describe("tunnelHostForCloudHost", () => {
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
     expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+      "staging-tunnel.mycadet.ai",
     );
     expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+      "dev-tunnel.mycadet.ai",
     );
   });
 

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,7 +1,7 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
@@ -11,7 +11,7 @@ export function tunnelHostForCloudHost(host: string): string | null {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -28,10 +28,10 @@ describe("tunnelHostForCloudHost", () => {
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
     expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+      "staging-tunnel.mycadet.ai",
     );
     expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+      "dev-tunnel.mycadet.ai",
     );
   });
 

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,7 +1,7 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
@@ -11,7 +11,7 @@ export function tunnelHostForCloudHost(host: string): string | null {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.11",
+  "version": "0.13.0",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {
@@ -20,7 +20,7 @@
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "eslint --max-warnings 323",
+    "lint": "eslint --max-warnings 319",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "compile:check": "bun build --compile src/index.ts --outfile /dev/null",
     "test": "bun run scripts/run-tests.ts",
@@ -41,6 +41,7 @@
     "qrcode-terminal": "0.12.0",
     "react": "19.2.6",
     "react-devtools-core": "7.0.1",
+    "tar": "7.5.22",
     "yaml": "2.8.2",
     "zod": "4.3.6"
   },

package/src/__tests__/assistant-client-cloud-auth.test.ts

@@ -1,5 +1,5 @@
 /**
- * Tests for AssistantClient's cloud-managed (`cloud: "cadet"`) auth path.
+ * Tests for AssistantClient's cloud-managed (`cloud: "cloud"`) auth path.
  * These entries have no guardian token on disk, so the client must authenticate
  * with the stored platform credential instead of sending an anonymous request
  * (which the cloud answers with a bare 403).
@@ -38,7 +38,7 @@ function seedCloud(token?: string): void {
     assistantId: ASSISTANT_ID,
     name: "Credence",
     runtimeUrl: PLATFORM_URL,
-    cloud: "cadet",
+    cloud: "cloud",
   });
   if (token) {
     saveCloudToken(token);

package/src/__tests__/backup-ops-matching.test.ts

@@ -7,42 +7,44 @@ const STAMP = "2026-09-15T14-27-28-123Z";
 describe("assistantBackupFilenamePattern", () => {
   test("matches this CLI's backups for exactly the given assistant", () => {
     const pattern = assistantBackupFilenamePattern("alpha");
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(true);
-    expect(pattern.test(`alpha-pre-teleport-${STAMP}.vbundle`)).toBe(true);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-teleport-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-rollback-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
   });
 
   test("does not match an assistant whose id extends this one", () => {
     const pattern = assistantBackupFilenamePattern("alpha");
-    expect(pattern.test(`alpha-prod-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
-    expect(pattern.test(`alpha-prod-pre-teleport-${STAMP}.vbundle`)).toBe(
+    expect(pattern.test(`alpha-prod-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
+    expect(pattern.test(`alpha-prod-pre-teleport-${STAMP}.tar.gz`)).toBe(
       false,
     );
   });
 
   test("does not match a shorter id's backups from a longer id", () => {
     const pattern = assistantBackupFilenamePattern("alpha-prod");
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
   });
 
   test("ignores user-named cadet backup files and other kinds", () => {
     const pattern = assistantBackupFilenamePattern("alpha");
-    expect(pattern.test(`alpha-${STAMP}.vbundle`)).toBe(false);
-    expect(pattern.test(`alpha-manual-${STAMP}.vbundle`)).toBe(false);
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle.enc`)).toBe(false);
+    expect(pattern.test(`alpha-${STAMP}.tar.gz`)).toBe(false);
+    expect(pattern.test(`alpha-manual-${STAMP}.tar.gz`)).toBe(false);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz.enc`)).toBe(false);
   });
 
   test("restricts to the requested kinds", () => {
     const pattern = assistantBackupFilenamePattern("alpha", ["pre-teleport"]);
-    expect(pattern.test(`alpha-pre-teleport-${STAMP}.vbundle`)).toBe(true);
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
+    expect(pattern.test(`alpha-pre-teleport-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
     expect(
-      pattern.test(`alpha-pre-teleport-prod-pre-teleport-${STAMP}.vbundle`),
+      pattern.test(`alpha-pre-teleport-prod-pre-teleport-${STAMP}.tar.gz`),
     ).toBe(false);
   });
 
   test("escapes regex metacharacters in ids", () => {
     const pattern = assistantBackupFilenamePattern("a.b");
-    expect(pattern.test(`a.b-pre-upgrade-${STAMP}.vbundle`)).toBe(true);
-    expect(pattern.test(`axb-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
+    expect(pattern.test(`a.b-pre-upgrade-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`axb-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
   });
 });

package/src/__tests__/backup-ops.test.ts

@@ -0,0 +1,105 @@
+import { afterAll, beforeEach, expect, spyOn, test } from "bun:test";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as config from "../lib/assistant-config.js";
+import * as backups from "../lib/backup-ops.js";
+import * as guardian from "../lib/guardian-token.js";
+import { stageRootArchive, STATE_ROOTS } from "../lib/root-backup.js";
+
+const directory = await mkdtemp(join(tmpdir(), "safety-root-backup-"));
+const root = join(directory, "instance");
+const backupDir = join(directory, "backups");
+const entry: config.AssistantEntry = {
+  assistantId: "alpha",
+  cloud: "local",
+  runtimeUrl: "http://127.0.0.1:1",
+  resources: {
+    instanceDir: root,
+    daemonPort: 1,
+    gatewayPort: 2,
+    cesPort: 3,
+    qdrantPort: 4,
+    signingKey: "07".repeat(32),
+  },
+};
+const lookup = spyOn(config, "findAssistantByName").mockReturnValue(entry);
+const location = spyOn(backups, "getBackupsDir").mockReturnValue(backupDir);
+const save = spyOn(config, "saveAssistantEntry").mockImplementation(() => {});
+const tokens = spyOn(guardian, "loadGuardianToken").mockImplementation(() => {
+  throw new Error("no guardian token access allowed");
+});
+beforeEach(async () => {
+  for (const name of STATE_ROOTS)
+    await mkdir(join(root, name), { recursive: true });
+  await writeFile(join(root, "workspace", "notes"), "original");
+  await writeFile(join(root, "gateway-security", "trust"), "gateway trust");
+  await writeFile(join(root, "ces-security", "keys.enc"), "opaque ciphertext", {
+    mode: 0o600,
+  });
+  await writeFile(join(root, "ces-data", "grants"), "CES policy");
+  lookup.mockReturnValue(entry);
+  tokens.mockClear();
+});
+afterAll(async () => {
+  for (const spy of [lookup, location, save, tokens]) spy.mockRestore();
+  await rm(directory, { recursive: true, force: true });
+});
+
+test("pre-upgrade safety backup captures all roots in XDG without a guardian token", async () => {
+  const path = await backups.createBackup(entry.runtimeUrl, entry.assistantId, {
+    prefix: "alpha-pre-upgrade",
+  });
+  expect(path).toMatch(
+    new RegExp(`^${backupDir}/alpha-pre-upgrade-.*\\.tar\\.gz$`),
+  );
+  const stage = await stageRootArchive(path!, directory);
+  for (const name of STATE_ROOTS)
+    expect(await readdir(join(stage, "state", name))).not.toHaveLength(0);
+  expect(
+    await readFile(join(stage, "state", "ces-security", "keys.enc"), "utf8"),
+  ).toBe("opaque ciphertext");
+  expect(tokens).not.toHaveBeenCalled();
+});
+
+test("rollback restores gateway and CES state as well as workspace", async () => {
+  const path = await backups.createBackup(entry.runtimeUrl, entry.assistantId, {
+    prefix: "alpha-pre-rollback",
+  });
+  for (const name of STATE_ROOTS)
+    await writeFile(join(root, name, "after-upgrade"), "stale");
+  await writeFile(join(root, "workspace", "notes"), "modified");
+  expect(
+    await backups.restoreBackup(entry.runtimeUrl, entry.assistantId, path!, {
+      resume: false,
+    }),
+  ).toBe(true);
+  expect(await readFile(join(root, "workspace", "notes"), "utf8")).toBe(
+    "original",
+  );
+  expect(await readFile(join(root, "gateway-security", "trust"), "utf8")).toBe(
+    "gateway trust",
+  );
+  expect(await readFile(join(root, "ces-data", "grants"), "utf8")).toBe(
+    "CES policy",
+  );
+  for (const name of STATE_ROOTS)
+    expect(await readdir(join(root, name))).not.toContain("after-upgrade");
+  expect(tokens).not.toHaveBeenCalled();
+});
+
+test("missing registry identity fails before capture instead of trying runtime export", async () => {
+  lookup.mockReturnValue(null);
+  expect(await backups.createBackup(entry.runtimeUrl, "missing")).toBeNull();
+  expect(
+    await backups.restoreBackup(entry.runtimeUrl, "missing", "missing.tar.gz"),
+  ).toBe(false);
+  expect(tokens).not.toHaveBeenCalled();
+});