@mycadet/cli 0.12.11 → 0.13.0-dev.202610171617.9ea363e

package/src/lib/cloud-releases.ts

@@ -1,3 +1,6 @@
+import { z } from "zod";
+
+import { CADET_GITHUB_REPOSITORY } from "./github-repository.js";
 import { getCloudUrl } from "./cloud-client.js";
 import { dockerhubImages } from "./docker.js";
 import type { ServiceName } from "./docker.js";
@@ -22,12 +25,40 @@ function releasesOptsFor(channel: ReleaseChannel): { channel?: "preview" } {
   return channel === "preview" ? { channel: "preview" } : {};
 }
 
-export interface ReleaseListItem {
-  version: string;
-  is_stable?: boolean;
-  assistant_image_ref?: string | null;
-  gateway_image_ref?: string | null;
-  credential_executor_image_ref?: string | null;
+const ReleaseListItemSchema = z.object({
+  version: z.string().min(1),
+  is_stable: z.boolean().optional(),
+  assistant_image_ref: z.string().nullable().optional(),
+  gateway_image_ref: z.string().nullable().optional(),
+  credential_executor_image_ref: z.string().nullable().optional(),
+});
+
+export type ReleaseListItem = z.infer<typeof ReleaseListItemSchema>;
+
+const STABLE_VERSION = /^(?:v)?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+const GitHubReleaseSchema = z.object({
+  tag_name: z.string().regex(STABLE_VERSION),
+  draft: z.literal(false),
+  prerelease: z.literal(false),
+});
+
+async function fetchLatestGitHubStableVersion(): Promise<string | null> {
+  try {
+    const response = await loopbackSafeFetch(
+      `https://api.github.com/repos/${CADET_GITHUB_REPOSITORY}/releases/latest`,
+      {
+        headers: { Accept: "application/vnd.github+json" },
+        signal: AbortSignal.timeout(10_000),
+      },
+    );
+    if (!response.ok) {
+      return null;
+    }
+    const parsed = GitHubReleaseSchema.safeParse(await response.json());
+    return parsed.success ? parsed.data.tag_name.replace(/^v/, "") : null;
+  } catch {
+    return null;
+  }
 }
 
 /**
@@ -56,15 +87,21 @@ export async function fetchReleases(opts?: {
       `${cloudUrl}/v1/releases/?${filter}&limit=${RELEASES_FETCH_LIMIT}`,
       { signal: AbortSignal.timeout(10_000) },
     );
-    if (!response.ok) return null;
-    return (await response.json()) as ReleaseListItem[];
+    if (!response.ok) {
+      return null;
+    }
+    const parsed = z
+      .array(ReleaseListItemSchema)
+      .safeParse(await response.json());
+    return parsed.success ? parsed.data : null;
   } catch {
     return null;
   }
 }
 
 /**
- * Fetch the latest release version for a channel from the Cadet Cloud API.
+ * Fetch the latest release version from Cadet Cloud, falling back to GitHub
+ * for stable releases when the cloud has no usable result.
  * Returns the version string (e.g. "0.7.0") or null if unavailable.
  * The releases endpoint returns entries ordered newest-first, so the first
  * entry is the latest for the requested channel.
@@ -73,7 +110,14 @@ export async function fetchLatestVersion(
   channel: ReleaseChannel = "stable",
 ): Promise<string | null> {
   const releases = await fetchReleases(releasesOptsFor(channel));
-  return releases?.[0]?.version ?? null;
+  if (channel === "preview") {
+    return releases?.[0]?.version ?? null;
+  }
+  const latest = releases?.find(
+    (release) =>
+      release.is_stable !== false && STABLE_VERSION.test(release.version),
+  );
+  return latest?.version ?? fetchLatestGitHubStableVersion();
 }
 
 /**

package/src/lib/cloud-values.ts

@@ -1,3 +1,3 @@
 export function isCloudHome(cloud: unknown): boolean {
-  return cloud === "cloud" || cloud === "cadet";
+  return cloud === "cloud";
 }

package/src/lib/confirm-action.ts

@@ -1,6 +1,6 @@
 /**
- * Shared interactive confirmation for destructive CLI commands (retire, unpair,
- * …). Per cli/AGENTS.md, a command that removes assistant state must print the
+ * Shared interactive confirmation for destructive CLI commands (retire,
+ * devices revoke, …). Per cli/AGENTS.md, a command that removes assistant state must print the
  * resolved identity and require confirmation, with a `--yes` bypass for
  * automation.
  */

package/src/lib/docker.ts

@@ -296,6 +296,8 @@ export interface HatchDockerParams {
   /** Extra env vars forwarded into the assistant container. */
   flagEnvVars?: Record<string, string>;
   setupProviderCredentials?: boolean;
+  /** Whole-installation state installed into stopped containers before startup. */
+  initialArchive?: string;
   /**
    * Path to a local source tree to build images from before hatching. When
    * provided, this path is used directly as the repo root and no file
@@ -812,6 +814,7 @@ export const SERVICE_START_ORDER: ServiceName[] = [
 /** Start all three containers in dependency order. */
 export async function startContainers(
   opts: {
+    createOnly?: boolean;
     signingKey?: string;
     bootstrapSecret?: string;
     cesServiceToken?: string;
@@ -832,8 +835,13 @@ export async function startContainers(
     avatarDevicePath: resolveAvatarDevicePath(),
   });
   for (const service of SERVICE_START_ORDER) {
-    log(`🚀 Starting ${service} container...`);
-    await exec("docker", runArgs[service]());
+    const args = runArgs[service]();
+    if (opts.createOnly) {
+      args[0] = "create";
+      args.splice(args.indexOf("-d"), 1);
+    }
+    log(`${opts.createOnly ? "Creating" : "Starting"} ${service} container...`);
+    await exec("docker", args);
   }
 }
 
@@ -849,14 +857,23 @@ export async function stopContainers(
 /** Stop containers without removing them (preserves state for `docker start`). */
 export async function sleepContainers(
   res: ReturnType<typeof dockerResourceNames>,
+  options: { timeoutMs?: number } = {},
 ): Promise<void> {
   for (const container of [
-    res.cesContainer,
-    res.gatewayContainer,
     res.assistantContainer,
+    res.gatewayContainer,
+    res.cesContainer,
   ]) {
     try {
-      await exec("docker", ["stop", container]);
+      const status = await execOutput("docker", ["inspect", "--format", "{{.State.Status}}", container]);
+      if (status === "exited" || status === "created") continue;
+      if (status !== "running") throw new Error(`${container} is ${status}; cannot stop gracefully.`);
+      await exec("docker", ["kill", "--signal=SIGTERM", container]);
+      const deadline = Date.now() + (options.timeoutMs ?? 60_000);
+      while (await execOutput("docker", ["inspect", "--format", "{{.State.Running}}", container]) === "true") {
+        if (Date.now() >= deadline) throw new Error(`${container} did not stop gracefully.`);
+        await new Promise((resolve) => setTimeout(resolve, 250));
+      }
     } catch (err) {
       const msg =
         err instanceof Error ? err.message.toLowerCase() : String(err);
@@ -1630,7 +1647,9 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
     }
 
     const cesServiceToken = randomBytes(32).toString("hex");
-    const signingKey = randomBytes(32).toString("hex");
+    const signingKey = params.initialArchive
+      ? undefined
+      : randomBytes(32).toString("hex");
 
     // When launched by a remote hatch startup script, the env var
     // GUARDIAN_BOOTSTRAP_SECRET is already set with the laptop's secret.
@@ -1669,8 +1688,26 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
       ...flagEnvVars,
       CADET_DEVICE_ID: hostDeviceId,
     };
+    const runtimeUrl = `http://localhost:${gatewayPort}`;
+    const dockerEntry: AssistantEntry = {
+      assistantId: instanceName,
+      runtimeUrl,
+      cloud: "docker",
+      hatchedAt: new Date().toISOString(),
+      guardianBootstrapSecret: ownSecret,
+      containerInfo: {
+        assistantImage: imageTags.assistant,
+        gatewayImage: imageTags.gateway,
+        cesImage: imageTags["credential-executor"],
+        assistantPort,
+      },
+    };
+    if (params.initialArchive) {
+      saveAssistantEntry(dockerEntry);
+    }
     await startContainers(
       {
+        createOnly: !!params.initialArchive,
         signingKey,
         bootstrapSecret,
         cesServiceToken,
@@ -1688,29 +1725,29 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
     );
     const containersUpAt = Date.now();
 
-    const runtimeUrl = `http://localhost:${gatewayPort}`;
-    const dockerEntry: AssistantEntry = {
-      assistantId: instanceName,
-      runtimeUrl,
-      cloud: "docker",
-      hatchedAt: new Date().toISOString(),
-      guardianBootstrapSecret: ownSecret,
-      containerInfo: {
-        assistantImage: imageTags.assistant,
-        gatewayImage: imageTags.gateway,
-        cesImage: imageTags["credential-executor"],
-        assistantPort,
-      },
-    };
     emitProgress(5, 6, "Saving configuration...");
     saveAssistantEntry(dockerEntry);
     setActiveAssistant(instanceName);
 
+    if (params.initialArchive) {
+      const { initializeRootArchive, DockerRootStorage } =
+        await import("./root-backup.js");
+      await initializeRootArchive(dockerEntry, params.initialArchive);
+      const storage = new DockerRootStorage(dockerEntry);
+      storage.initialRunning = new Set(Object.values(storage.containers));
+      await storage.resume();
+    }
+
     emitProgress(6, 6, "Waiting for services...");
     // Hatch always detaches; only watch mode keeps the log stream attached.
     const waitDetached = !watch;
-    const { ready, guardianAccessToken, notReadyReason } =
-      await waitForGatewayAndLease({
+    const { ready, guardianAccessToken, notReadyReason } = params.initialArchive
+      ? {
+          ready: true,
+          guardianAccessToken: undefined,
+          notReadyReason: undefined,
+        }
+      : await waitForGatewayAndLease({
         bootstrapSecret: ownSecret,
         containerName: res.assistantContainer,
         detached: waitDetached,

package/src/lib/github-repository.ts

@@ -0,0 +1,2 @@
+/** Source repository for published Cadet releases. */
+export const CADET_GITHUB_REPOSITORY = "vargasjr-dev/mycadet-temp";

package/src/lib/guardian-token.ts

@@ -7,7 +7,6 @@ import {
   mkdirSync,
   openSync,
   readFileSync,
-  rmdirSync,
   statSync,
   unlinkSync,
   writeFileSync,
@@ -79,27 +78,6 @@ function getGuardianTokenPath(assistantId: string): string {
   return guardianTokenPath(resolveConfigDir(process.env), assistantId);
 }
 
-/**
- * Best-effort removal of an assistant's stored guardian token (used by
- * `cadet unpair` to forget a paired connection). Never throws if the token
- * file or its per-assistant directory is already absent.
- */
-export function deleteGuardianToken(assistantId: string): void {
-  const tokenPath = getGuardianTokenPath(assistantId);
-  try {
-    unlinkSync(tokenPath);
-  } catch {
-    /* already gone */
-  }
-  // Clean up the now-empty per-assistant directory; rmdir throws if it still
-  // holds other files, in which case we leave it.
-  try {
-    rmdirSync(dirname(tokenPath));
-  } catch {
-    /* not empty or absent */
-  }
-}
-
 function getPersistedDeviceIdPath(): string {
   return join(getConfigDir(getCurrentEnvironment()), "device-id");
 }
@@ -454,7 +432,7 @@ export async function refreshGuardianTokenResult(
     return {
       ok: false,
       status: 401,
-      error: "Guardian token expired. Re-run `cadet hatch` or `cadet wake`.",
+      error: "Guardian refresh token expired",
     };
   }
 

package/src/lib/hatch-local.ts

@@ -1,3 +1,4 @@
+import { persistRootSigningKey } from "./root-signing-key.js";
 import {
   existsSync,
   lstatSync,
@@ -160,6 +161,8 @@ export interface HatchLocalParams {
   /** Extra env vars forwarded into the assistant process. */
   flagEnvVars?: Record<string, string>;
   setupProviderCredentials?: boolean;
+  /** Whole-installation state installed before the first service startup. */
+  initialArchive?: string;
   /**
    * Show the per-service startup logs (assistant, credential executor,
    * gateway) and the extended next steps. Off by default — the happy path
@@ -291,7 +294,20 @@ export async function hatchLocal(
       const defaultWorkspaceConfigPath = writeInitialConfig(hatchConfigValues);
 
       reporter.progress(3, 6, "Starting assistant...");
-      const signingKey = generateLocalSigningKey();
+      const signingKey = params.initialArchive
+        ? await (
+            await import("./root-backup.js")
+          ).initializeRootArchive(
+            {
+              assistantId: instanceName,
+              cloud: "local",
+              runtimeUrl: "",
+              resources,
+            },
+            params.initialArchive,
+          )
+        : generateLocalSigningKey();
+      persistRootSigningKey(resources.instanceDir, signingKey);
       const bootstrapSecret = generateLocalSigningKey();
       let runtimeUrl = `http://127.0.0.1:${resources.gatewayPort}`;
       try {