@mycadet/cli 0.12.11 → 0.13.0

package/src/__tests__/cloud-releases.test.ts

@@ -13,6 +13,8 @@ import {
   isStagingVersion,
 } from "../lib/version-compat.js";
 
+import { CADET_GITHUB_REPOSITORY } from "../lib/github-repository.js";
+
 const originalFetch = globalThis.fetch;
 
 function mockFetchJson(body: unknown, status = 200) {
@@ -207,3 +209,83 @@ describe("fetchLatestVersion", () => {
     expect(await fetchLatestVersion("preview")).toBeNull();
   });
 });
+
+describe("stable release fallback", () => {
+  function withGitHubFallback(cloudBody: unknown, cloudStatus = 200) {
+    const fetchMock = mock(async (url: RequestInfo | URL) => {
+      if (String(url).startsWith("https://api.github.com/")) {
+        return Response.json({
+          tag_name: "v0.12.11",
+          draft: false,
+          prerelease: false,
+        });
+      }
+      return Response.json(cloudBody, { status: cloudStatus });
+    });
+    globalThis.fetch = Object.assign(fetchMock, {
+      preconnect: originalFetch.preconnect,
+    });
+    return fetchMock;
+  }
+
+  test.each([
+    [404, { detail: "not found" }],
+    [503, { detail: "unavailable" }],
+    [200, []],
+    [200, { results: [] }],
+    [200, [{ version: "not-a-version" }]],
+    [200, [{ version: "0.13.0-preview.1" }]],
+    [200, [{ version: "0.13.0", is_stable: false }]],
+  ])("falls back for cloud status %s and body %j", async (status, body) => {
+    const fetchMock = withGitHubFallback(body, status);
+    expect(await fetchLatestVersion()).toBe("0.12.11");
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(String(fetchMock.mock.calls[1][0])).toBe(
+      `https://api.github.com/repos/${CADET_GITHUB_REPOSITORY}/releases/latest`,
+    );
+  });
+
+  test("falls back when the cloud request throws", async () => {
+    const fetchMock = withGitHubFallback([]);
+    globalThis.fetch = Object.assign(
+      mock(async (url: RequestInfo | URL) => {
+        if (!String(url).startsWith("https://api.github.com/")) {
+          throw new TypeError("fetch failed");
+        }
+        return fetchMock(url);
+      }),
+      { preconnect: originalFetch.preconnect },
+    );
+    expect(await fetchLatestVersion()).toBe("0.12.11");
+  });
+
+  test("does not contact GitHub when cloud discovery succeeds", async () => {
+    const fetchMock = withGitHubFallback([RELEASE]);
+    expect(await fetchLatestVersion()).toBe(RELEASE.version);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("does not substitute stable for an unavailable preview channel", async () => {
+    const fetchMock = withGitHubFallback([], 503);
+    expect(await fetchLatestVersion("preview")).toBeNull();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  test.each([
+    { tag_name: "v0.13.0", draft: true, prerelease: false },
+    { tag_name: "v0.13.0", draft: false, prerelease: true },
+    { tag_name: "v0.13.0-preview.1", draft: false, prerelease: false },
+    { tag_name: "not-a-version", draft: false, prerelease: false },
+    { tag_name: "v0.13.0" },
+  ])("rejects invalid GitHub stable release %j", async (body) => {
+    mockFetchJson(body);
+    expect(await fetchLatestVersion()).toBeNull();
+  });
+
+  test("returns null when both services fail", async () => {
+    mockFetchError();
+    expect(await fetchLatestVersion()).toBeNull();
+    mockFetchJson({ message: "rate limited" }, 403);
+    expect(await fetchLatestVersion()).toBeNull();
+  });
+});

package/src/__tests__/commands-mock.ts

@@ -0,0 +1,101 @@
+import type { ChildProcessWithoutNullStreams } from "node:child_process";
+import { EventEmitter } from "node:events";
+import * as childProcess from "node:child_process";
+import { PassThrough } from "node:stream";
+import { spyOn } from "bun:test";
+
+export interface CommandRequest {
+  command: string;
+  args: string[];
+  input: Buffer;
+}
+export interface CommandResponse {
+  stdout?: string;
+  stderr?: string;
+  code?: number;
+}
+
+/** requests-mock pattern at the subprocess boundary: explicit registrations, history and no fallthrough to real commands. */
+export function mockCommands() {
+  const calls: CommandRequest[] = [];
+  const handlers: Array<{
+    command: string;
+    match: (args: string[]) => boolean;
+    respond: (
+      request: CommandRequest,
+    ) => CommandResponse | Promise<CommandResponse>;
+  }> = [];
+  const implementation = (command: string, argsOrOptions: unknown = []) => {
+    const args: string[] = Array.isArray(argsOrOptions) ? argsOrOptions : [];
+    const request: CommandRequest = {
+      command,
+      args: [...args],
+      input: Buffer.alloc(0),
+    };
+    calls.push(request);
+    const handler = [...handlers]
+      .reverse()
+      .find((entry) => entry.command === command && entry.match(request.args));
+    if (!handler) throw new Error(`Unregistered command: ${command}`);
+    const stdin = new PassThrough(),
+      stdout = new PassThrough(),
+      stderr = new PassThrough();
+    const child = Object.assign(new EventEmitter(), {
+      stdin,
+      stdout,
+      stderr,
+      stdio: [stdin, stdout, stderr],
+      kill: () => true,
+    });
+    const chunks: Buffer[] = [];
+    stdin.on("data", (chunk: Buffer) => chunks.push(chunk));
+    const respond = async () => {
+      request.input = Buffer.concat(chunks);
+      try {
+        const result = await handler.respond(request);
+        stdout.end(result.stdout ?? "");
+        stderr.end(result.stderr ?? "");
+        child.emit("close", result.code ?? 0);
+      } catch (error) {
+        child.emit("error", error);
+        child.emit("close", 1);
+      }
+    };
+    if (request.args.includes("-i"))
+      stdin.once("finish", () => {
+        void respond();
+      });
+    else
+      queueMicrotask(() => {
+        void respond();
+      });
+    return child as unknown as ChildProcessWithoutNullStreams;
+  };
+  const spawn = spyOn(childProcess, "spawn").mockImplementation(
+    implementation as typeof childProcess.spawn,
+  );
+  return {
+    calls,
+    on(
+      command: string,
+      args: string[] | ((args: string[]) => boolean),
+      response:
+        | CommandResponse
+        | ((
+            request: CommandRequest,
+          ) => CommandResponse | Promise<CommandResponse>),
+    ) {
+      handlers.push({
+        command,
+        match:
+          typeof args === "function"
+            ? args
+            : (actual) => JSON.stringify(actual) === JSON.stringify(args),
+        respond: typeof response === "function" ? response : () => response,
+      });
+    },
+    restore() {
+      spawn.mockRestore();
+    },
+  };
+}

package/src/__tests__/debug.test.ts

@@ -18,7 +18,6 @@ process.env.CADET_LOCKFILE_DIR = testDir;
 
 import * as assistantConfig from "../lib/assistant-config.js";
 import * as guardianToken from "../lib/guardian-token.js";
-import * as localRuntimeClient from "../lib/local-runtime-client.js";
 import * as cloudClient from "../lib/cloud-client.js";
 import { withPreconnect } from "./helpers/http.js";
 import { makeGuardianTokenData } from "./helpers/guardian-token.js";
@@ -29,26 +28,9 @@ const resolveTargetMock = spyOn(
 ).mockImplementation(() => {
   throw new Error("process.exit:1");
 });
-const readCloudTokenMock = spyOn(
-  cloudClient,
-  "readCloudToken",
-).mockReturnValue("platform-token");
-const exportMock = spyOn(
-  localRuntimeClient,
-  "localRuntimeExportToGcs",
-).mockResolvedValue({ jobId: "job-1" });
-const identityMock = spyOn(
-  localRuntimeClient,
-  "localRuntimeIdentity",
-).mockResolvedValue({ version: "0.12.3" });
-const pollMock = spyOn(
-  localRuntimeClient,
-  "localRuntimePollJobStatus",
-).mockResolvedValue({
-  jobId: "job-1",
-  type: "export",
-  status: "complete",
-});
+const readCloudTokenMock = spyOn(cloudClient, "readCloudToken").mockReturnValue(
+  "platform-token",
+);
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
@@ -109,13 +91,9 @@ beforeEach(() => {
   );
   resolveTargetMock.mockReset();
   resolveTargetMock.mockReturnValue(LOCAL_ENTRY);
-  identityMock.mockReset();
-  identityMock.mockResolvedValue({ version: "0.12.3" });
   leaseGuardianTokenSpy.mockClear();
   readCloudTokenMock.mockReset();
   readCloudTokenMock.mockReturnValue("platform-token");
-  exportMock.mockClear();
-  pollMock.mockClear();
 });
 
 afterEach(() => {
@@ -125,40 +103,29 @@ afterEach(() => {
 
 afterAll(() => {
   resolveTargetMock.mockRestore();
-  identityMock.mockRestore();
   leaseGuardianTokenSpy.mockRestore();
   readCloudTokenMock.mockRestore();
-  exportMock.mockRestore();
-  pollMock.mockRestore();
   loadGuardianTokenSpy.mockRestore();
   rmSync(testDir, { recursive: true, force: true });
 });
 
 describe("cadet debug", () => {
-  test("mints the URL on the cloud, exports with the debug profile, and waits", async () => {
+  test("requests sanitized logs and uploads them without runtime export jobs", async () => {
     await debug();
-
-    expect(fetchCalls).toHaveLength(1);
-    expect(fetchCalls[0].url).toBe(
+    expect(fetchCalls.map((call) => call.url)).toEqual([
       "https://cloud.mycadet.ai/v1/assistants/11111111-2222-3333-4444-555555555555/debug-bundle-upload-url/",
+      "http://127.0.0.1:7821/v1/logs/export",
+      "https://storage.googleapis.com/b/signed",
+    ]);
+    expect(fetchCalls[1].init?.method).toBe("POST");
+    expect(new Headers(fetchCalls[1].init?.headers).get("Authorization")).toBe(
+      "Bearer local-token",
     );
-    expect(fetchCalls[0].init?.method).toBe("POST");
-    expect(
-      new Headers(fetchCalls[0].init?.headers).get("Cadet-Organization-Id"),
-    ).toBe("org-1");
-
-    expect(exportMock).toHaveBeenCalledTimes(1);
-    const [entry, token, params] = exportMock.mock.calls[0];
-    expect(entry).toBe(LOCAL_ENTRY);
-    expect(token).toBe("local-token");
-    expect(params).toEqual({
-      uploadUrl: "https://storage.googleapis.com/b/signed",
-      description: "debug bundle for Cadet staff",
-      profile: "debug",
-    });
-    expect(pollMock).toHaveBeenCalled();
-    // The daemon was checked for the debug profile before the cloud call.
-    expect(identityMock).toHaveBeenCalledTimes(1);
+    expect(fetchCalls[2].init?.method).toBe("PUT");
+    expect(new Headers(fetchCalls[2].init?.headers).has("Authorization")).toBe(
+      false,
+    );
+    expect(fetchCalls[2].init?.body).toBeInstanceOf(Blob);
   });
 
   test("passes an unquoted multi-word display name through to the shared resolver", async () => {
@@ -167,46 +134,6 @@ describe("cadet debug", () => {
     expect(resolveTargetMock).toHaveBeenCalledWith("Support Bot");
   });
 
-  test("refuses a daemon older than the debug profile before any URL is minted", async () => {
-    // Such a daemon strips `profile` and would upload the owner's
-    // credentials to the staff bucket.
-    identityMock.mockResolvedValue({ version: "0.12.2" });
-    const errors: string[] = [];
-    const errorSpy = spyOn(console, "error").mockImplementation((msg) => {
-      errors.push(String(msg));
-    });
-    try {
-      await expect(debug()).rejects.toThrow("process.exit:1");
-    } finally {
-      errorSpy.mockRestore();
-    }
-    expect(errors.join("\n")).toContain("0.12.3");
-    expect(fetchCalls).toHaveLength(0);
-    expect(exportMock).not.toHaveBeenCalled();
-  });
-
-  test("re-leases the guardian token when the daemon answers 401 mid-poll", async () => {
-    pollMock.mockReset();
-    let polls = 0;
-    pollMock.mockImplementation(async (_entry, token) => {
-      polls += 1;
-      if (polls === 1) {
-        throw new Error("Local job status check failed: 401 Unauthorized");
-      }
-      expect(token).toBe("leased-token");
-      return {
-        jobId: "job-1",
-        type: "export",
-        status: "complete",
-      };
-    });
-
-    await debug();
-
-    expect(leaseGuardianTokenSpy).toHaveBeenCalledTimes(1);
-    expect(polls).toBe(2);
-  });
-
   test("explains what to turn on when the cloud refuses", async () => {
     uploadUrlStatus = 403;
     const errors: string[] = [];
@@ -219,13 +146,12 @@ describe("cadet debug", () => {
       errorSpy.mockRestore();
     }
     expect(errors.join("\n")).toContain("Allow Staff Access");
-    expect(exportMock).not.toHaveBeenCalled();
   });
 
   test("refuses a Cadet-hosted assistant, which needs no bundle", async () => {
     resolveTargetMock.mockReturnValue({
       ...LOCAL_ENTRY,
-      cloud: "cadet",
+      cloud: "cloud",
     });
     const errorSpy = spyOn(console, "error").mockImplementation(() => {});
     try {

package/src/__tests__/devices.test.ts

@@ -420,7 +420,7 @@ describe("cadet devices", () => {
     expect(fetchCalls).toHaveLength(0);
   });
 
-  test("host-gates a paired connection (points to the host / unpair)", async () => {
+  test("host-gates a paired connection (points to the host)", async () => {
     saveAssistantEntry({
       assistantId: "paired-box",
       name: "Paired Box",
@@ -433,7 +433,7 @@ describe("cadet devices", () => {
     const { exited, errors } = await runDevices();
 
     expect(exited).toBe(true);
-    expect(errors).toContain("cadet unpair");
+    expect(errors).toContain("cadet devices");
     expect(fetchCalls).toHaveLength(0);
   });
 

package/src/__tests__/gateway-token.test.ts

@@ -0,0 +1,267 @@
+/**
+ * Command-level tests for `cadet gateway token get/refresh`.
+ *
+ * Resolution: the assistant id is OPTIONAL — resolveTargetAssistant falls
+ * back to the active (or sole) assistant, so `cadet gateway token refresh`
+ * works with no arguments.
+ *
+ * Self-heal: a spent credential (401 — expired/revoked refresh token) or a
+ * missing token file (404) triggers an in-place re-provision via the
+ * gateway's bootstrap reset — the same machinery `cadet wake
+ * --repair-guardian` runs. It must NEVER suggest `cadet hatch`: hatching
+ * creates a different assistant.
+ */
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { gatewayToken } from "../commands/gateway/token.js";
+import {
+  saveAssistantEntry,
+  setActiveAssistant,
+} from "../lib/assistant-config.js";
+import {
+  loadGuardianToken,
+  saveGuardianToken,
+} from "../lib/guardian-token.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
+import { withPreconnect } from "./helpers/http.js";
+
+const ORIGINAL_LOCKFILE_DIR = process.env.CADET_LOCKFILE_DIR;
+const ORIGINAL_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
+const ORIGINAL_ENVIRONMENT = process.env.CADET_ENVIRONMENT;
+const ORIGINAL_ARGV = [...process.argv];
+const REAL_FETCH = globalThis.fetch;
+
+let tempHome: string;
+
+function seedLocalEntry(overrides: Record<string, unknown> = {}): void {
+  saveAssistantEntry({
+    assistantId: "px",
+    name: "Prime Quail",
+    runtimeUrl: "http://127.0.0.1:7830",
+    localUrl: "http://127.0.0.1:7830",
+    cloud: "local",
+    paired: false,
+    ...overrides,
+  });
+}
+
+/**
+ * Run `gatewayToken()` with console.log + console.error + process.exit
+ * spied; return the captured streams and whether the run exited 1.
+ */
+async function runGatewayToken(): Promise<{
+  exited: boolean;
+  logs: string;
+  errors: string;
+}> {
+  const logs: string[] = [];
+  const errors: string[] = [];
+  const logSpy = spyOn(console, "log").mockImplementation(
+    (...a: unknown[]) => {
+      logs.push(a.join(" "));
+    },
+  );
+  const errSpy = spyOn(console, "error").mockImplementation(
+    (...a: unknown[]) => {
+      errors.push(a.join(" "));
+    },
+  );
+  const exitSpy = spyOn(process, "exit").mockImplementation(
+    (code?: number | string | undefined): never => {
+      throw new Error(`exit:${code ?? 0}`);
+    },
+  );
+  let exited = false;
+  try {
+    await gatewayToken();
+  } catch (e) {
+    exited = e instanceof Error && e.message === "exit:1";
+  } finally {
+    logSpy.mockRestore();
+    errSpy.mockRestore();
+    exitSpy.mockRestore();
+  }
+  return { exited, logs: logs.join("\n"), errors: errors.join("\n") };
+}
+
+/** Fetch double covering the repair choreography (readyz/reset/init). */
+function mockRepairFetch(initBody: object): void {
+  globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+    const url = String(input);
+    if (url.endsWith("/readyz")) {
+      return new Response("", { status: 404 }); // no starting gate — proceed
+    }
+    if (url.endsWith("/v1/guardian/reset-bootstrap")) {
+      return new Response("{}", { status: 200 });
+    }
+    if (url.endsWith("/v1/guardian/init")) {
+      return new Response(JSON.stringify(initBody), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    }
+    throw new Error(`unexpected fetch: ${url}`);
+  });
+}
+
+const FRESH_LEASE = {
+  guardianPrincipalId: "principal-new",
+  accessToken: "fresh-acc",
+  accessTokenExpiresAt: Date.now() + 60 * 60 * 1000,
+  refreshToken: "fresh-ref",
+  refreshTokenExpiresAt: Date.now() + 365 * 24 * 60 * 60 * 1000,
+  refreshAfter: Date.now() + 48 * 60 * 60 * 1000,
+  isNew: false,
+};
+
+describe("gateway token command", () => {
+  beforeEach(() => {
+    tempHome = mkdtempSync(join(tmpdir(), "gateway-token-test-"));
+    process.env.CADET_LOCKFILE_DIR = tempHome;
+    process.env.XDG_CONFIG_HOME = tempHome;
+    delete process.env.CADET_ENVIRONMENT;
+  });
+
+  afterEach(() => {
+    process.argv = [...ORIGINAL_ARGV];
+    globalThis.fetch = REAL_FETCH;
+    if (ORIGINAL_LOCKFILE_DIR === undefined)
+      delete process.env.CADET_LOCKFILE_DIR;
+    else process.env.CADET_LOCKFILE_DIR = ORIGINAL_LOCKFILE_DIR;
+    if (ORIGINAL_CONFIG_HOME === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = ORIGINAL_CONFIG_HOME;
+    if (ORIGINAL_ENVIRONMENT === undefined) delete process.env.CADET_ENVIRONMENT;
+    else process.env.CADET_ENVIRONMENT = ORIGINAL_ENVIRONMENT;
+    rmSync(tempHome, { recursive: true, force: true });
+  });
+
+  afterAll(() => {
+    globalThis.fetch = REAL_FETCH;
+  });
+
+  test("refresh without a name targets the sole assistant and prints the refreshed token", async () => {
+    seedLocalEntry();
+    saveGuardianToken("px", makeGuardianTokenData());
+    let sawRefresh = false;
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.endsWith("/v1/guardian/refresh")) {
+        sawRefresh = true;
+        return new Response(JSON.stringify({ accessToken: "new-acc" }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
+      }
+      throw new Error(`unexpected fetch: ${url}`);
+    });
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs, errors } = await runGatewayToken();
+
+    expect(sawRefresh).toBe(true);
+    expect(exited).toBe(false);
+    expect(logs).toContain("new-acc");
+    expect(loadGuardianToken("px")?.accessToken).toBe("new-acc");
+    expect(`${logs}\n${errors}`).not.toContain("hatch");
+  });
+
+  test("get without a name targets the active assistant", async () => {
+    seedLocalEntry();
+    saveAssistantEntry({
+      assistantId: "py",
+      name: "Other Box",
+      runtimeUrl: "http://127.0.0.1:7831",
+      localUrl: "http://127.0.0.1:7831",
+      cloud: "local",
+      paired: false,
+    });
+    setActiveAssistant("py");
+    saveGuardianToken(
+      "py",
+      makeGuardianTokenData({ accessToken: "active-token" }),
+    );
+
+    process.argv = ["bun", "cadet", "gateway", "token", "get"];
+    const { exited, logs } = await runGatewayToken();
+
+    expect(exited).toBe(false);
+    expect(logs).toContain("active-token");
+  });
+
+  test("an unknown name is a strict-match error", async () => {
+    seedLocalEntry();
+    saveGuardianToken("px", makeGuardianTokenData());
+
+    process.argv = ["bun", "cadet", "gateway", "token", "get", "nope"];
+    const { exited, errors } = await runGatewayToken();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("No assistant found with name or ID 'nope'");
+  });
+
+  test("refresh self-heals an expired credential via the bootstrap reset", async () => {
+    seedLocalEntry({ guardianBootstrapSecret: "boot-secret-1" });
+    saveGuardianToken(
+      "px",
+      makeGuardianTokenData({
+        refreshTokenExpiresAt: new Date(Date.now() - 1000).toISOString(),
+      }),
+    );
+    mockRepairFetch(FRESH_LEASE);
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs, errors } = await runGatewayToken();
+
+    expect(exited).toBe(false);
+    expect(errors).toContain(
+      "Re-provisioned guardian token (this revoked other devices' paired tokens).",
+    );
+    expect(logs).toContain("fresh-acc");
+    expect(loadGuardianToken("px")?.accessToken).toBe("fresh-acc");
+    expect(`${logs}\n${errors}`).not.toContain("hatch");
+  });
+
+  test("refresh reports repair failure and never suggests hatching", async () => {
+    seedLocalEntry({ guardianBootstrapSecret: "boot-secret-1" });
+    saveGuardianToken(
+      "px",
+      makeGuardianTokenData({
+        refreshTokenExpiresAt: new Date(Date.now() - 1000).toISOString(),
+      }),
+    );
+    // Malformed 200 lease → GuardianLeasePermanentError → no retries.
+    mockRepairFetch({});
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs, errors } = await runGatewayToken();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("Guardian token could not be re-provisioned.");
+    expect(errors).toContain("--repair-guardian");
+    expect(errors).toContain("CADET_REFRESH_ERROR=");
+    expect(`${logs}\n${errors}`).not.toContain("hatch");
+  });
+
+  test("refresh re-provisions when the token file is missing entirely", async () => {
+    seedLocalEntry({ guardianBootstrapSecret: "boot-secret-1" });
+    mockRepairFetch(FRESH_LEASE);
+
+    process.argv = ["bun", "cadet", "gateway", "token", "refresh"];
+    const { exited, logs } = await runGatewayToken();
+
+    expect(exited).toBe(false);
+    expect(logs).toContain("fresh-acc");
+    expect(loadGuardianToken("px")?.accessToken).toBe("fresh-acc");
+  });
+});