@mycadet/cli 0.12.11 → 0.13.0

package/src/__tests__/host-teleport.test.ts

@@ -0,0 +1,405 @@
+import { afterEach, beforeEach, expect, mock, spyOn, test } from "bun:test";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  findAssistantByName,
+  saveAssistantEntry,
+  type AssistantEntry,
+} from "../lib/assistant-config.js";
+import {
+  teleportHostInstallation,
+  TeleportRecoveryError,
+  type HostTeleportOps,
+} from "../lib/host-teleport.js";
+import {
+  createRootBackup,
+  LocalRootStorage,
+  restoreRootBackup,
+  STATE_ROOTS,
+} from "../lib/root-backup.js";
+
+let directory: string,
+  source: AssistantEntry,
+  target: AssistantEntry,
+  ops: HostTeleportOps;
+let order: string[],
+  running: Map<string, boolean>,
+  stores: Map<string, LocalRootStorage>;
+let log: ReturnType<typeof spyOn>, previousLockDir: string | undefined;
+const options = { dryRun: false, keepSource: false };
+async function instance(
+  name: string,
+  cloud: "local" | "docker",
+  byte: number,
+): Promise<AssistantEntry> {
+  const root = join(directory, name);
+  for (const state of STATE_ROOTS) {
+    await mkdir(join(root, state), { recursive: true });
+    await writeFile(join(root, state, "state"), `${name}:${state}`, {
+      mode: 0o600,
+    });
+  }
+  await writeFile(
+    join(root, "gateway-security", "actor-token-signing-key"),
+    Buffer.alloc(32, byte),
+  );
+  await writeFile(
+    join(root, "ces-security", "keys.enc"),
+    Buffer.from([byte, 0, 255]),
+  );
+  await writeFile(
+    join(root, "ces-security", "store.key"),
+    Buffer.alloc(32, byte + 1),
+  );
+  return {
+    assistantId: name,
+    cloud,
+    runtimeUrl: "http://127.0.0.1:7830",
+    resources: {
+      instanceDir: root,
+      daemonPort: 1,
+      gatewayPort: 2,
+      cesPort: 3,
+      qdrantPort: 4,
+      signingKey: byte.toString(16).padStart(2, "0").repeat(32),
+    },
+  };
+}
+const previousDataHome = process.env.XDG_DATA_HOME;
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), "host-teleport-"));
+  process.env.XDG_DATA_HOME = directory;
+  previousLockDir = process.env.CADET_LOCKFILE_DIR;
+  process.env.CADET_LOCKFILE_DIR = join(directory, "registry");
+  source = await instance("source", "docker", 7);
+  target = await instance("target", "local", 3);
+  saveAssistantEntry(source);
+  saveAssistantEntry(target);
+  order = [];
+  running = new Map([
+    ["source", true],
+    ["target", true],
+  ]);
+  stores = new Map();
+  log = spyOn(console, "log").mockImplementation(() => {});
+  ops = {
+    storage: (entry) => {
+      let storage = stores.get(entry.assistantId);
+      if (!storage) {
+        storage = new LocalRootStorage(entry);
+        storage.running = async () => {
+          storage!.initialRunning ??= new Set(
+            running.get(entry.assistantId)
+              ? ["assistant", "gateway", "ces"]
+              : [],
+          );
+          return running.get(entry.assistantId) ?? false;
+        };
+        storage.resume = async () => {
+          order.push(`wake:${entry.assistantId}`);
+          running.set(entry.assistantId, true);
+        };
+        stores.set(entry.assistantId, storage);
+      }
+      return storage;
+    },
+    sleep: mock(async (entry) => {
+      order.push(`sleep:${entry.assistantId}`);
+      running.set(entry.assistantId, false);
+    }),
+    backup: mock(async (entry) => {
+      const file = join(directory, `${entry.assistantId}.tar.gz`),
+        storage = ops.storage(entry);
+      await createRootBackup({ ...entry, cloud: "local" }, file, {
+        storage,
+        sleep: () => ops.sleep(entry),
+        wake: () => storage.resume(),
+        save: saveAssistantEntry,
+      });
+      order.push(`backup:${entry.assistantId}`);
+      return file;
+    }),
+    version: mock(async () => "0.12.9"),
+    hatch: mock(async () => target),
+    restore: mock(async (entry, archive) => {
+      const storage = ops.storage(entry);
+      await restoreRootBackup(
+        entry,
+        archive,
+        { resume: false, recoveryPath: join(directory, "pre-restore.tar.gz") },
+        {
+          storage,
+          sleep: () => ops.sleep(entry),
+          wake: () => storage.resume(),
+          save: saveAssistantEntry,
+        },
+      );
+      await storage.resume();
+      order.push(`restore:${entry.assistantId}`);
+    }),
+    retire: mock(async (entry) => {
+      order.push(`retire:${entry.assistantId}`);
+    }),
+  };
+});
+afterEach(async () => {
+  if (previousDataHome === undefined) {
+    delete process.env.XDG_DATA_HOME;
+  } else {
+    process.env.XDG_DATA_HOME = previousDataHome;
+  }
+  log.mockRestore();
+  if (previousLockDir === undefined) {
+    delete process.env.CADET_LOCKFILE_DIR;
+  } else {
+    process.env.CADET_LOCKFILE_DIR = previousLockDir;
+  }
+  await rm(directory, { recursive: true, force: true });
+});
+
+test("moves all four roots and encrypted key pairs using the exact stopped-source safety tar", async () => {
+  await teleportHostInstallation(source, "local", "target", options, ops);
+  for (const state of STATE_ROOTS) {
+    expect(
+      await readFile(
+        join(target.resources!.instanceDir, state, "state"),
+        "utf8",
+      ),
+    ).toBe(`source:${state}`);
+  }
+  expect(
+    await readFile(
+      join(target.resources!.instanceDir, "ces-security", "keys.enc"),
+    ),
+  ).toEqual(Buffer.from([7, 0, 255]));
+  expect(
+    await readFile(
+      join(target.resources!.instanceDir, "ces-security", "store.key"),
+    ),
+  ).toEqual(Buffer.alloc(32, 8));
+  expect(findAssistantByName("target")!.resources!.signingKey).toBe(
+    "07".repeat(32),
+  );
+  expect(order).toEqual([
+    "sleep:source",
+    "backup:source",
+    "sleep:target",
+    "backup:target",
+    "wake:target",
+    "restore:target",
+    "retire:source",
+  ]);
+  expect(ops.restore).toHaveBeenCalledWith(
+    expect.objectContaining({ assistantId: "target" }),
+    join(directory, "source.tar.gz"),
+    join(directory, "target.tar.gz"),
+  );
+});
+test("dry run creates no archives and does not stop or hatch services", async () => {
+  await teleportHostInstallation(
+    source,
+    "local",
+    "target",
+    { ...options, dryRun: true },
+    ops,
+  );
+  expect(order).toEqual([]);
+  expect(ops.version).not.toHaveBeenCalled();
+  expect(ops.backup).not.toHaveBeenCalled();
+  expect(ops.hatch).not.toHaveBeenCalled();
+});
+test("keep-source retains the stopped original", async () => {
+  await teleportHostInstallation(
+    source,
+    "local",
+    "target",
+    { ...options, keepSource: true },
+    ops,
+  );
+  expect(running.get("source")).toBe(false);
+  expect(ops.retire).not.toHaveBeenCalled();
+});
+test("source backup failure wakes source without touching target", async () => {
+  ops.backup = mock(async () => {
+    throw new Error("unreadable credential store");
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("unreadable credential store");
+  expect(order).toEqual(["sleep:source", "wake:source"]);
+  expect(ops.restore).not.toHaveBeenCalled();
+  expect(ops.retire).not.toHaveBeenCalled();
+});
+test("graceful shutdown failure never captures a live installation", async () => {
+  ops.sleep = mock(async () => {
+    throw new Error("graceful timeout");
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("graceful timeout");
+  expect(ops.backup).not.toHaveBeenCalled();
+  expect(ops.retire).not.toHaveBeenCalled();
+});
+test("source that fails to stop is rejected even if sleep returned", async () => {
+  ops.sleep = mock(async () => {});
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("still running");
+  expect(ops.backup).not.toHaveBeenCalled();
+});
+test("target capture failure resumes both original installations", async () => {
+  const backup = ops.backup;
+  ops.backup = mock(async (entry) => {
+    if (entry.assistantId === target.assistantId) {
+      throw new Error("target capture failed");
+    }
+    return backup(entry);
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("target capture failed");
+  expect(order.slice(-2)).toEqual(["wake:target", "wake:source"]);
+  expect(ops.restore).not.toHaveBeenCalled();
+});
+test("failed import retains source and resumes recovered target", async () => {
+  ops.restore = mock(async () => {
+    throw new Error("import failed; original data recovered");
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("import failed");
+  expect(ops.retire).not.toHaveBeenCalled();
+  expect(order.slice(-2)).toEqual(["wake:target", "wake:source"]);
+});
+test("failed recovery leaves damaged target stopped", async () => {
+  ops.restore = mock(async () => {
+    throw new TeleportRecoveryError([], "recovery failed");
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("recovery failed");
+  expect(running.get("target")).toBe(false);
+  expect(order).not.toContain("wake:target");
+  expect(ops.retire).not.toHaveBeenCalled();
+});
+test("originally sleeping source stays asleep on capture failure", async () => {
+  running.set("source", false);
+  ops.backup = mock(async () => {
+    throw new Error("capture failed");
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("capture failed");
+  expect(order).not.toContain("wake:source");
+});
+test("new target receives safety tar at hatch and becomes ready before source retirement", async () => {
+  await teleportHostInstallation(source, "local", "fresh-target", options, ops);
+  expect(ops.hatch).toHaveBeenCalledWith(
+    "local",
+    "fresh-target",
+    join(directory, "source.tar.gz"),
+  );
+  expect(order.indexOf("wake:target")).toBeLessThan(
+    order.indexOf("retire:source"),
+  );
+  expect(ops.restore).not.toHaveBeenCalled();
+});
+test("failed new target readiness cleans it up before waking source", async () => {
+  ops.storage(target).resume = async () => {
+    throw new Error("migration failed");
+  };
+  await expect(
+    teleportHostInstallation(source, "local", "fresh-target", options, ops),
+  ).rejects.toThrow("migration failed");
+  expect(order.slice(-3)).toEqual([
+    "sleep:target",
+    "retire:target",
+    "wake:source",
+  ]);
+  expect(order).not.toContain("retire:source");
+});
+test("hatch failure retains tar and wakes source", async () => {
+  ops.hatch = mock(async () => {
+    throw new Error("image pull failed");
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "fresh-target", options, ops),
+  ).rejects.toThrow("image pull failed");
+  expect(order.at(-1)).toBe("wake:source");
+  expect(await readFile(join(directory, "source.tar.gz"))).not.toHaveLength(0);
+  expect(ops.retire).not.toHaveBeenCalled();
+});
+test("multi-patch downgrade fails before shutdown", async () => {
+  ops.version = mock(async (entry) => (entry === source ? "0.12.9" : "0.12.5"));
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("older than source");
+  expect(order).toEqual([]);
+});
+test("target environment mismatch fails before shutdown", async () => {
+  await expect(
+    teleportHostInstallation(source, "docker", "target", options, ops),
+  ).rejects.toThrow("not docker");
+  expect(order).toEqual([]);
+});
+test("source restarted during transfer is retained to preserve newer writes", async () => {
+  const restore = ops.restore;
+  ops.restore = mock(async (entry, archive, recovery) => {
+    await restore(entry, archive, recovery);
+    running.set("source", true);
+  });
+  await expect(
+    teleportHostInstallation(source, "local", "target", options, ops),
+  ).rejects.toThrow("restarted during teleport");
+  expect(ops.retire).not.toHaveBeenCalled();
+  expect(order).not.toContain("wake:source");
+});
+
+test("holds source and target operation locks through import and releases them afterward", async () => {
+  let release!: () => void;
+  const blocked = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let entered!: () => void;
+  const importing = new Promise<void>((resolve) => {
+    entered = resolve;
+  });
+  const restore = ops.restore;
+  ops.restore = mock(async (entry, archive, recovery) => {
+    entered();
+    await blocked;
+    await restore(entry, archive, recovery);
+  });
+  const transfer = teleportHostInstallation(
+    source,
+    "local",
+    "target",
+    options,
+    ops,
+  );
+  await importing;
+  try {
+    for (const entry of [source, target]) {
+      const storage = ops.storage(entry);
+      await expect(
+        createRootBackup(entry, join(directory, "competing.tar.gz"), {
+          storage,
+          sleep: () => ops.sleep(entry),
+          wake: () => storage.resume(),
+          save: saveAssistantEntry,
+        }),
+      ).rejects.toThrow("Another backup/restore owns");
+    }
+  } finally {
+    release();
+  }
+  await transfer;
+  const storage = ops.storage(source);
+  await createRootBackup(source, join(directory, "after.tar.gz"), {
+    storage,
+    sleep: () => ops.sleep(source),
+    wake: () => storage.resume(),
+    save: saveAssistantEntry,
+  });
+});

package/src/__tests__/nginx-ingress.test.ts

@@ -51,6 +51,10 @@ mock.module("node:fs", () => ({
   readFileSync: readFileSyncMock,
 }));
 
+const fetchCurrentVersionMock = mock<typeof httpClient.fetchCurrentVersion>(
+  async () => "1.2.3",
+);
+
 const waitForDaemonReadyMock = mock<typeof httpClient.waitForDaemonReady>(
   async () => true,
 );
@@ -58,6 +62,7 @@ const waitForDaemonReadyMock = mock<typeof httpClient.waitForDaemonReady>(
 mock.module("../lib/http-client.js", () => ({
   ...httpClient,
   waitForDaemonReady: waitForDaemonReadyMock,
+  fetchCurrentVersion: fetchCurrentVersionMock,
 }));
 
 // Restore the real modules once this file finishes so the mocks do not leak
@@ -72,7 +77,6 @@ import {
   buildIngressNginxConfig,
   hasIpv6Loopback,
   buildRemoteWebIndexHtml,
-  cloudWebHubUrl,
   MAX_PRESERVED_MODULE_PRELOADS,
   ensureTunnelEdge,
   EDGE_TEMPLATE_VERSION,
@@ -124,6 +128,8 @@ afterEach(() => {
   existsSyncMock.mockImplementation(realFs.existsSync);
   readFileSyncMock.mockReset();
   readFileSyncMock.mockImplementation(realFs.readFileSync);
+  fetchCurrentVersionMock.mockReset();
+  fetchCurrentVersionMock.mockImplementation(async () => "1.2.3");
   waitForDaemonReadyMock.mockReset();
   waitForDaemonReadyMock.mockImplementation(async () => true);
   for (const dir of workspaces.splice(0)) {
@@ -307,7 +313,7 @@ describe("buildIngressNginxConfig", () => {
     ).toEqual([]);
   });
 
-  test("revalidates the shell and forbids storing only the inline config", () => {
+  test("revalidates the shell and forbids storing inline config", () => {
     const blocks = locationBlocks(remoteConf);
     const cacheControlOf = (matcher: string) =>
       blocks
@@ -318,11 +324,8 @@ describe("buildIngressNginxConfig", () => {
     expect(cacheControlOf("^~ /assistant/assets/")).toBe(
       "public, max-age=31536000, immutable",
     );
-    // Only the inline __config return, which nginx gives no validator, still
-    // refuses storage. A second no-store means a revalidating location
-    // regressed to re-sending its whole body on every load.
+    // Inline config has no validator and must not be stored.
     expect(cacheControlOf("= /assistant/__config")).toBe("no-store");
-    expect(remoteConf.match(/no-store/g)).toHaveLength(1);
   });
 
   test("serves remote web config for the SPA", () => {
@@ -527,18 +530,6 @@ describe("buildRemoteWebIndexHtml", () => {
   });
 });
 
-describe("cloudWebHubUrl", () => {
-  test("maps build environments to their cloud SPA base", () => {
-    expect(cloudWebHubUrl("production")).toBe("https://mycadet.ai/assistant");
-    expect(cloudWebHubUrl("staging")).toBe(
-      "https://staging.mycadet.ai/assistant",
-    );
-    expect(cloudWebHubUrl("dev")).toBe("https://dev.mycadet.ai/assistant");
-    expect(cloudWebHubUrl("local")).toBe("https://dev.mycadet.ai/assistant");
-    expect(cloudWebHubUrl(undefined)).toBe("https://dev.mycadet.ai/assistant");
-  });
-});
-
 describe("nginx ingress process state", () => {
   function writeIngressState(workspaceDir: string, listenPort: number): void {
     writeFileSync(
@@ -746,17 +737,19 @@ function mockWebDistMissing(): void {
 }
 
 /** Force findWebDistDir() to resolve a dist dir, regardless of checkout state. */
-function mockWebDistPresent(): void {
+function mockWebDistPresent(version: string | null = "1.2.3"): void {
   existsSyncMock.mockImplementation((path) =>
     String(path).endsWith(WEB_INDEX_SUFFIX) ? true : realFs.existsSync(path),
   );
   readFileSyncMock.mockImplementation(((path, options) =>
     String(path).endsWith(WEB_INDEX_SUFFIX)
       ? FAKE_INDEX_HTML
-      : realFs.readFileSync(
-          path as never,
-          options as never,
-        )) as typeof readFileSync);
+      : String(path).endsWith("release.json")
+        ? JSON.stringify(version === null ? {} : { version })
+        : realFs.readFileSync(
+            path as never,
+            options as never,
+          )) as typeof readFileSync);
 }
 
 /** Record a running edge: ingress state, live pidfile, matching ps output. */
@@ -863,6 +856,7 @@ function spaConfigHash(
           hubUrl: PRODUCTION_HUB_URL,
         },
         webDistDir: opts.webDistDir ?? findWebDistDir(),
+        version: "1.2.3",
         indexHtml: opts.indexHtml ?? FAKE_INDEX_HTML,
       }),
     )
@@ -888,6 +882,70 @@ function pinProductionEnvironment(): void {
 describe("startRemoteWebIngress", () => {
   pinProductionEnvironment();
 
+  for (const [webVersion, runtimeVersion, ready] of [
+    ["1.2.3", "1.2.3", true],
+    ["1.2.3", "v1.2.3", true],
+    ["1.2.2", "1.2.3", false],
+    ["1.2.3", undefined, false],
+    [null, "1.2.3", false],
+  ] as const) {
+    test(`release resolution: UI ${webVersion}, assistant ${runtimeVersion}`, async () => {
+      const ws = makeWorkspace();
+      mockNginxInstalled();
+      mockNginxSpawn();
+      mockWebDistPresent(webVersion);
+      fetchCurrentVersionMock.mockResolvedValue(runtimeVersion);
+      const result = await startRemoteWebIngress({
+        workspaceDir: ws,
+        gatewayPort: 7830,
+        listenPort: 7845,
+        assistantId: "assistant-1",
+      });
+      expect(result.status).toBe("started");
+      expect(fetchCurrentVersionMock).toHaveBeenCalledWith(
+        "http://127.0.0.1:7830",
+      );
+      const conf = realFs.readFileSync(ingressConfPath(ws), "utf8");
+      const detail = conf
+        .split('location = "/v1/assistants/assistant-1/" {')[1]
+        ?.split("\n    }")[0];
+      expect(detail).toContain(`return ${ready ? 200 : 409} `);
+      if (ready) {
+        expect(detail).toContain('\\"version\\":\\"1.2.3\\"');
+      } else {
+        expect(detail).not.toContain('\\"url\\"');
+      }
+    });
+  }
+
+  test("restarts an edge when its verified assistant/UI release changes", async () => {
+    const ws = makeWorkspace();
+    mockNginxInstalled();
+    mockNginxSpawn();
+    mockWebDistPresent("1.2.3");
+    fetchCurrentVersionMock.mockResolvedValue("1.2.4");
+    const pid = mockRunningEdge(ws, {
+      listenPort: 7845,
+      includeWebApp: true,
+      gatewayPort: 7830,
+      remoteWebConfigHash: spaConfigHash({ assistantId: "assistant-1" }),
+    });
+    const edge = mockKillableNginx(pid);
+    const result = await startRemoteWebIngress({
+      workspaceDir: ws,
+      gatewayPort: 7830,
+      listenPort: 7845,
+      assistantId: "assistant-1",
+    });
+    expect(result.status).toBe("started");
+    expect(edge.killed()).toBe(true);
+    const conf = realFs.readFileSync(ingressConfPath(ws), "utf8");
+    const detail = conf
+      .split('location = "/v1/assistants/assistant-1/" {')[1]
+      ?.split("\n    }")[0];
+    expect(detail).toContain("return 409 ");
+  });
+
   test("webhooks-only mode starts the denylist+proxy edge without a web dist", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
@@ -2261,3 +2319,104 @@ describe("stopContainerTunnelEdge", () => {
     expect(await stopContainerTunnelEdge(containerEntry(7930))).toBe(false);
   });
 });
+
+describe("assistant metadata API", () => {
+  function config(id = "assistant-1") {
+    return buildIngressNginxConfig({
+      gatewayPort: 7830,
+      listenPort: 7840,
+      remoteWebIngress: {
+        webDistDir: "/tmp/web",
+        version: "1.2.3",
+        assistantId: id,
+        assistantName: "My assistant",
+        config: { appAllowedOrigins: ["https://parent.example"] },
+      },
+    });
+  }
+  function body(conf: string, path: string, status = 200): unknown {
+    const location = conf
+      .split(`location = "${path}" {`)[1]
+      ?.split("\n    }")[0];
+    const value = location?.match(/return (200|409) ("(?:\\.|[^"\\])*");/);
+    expect(Number(value?.[1])).toBe(status);
+    if (!value) {
+      throw new Error(`Missing metadata for ${path}`);
+    }
+    return JSON.parse(JSON.parse(value[2]));
+  }
+  test("lists only this host's assistant and returns its actual UI version and URL", () => {
+    const conf = config();
+    expect(body(conf, "/v1/assistants/")).toEqual({
+      results: [{ id: "assistant-1", name: "My assistant" }],
+      next: null,
+    });
+    expect(body(conf, "/v1/assistants/assistant-1/")).toEqual({
+      id: "assistant-1",
+      name: "My assistant",
+      status: "active",
+      version: "1.2.3",
+      url: "assistant/",
+    });
+    expect(conf).not.toContain('location = "/v1/assistants/other/"');
+  });
+  test("metadata supports both slash forms and only read methods", () => {
+    const conf = config();
+    for (const path of [
+      "/v1/assistants",
+      "/v1/assistants/",
+      "/v1/assistants/assistant-1",
+      "/v1/assistants/assistant-1/",
+    ]) {
+      expect(body(conf, path)).toBeDefined();
+    }
+    expect(conf).toContain(
+      "if ($request_method !~ ^(GET|HEAD)$) { return 405; }",
+    );
+    expect(conf).toContain(
+      '"https://parent.example" "https://parent.example";',
+    );
+    expect(conf).toContain(
+      "add_header Access-Control-Allow-Origin $cadet_app_origin always;",
+    );
+  });
+  test("unknown identity yields an empty list without inventing an assistant ID", () => {
+    const conf = buildIngressNginxConfig({
+      gatewayPort: 7830,
+      listenPort: 7840,
+      remoteWebIngress: { webDistDir: "/tmp/web" },
+    });
+    expect(body(conf, "/v1/assistants/")).toEqual({ results: [], next: null });
+  });
+  test("a known assistant without a UI bundle returns 409 on both detail paths", () => {
+    const conf = buildIngressNginxConfig({
+      gatewayPort: 7830,
+      listenPort: 7840,
+      remoteWebIngress: { webDistDir: "/tmp/web", assistantId: "assistant-1" },
+    });
+    expect(body(conf, "/v1/assistants/")).toEqual({
+      results: [{ id: "assistant-1" }],
+      next: null,
+    });
+    for (const path of [
+      "/v1/assistants/assistant-1",
+      "/v1/assistants/assistant-1/",
+    ]) {
+      expect(body(conf, path, 409)).toEqual({
+        detail: "assistant is not ready",
+      });
+    }
+  });
+  test("invalid browser origins fail before nginx starts", () => {
+    expect(() =>
+      buildIngressNginxConfig({
+        gatewayPort: 7830,
+        listenPort: 7840,
+        remoteWebIngress: {
+          webDistDir: "/tmp/web",
+          config: { appAllowedOrigins: ["https://parent.example/path"] },
+        },
+      }),
+    ).toThrow("App origins");
+  });
+});

package/src/__tests__/orphan-detection.test.ts

@@ -107,7 +107,7 @@ describe("getKnownPidsFromAssistants", () => {
     const entry: AssistantEntry = {
       assistantId: "managed-1",
       runtimeUrl: "https://cloud.mycadet.ai/foo",
-      cloud: "cadet",
+      cloud: "cloud",
     };
     const pids = getKnownPidsFromAssistants([entry]);
     expect(pids.size).toBe(0);