@mycadet/cli 0.12.6-dev.202610082233.54244ee → 0.12.7-dev.202610102207.24bf931

package/eslint.config.mjs

@@ -10,6 +10,13 @@ const eslintConfig = defineConfig([
         "error",
         { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
       ],
+      // Ban `as` casts (the platform repo's rule) at warning level: the
+      // lint script pins --max-warnings to the current count and each PR
+      // chips away at it — prefer zod schemas or `in`-narrowing.
+      "@typescript-eslint/consistent-type-assertions": [
+        "warn",
+        { assertionStyle: "never" },
+      ],
     },
   },
 ]);

package/node_modules/@mycadet/local-mode/src/__tests__/environment.test.ts

@@ -117,8 +117,7 @@ describe("path resolvers honor the persisted default", () => {
       CADET_ENVIRONMENT: "production",
     };
     expect(resolveLockfilePaths(env)).toEqual([
-      path.join(os.homedir(), ".cadet.lock.json"),
-      path.join(os.homedir(), ".cadet.lockfile.json"),
+      path.join(configHome, "cadet", "lockfile.json"),
     ]);
   });
 });
@@ -162,8 +161,6 @@ describe("Windows path resolution", () => {
     const productionEnv = { CADET_ENVIRONMENT: "production" };
     expect(resolveLockfilePaths(productionEnv, options)).toEqual([
       "C:\\Users\\Example\\AppData\\Roaming\\cadet\\lockfile.json",
-      "C:\\Users\\Example\\.cadet.lock.json",
-      "C:\\Users\\Example\\.cadet.lockfile.json",
     ]);
     expect(defaultEnvironmentFilePaths(env, options)).toEqual([
       "C:\\Users\\Example\\AppData\\Roaming\\cadet\\environment",

package/node_modules/@mycadet/local-mode/src/config.ts

@@ -52,31 +52,26 @@ export function resolveLockfilePaths(
   if ((options.platform ?? process.platform) === "win32") {
     const canonicalDir = lockfileDir ?? resolveConfigDir(env, options);
     const canonical = joinLocalPath(options, canonicalDir, "lockfile.json");
-    const legacyDir = lockfileDir ?? options.homeDir ?? os.homedir();
-    const legacy =
-      cadetEnv === PRODUCTION_ENVIRONMENT_NAME
-        ? [".cadet.lock.json", ".cadet.lockfile.json"].map((name) =>
-            joinLocalPath(options, legacyDir, name),
-          )
-        : [
-            joinLocalPath(
-              options,
-              lockfileDir ?? resolveConfigDirPaths(env, options).at(-1)!,
-              "lockfile.json",
-            ),
-          ];
+    if (cadetEnv === PRODUCTION_ENVIRONMENT_NAME) {
+      return [canonical];
+    }
     return [
       canonical,
-      ...legacy.filter((candidate) => candidate !== canonical),
+      joinLocalPath(
+        options,
+        lockfileDir ?? resolveConfigDirPaths(env, options).at(-1)!,
+        "lockfile.json",
+      ),
     ];
   }
 
   if (cadetEnv === PRODUCTION_ENVIRONMENT_NAME) {
-    const dir = lockfileDir ?? options.homeDir ?? os.homedir();
-    return [
-      joinLocalPath(options, dir, ".cadet.lock.json"),
-      joinLocalPath(options, dir, ".cadet.lockfile.json"),
-    ];
+    // Canonical: the XDG config dir, where every other environment keeps
+    // its lockfile. Installs that predate the move are handled by the
+    // vellum → cadet migration, which moves the home-level file into
+    // place — no legacy candidates here.
+    const dir = lockfileDir ?? resolveConfigDir(env, options);
+    return [joinLocalPath(options, dir, "lockfile.json")];
   }
 
   const dir = lockfileDir ?? resolveConfigDir(env, options);

package/node_modules/@mycadet/local-mode/src/index.ts

@@ -140,3 +140,8 @@ export type {
   PairedForwardAuthorizationResult,
   PairedGuardianTokenProvider,
 } from "./gateway-proxy";
+
+export {
+  resolveExistingLocalSigningKey,
+  SigningKeyContinuityError,
+} from "./local-signing-key";

package/node_modules/@mycadet/local-mode/src/local-signing-key.ts

@@ -0,0 +1,73 @@
+import { timingSafeEqual } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+
+const KeySchema = z.string().regex(/^[0-9a-f]{64}$/i);
+const ResourcesSchema = z.object({
+  instanceDir: z.string().min(1),
+  signingKey: KeySchema.optional(),
+});
+
+export class SigningKeyContinuityError extends Error {
+  constructor(
+    public readonly code: "missing" | "invalid" | "unreadable" | "conflict",
+  ) {
+    super(
+      `Cannot resume authentication: signing key ${code}. Preserve the existing authentication state and restore its original key; no replacement key was generated.`,
+    );
+    this.name = "SigningKeyContinuityError";
+  }
+}
+
+/** Resolve existing identity material. This operation never creates or rotates a key. */
+export function resolveExistingLocalSigningKey(
+  resources: unknown,
+  stateRoot?: string,
+): string {
+  const parsed = ResourcesSchema.safeParse(resources);
+  if (!parsed.success) {
+    throw new SigningKeyContinuityError("invalid");
+  }
+  const { instanceDir, signingKey } = parsed.data;
+  // The host registry is authoritative after provisioning or migration.
+  // Legacy files can be stale after an explicit identity repair.
+  if (signingKey) {
+    return signingKey.toLowerCase();
+  }
+  const candidates: Buffer[] = [];
+  const root = stateRoot ?? instanceDir;
+  // Read-only migration sources, scoped to this instance rather than the user's home.
+  const legacyPaths = [
+    join(root, "gateway-security", "actor-token-signing-key"),
+    join(root, "workspace", "deprecated", "actor-token-signing-key"),
+  ];
+  for (const keyPath of legacyPaths) {
+    let raw: Buffer;
+    try {
+      raw = readFileSync(keyPath);
+    } catch (error) {
+      if (
+        error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "ENOENT"
+      ) {
+        continue;
+      }
+      throw new SigningKeyContinuityError("unreadable");
+    }
+    if (raw.length !== 32) {
+      throw new SigningKeyContinuityError("invalid");
+    }
+    candidates.push(raw);
+  }
+  const key = candidates[0];
+  if (!key) {
+    throw new SigningKeyContinuityError("missing");
+  }
+  if (candidates.some((candidate) => !timingSafeEqual(candidate, key))) {
+    throw new SigningKeyContinuityError("conflict");
+  }
+  return key.toString("hex");
+}

package/node_modules/@mycadet/local-mode/src/lockfile.ts

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 
 import {
+  LockfileAssistantSchema,
   parseLockfile,
   resolveCloud,
   type Lockfile,
@@ -207,7 +208,8 @@ export function stampLockfileAssistantOnboardedIfPresent(
     lockfilePaths,
     assistantId,
     { onboardedAt },
-    (entry) => typeof entry.onboardedAt === "string" && entry.onboardedAt !== "",
+    (entry) =>
+      typeof entry.onboardedAt === "string" && entry.onboardedAt !== "",
   );
 }
 
@@ -289,6 +291,10 @@ export function upsertLockfileAssistant(
   return locked.ok ? locked.value : lockFailure(locked.error);
 }
 
+const RendererAssistantUpdateSchema = LockfileAssistantSchema.omit({
+  resources: true,
+});
+
 const PAIRED_LOCKFILE_WRITE_ERROR =
   "Paired assistant identity can only be changed through the connect flow";
 
@@ -296,6 +302,7 @@ const PAIRED_LOCKFILE_WRITE_ERROR =
  * Apply a renderer-originated lockfile upsert without allowing it to create,
  * retarget, or reclassify a paired assistant. Existing paired entries may
  * still update non-security fields and become the active assistant.
+ * Resources and secrets are host-owned and never accepted from a renderer.
  */
 export function upsertRendererLockfileAssistant(
   lockfilePaths: string[],
@@ -309,7 +316,11 @@ export function upsertRendererLockfileAssistant(
   // Lock spans the paired-guard read and the upsert (which reenters) so the
   // guard cannot be judged against a snapshot another writer replaces.
   const locked = withLockfileLock(lockfilePaths, (): WriteResult => {
-    const lockfile = readRawLockfile(lockfilePaths);
+    const read = readRawLockfileStrict(lockfilePaths);
+    if (!read.ok) {
+      return { ok: false, status: 409, error: read.error };
+    }
+    const lockfile = read.lockfile;
     const assistants = Array.isArray(lockfile.assistants)
       ? (lockfile.assistants as Array<Record<string, unknown>>)
       : [];
@@ -335,7 +346,11 @@ export function upsertRendererLockfileAssistant(
       return { ok: false, status: 403, error: PAIRED_LOCKFILE_WRITE_ERROR };
     }
 
-    return upsertLockfileAssistant(lockfilePaths, assistant, activeAssistant);
+    const update = RendererAssistantUpdateSchema.safeParse(assistant);
+    if (!update.success) {
+      return { ok: false, status: 400, error: "Invalid assistant metadata" };
+    }
+    return upsertLockfileAssistant(lockfilePaths, update.data, activeAssistant);
   });
   return locked.ok ? locked.value : lockFailure(locked.error);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.6-dev.202610082233.54244ee",
+  "version": "0.12.7-dev.202610102207.24bf931",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {
@@ -15,12 +15,12 @@
     "./src/commands/*": "./src/commands/*.ts"
   },
   "bin": {
-    "cadet": "./src/index.ts"
+    "cadet-dev": "./src/index.ts"
   },
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "eslint",
+    "lint": "eslint --max-warnings 326",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "compile:check": "bun build --compile src/index.ts --outfile /dev/null",
     "test": "bun run scripts/run-tests.ts",
@@ -40,7 +40,8 @@
     "nanoid": "5.1.7",
     "qrcode-terminal": "0.12.0",
     "react": "19.2.6",
-    "react-devtools-core": "7.0.1"
+    "react-devtools-core": "7.0.1",
+    "zod": "4.3.6"
   },
   "bundledDependencies": [
     "@mycadet/assistant-api",

package/src/__tests__/assistant-config.test.ts

@@ -46,7 +46,7 @@ afterAll(() => {
 
 function writeLockfile(data: unknown): void {
   writeFileSync(
-    join(testDir, ".cadet.lock.json"),
+    join(testDir, "lockfile.json"),
     JSON.stringify(data, null, 2),
   );
 }
@@ -64,14 +64,9 @@ const makeEntry = (
 
 describe("assistant-config", () => {
   beforeEach(() => {
-    // Reset lockfile between tests
+    // Reset the canonical lockfile between tests
     try {
-      rmSync(join(testDir, ".cadet.lock.json"));
-    } catch {
-      // file may not exist
-    }
-    try {
-      rmSync(join(testDir, ".cadet.lockfile.json"));
+      rmSync(join(testDir, "lockfile.json"));
     } catch {
       // file may not exist
     }
@@ -82,7 +77,17 @@ describe("assistant-config", () => {
   });
 
   test("loadAllAssistants returns empty array for malformed lockfile", () => {
-    writeFileSync(join(testDir, ".cadet.lock.json"), "not json");
+    writeFileSync(join(testDir, "lockfile.json"), "not json");
+    expect(loadAllAssistants()).toEqual([]);
+  });
+
+  test("legacy home-level lockfile names are no longer read (the migration moves them into place)", () => {
+    // A pre-move home-level file alone must NOT be picked up — the
+    // migration tooling is what moves it to the canonical config-dir path.
+    writeFileSync(
+      join(testDir, ".cadet.lock.json"),
+      JSON.stringify({ assistants: [makeEntry("legacy-1")] }, null, 2),
+    );
     expect(loadAllAssistants()).toEqual([]);
   });
 
@@ -103,11 +108,11 @@ describe("assistant-config", () => {
     saveAssistantEntry(makeEntry("locked-1"));
     expect(loadAllAssistants()).toHaveLength(1);
     // The shared `${lockfilePath}.lock` key hosts contend on is released.
-    expect(existsSync(join(testDir, ".cadet.lock.json.lock"))).toBe(false);
+    expect(existsSync(join(testDir, "lockfile.json.lock"))).toBe(false);
   });
 
   test("saveAssistantEntry breaks a stale lock and still lands the write", () => {
-    const lockDir = join(testDir, ".cadet.lock.json.lock");
+    const lockDir = join(testDir, "lockfile.json.lock");
     mkdirSync(lockDir);
     const past = new Date(Date.now() - 60_000);
     utimesSync(lockDir, past, past);
@@ -118,7 +123,7 @@ describe("assistant-config", () => {
   });
 
   test("saveAssistantEntry fails fast without writing when another holder is fresh", () => {
-    const lockDir = join(testDir, ".cadet.lock.json.lock");
+    const lockDir = join(testDir, "lockfile.json.lock");
     mkdirSync(lockDir);
     try {
       const start = Date.now();
@@ -615,9 +620,11 @@ describe("legacy migration via loadAllAssistants", () => {
     );
     expect(all[0].resources!.gatewayPort).toBe(7830);
 
-    // AND the lockfile on disk should reflect the migration
+    // AND the lockfile on disk should reflect the migration — persisted to
+    // the canonical config-dir path (the legacy seed file is left in place
+    // as a read-only fallback).
     const rawDisk = JSON.parse(
-      readFileSync(join(testDir, ".cadet.lock.json"), "utf-8"),
+      readFileSync(join(testDir, "lockfile.json"), "utf-8"),
     );
     const diskEntry = rawDisk.assistants[0];
     expect(diskEntry.baseDataDir).toBeUndefined();
@@ -715,21 +722,17 @@ describe("env-scoped lockfile and migration", () => {
     }
   });
 
-  test("production lockfile path is unchanged — uses .cadet.lock.json", () => {
+  test("production writes land at the config-dir lockfile.json, never the legacy home-level name", () => {
     // With CADET_ENVIRONMENT unset, the env package resolves production,
-    // whose canonical lockfile filename is `.cadet.lock.json`. This test
-    // uses the existing CADET_LOCKFILE_DIR=testDir override to route the
-    // lockfile to a scratch directory but verifies the FILENAME matches
-    // the production convention (not the non-prod "lockfile.json").
+    // whose canonical lockfile is the config-dir `lockfile.json` — the same
+    // convention every environment uses. The home-level `.cadet.lock.json`
+    // name is a read-only fallback and is never (re)created by writes.
     const prevEnv = process.env.CADET_ENVIRONMENT;
     delete process.env.CADET_ENVIRONMENT;
     try {
       // Clear any existing lockfile from earlier tests
-      try {
-        rmSync(join(testDir, ".cadet.lock.json"));
-      } catch {
-        // ignore
-      }
+      rmSync(join(testDir, "lockfile.json"), { force: true });
+      rmSync(join(testDir, ".cadet.lock.json"), { force: true });
 
       saveAssistantEntry({
         assistantId: "prod-bot",
@@ -737,12 +740,10 @@ describe("env-scoped lockfile and migration", () => {
         cloud: "local",
       });
 
-      // The file should land at testDir/.cadet.lock.json — the production
-      // filename — rather than testDir/lockfile.json.
-      const prodPath = join(testDir, ".cadet.lock.json");
-      const raw = JSON.parse(readFileSync(prodPath, "utf-8"));
+      const raw = JSON.parse(readFileSync(join(testDir, "lockfile.json"), "utf-8"));
       expect(raw.assistants).toHaveLength(1);
       expect(raw.assistants[0].assistantId).toBe("prod-bot");
+      expect(existsSync(join(testDir, ".cadet.lock.json"))).toBe(false);
     } finally {
       if (prevEnv !== undefined) {
         process.env.CADET_ENVIRONMENT = prevEnv;
@@ -765,6 +766,7 @@ describe("cross-environment hint on resolution failure", () => {
     // copy is deterministic. The current-env lockfile is emptied so resolution
     // genuinely finds nothing.
     process.env.CADET_ENVIRONMENT = "production";
+    rmSync(join(testDir, "lockfile.json"), { force: true });
     rmSync(join(testDir, ".cadet.lock.json"), { force: true });
     rmSync(join(testDir, ".cadet.lockfile.json"), { force: true });
   });

package/src/__tests__/backup.test.ts

@@ -5,6 +5,7 @@ import {
   describe,
   expect,
   mock,
+  type Mock,
   spyOn,
   test,
 } from "bun:test";
@@ -79,6 +80,7 @@ const localRuntimePollJobStatusMock = spyOn(
   result: { manifest_sha256: "abc123def456" },
 });
 
+/** A complete-but-fake guardian token; the SUT only reads the fields it sets. */
 // Mode 1 (runtime-direct local backup) uses guardian tokens. Don't exercise
 // it here, but the spies need to exist so the module under test can import
 // them without surprises. Saved to variables so afterAll can restore them —
@@ -87,31 +89,25 @@ const localRuntimePollJobStatusMock = spyOn(
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
-).mockReturnValue({
-  accessToken: "local-token",
-  accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-} as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+).mockReturnValue(makeGuardianTokenData({ accessToken: "local-token" }));
 const leaseGuardianTokenSpy = spyOn(
   guardianToken,
   "leaseGuardianToken",
-).mockResolvedValue({
-  accessToken: "leased-token",
-  accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-} as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+).mockResolvedValue(makeGuardianTokenData({ accessToken: "leased-token" }));
 
 const getBackupsDirMock = spyOn(backupOps, "getBackupsDir").mockReturnValue(
   "/tmp/backups-default",
 );
 
 const mkdirSyncMock = spyOn(fs, "mkdirSync").mockImplementation(
-  (() => undefined) as never,
+  () => undefined,
 );
 const writeFileSyncMock = spyOn(fs, "writeFileSync").mockImplementation(
   () => undefined,
 );
 
 let originalFetch: typeof globalThis.fetch;
-let exitMock: ReturnType<typeof mock>;
+let exitMock: Mock<(code?: number | string | undefined) => never>;
 
 const CADET_ENTRY = {
   assistantId: "11111111-2222-3333-4444-555555555555",
@@ -126,10 +122,10 @@ function setArgv(...rest: string[]) {
 
 beforeEach(() => {
   originalFetch = globalThis.fetch;
-  exitMock = mock((code?: number) => {
+  exitMock = mock((code?: number | string | undefined): never => {
     throw new Error(`process.exit:${code}`);
   });
-  process.exit = exitMock as unknown as typeof process.exit;
+  process.exit = exitMock;
 
   findAssistantByNameMock.mockReset();
   findAssistantByNameMock.mockReturnValue(null);
@@ -162,17 +158,15 @@ beforeEach(() => {
   getBackupsDirMock.mockReset();
   getBackupsDirMock.mockReturnValue("/tmp/backups-default");
   loadGuardianTokenSpy.mockReset();
-  loadGuardianTokenSpy.mockReturnValue({
-    accessToken: "local-token",
-    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-  } as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+  loadGuardianTokenSpy.mockReturnValue(
+    makeGuardianTokenData({ accessToken: "local-token" }),
+  );
   leaseGuardianTokenSpy.mockReset();
-  leaseGuardianTokenSpy.mockResolvedValue({
-    accessToken: "leased-token",
-    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-  } as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+  leaseGuardianTokenSpy.mockResolvedValue(
+    makeGuardianTokenData({ accessToken: "leased-token" }),
+  );
   mkdirSyncMock.mockReset();
-  mkdirSyncMock.mockImplementation((() => undefined) as never);
+  mkdirSyncMock.mockImplementation(() => undefined);
   writeFileSyncMock.mockReset();
   writeFileSyncMock.mockImplementation(() => undefined);
 });
@@ -200,20 +194,26 @@ afterAll(() => {
 });
 
 import { backup } from "../commands/backup.js";
+import { withPreconnect } from "./helpers/http.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 // ---------------------------------------------------------------------------
 // Helper: simulated GCS download response
 // ---------------------------------------------------------------------------
-function mockGcsDownload(body: Uint8Array, ok = true, status = 200) {
-  globalThis.fetch = mock(async () => {
-    const responseBody: BodyInit = ok
-      ? new Blob([body as unknown as ArrayBuffer])
-      : "boom";
+function mockGcsDownload(
+  body: Uint8Array<ArrayBuffer>,
+  ok = true,
+  status = 200,
+) {
+  const gcsFetch = mock(async () => {
+    const responseBody: BodyInit = ok ? new Blob([body]) : "boom";
     return new Response(responseBody, {
       status,
       statusText: ok ? "OK" : "Error",
     });
-  }) as unknown as typeof globalThis.fetch;
+  });
+  globalThis.fetch = withPreconnect(gcsFetch);
+  return gcsFetch;
 }
 
 describe("cadet backup <local>: guardian bootstrap secret", () => {
@@ -228,11 +228,9 @@ describe("cadet backup <local>: guardian bootstrap secret", () => {
     loadGuardianTokenSpy.mockReturnValue(null);
     setArgv("my-local", "--output", "/tmp/local-backup.vbundle");
 
-    globalThis.fetch = mock(async () => {
-      return new Response(new Uint8Array([1, 2, 3]), {
-        status: 200,
-      });
-    }) as unknown as typeof globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async () => new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    );
 
     await backup();
 
@@ -294,9 +292,9 @@ describe("cadet backup: --export-timeout flag", () => {
       "/tmp/local-backup.vbundle",
     );
 
-    globalThis.fetch = mock(async () => {
-      return new Response(new Uint8Array([1, 2, 3]), { status: 200 });
-    }) as unknown as typeof globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async () => new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    );
 
     await backup();
 
@@ -313,7 +311,7 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     setArgv("my-platform");
 
     const bytes = new Uint8Array([1, 2, 3, 4]);
-    mockGcsDownload(bytes);
+    const gcsFetch = mockGcsDownload(bytes);
 
     await backup();
 
@@ -366,13 +364,12 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
       "https://cloud.mycadet.ai",
     );
     const downloadCall = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "download",
+      (c) => c[0].operation === "download",
     );
     expect(downloadCall).toBeDefined();
     expect(downloadCall![0]).not.toHaveProperty("targetRuntimeVersion");
 
     // GCS fetch went directly to the signed download URL with no auth.
-    const gcsFetch = globalThis.fetch as unknown as ReturnType<typeof mock>;
     expect(gcsFetch).toHaveBeenCalledWith(
       "https://storage.googleapis.com/bucket/signed-download",
     );
@@ -382,7 +379,7 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     const [outputPath, written] = writeFileSyncMock.mock.calls[0]!;
     expect(written).toEqual(bytes);
     expect(typeof outputPath).toBe("string");
-    expect(outputPath as string).toMatch(
+    expect(outputPath).toMatch(
       /\/tmp\/backups-default\/my-platform-.*\.vbundle$/,
     );
     expect(mkdirSyncMock).toHaveBeenCalled();
@@ -411,10 +408,8 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     await backup();
 
     const [outputPath] = writeFileSyncMock.mock.calls[0]!;
-    expect(outputPath as string).toMatch(
-      /^\/tmp\/backups-default\/my-platform-/,
-    );
-    expect(outputPath as string).toMatch(/\.vbundle$/);
+    expect(outputPath).toMatch(/^\/tmp\/backups-default\/my-platform-/);
+    expect(outputPath).toMatch(/\.vbundle$/);
   });
 
   test("signed-URL requests target entry.runtimeUrl, not getPlatformUrl() — regression for staging/dev assistants", async () => {
@@ -502,10 +497,10 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     // `platformToken` parameter instead of `exportPlatformToken`, a
     // future poll-loop refresh would silently break this invariant.
     const uploadCallToken = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "upload",
+      (c) => c[0].operation === "upload",
     )![1];
     const downloadCallToken = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "download",
+      (c) => c[0].operation === "download",
     )![1];
     expect(downloadCallToken).toBe(uploadCallToken);
     const kickoffToken = localRuntimeExportToGcsMock.mock.calls[0]![1];