@mycadet/cli 0.12.6-dev.202610082233.54244ee → 0.12.7

package/src/commands/upgrade.ts

@@ -1,3 +1,4 @@
+import { resolveExistingLocalSigningKey } from "@mycadet/local-mode";
 import { isManagedCloud } from "../lib/managed-cloud.js";
 import { spawnSync } from "child_process";
 import { writeFileSync } from "fs";
@@ -873,6 +874,12 @@ async function upgradeLocal(
     process.exit(1);
   }
 
+  const signingKey = resolveExistingLocalSigningKey(entry.resources);
+  if (entry.resources.signingKey !== signingKey) {
+    entry.resources.signingKey = signingKey;
+    saveAssistantEntry(entry);
+  }
+
   const targetVersion = await targetVersionFromCli(version);
   const adminUrl = localAdminUrl(entry);
   const { currentVersion, preMigrationState } = await fetchLocalUpgradeState(
@@ -947,14 +954,8 @@ async function upgradeLocal(
     console.warn("⚠️  Pre-upgrade backup failed (continuing with upgrade)\n");
   }
 
-  let signingKey = entry.resources.signingKey;
   let bootstrapSecret = entry.guardianBootstrapSecret;
   let entryChanged = false;
-  if (!signingKey) {
-    signingKey = generateLocalSigningKey();
-    entry.resources = { ...entry.resources, signingKey };
-    entryChanged = true;
-  }
   if (!bootstrapSecret) {
     bootstrapSecret = generateLocalSigningKey();
     entry.guardianBootstrapSecret = bootstrapSecret;
@@ -1543,7 +1544,8 @@ async function resolveLatestAndMaybeSelfUpdate(
   return latestTag;
 }
 
-export async function upgrade(): Promise<void> {
+export const upgrade = Object.assign(
+  async function upgrade(): Promise<void> {
   const { name, version, latest, prepare, finalize, noWait, force } =
     parseArgs();
   const entry = resolveTargetAssistant(name);
@@ -1607,4 +1609,7 @@ export async function upgrade(): Promise<void> {
   console.error(msg);
   emitCliError("UNSUPPORTED_TOPOLOGY", msg);
   process.exit(1);
-}
+},
+  { description: "Upgrade an assistant to a newer version" },
+);
+

package/src/commands/use.ts

@@ -7,7 +7,8 @@ import {
 } from "../lib/assistant-config.js";
 import { parseAssistantTargetArg } from "../lib/assistant-target-args.js";
 
-export async function use(): Promise<void> {
+export const use = Object.assign(
+  async function use(): Promise<void> {
   const args = process.argv.slice(3);
 
   if (args.includes("--help") || args.includes("-h")) {
@@ -55,4 +56,7 @@ export async function use(): Promise<void> {
   console.log(
     `Active assistant set to ${formatAssistantReference(result.entry)}.`,
   );
-}
+},
+  { description: "Set the active assistant for commands" },
+);
+

package/src/commands/voice.ts

@@ -66,7 +66,8 @@ EXAMPLES:
 `);
 }
 
-export async function voice(): Promise<void> {
+export const voice = Object.assign(
+  async function voice(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
     printUsage();
@@ -119,7 +120,10 @@ export async function voice(): Promise<void> {
     reference: connection.reference,
     ...(sayText !== undefined ? { sayText } : {}),
   });
-}
+},
+  { description: "Type to an assistant and hear it answer out loud" },
+);
+
 
 /** Exported for tests. Not part of the command's public surface. */
 export interface SessionDeps {

package/src/commands/wake.ts

@@ -1,4 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from "fs";
+import {
+  SigningKeyContinuityError,
+  resolveExistingLocalSigningKey,
+} from "@mycadet/local-mode";
+import { writeFileSync } from "fs";
 import { join } from "path";
 
 import {
@@ -16,6 +20,7 @@ import {
   probeDaemonReadinessWithRetry,
   waitForDaemonMigrationsReady,
 } from "../lib/http-client.js";
+import { findOpenPort } from "../lib/port-allocator.js";
 import {
   DAEMON_STOP_TIMEOUT_MS,
   isProcessAlive,
@@ -36,7 +41,8 @@ import {
   restoreTunnelEdgeAndAutoTunnel,
 } from "../lib/tunnel-edge.js";
 
-export async function wake(): Promise<void> {
+export const wake = Object.assign(
+  async function wake(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
     console.log("Usage: cadet wake [<name>] [options]");
@@ -58,7 +64,8 @@ export async function wake(): Promise<void> {
     console.log(
       "  --repair-guardian  Force-re-provision the guardian token (resets the\n" +
         "                     gateway bootstrap and re-leases — REVOKES other device-bound\n" +
-        "                     tokens, so only use deliberately, never from auto-repair)",
+        "                     tokens; replaces an unrecoverable signing key and restarts services only then.\n" +
+        "                     Clients may need to authenticate again. Use deliberately.)",
     );
     process.exit(0);
   }
@@ -120,6 +127,61 @@ export async function wake(): Promise<void> {
     process.exit(1);
   }
   const resources = entry.resources;
+  let signingKey: string;
+  let replacingSigningKey = false;
+  try {
+    signingKey = resolveExistingLocalSigningKey(resources);
+  } catch (error) {
+    if (!(error instanceof SigningKeyContinuityError)) {
+      throw error;
+    }
+    if (!repairGuardian) {
+      error.message += ` Run cadet wake ${JSON.stringify(entry.assistantId)} --repair-guardian to recover access. Repair may replace the signing key and require all clients to authenticate again.`;
+      throw error;
+    }
+    console.warn(
+      `Repairing authentication for ${entry.assistantId}: signing key ${error.code}. Replacing the signing key; all clients must authenticate again.`,
+    );
+    signingKey = generateLocalSigningKey();
+    replacingSigningKey = true;
+  }
+
+  // A replacement must reach both processes. Stop them before saving it so
+  // retries cannot attach to a surviving process that still uses the old key.
+  if (replacingSigningKey) {
+    for (const [file, label, port] of [
+      [
+        join(resources.instanceDir, "gateway.pid"),
+        "gateway",
+        resources.gatewayPort,
+      ],
+      [getDaemonPidPath(resources), "assistant", resources.daemonPort],
+    ] as const) {
+      const stopped = await stopProcessByPidFile(
+        file,
+        label,
+        undefined,
+        DAEMON_STOP_TIMEOUT_MS,
+      );
+      if (!stopped && isProcessAlive(file).alive) {
+        throw new Error(
+          `Cannot repair authentication: ${label} could not be stopped. Stop it and retry the same repair command; no replacement key was saved.`,
+        );
+      }
+      // A missing PID file does not prove the service has released its port.
+      try {
+        await findOpenPort(port, { maxAttempts: 1, host: "127.0.0.1" });
+      } catch {
+        throw new Error(
+          `Cannot repair authentication: could not confirm that ${label} port ${port} is free. Stop any process using it, then retry the same repair command; no replacement key was saved.`,
+        );
+      }
+    }
+  }
+  if (replacingSigningKey || signingKey !== resources.signingKey) {
+    resources.signingKey = signingKey;
+    saveAssistantEntry(entry);
+  }
 
   const pidFile = getDaemonPidPath(resources);
 
@@ -185,39 +247,6 @@ export async function wake(): Promise<void> {
     }
   }
 
-  // Resolve the signing key. The gateway persists its own copy to disk at
-  // <instanceDir>/.cadet/protected/actor-token-signing-key. That on-disk key
-  // is the source of truth because it is what the gateway actually used to sign
-  // existing actor tokens. Prefer it over the lockfile value so that tokens
-  // survive upgrades and any scenario where the two diverge.
-  //
-  // NOTE: Removal of this legacy key path read is blocked on removing all use
-  // of the signing key from the assistant daemon. Until then, the on-disk key
-  // must remain the authoritative source.
-  const legacyKeyPath = join(
-    resources.instanceDir,
-    "protected",
-    "actor-token-signing-key",
-  );
-  let signingKey: string | undefined;
-  if (existsSync(legacyKeyPath)) {
-    try {
-      const raw = readFileSync(legacyKeyPath);
-      if (raw.length === 32) {
-        signingKey = raw.toString("hex");
-      }
-    } catch {
-      // Ignore — fall through to lockfile or generate.
-    }
-  }
-  if (!signingKey) {
-    signingKey = resources.signingKey ?? generateLocalSigningKey();
-  }
-  if (signingKey !== resources.signingKey) {
-    entry.resources = { ...resources, signingKey };
-    saveAssistantEntry(entry);
-  }
-
   let bootstrapSecret = entry.guardianBootstrapSecret;
   let bootstrapSecretBackfilled = false;
   if (!bootstrapSecret) {
@@ -454,4 +483,7 @@ export async function wake(): Promise<void> {
       process.on("SIGTERM", () => resolve());
     });
   }
-}
+},
+  { description: "Start the assistant and gateway" },
+);
+

package/src/commands/workflows.ts

@@ -242,7 +242,8 @@ async function resumeRun(runId: string, assistantName?: string): Promise<void> {
   );
 }
 
-export async function workflows(): Promise<void> {
+export const workflows = Object.assign(
+  async function workflows(): Promise<void> {
   const args = process.argv.slice(3);
 
   if (args.includes("--help") || args.includes("-h")) {
@@ -298,4 +299,7 @@ export async function workflows(): Promise<void> {
   console.error(`Unknown subcommand: ${subcommand}`);
   printHelp();
   process.exit(1);
-}
+},
+  { description: "Inspect and control workflow runs" },
+);
+