@mycadet/cli 0.12.6-dev.202610082233.54244ee → 0.12.7

package/src/lib/local.ts

@@ -133,9 +133,7 @@ function packagePath(
 function hasLocalRuntimeComponents(installDir: string): boolean {
   return (
     existsSync(packagePath(installDir, "@mycadet/assistant", "src/index.ts")) &&
-    existsSync(
-      packagePath(installDir, "@mycadet/gateway", "src/index.ts"),
-    ) &&
+    existsSync(packagePath(installDir, "@mycadet/gateway", "src/index.ts")) &&
     existsSync(
       packagePath(installDir, "@mycadet/credential-executor", "src/main.ts"),
     )
@@ -556,10 +554,11 @@ function resolveDaemonMainPath(assistantIndex: string): string {
  *
  * Both the daemon and gateway must use the same HMAC signing key so JWT
  * tokens minted by one can be verified by the other. The CLI generates
- * an ephemeral key each time and passes it as `ACTOR_TOKEN_SIGNING_KEY`
- * to both processes — the daemon and gateway each persist it on their
+ * a key at hatch and passes it as `ACTOR_TOKEN_SIGNING_KEY` to both
+ * processes — the daemon and gateway each persist it on their
  * own terms (the `.cadet/` directory layout is their concern, not the
- * CLI's).
+ * CLI's). Lifecycle resumes resolve the existing identity rather than
+ * generating a key.
  */
 export function generateLocalSigningKey(): string {
   return randomBytes(32).toString("hex");
@@ -602,18 +601,9 @@ function applyDaemonEnvOverrides(
   options?: DaemonStartOptions,
 ): void {
   if (resources) {
-    env.CADET_WORKSPACE_DIR = join(
-      resources.instanceDir,
-      "workspace",
-    );
-    env.GATEWAY_SECURITY_DIR = join(
-      resources.instanceDir,
-      "gateway-security",
-    );
-    env.CREDENTIAL_SECURITY_DIR = join(
-      resources.instanceDir,
-      "ces-security",
-    );
+    env.CADET_WORKSPACE_DIR = join(resources.instanceDir, "workspace");
+    env.GATEWAY_SECURITY_DIR = join(resources.instanceDir, "gateway-security");
+    env.CREDENTIAL_SECURITY_DIR = join(resources.instanceDir, "ces-security");
     env.CES_DATA_DIR = join(resources.instanceDir, "ces-data");
     env.RUNTIME_HTTP_PORT = String(resources.daemonPort);
     env.GATEWAY_PORT = String(resources.gatewayPort);
@@ -1075,9 +1065,7 @@ export async function startCes(
   watch: boolean = false,
   resources?: LocalInstanceResources,
 ): Promise<void> {
-  const cadetDir = resources
-    ? resources.instanceDir
-    : defaultCadetRoot();
+  const cadetDir = resources ? resources.instanceDir : defaultCadetRoot();
   const cesPidFile = join(cadetDir, "ces.pid");
 
   // Kill any existing sibling first — a stale CES holds the socket and would
@@ -1513,7 +1501,8 @@ export async function startLocalDaemon(
   watch: boolean = false,
   resources: LocalInstanceResources,
   options?: DaemonStartOptions,
-): Promise<void> {  writeAssistantWrapper(resources);
+): Promise<void> {
+  writeAssistantWrapper(resources);
 
   const runtimeAssistantIndex = !watch
     ? localRuntimeAssistantIndex(resources)
@@ -1823,9 +1812,7 @@ export async function startGateway(
   // Without this, crashed/stale gateways accumulate as zombies — the old
   // process holds the port (or lingers after losing it), and every restart
   // attempt spawns yet another process that fails with EADDRINUSE.
-  const gwPidDir = resources
-    ? resources.instanceDir
-    : defaultCadetRoot();
+  const gwPidDir = resources ? resources.instanceDir : defaultCadetRoot();
   const gwPidFile = join(gwPidDir, "gateway.pid");
   await stopProcessByPidFile(gwPidFile, "gateway");
 
@@ -1861,18 +1848,9 @@ export async function startGateway(
     // assistant DB directly for guardian bootstrap.
     ...(resources
       ? {
-          CADET_WORKSPACE_DIR: join(
-            resources.instanceDir,
-            "workspace",
-          ),
-          GATEWAY_SECURITY_DIR: join(
-            resources.instanceDir,
-            "gateway-security",
-          ),
-          CREDENTIAL_SECURITY_DIR: join(
-            resources.instanceDir,
-            "ces-security",
-          ),
+          CADET_WORKSPACE_DIR: join(resources.instanceDir, "workspace"),
+          GATEWAY_SECURITY_DIR: join(resources.instanceDir, "gateway-security"),
+          CREDENTIAL_SECURITY_DIR: join(resources.instanceDir, "ces-security"),
           CES_DATA_DIR: join(resources.instanceDir, "ces-data"),
         }
       : {}),
@@ -1928,9 +1906,7 @@ export async function startGateway(
   gateway.unref();
 
   if (gateway.pid) {
-    const gwPidDir = resources
-      ? resources.instanceDir
-      : defaultCadetRoot();
+    const gwPidDir = resources ? resources.instanceDir : defaultCadetRoot();
     writeFileSync(join(gwPidDir, "gateway.pid"), String(gateway.pid), "utf-8");
   }
 
@@ -1976,9 +1952,7 @@ function isNgrokProcess(pid: number): boolean {
 export async function stopLocalProcesses(
   resources?: LocalInstanceResources,
 ): Promise<void> {
-  const cadetDir = resources
-    ? resources.instanceDir
-    : defaultCadetRoot();
+  const cadetDir = resources ? resources.instanceDir : defaultCadetRoot();
   const daemonPidFile = getDaemonPidPath(resources);
   await stopProcessByPidFile(
     daemonPidFile,

package/src/lib/ngrok.ts

@@ -12,19 +12,35 @@ import {
   saveNgrokDomain,
 } from "./ingress-config.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
+import { z } from "zod";
 
 const NGROK_API_URL = "http://127.0.0.1:4040/api/tunnels";
 const NGROK_POLL_INTERVAL_MS = 500;
 const NGROK_POLL_TIMEOUT_MS = 15_000;
 
-interface NgrokTunnel {
-  public_url: string;
-  config?: { addr?: string };
-}
+const NgrokTunnelSchema = z.object({
+  public_url: z.string(),
+  config: z
+    .object({
+      addr: z.string().optional(),
+    })
+    .optional(),
+});
 
-interface NgrokTunnelsResponse {
-  tunnels: NgrokTunnel[];
-}
+type NgrokTunnel = z.infer<typeof NgrokTunnelSchema>;
+
+const NgrokTunnelsResponseSchema = z.object({
+  tunnels: z.array(NgrokTunnelSchema).optional(),
+});
+
+/**
+ * The ingress block of the workspace config, as read by the tunnel edge:
+ * explicitly enabled with a saved public URL.
+ */
+export const IngressConfigSchema = z.object({
+  enabled: z.boolean().optional(),
+  publicBaseUrl: z.string().optional(),
+});
 
 /**
  * Check whether ngrok is installed and accessible on the PATH.
@@ -54,8 +70,8 @@ async function queryNgrokTunnels(): Promise<NgrokTunnel[] | null> {
       signal: AbortSignal.timeout(2_000),
     });
     if (!res.ok) return null;
-    const data = (await res.json()) as NgrokTunnelsResponse;
-    return data.tunnels ?? [];
+    const parsed = NgrokTunnelsResponseSchema.safeParse(await res.json());
+    return parsed.success ? (parsed.data.tunnels ?? []) : null;
   } catch {
     return null;
   }
@@ -194,13 +210,27 @@ export async function waitForNgrokUrl(
  * Check whether an already-loaded workspace config has webhook-based
  * integrations (e.g. Telegram, Twilio) that require a public ingress URL.
  */
+const TelegramIntegrationSchema = z.object({
+  botUsername: z.unknown().optional(),
+});
+
+const TwilioIntegrationSchema = z.object({
+  accountSid: z.unknown().optional(),
+  phoneNumber: z.unknown().optional(),
+});
+
 export function hasWebhookIntegrations(
   config: Record<string, unknown>,
 ): boolean {
-  const telegram = config.telegram as Record<string, unknown> | undefined;
-  if (telegram?.botUsername) return true;
-  const twilio = config.twilio as Record<string, unknown> | undefined;
-  if (twilio?.accountSid || twilio?.phoneNumber) return true;
+  const telegram = TelegramIntegrationSchema.safeParse(config.telegram);
+  if (telegram.success && telegram.data.botUsername) return true;
+  const twilio = TwilioIntegrationSchema.safeParse(config.twilio);
+  if (
+    twilio.success &&
+    (twilio.data.accountSid || twilio.data.phoneNumber)
+  ) {
+    return true;
+  }
   return false;
 }
 
@@ -226,9 +256,11 @@ export function hasWebhookIntegrationsConfigured(
 function hasNonNgrokIngressUrl(workspaceDir: string): boolean {
   try {
     const config = loadRawConfig(workspaceDir);
-    const ingress = config.ingress as Record<string, unknown> | undefined;
-    const publicBaseUrl = ingress?.publicBaseUrl;
-    if (!publicBaseUrl || typeof publicBaseUrl !== "string") return false;
+    const parsed = IngressConfigSchema.safeParse(config.ingress);
+    const publicBaseUrl = parsed.success
+      ? parsed.data.publicBaseUrl
+      : undefined;
+    if (!publicBaseUrl) return false;
     return !publicBaseUrl.includes("ngrok");
   } catch {
     return false;

package/src/lib/platform-client.ts

@@ -16,6 +16,15 @@ import { getLockfilePlatformBaseUrl } from "./assistant-config.js";
 import { getConfigDir, getConfigDirs } from "./environments/paths.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
+import { z } from "zod";
+
+const PlatformErrorDetailSchema = z.object({
+  detail: z.string().optional(),
+});
+
+const InProgressResponseSchema = z.object({
+  in_progress: z.boolean().optional(),
+});
 
 function getPlatformTokenPath(): string {
   return join(getConfigDir(getCurrentEnvironment()), "platform-token");
@@ -200,6 +209,95 @@ export interface HatchedAssistant {
   status: string;
 }
 
+const HatchedAssistantSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  status: z.string(),
+});
+
+const HatchedListResponseSchema = z.object({
+  results: z.array(HatchedAssistantSchema).optional(),
+});
+
+const EnsureRegistrationResponseSchema = z.object({
+  assistant: z.object({ id: z.string(), name: z.string() }),
+  registration: z.object({
+    client_installation_id: z.string(),
+    runtime_assistant_id: z.string(),
+    client_platform: z.string(),
+  }),
+  assistant_api_key: z.string().nullable(),
+  webhook_secret: z.string(),
+});
+
+const ReprovisionApiKeyResponseSchema = z.object({
+  provisioning: z.object({ assistant_api_key: z.string() }),
+});
+
+const SecretReadResponseSchema = z
+  .object({
+    found: z.boolean(),
+    value: z.string().optional(),
+    unreachable: z.boolean().optional(),
+  })
+  .catch({ found: false });
+
+const ReleaseChannelResponseSchema = z.object({
+  current_release_version: z.string().nullable().optional(),
+  release_channel: z.string().optional(),
+});
+
+const OrganizationListResponseSchema = z.object({
+  results: z.array(z.object({ id: z.string(), name: z.string() })).optional(),
+});
+
+const AllauthSessionResponseSchema = z.object({
+  status: z.number(),
+  data: z.object({
+    user: z.object({ id: z.string(), email: z.string(), display: z.string() }),
+  }),
+});
+
+const VersionCheckResponseSchema = z
+  .object({
+    detail: z.string().optional(),
+    version: z.string().nullable().optional(),
+  })
+  .catch({});
+
+const PassthroughBodySchema = z.record(z.string(), z.unknown()).catch({});
+
+const BundleUploadUrlSchema = z.object({
+  url: z.string(),
+  bundle_key: z.string(),
+  expires_at: z.string(),
+  max_content_length: z.number().optional(),
+});
+
+const BundleImportErrorSchema = z
+  .object({
+    detail: z.string().optional(),
+    reason: z.string().optional(),
+    bundle_compat: z
+      .object({
+        min_runtime_version: z.string(),
+        max_runtime_version: z.string().nullable(),
+      })
+      .optional()
+      .catch(undefined),
+    target_runtime_version: z.string().optional(),
+  })
+  .catch({});
+
+const RawUnifiedJobStatusSchema = z.object({
+  job_id: z.string(),
+  type: z.enum(["export", "import"]),
+  status: z.enum(["processing", "complete", "failed"]),
+  bundle_key: z.string().optional(),
+  result: z.unknown().optional(),
+  error: z.string().optional(),
+});
+
 export interface HatchAssistantResult {
   assistant: HatchedAssistant;
   /** true when the platform returned an existing assistant (HTTP 200) */
@@ -276,7 +374,7 @@ export async function ensureSelfHostedLocalRegistration(
     );
   }
 
-  return (await response.json()) as EnsureRegistrationResponse;
+  return EnsureRegistrationResponseSchema.parse(await response.json());
 }
 
 // ---------------------------------------------------------------------------
@@ -342,7 +440,7 @@ export async function reprovisionAssistantApiKey(
     );
   }
 
-  return (await response.json()) as ReprovisionApiKeyResponse;
+  return ReprovisionApiKeyResponseSchema.parse(await response.json());
 }
 
 // ---------------------------------------------------------------------------
@@ -442,11 +540,7 @@ export async function readGatewayCredential(
       return { value: null, unreachable: response.status >= 500 };
     }
 
-    const json = (await response.json()) as {
-      found: boolean;
-      value?: string;
-      unreachable?: boolean;
-    };
+    const json = SecretReadResponseSchema.parse(await response.json());
     // The daemon's /v1/secrets/read returns `unreachable: true` when the
     // credential backend (CES) can't be reached. Respect that signal.
     if (json.unreachable) {
@@ -553,14 +647,14 @@ export async function hatchAssistant(
   });
 
   if (response.ok) {
-    const assistant = (await response.json()) as HatchedAssistant;
+    const assistant = HatchedAssistantSchema.parse(await response.json());
     return { assistant, reusedExisting: response.status === 200 };
   }
 
   if (response.status === 401 || response.status === 403) {
-    const detail = (await response.json().catch(() => ({}))) as {
-      detail?: string;
-    };
+    const detail = PlatformErrorDetailSchema
+      .catch({})
+      .parse(await response.json().catch(() => ({})));
     throw new Error(
       detail.detail ??
         "Invalid or expired token. Run `cadet login` to re-authenticate.",
@@ -571,9 +665,9 @@ export async function hatchAssistant(
     throw new Error("Insufficient balance to hatch a new assistant.");
   }
 
-  const errorBody = (await response.json().catch(() => ({}))) as {
-    detail?: string;
-  };
+  const errorBody = PlatformErrorDetailSchema
+    .catch({})
+    .parse(await response.json().catch(() => ({})));
   throw new Error(
     errorBody.detail ??
       `Platform API error: ${response.status} ${response.statusText}`,
@@ -614,11 +708,9 @@ export async function checkExistingPlatformAssistant(
       return null;
     }
 
-    const body = (await response.json()) as {
-      results?: HatchedAssistant[];
-    };
-    const active = body.results?.find((a) => a.status === "active");
-    return active ?? null;
+    const parsed = HatchedListResponseSchema.safeParse(await response.json());
+    const results = parsed.success ? parsed.data.results : undefined;
+    return results?.find((a) => a.status === "active") ?? null;
   } finally {
     clearTimeout(timeoutId);
   }
@@ -649,11 +741,10 @@ export async function fetchPlatformAssistants(
 
     if (!response.ok) return [];
 
-    const body = (await response.json()) as {
-      results?: HatchedAssistant[];
-    };
+    const parsed = HatchedListResponseSchema.safeParse(await response.json());
+    const results = parsed.success ? (parsed.data.results ?? []) : [];
 
-    return (body.results ?? []).filter((a) => a.status === "active");
+    return results.filter((a) => a.status === "active");
   } finally {
     clearTimeout(timeoutId);
   }
@@ -685,10 +776,10 @@ export async function fetchAssistantDetail(
 
     if (!response.ok) return null;
 
-    const body = (await response.json()) as {
-      current_release_version?: string | null;
-      release_channel?: string;
-    };
+    const parsed = ReleaseChannelResponseSchema.safeParse(
+      await response.json(),
+    );
+    const body = parsed.success ? parsed.data : {};
     return {
       currentReleaseVersion: body.current_release_version ?? null,
       releaseChannel: body.release_channel === "preview" ? "preview" : "stable",
@@ -720,8 +811,10 @@ export async function fetchUpgradeInProgress(
 
     if (!response.ok) return null;
 
-    const body = (await response.json()) as { in_progress?: boolean };
-    return typeof body.in_progress === "boolean" ? body.in_progress : null;
+    const parsed = InProgressResponseSchema.safeParse(await response.json());
+    return parsed.success && parsed.data.in_progress !== undefined
+      ? parsed.data.in_progress
+      : null;
   } catch {
     return null;
   }
@@ -733,10 +826,6 @@ export interface PlatformUser {
   display: string;
 }
 
-interface OrganizationListResponse {
-  results: { id: string; name: string }[];
-}
-
 export async function fetchOrganizationId(
   token: string,
   platformUrl?: string,
@@ -762,8 +851,10 @@ export async function fetchOrganizationId(
       );
     }
 
-    const body = (await response.json()) as OrganizationListResponse;
-    const orgId = body.results?.[0]?.id;
+    const parsed = OrganizationListResponseSchema.safeParse(
+      await response.json(),
+    );
+    const orgId = parsed.success ? parsed.data.results?.[0]?.id : undefined;
     if (!orgId) {
       throw new Error("No organization found for this account.");
     }
@@ -773,17 +864,6 @@ export async function fetchOrganizationId(
   }
 }
 
-interface AllauthSessionResponse {
-  status: number;
-  data: {
-    user: {
-      id: string;
-      email: string;
-      display: string;
-    };
-  };
-}
-
 export async function fetchCurrentUser(
   token: string,
   platformUrl?: string,
@@ -816,7 +896,7 @@ export async function fetchCurrentUser(
       );
     }
 
-    const body = (await response.json()) as AllauthSessionResponse;
+    const body = AllauthSessionResponseSchema.parse(await response.json());
     return body.data.user;
   } finally {
     clearTimeout(timeoutId);
@@ -843,10 +923,9 @@ export async function rollbackPlatformAssistant(
     },
   );
 
-  const body = (await response.json().catch(() => ({}))) as {
-    detail?: string;
-    version?: string | null;
-  };
+  const body = VersionCheckResponseSchema.parse(
+    await response.json().catch(() => ({})),
+  );
 
   if (response.status === 200) {
     return { detail: body.detail ?? "", version: body.version ?? null };
@@ -907,10 +986,9 @@ export async function platformImportPreflightFromGcs(
     },
   );
 
-  const body = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
+  const body = PassthroughBodySchema.parse(
+    await response.json().catch(() => ({})),
+  );
   return { statusCode: response.status, body };
 }
 
@@ -934,10 +1012,9 @@ export async function platformImportBundleFromGcs(
     throw new Error("Bundle too large to import");
   }
 
-  const body = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
+  const body = PassthroughBodySchema.parse(
+    await response.json().catch(() => ({})),
+  );
   return { statusCode: response.status, body };
 }
 
@@ -1128,12 +1205,7 @@ export async function platformRequestSignedUrl(
   }
 
   if (response.status === 201 || response.status === 200) {
-    const json = (await response.json()) as {
-      url: string;
-      bundle_key: string;
-      expires_at: string;
-      max_content_length?: number;
-    };
+    const json = BundleUploadUrlSchema.parse(await response.json());
     return {
       url: json.url,
       bundleKey: json.bundle_key,
@@ -1145,12 +1217,9 @@ export async function platformRequestSignedUrl(
   // Non-success body. Read once and reuse for both the 422 version-mismatch
   // branch and the generic-error fallthrough — `response.json()` consumes
   // the body, so a second read would always return undefined.
-  const errorBody = (await response.json().catch(() => ({}))) as {
-    detail?: string;
-    reason?: string;
-    bundle_compat?: BundleCompatibility;
-    target_runtime_version?: string;
-  };
+  const errorBody = BundleImportErrorSchema.parse(
+    await response.json().catch(() => ({})),
+  );
 
   if (
     response.status === 422 &&
@@ -1197,6 +1266,6 @@ export async function platformPollJobStatus(
     );
   }
 
-  const raw = (await response.json()) as RawUnifiedJobStatus;
+  const raw = RawUnifiedJobStatusSchema.parse(await response.json());
   return parseUnifiedJobStatus(raw);
 }

package/src/lib/retire-archive.ts

@@ -1,7 +1,9 @@
 import { mkdirSync } from "fs";
-import { homedir } from "os";
 import { join, posix, win32 } from "path";
 
+import { getStateDir } from "./environments/paths.js";
+import { getCurrentEnvironment } from "./environments/resolve.js";
+
 function isPathInside(
   parent: string,
   candidate: string,
@@ -17,9 +19,7 @@ function isPathInside(
 }
 
 export function getRetiredDir(): string {
-  const xdgData =
-    process.env.XDG_DATA_HOME?.trim() || join(homedir(), ".local", "share");
-  const dir = join(xdgData, "cadet", "retired");
+  const dir = join(getStateDir(getCurrentEnvironment()), "retired");
   mkdirSync(dir, { recursive: true });
   return dir;
 }

package/src/lib/retire-local.ts

@@ -128,34 +128,11 @@ export async function retireLocal(
 
   // Stop gateway via PID file — use a longer timeout because the gateway has a
   // drain window (5s) before it exits.
-  const gatewayPidFile = join(cadetDir, "gateway.pid");
-  await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
+  await stopProcessByPidFile(join(cadetDir, "gateway.pid"), "gateway", undefined, 7000);
 
   // Stop the CES sibling — it is stopped by its PID file, a no-op when the
   // PID file is absent (e.g. the sibling was never started or already exited).
-  const cesPidFile = join(cadetDir, "ces.pid");
-  const cesStopped = await stopProcessByPidFile(
-    cesPidFile,
-    "credential-executor",
-  );
-  if (cesStopped) {
-    reporter.log("credential-executor stopped.");
-  }
-
-  // Stop Qdrant. The daemon's graceful shutdown tries to stop it via
-  // qdrantManager.stop(), but a daemon that never completes that shutdown
-  // (crash, OOM kill, or the SIGKILL ceiling above) leaves Qdrant running as
-  // an orphan. Check both the current PID file location and the legacy one.
-  const qdrantPidFile = join(
-    cadetDir,
-    "workspace",
-    "data",
-    "qdrant",
-    "qdrant.pid",
-  );
-  const qdrantLegacyPidFile = join(cadetDir, "qdrant.pid");
-  await stopProcessByPidFile(qdrantPidFile, "qdrant", undefined, 5000);
-  await stopProcessByPidFile(qdrantLegacyPidFile, "qdrant", undefined, 5000);
+  await stopProcessByPidFile(join(cadetDir, "ces.pid"), "credential-executor");
 
   // Stop the nginx ingress if one is fronting this gateway — it would
   // otherwise be orphaned when the instance directory is archived.