@mycadet/cli 0.12.6-dev.202610082233.54244ee → 0.12.7

package/src/lib/teleport-backup.ts

@@ -24,6 +24,22 @@ import {
 import type { AssistantEntry } from "./assistant-config.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
 import { authHeaders, invalidateOrgIdCache } from "./platform-client.js";
+import { z } from "zod";
+
+const ManagedBackupEntrySchema = z.object({
+  snapshot_name: z.string().optional(),
+  created_at: z.string().optional(),
+  ready_to_use: z.boolean().optional(),
+});
+
+const ManagedBackupsResponseSchema = z.object({
+  backups: z.array(ManagedBackupEntrySchema).optional(),
+});
+
+const CreatedBackupResponseSchema = z.object({
+  snapshot_name: z.string().optional(),
+  ready_to_use: z.boolean().optional(),
+});
 
 type PlatformEntry = Pick<AssistantEntry, "runtimeUrl" | "assistantId">;
 
@@ -72,8 +88,8 @@ async function fetchPlatformBackups(
       `Cadet Cloud backup list failed ${await errorSuffix(response)}`,
     );
   }
-  const body = (await response.json()) as { backups?: ManagedBackupEntry[] };
-  return body.backups ?? [];
+  const parsed = ManagedBackupsResponseSchema.safeParse(await response.json());
+  return parsed.success ? (parsed.data.backups ?? []) : [];
 }
 
 /**
@@ -113,17 +129,15 @@ export async function createPlatformBackup(
       `Cadet Cloud backup create failed ${await errorSuffix(response)}`,
     );
   }
-  const created = (await response.json().catch(() => null)) as {
-    snapshot_name?: string;
-    ready_to_use?: boolean;
-  } | null;
-  const snapshotName = created?.snapshot_name;
-  if (!snapshotName) {
+  const body: unknown = await response.json().catch(() => null);
+  const created = CreatedBackupResponseSchema.safeParse(body);
+  if (!created.success || !created.data.snapshot_name) {
     throw new Error("Cadet Cloud backup create returned no snapshot name");
   }
-  if (created?.ready_to_use === true) {
+  if (created.data.ready_to_use === true) {
     return;
   }
+  const snapshotName = created.data.snapshot_name;
 
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {

package/src/lib/terminal-client.ts

@@ -6,8 +6,19 @@
  * the web UI's xterm.js terminal uses.
  */
 
-import { authHeaders, getPlatformUrl } from "./platform-client.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
+import { authHeaders, getPlatformUrl } from "./platform-client.js";
+import { z } from "zod";
+
+const TerminalSessionResponseSchema = z.object({ session_id: z.string() });
+
+const TerminalOutputEventSchema = z.object({
+  seq: z.number(),
+  /** Base64-encoded PTY output bytes. */
+  data: z.string(),
+});
+
+export type TerminalOutputEvent = z.infer<typeof TerminalOutputEventSchema>;
 
 // ---------------------------------------------------------------------------
 // Create / Close
@@ -40,7 +51,11 @@ export async function createTerminalSession(
       `Failed to create terminal session (${response.status}): ${detail || response.statusText}`,
     );
   }
-  return (await response.json()) as { session_id: string };
+  const parsed = TerminalSessionResponseSchema.safeParse(await response.json());
+  if (!parsed.success) {
+    throw new Error("Terminal session response did not include a session_id.");
+  }
+  return parsed.data;
 }
 
 export async function closeTerminalSession(
@@ -120,12 +135,6 @@ export async function resizeTerminalSession(
 // SSE event stream
 // ---------------------------------------------------------------------------
 
-export interface TerminalOutputEvent {
-  seq: number;
-  /** Base64-encoded PTY output bytes. */
-  data: string;
-}
-
 /**
  * Subscribe to the terminal output SSE stream. Yields parsed events as they
  * arrive. The generator completes when the stream ends or is aborted.
@@ -170,7 +179,10 @@ export async function* subscribeTerminalEvents(
         const trimmed = line.trimEnd();
         if (trimmed.startsWith("data: ")) {
           try {
-            yield JSON.parse(trimmed.slice(6)) as TerminalOutputEvent;
+            const frame = TerminalOutputEventSchema.safeParse(
+              JSON.parse(trimmed.slice(6)),
+            );
+            if (frame.success) yield frame.data;
           } catch {
             // Skip malformed SSE frames
           }

package/src/lib/tunnel-edge.ts

@@ -14,6 +14,7 @@ import {
   loadRawConfig,
   parseGatewayPortFromEntryUrls,
 } from "./ingress-config.js";
+import { IngressConfigSchema } from "./ngrok.js";
 import {
   ensureTunnelEdge,
   formatEdgeMode,
@@ -33,13 +34,11 @@ export const DOCKER_GATEWAY_READY_TIMEOUT_MS = 5 * 60_000;
  * enabled with a saved public URL.
  */
 function wantsWebIngress(config: Record<string, unknown>): boolean {
-  const ingress = config.ingress as
-    | { enabled?: unknown; publicBaseUrl?: unknown }
-    | undefined;
+  const parsed = IngressConfigSchema.safeParse(config.ingress);
   return (
-    ingress?.enabled === true &&
-    typeof ingress.publicBaseUrl === "string" &&
-    ingress.publicBaseUrl.trim() !== ""
+    parsed.success &&
+    parsed.data.enabled === true &&
+    (parsed.data.publicBaseUrl?.trim() ?? "") !== ""
   );
 }
 
@@ -189,17 +188,16 @@ function ownsSharedIngress(
   ) {
     return false;
   }
-  let publicBaseUrl: unknown;
+  let publicBaseUrl: string | undefined;
   try {
-    publicBaseUrl = (
-      loadRawConfig(workspaceDir).ingress as
-        | { publicBaseUrl?: unknown }
-        | undefined
-    )?.publicBaseUrl;
+    const parsed = IngressConfigSchema.safeParse(
+      loadRawConfig(workspaceDir).ingress,
+    );
+    publicBaseUrl = parsed.success ? parsed.data.publicBaseUrl : undefined;
   } catch {
     return true;
   }
-  if (typeof publicBaseUrl !== "string" || !publicBaseUrl.trim()) {
+  if (!publicBaseUrl || !publicBaseUrl.trim()) {
     return true;
   }
   if (entry.ingressUrl === publicBaseUrl) {

package/src/lib/upgrade-lifecycle.ts

@@ -25,6 +25,16 @@ import { getCurrentEnvironment } from "./environments/resolve.js";
 import { loadGuardianToken } from "./guardian-token.js";
 import { classifyReadyzResponse } from "./http-client.js";
 import { fetchReleases, resolveImageRefs } from "./platform-releases.js";
+import { z } from "zod";
+
+const GatewayHealthSchema = z.object({
+  version: z.string().optional(),
+});
+
+const MigrationGateBodySchema = z.object({
+  status: z.string().optional(),
+  reason: z.string().optional(),
+});
 import {
   getBuilderManagedEnvKeys,
   type DockerStatefulSetSpec,
@@ -289,8 +299,8 @@ export async function fetchCurrentVersion(
       signal: AbortSignal.timeout(5000),
     });
     if (resp.ok) {
-      const body = (await resp.json()) as { version?: string };
-      return body.version;
+      const parsed = GatewayHealthSchema.safeParse(await resp.json());
+      return parsed.success ? parsed.data.version : undefined;
     }
   } catch {
     // Best-effort
@@ -532,9 +542,11 @@ export async function rollbackMigrations(
         // The daemon's running-migrations 503 also says "starting" but
         // carries a `reason` field — don't retry against that one (the
         // rollback stays blocked until migrations leave the running state).
-        const parsed = JSON.parse(text) as { status?: string; reason?: string };
+        const parsed = MigrationGateBodySchema.safeParse(JSON.parse(text));
         gatewayStarting =
-          parsed.status === "starting" && parsed.reason === undefined;
+          parsed.success &&
+          parsed.data.status === "starting" &&
+          parsed.data.reason === undefined;
       } catch {
         // Non-JSON error body — not the starting gate.
       }

package/src/lib/workos-pkce.ts

@@ -5,6 +5,7 @@
 import crypto from "node:crypto";
 
 import { loopbackSafeFetch } from "./loopback-fetch.js";
+import { z } from "zod";
 
 const WORKOS_API_BASE_URL = "https://api.workos.com";
 const PROVIDER_ID = "workos";
@@ -50,13 +51,39 @@ export function buildAuthorizeUrl(options: AuthorizeUrlOptions): string {
   return url.toString();
 }
 
-interface HeadlessProviderEntry {
-  id: string;
-  name?: string;
-  client_id?: string;
-  flows?: string[];
-  openid_configuration_url?: string;
-}
+const HeadlessProviderEntrySchema = z.object({
+  id: z.string().optional(),
+  name: z.string().optional(),
+  client_id: z.string().optional(),
+  flows: z.array(z.string()).optional(),
+  openid_configuration_url: z.string().optional(),
+});
+
+type HeadlessProviderEntry = z.infer<typeof HeadlessProviderEntrySchema>;
+
+const WorkosAuthConfigSchema = z.object({
+  data: z
+    .object({
+      socialaccount: z
+        .object({
+          providers: z.array(HeadlessProviderEntrySchema).optional(),
+        })
+        .optional(),
+    })
+    .optional(),
+});
+
+const WorkosAccessTokenResponseSchema = z.object({
+  access_token: z.string(),
+});
+
+const WorkosSessionTokenResponseSchema = z.object({
+  meta: z
+    .object({
+      session_token: z.string(),
+    })
+    .optional(),
+});
 
 /**
  * Pick the OAuth2 WorkOS provider from the headless config. During the
@@ -83,12 +110,11 @@ export async function fetchWorkosClientId(
   if (!response.ok) {
     throw new Error(`Failed to fetch auth config (${response.status})`);
   }
-  const body = (await response.json()) as {
-    data?: { socialaccount?: { providers?: HeadlessProviderEntry[] } };
-  };
-  const clientId = selectWorkosClientId(
-    body.data?.socialaccount?.providers ?? [],
-  );
+  const parsed = WorkosAuthConfigSchema.safeParse(await response.json());
+  const providers = parsed.success
+    ? (parsed.data.data?.socialaccount?.providers ?? [])
+    : [];
+  const clientId = selectWorkosClientId(providers);
   if (!clientId) {
     throw new Error(
       "Cadet Cloud does not advertise a token-auth WorkOS provider; cannot start PKCE login.",
@@ -122,11 +148,13 @@ export async function exchangeCodeWithWorkos(options: {
       `WorkOS code exchange failed (${response.status}): ${body}`,
     );
   }
-  const data = (await response.json()) as { access_token?: string };
-  if (!data.access_token) {
+  const parsed = WorkosAccessTokenResponseSchema.safeParse(
+    await response.json(),
+  );
+  if (!parsed.success) {
     throw new Error("WorkOS code exchange returned no access token.");
   }
-  return data.access_token;
+  return parsed.data.access_token;
 }
 
 /** Exchange the WorkOS access token for a platform session token. */
@@ -149,11 +177,14 @@ export async function exchangeAccessTokenForSession(
     const body = await response.text();
     throw new Error(`Session exchange failed (${response.status}): ${body}`);
   }
-  const data = (await response.json()) as {
-    meta?: { session_token?: string };
-  };
-  if (!data.meta?.session_token) {
+  const parsed = WorkosSessionTokenResponseSchema.safeParse(
+    await response.json(),
+  );
+  const sessionToken = parsed.success
+    ? parsed.data.meta?.session_token
+    : undefined;
+  if (!sessionToken) {
     throw new Error("Session exchange returned no session token.");
   }
-  return data.meta.session_token;
+  return sessionToken;
 }