@mycadet/cli 0.12.6-dev.202610082233.54244ee → 0.12.7

package/src/commands/login.ts

@@ -1,303 +1,29 @@
 import { isManagedCloud } from "../lib/managed-cloud.js";
-import { randomBytes } from "crypto";
-import { createServer } from "http";
-import type { AddressInfo } from "net";
 
 import {
   getActiveAssistant,
   loadAllAssistants,
   removeAssistantEntry,
-  resolveAssistant,
-  saveAssistantEntry,
   setActiveAssistant,
 } from "../lib/assistant-config";
-import { resolveAssistantApiKeyForInjection } from "../lib/assistant-api-key-resolution";
-import { computeDeviceId } from "../lib/guardian-token";
-import { openBrowser } from "../lib/open-browser";
 import {
   clearPlatformToken,
-  ensureSelfHostedLocalRegistration,
   fetchCurrentUser,
-  fetchOrganizationId,
   fetchPlatformAssistants,
-  getPlatformUrl,
-  injectCredentialsIntoAssistant,
   readPlatformToken,
   savePlatformToken,
 } from "../lib/platform-client";
-import { syncCloudAssistants } from "../lib/sync-cloud-assistants";
-import {
-  fetchAssistantIngressUrl,
-  fetchCurrentVersion,
-} from "../lib/upgrade-lifecycle.js";
 import {
-  CALLBACK_PATH,
-  buildAuthorizeUrl,
-  exchangeAccessTokenForSession,
-  exchangeCodeWithWorkos,
-  fetchWorkosClientId,
-  generatePkcePair,
-} from "../lib/workos-pkce";
-
-const LOGIN_TIMEOUT_MS = 120_000; // 2 minutes
-
-function escapeHtml(s: string): string {
-  return s
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
-function renderLoginPage(
-  title: string,
-  subtitle: string,
-  success: boolean,
-): string {
-  const checkmarkSvg = `<svg class="icon" viewBox="0 0 56 56" fill="none" xmlns="http://www.w3.org/2000/svg">
-      <circle cx="28" cy="28" r="28" fill="var(--positive-bg)"/>
-      <path class="check" d="M17 28.5L24.5 36L39 21" stroke="var(--positive-fg)" stroke-width="3.5" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
-    </svg>`;
-
-  const errorSvg = `<svg class="icon" viewBox="0 0 56 56" fill="none" xmlns="http://www.w3.org/2000/svg">
-      <circle cx="28" cy="28" r="28" fill="var(--negative-bg)"/>
-      <path class="cross cross-1" d="M20 20L36 36" stroke="var(--negative-fg)" stroke-width="3.5" stroke-linecap="round" fill="none"/>
-      <path class="cross cross-2" d="M36 20L20 36" stroke="var(--negative-fg)" stroke-width="3.5" stroke-linecap="round" fill="none"/>
-    </svg>`;
-
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>${escapeHtml(title)}</title>
-  <style>
-    :root {
-      --surface: #F5F3EB;
-      --surface-card: #FFFFFF;
-      --card-border: #E8E6DA;
-      --text-primary: #2A2A28;
-      --text-secondary: #4A4A46;
-      --positive-bg: #D4DFD0;
-      --positive-fg: #516748;
-      --negative-bg: #F7DAC9;
-      --negative-fg: #DA491A;
-      --shadow: 0 1px 3px rgba(0,0,0,0.04), 0 4px 12px rgba(0,0,0,0.06);
-      --font: -apple-system, BlinkMacSystemFont, "SF Pro Text", "Helvetica Neue", sans-serif;
-    }
-    @media (prefers-color-scheme: dark) {
-      :root {
-        --surface: #1A1A18;
-        --surface-card: #2A2A28;
-        --card-border: #3A3A37;
-        --text-primary: #F5F3EB;
-        --text-secondary: #BDB9A9;
-        --positive-bg: #1A2316;
-        --positive-fg: #7A8B6F;
-        --negative-bg: #4E281D;
-        --negative-fg: #E86B40;
-        --shadow: 0 1px 3px rgba(0,0,0,0.2), 0 4px 12px rgba(0,0,0,0.3);
-      }
-    }
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body {
-      font-family: var(--font);
-      background: var(--surface);
-      color: var(--text-primary);
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      min-height: 100vh;
-      -webkit-font-smoothing: antialiased;
-    }
-    .card {
-      text-align: center;
-      padding: 48px 40px 40px;
-      background: var(--surface-card);
-      border: 1px solid var(--card-border);
-      border-radius: 16px;
-      box-shadow: var(--shadow);
-      max-width: 380px;
-      width: 100%;
-      opacity: 0;
-      transform: translateY(8px) scale(0.98);
-      animation: cardIn 0.5s cubic-bezier(0.16, 1, 0.3, 1) 0.1s forwards;
-    }
-    @keyframes cardIn {
-      to { opacity: 1; transform: translateY(0) scale(1); }
-    }
-    .icon {
-      width: 56px;
-      height: 56px;
-      margin-bottom: 20px;
-    }
-    .check {
-      stroke-dasharray: 32;
-      stroke-dashoffset: 32;
-      animation: draw 0.4s ease-out 0.45s forwards;
-    }
-    .cross {
-      stroke-dasharray: 22;
-      stroke-dashoffset: 22;
-    }
-    .cross-1 { animation: draw 0.3s ease-out 0.45s forwards; }
-    .cross-2 { animation: draw 0.3s ease-out 0.55s forwards; }
-    @keyframes draw {
-      to { stroke-dashoffset: 0; }
-    }
-    h1 {
-      font-size: 18px;
-      font-weight: 600;
-      letter-spacing: -0.2px;
-      color: var(--text-primary);
-      margin-bottom: 6px;
-    }
-    p {
-      font-size: 13px;
-      line-height: 1.5;
-      color: var(--text-secondary);
-    }
-  </style>
-</head>
-<body>
-  <div class="card">
-    ${success ? checkmarkSvg : errorSvg}
-    <h1>${escapeHtml(title)}</h1>
-    <p>${escapeHtml(subtitle)}</p>
-  </div>
-</body>
-</html>`;
-}
-
-export interface LoopbackListener {
-  /** The full `http://127.0.0.1:<port>/auth/callback` redirect URI. */
-  redirectUri: string;
-  /** Resolves with the authorization code once the state-matched callback arrives. */
-  waitForCode: Promise<string>;
-  /** Tear down the server, rejecting any pending waiter with `reason`. */
-  close: (reason?: string) => void;
-}
-
-/**
- * Bind an ephemeral 127.0.0.1 listener and wait for the OAuth redirect.
- * Exported for tests; production callers go through `workosPkceLogin`.
- */
-export function startLoopbackListener(
-  expectedState: string,
-): Promise<LoopbackListener> {
-  return new Promise((resolveListener, rejectListener) => {
-    let settle: {
-      resolve: (code: string) => void;
-      reject: (err: Error) => void;
-    };
-    const waitForCode = new Promise<string>((resolve, reject) => {
-      settle = { resolve, reject };
-    });
-
-    const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (
-        url.pathname !== CALLBACK_PATH ||
-        url.searchParams.get("state") !== expectedState
-      ) {
-        res.writeHead(404, { "Content-Type": "text/plain" });
-        res.end("Not found");
-        return;
-      }
-
-      const error = url.searchParams.get("error");
-      const code = url.searchParams.get("code");
-      if (error || !code) {
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end(
-          renderLoginPage(
-            "Login Failed",
-            "Please try again from your terminal.",
-            false,
-          ),
-        );
-        server.close();
-        settle.reject(
-          new Error(
-            `Authentication failed: ${error ?? "no authorization code received"}`,
-          ),
-        );
-        return;
-      }
-
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end(
-        renderLoginPage(
-          "Login Successful",
-          "You can close this window and return to your terminal.",
-          true,
-        ),
-      );
-      server.close();
-      settle.resolve(code);
-    });
-
-    server.on("error", rejectListener);
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      if (!addr || typeof addr === "string") {
-        rejectListener(new Error("Failed to start local server."));
-        return;
-      }
-      const { port } = addr as AddressInfo;
-      resolveListener({
-        redirectUri: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
-        waitForCode,
-        close: (reason?: string) => {
-          server.close();
-          settle.reject(new Error(reason ?? "Login cancelled."));
-        },
-      });
-    });
-  });
-}
-
-/** App-held WorkOS PKCE login */
-async function workosPkceLogin(platformUrl: string): Promise<string> {
-  const clientId = await fetchWorkosClientId(platformUrl);
-  const { verifier, challenge } = generatePkcePair();
-  const state = randomBytes(32).toString("hex");
-
-  const listener = await startLoopbackListener(state);
-  const timeout = setTimeout(() => {
-    listener.close("Login timed out. Please try again.");
-  }, LOGIN_TIMEOUT_MS);
-
-  try {
-    const authorizeUrl = buildAuthorizeUrl({
-      clientId,
-      redirectUri: listener.redirectUri,
-      challenge,
-      state,
-    });
-
-    console.log("Opening browser for login...");
-    console.log(`If the browser doesn't open, visit: ${authorizeUrl}`);
-    openBrowser(authorizeUrl);
+  describeLoginError,
+  registerLocalAssistantWithPlatform,
+  workosPkceLogin,
+} from "../lib/cloud-login.js";
+import { getPlatformUrl } from "../lib/platform-client";
+import { syncCloudAssistants } from "../lib/sync-cloud-assistants";
 
-    const code = await listener.waitForCode;
-    const accessToken = await exchangeCodeWithWorkos({
-      clientId,
-      code,
-      verifier,
-    });
-    return await exchangeAccessTokenForSession(
-      platformUrl,
-      clientId,
-      accessToken,
-    );
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 
-export async function login(): Promise<void> {
+export const login = Object.assign(
+  async function login(): Promise<void> {
   const args = process.argv.slice(3);
 
   if (args.includes("--help") || args.includes("-h")) {
@@ -359,7 +85,7 @@ export async function login(): Promise<void> {
     try {
       token = await workosPkceLogin(getPlatformUrl());
     } catch (error) {
-      console.error(`❌ ${error instanceof Error ? error.message : error}`);
+      console.error(`❌ ${describeLoginError(error)}`);
       process.exit(1);
     }
   }
@@ -374,74 +100,7 @@ export async function login(): Promise<void> {
     // Register the local assistant with the platform (non-fatal).
     // Mirrors the desktop app's LocalAssistantBootstrapService flow.
     try {
-      const entry = resolveAssistant();
-
-      // Skip managed ("cadet") assistants — they are handled by the platform.
-      if (entry && !isManagedCloud(entry.cloud)) {
-        const orgId = await fetchOrganizationId(token);
-        const clientInstallationId = computeDeviceId();
-        const [assistantVersion, ingressUrl] = await Promise.all([
-          fetchCurrentVersion(entry.runtimeUrl),
-          fetchAssistantIngressUrl(entry.runtimeUrl, entry.bearerToken),
-        ]);
-        const platformUrl = getPlatformUrl();
-        const registration = await ensureSelfHostedLocalRegistration(
-          token,
-          orgId,
-          clientInstallationId,
-          entry.assistantId,
-          "cli",
-          assistantVersion,
-          platformUrl,
-          ingressUrl,
-        );
-        saveAssistantEntry({
-          ...entry,
-          platformAssistantId: registration.assistant.id,
-          platformBaseUrl: platformUrl,
-          platformOrganizationId: orgId,
-        });
-        console.log(
-          `Registered assistant: ${registration.assistant.name} (${registration.assistant.id})`,
-        );
-
-        // Which key to hand the assistant, and why. Shared with teleport so
-        // the two injection paths cannot drift.
-        const resolved = await resolveAssistantApiKeyForInjection({
-          registrationApiKey: registration.assistant_api_key,
-          runtimeUrl: entry.runtimeUrl,
-          bearerToken: entry.bearerToken,
-          token,
-          organizationId: orgId,
-          clientInstallationId,
-          runtimeAssistantId: entry.assistantId,
-          clientPlatform: "cli",
-        });
-        const assistantApiKey = resolved.apiKey;
-        if (resolved.source === "reprovisioned") {
-          console.log("Provisioning a replacement API key...");
-        }
-
-        // Inject credentials into the running assistant via the gateway,
-        // mirroring the desktop app's LocalAssistantBootstrapService flow.
-        const allInjected = await injectCredentialsIntoAssistant({
-          gatewayUrl: entry.runtimeUrl,
-          bearerToken: entry.bearerToken,
-          assistantApiKey,
-          platformAssistantId: registration.assistant.id,
-          platformBaseUrl: platformUrl,
-          organizationId: orgId,
-          userId: user.id,
-          webhookSecret: registration.webhook_secret,
-        });
-        if (allInjected) {
-          console.log("Injected cloud credentials into assistant.");
-        } else {
-          console.warn(
-            "Some credentials could not be injected into the assistant.",
-          );
-        }
-      }
+      await registerLocalAssistantWithPlatform(token, user);
     } catch {
       // Non-fatal — login succeeded even if registration fails
     }
@@ -477,9 +136,13 @@ export async function login(): Promise<void> {
     );
     process.exit(1);
   }
-}
+},
+  { description: "Log in to Cadet Cloud" },
+);
 
-export async function logout(): Promise<void> {
+
+export const logout = Object.assign(
+  async function logout(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
     console.log("Usage: cadet logout");
@@ -504,9 +167,13 @@ export async function logout(): Promise<void> {
 
   clearPlatformToken();
   console.log("Logged out. Cadet Cloud token removed.");
-}
+},
+  { description: "Log out of Cadet Cloud" },
+);
+
 
-export async function whoami(): Promise<void> {
+export const whoami = Object.assign(
+  async function whoami(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
     console.log("Usage: cadet whoami");
@@ -532,4 +199,7 @@ export async function whoami(): Promise<void> {
     console.error(`Error: ${error instanceof Error ? error.message : error}`);
     process.exit(1);
   }
-}
+},
+  { description: "Show current logged-in user" },
+);
+

package/src/commands/logs.ts

@@ -583,7 +583,8 @@ async function showAwsLogs(
 
 // ── Entry point ─────────────────────────────────────────────────
 
-export async function logs(): Promise<void> {
+export const logs = Object.assign(
+  async function logs(): Promise<void> {
   const opts = parseArgs();
 
   const entry = resolveAssistant(opts.name);
@@ -640,4 +641,7 @@ export async function logs(): Promise<void> {
       console.error(`Unsupported topology '${cloud}' for log viewing.`);
       process.exit(1);
   }
-}
+},
+  { description: "View logs from an assistant instance" },
+);
+

package/src/commands/message.ts

@@ -123,7 +123,8 @@ function exitWithUsage(error: string): never {
   process.exit(1);
 }
 
-export async function message(): Promise<void> {
+export const message = Object.assign(
+  async function message(): Promise<void> {
   const rawArgs = process.argv.slice(3);
 
   if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
@@ -192,4 +193,7 @@ export async function message(): Promise<void> {
       console.log(`Message rejected (id: ${result.messageId})`);
     }
   }
-}
+},
+  { description: "Send a message to a running assistant" },
+);
+

package/src/commands/pair.ts

@@ -258,7 +258,8 @@ async function approveRemoteWebPairing(
   return (await response.json()) as RemoteWebPairingVerificationResponse;
 }
 
-export async function pair(): Promise<void> {
+export const pair = Object.assign(
+  async function pair(): Promise<void> {
   const rawArgs = process.argv.slice(3);
 
   if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
@@ -497,4 +498,7 @@ export async function pair(): Promise<void> {
   console.log(`On another computer, run:  cadet connect import "${pairUrl}"`);
   console.log("");
   console.log(`Expires: ${challenge.expiresAt}`);
-}
+},
+  { description: "Print a pairing link and QR code for another device [beta]" },
+);
+

package/src/commands/ps.ts

@@ -677,11 +677,13 @@ export async function listAllAssistants(verbose: boolean): Promise<void> {
   );
 
   printTable(rows, { name: "NAME", status: "STATUS", info: "INFO" });
+  console.log("");
 }
 
 // ── Entry point ─────────────────────────────────────────────────
 
-export async function ps(): Promise<void> {
+export const ps = Object.assign(
+  async function ps(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
     console.log("Usage: cadet ps [<name-or-id>] [--verbose]");
@@ -717,4 +719,7 @@ export async function ps(): Promise<void> {
   }
 
   await showAssistantProcesses(result.entry);
-}
+},
+  { description: "List assistants (or processes for a specific assistant)" },
+);
+

package/src/commands/recover.ts

@@ -1,3 +1,4 @@
+import { resolveExistingLocalSigningKey } from "@mycadet/local-mode";
 import {
   existsSync,
   mkdirSync,
@@ -18,7 +19,8 @@ import {
 import { getArchivePath, getMetadataPath } from "../lib/retire-archive";
 import { exec } from "../lib/step-runner";
 
-export async function recover(): Promise<void> {
+export const recover = Object.assign(
+  async function recover(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
     console.log("Usage: cadet recover <name>");
@@ -96,24 +98,21 @@ export async function recover(): Promise<void> {
   const extractedPath = join(retiredDir, basename(archivePath) + ".staging");
 
   await exec("tar", ["xzf", archivePath, "-C", retiredDir]);
-  mkdirSync(dirname(targetDir), { recursive: true });
-  renameSync(extractedPath, targetDir);
-
-  // 5. Restore lockfile entry
-  saveAssistantEntry(entry);
-
-  // 6. Clean up archive
-  unlinkSync(archivePath);
-  unlinkSync(metadataPath);
-
-  // 7. Persist signing key and bootstrap secret so they survive daemon/gateway restarts
-  const signingKey = generateLocalSigningKey();
-  const bootstrapSecret = generateLocalSigningKey();
+  // Validate the staged identity before occupying the destination or updating
+  // the registry. A failed validation leaves the archive available for retry.
+  const signingKey = resolveExistingLocalSigningKey(
+    entry.resources,
+    extractedPath,
+  );
+  const bootstrapSecret =
+    entry.guardianBootstrapSecret ?? generateLocalSigningKey();
   entry.resources = { ...entry.resources, signingKey };
   entry.guardianBootstrapSecret = bootstrapSecret;
+  mkdirSync(dirname(targetDir), { recursive: true });
+  renameSync(extractedPath, targetDir);
   saveAssistantEntry(entry);
 
-  // 8. Start CES sibling + daemon + gateway in parallel, the way the
+  // 7. Start CES sibling + daemon + gateway in parallel, the way the
   // Docker topology brings its sibling processes up together. startCes
   // always launches the CES sibling.
   await Promise.all([
@@ -122,5 +121,11 @@ export async function recover(): Promise<void> {
     startGateway(false, entry.resources, { signingKey, bootstrapSecret }),
   ]);
 
+  unlinkSync(archivePath);
+  unlinkSync(metadataPath);
+
   console.log(`✅ Recovered assistant '${name}'.`);
-}
+},
+  { description: "Restore a previously retired local assistant" },
+);
+

package/src/commands/restore.ts

@@ -515,7 +515,8 @@ async function restorePlatform(
   }
 }
 
-export async function restore(): Promise<void> {
+export const restore = Object.assign(
+  async function restore(): Promise<void> {
   const { name, fromPath, version, dryRun, help } = parseArgs(process.argv);
 
   if (help) {
@@ -623,7 +624,10 @@ export async function restore(): Promise<void> {
       await cleanupStaged();
     }
   }
-}
+},
+  { description: "Restore data (and optionally version) from a .vbundle backup" },
+);
+
 
 async function runLocalRestore(opts: {
   entry: AssistantEntry;

package/src/commands/retire.ts

@@ -364,7 +364,8 @@ function teeConsoleToLogFile(fd: number | "ignore"): void {
   };
 }
 
-export async function retire(): Promise<void> {
+export const retire = Object.assign(
+  async function retire(): Promise<void> {
   if (process.env.CADET_DESKTOP_APP) {
     resetLogFile("retire.log");
   }
@@ -378,7 +379,10 @@ export async function retire(): Promise<void> {
   } finally {
     closeLogFile(logFd);
   }
-}
+},
+  { description: "Delete an assistant instance" },
+);
+
 
 async function retireInner(): Promise<void> {
   const args = process.argv.slice(3);

package/src/commands/roadmap.ts

@@ -413,7 +413,8 @@ async function roadmapUnvote(args: string[]): Promise<void> {
 
 // ── main ──
 
-export async function roadmap(): Promise<void> {
+export const roadmap = Object.assign(
+  async function roadmap(): Promise<void> {
   const args = process.argv.slice(3);
   const sub = args[0];
 
@@ -452,4 +453,7 @@ export async function roadmap(): Promise<void> {
       printUsage();
       process.exitCode = 1;
   }
-}
+},
+  { description: "Manage roadmap items" },
+);
+

package/src/commands/rollback.ts

@@ -211,7 +211,8 @@ async function rollbackPlatformViaEndpoint(
   }
 }
 
-export async function rollback(): Promise<void> {
+export const rollback = Object.assign(
+  async function rollback(): Promise<void> {
   const { name, version } = parseArgs();
   const entry = resolveTargetAssistant(name);
   const cloud = entry.cloud;
@@ -478,4 +479,7 @@ export async function rollback(): Promise<void> {
     emitCliError(categorizeUpgradeError(err), "Rollback failed", detail);
     process.exit(1);
   }
-}
+},
+  { description: "Roll back an assistant to a previous version" },
+);
+