@mycadet/cli 0.12.6-dev.202610091338.ee7f3e3 → 0.12.7-dev.202610102207.24bf931

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.6-dev.202610091338.ee7f3e3",
+  "version": "0.12.7-dev.202610102207.24bf931",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {
@@ -15,12 +15,12 @@
     "./src/commands/*": "./src/commands/*.ts"
   },
   "bin": {
-    "cadet": "./src/index.ts"
+    "cadet-dev": "./src/index.ts"
   },
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "eslint --max-warnings 696",
+    "lint": "eslint --max-warnings 326",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "compile:check": "bun build --compile src/index.ts --outfile /dev/null",
     "test": "bun run scripts/run-tests.ts",
@@ -40,7 +40,8 @@
     "nanoid": "5.1.7",
     "qrcode-terminal": "0.12.0",
     "react": "19.2.6",
-    "react-devtools-core": "7.0.1"
+    "react-devtools-core": "7.0.1",
+    "zod": "4.3.6"
   },
   "bundledDependencies": [
     "@mycadet/assistant-api",

package/src/__tests__/backup.test.ts

@@ -5,6 +5,7 @@ import {
   describe,
   expect,
   mock,
+  type Mock,
   spyOn,
   test,
 } from "bun:test";
@@ -79,6 +80,7 @@ const localRuntimePollJobStatusMock = spyOn(
   result: { manifest_sha256: "abc123def456" },
 });
 
+/** A complete-but-fake guardian token; the SUT only reads the fields it sets. */
 // Mode 1 (runtime-direct local backup) uses guardian tokens. Don't exercise
 // it here, but the spies need to exist so the module under test can import
 // them without surprises. Saved to variables so afterAll can restore them —
@@ -87,31 +89,25 @@ const localRuntimePollJobStatusMock = spyOn(
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
-).mockReturnValue({
-  accessToken: "local-token",
-  accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-} as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+).mockReturnValue(makeGuardianTokenData({ accessToken: "local-token" }));
 const leaseGuardianTokenSpy = spyOn(
   guardianToken,
   "leaseGuardianToken",
-).mockResolvedValue({
-  accessToken: "leased-token",
-  accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-} as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+).mockResolvedValue(makeGuardianTokenData({ accessToken: "leased-token" }));
 
 const getBackupsDirMock = spyOn(backupOps, "getBackupsDir").mockReturnValue(
   "/tmp/backups-default",
 );
 
 const mkdirSyncMock = spyOn(fs, "mkdirSync").mockImplementation(
-  (() => undefined) as never,
+  () => undefined,
 );
 const writeFileSyncMock = spyOn(fs, "writeFileSync").mockImplementation(
   () => undefined,
 );
 
 let originalFetch: typeof globalThis.fetch;
-let exitMock: ReturnType<typeof mock>;
+let exitMock: Mock<(code?: number | string | undefined) => never>;
 
 const CADET_ENTRY = {
   assistantId: "11111111-2222-3333-4444-555555555555",
@@ -126,10 +122,10 @@ function setArgv(...rest: string[]) {
 
 beforeEach(() => {
   originalFetch = globalThis.fetch;
-  exitMock = mock((code?: number) => {
+  exitMock = mock((code?: number | string | undefined): never => {
     throw new Error(`process.exit:${code}`);
   });
-  process.exit = exitMock as unknown as typeof process.exit;
+  process.exit = exitMock;
 
   findAssistantByNameMock.mockReset();
   findAssistantByNameMock.mockReturnValue(null);
@@ -162,17 +158,15 @@ beforeEach(() => {
   getBackupsDirMock.mockReset();
   getBackupsDirMock.mockReturnValue("/tmp/backups-default");
   loadGuardianTokenSpy.mockReset();
-  loadGuardianTokenSpy.mockReturnValue({
-    accessToken: "local-token",
-    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-  } as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+  loadGuardianTokenSpy.mockReturnValue(
+    makeGuardianTokenData({ accessToken: "local-token" }),
+  );
   leaseGuardianTokenSpy.mockReset();
-  leaseGuardianTokenSpy.mockResolvedValue({
-    accessToken: "leased-token",
-    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-  } as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+  leaseGuardianTokenSpy.mockResolvedValue(
+    makeGuardianTokenData({ accessToken: "leased-token" }),
+  );
   mkdirSyncMock.mockReset();
-  mkdirSyncMock.mockImplementation((() => undefined) as never);
+  mkdirSyncMock.mockImplementation(() => undefined);
   writeFileSyncMock.mockReset();
   writeFileSyncMock.mockImplementation(() => undefined);
 });
@@ -200,20 +194,26 @@ afterAll(() => {
 });
 
 import { backup } from "../commands/backup.js";
+import { withPreconnect } from "./helpers/http.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 // ---------------------------------------------------------------------------
 // Helper: simulated GCS download response
 // ---------------------------------------------------------------------------
-function mockGcsDownload(body: Uint8Array, ok = true, status = 200) {
-  globalThis.fetch = mock(async () => {
-    const responseBody: BodyInit = ok
-      ? new Blob([body as unknown as ArrayBuffer])
-      : "boom";
+function mockGcsDownload(
+  body: Uint8Array<ArrayBuffer>,
+  ok = true,
+  status = 200,
+) {
+  const gcsFetch = mock(async () => {
+    const responseBody: BodyInit = ok ? new Blob([body]) : "boom";
     return new Response(responseBody, {
       status,
       statusText: ok ? "OK" : "Error",
     });
-  }) as unknown as typeof globalThis.fetch;
+  });
+  globalThis.fetch = withPreconnect(gcsFetch);
+  return gcsFetch;
 }
 
 describe("cadet backup <local>: guardian bootstrap secret", () => {
@@ -228,11 +228,9 @@ describe("cadet backup <local>: guardian bootstrap secret", () => {
     loadGuardianTokenSpy.mockReturnValue(null);
     setArgv("my-local", "--output", "/tmp/local-backup.vbundle");
 
-    globalThis.fetch = mock(async () => {
-      return new Response(new Uint8Array([1, 2, 3]), {
-        status: 200,
-      });
-    }) as unknown as typeof globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async () => new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    );
 
     await backup();
 
@@ -294,9 +292,9 @@ describe("cadet backup: --export-timeout flag", () => {
       "/tmp/local-backup.vbundle",
     );
 
-    globalThis.fetch = mock(async () => {
-      return new Response(new Uint8Array([1, 2, 3]), { status: 200 });
-    }) as unknown as typeof globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async () => new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    );
 
     await backup();
 
@@ -313,7 +311,7 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     setArgv("my-platform");
 
     const bytes = new Uint8Array([1, 2, 3, 4]);
-    mockGcsDownload(bytes);
+    const gcsFetch = mockGcsDownload(bytes);
 
     await backup();
 
@@ -366,13 +364,12 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
       "https://cloud.mycadet.ai",
     );
     const downloadCall = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "download",
+      (c) => c[0].operation === "download",
     );
     expect(downloadCall).toBeDefined();
     expect(downloadCall![0]).not.toHaveProperty("targetRuntimeVersion");
 
     // GCS fetch went directly to the signed download URL with no auth.
-    const gcsFetch = globalThis.fetch as unknown as ReturnType<typeof mock>;
     expect(gcsFetch).toHaveBeenCalledWith(
       "https://storage.googleapis.com/bucket/signed-download",
     );
@@ -382,7 +379,7 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     const [outputPath, written] = writeFileSyncMock.mock.calls[0]!;
     expect(written).toEqual(bytes);
     expect(typeof outputPath).toBe("string");
-    expect(outputPath as string).toMatch(
+    expect(outputPath).toMatch(
       /\/tmp\/backups-default\/my-platform-.*\.vbundle$/,
     );
     expect(mkdirSyncMock).toHaveBeenCalled();
@@ -411,10 +408,8 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     await backup();
 
     const [outputPath] = writeFileSyncMock.mock.calls[0]!;
-    expect(outputPath as string).toMatch(
-      /^\/tmp\/backups-default\/my-platform-/,
-    );
-    expect(outputPath as string).toMatch(/\.vbundle$/);
+    expect(outputPath).toMatch(/^\/tmp\/backups-default\/my-platform-/);
+    expect(outputPath).toMatch(/\.vbundle$/);
   });
 
   test("signed-URL requests target entry.runtimeUrl, not getPlatformUrl() — regression for staging/dev assistants", async () => {
@@ -502,10 +497,10 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     // `platformToken` parameter instead of `exportPlatformToken`, a
     // future poll-loop refresh would silently break this invariant.
     const uploadCallToken = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "upload",
+      (c) => c[0].operation === "upload",
     )![1];
     const downloadCallToken = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "download",
+      (c) => c[0].operation === "download",
     )![1];
     expect(downloadCallToken).toBe(uploadCallToken);
     const kickoffToken = localRuntimeExportToGcsMock.mock.calls[0]![1];

package/src/__tests__/connect-import.test.ts

@@ -27,7 +27,9 @@ import {
   findAssistantByName,
   saveAssistantEntry,
 } from "../lib/assistant-config.js";
+import { z } from "zod";
 import { loadGuardianToken } from "../lib/guardian-token.js";
+import { withPreconnect } from "./helpers/http.js";
 
 const HOST = "https://host.example.ts.net";
 const PAIRING_LINK = `${HOST}/assistant/pair#device_code=dev-code`;
@@ -69,6 +71,9 @@ function approvedBody(overrides: Record<string, unknown> = {}) {
   };
 }
 
+/** The commands always send flat string-keyed JSON bodies. */
+const JsonRecord = z.record(z.string(), z.unknown());
+
 interface FetchCall {
   url: string;
   body: Record<string, unknown>;
@@ -79,17 +84,20 @@ function stubFetch(
   replies: (call: FetchCall, index: number) => Response,
 ): FetchCall[] {
   const calls: FetchCall[] = [];
-  globalThis.fetch = (async (url: string, init?: RequestInit) => {
-    const call = {
-      url,
-      body: JSON.parse((init?.body as string) ?? "{}") as Record<
-        string,
-        unknown
-      >,
-    };
-    calls.push(call);
-    return replies(call, calls.length - 1);
-  }) as unknown as typeof fetch;
+  globalThis.fetch = withPreconnect(
+    async (input: RequestInfo | URL, init?: RequestInit) => {
+      const call = {
+        url: String(input),
+        // The command always sends a JSON string body; anything else records
+        // as an empty record.
+        body: JsonRecord.parse(
+          JSON.parse(typeof init?.body === "string" ? init.body : "{}"),
+        ),
+      };
+      calls.push(call);
+      return replies(call, calls.length - 1);
+    },
+  );
   return calls;
 }
 
@@ -112,14 +120,16 @@ async function runExpectingExit(): Promise<{ exited: boolean; out: string }> {
   const logSpy = spyOn(console, "log").mockImplementation((...a: unknown[]) => {
     messages.push(a.join(" "));
   });
-  const exitSpy = spyOn(process, "exit").mockImplementation(((c?: number) => {
-    throw new Error(`exit:${c}`);
-  }) as never);
+  const exitSpy = spyOn(process, "exit").mockImplementation(
+    (c?: number | string | undefined): never => {
+      throw new Error(`exit:${c}`);
+    },
+  );
   let exited = false;
   try {
     await connectImport();
   } catch (e) {
-    exited = (e as Error).message === "exit:1";
+    exited = e instanceof Error && e.message === "exit:1";
   } finally {
     errSpy.mockRestore();
     logSpy.mockRestore();
@@ -144,10 +154,13 @@ describe("connect import", () => {
     // a multi-second cadence is exercised in full without being spent, and
     // both the cadence and the backoff are assertable rather than implicit.
     setSystemTime(new Date());
-    sleepSpy = spyOn(Bun, "sleep").mockImplementation((async (ms: number) => {
-      waits.push(ms);
-      setSystemTime(new Date(Date.now() + ms));
-    }) as never);
+    sleepSpy = spyOn(Bun, "sleep").mockImplementation(
+      async (ms: number | Date) => {
+        const waitMs = typeof ms === "number" ? ms : ms.getTime() - Date.now();
+        waits.push(waitMs);
+        setSystemTime(new Date(Date.now() + waitMs));
+      },
+    );
   });
 
   afterEach(() => {
@@ -312,10 +325,10 @@ describe("connect import", () => {
       "http://insecure.example.com",
     ];
     let fetched = false;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       fetched = true;
       return jsonResponse({});
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 
@@ -333,10 +346,10 @@ describe("connect import", () => {
       "https://127.0.0.1:7830",
     ];
     let fetched = false;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       fetched = true;
       return jsonResponse({});
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 
@@ -361,10 +374,10 @@ describe("connect import", () => {
       "legacy-box",
     ];
     let fetched = false;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       fetched = true;
       return jsonResponse({});
-    }) as unknown as typeof fetch;
+    });
     const { logs, restore } = captureLogs();
     try {
       await connectImport();
@@ -385,10 +398,10 @@ describe("connect import", () => {
   test("a string that is neither an address nor a bundle keeps the address error", async () => {
     process.argv = ["bun", "cadet", "connect", "import", "not-a-url"];
     let fetched = false;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       fetched = true;
       return jsonResponse({});
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 
@@ -410,7 +423,8 @@ describe("connect import", () => {
       "flaky-box",
     ];
     let attempt = 0;
-    globalThis.fetch = (async (url: string) => {
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
       if (url === CHALLENGE_URL) {
         return jsonResponse(challengeBody());
       }
@@ -420,7 +434,7 @@ describe("connect import", () => {
         throw new Error("connect ECONNRESET");
       }
       return jsonResponse(approvedBody());
-    }) as unknown as typeof fetch;
+    });
     const { logs, restore } = captureLogs();
     try {
       await connectImport();
@@ -448,7 +462,8 @@ describe("connect import", () => {
       "repairing-box",
     ];
     let attempt = 0;
-    globalThis.fetch = (async (url: string) => {
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
       if (url === CHALLENGE_URL) {
         return jsonResponse(challengeBody());
       }
@@ -459,7 +474,7 @@ describe("connect import", () => {
         return jsonResponse({ error: "guardian repair required" }, 503);
       }
       return jsonResponse(approvedBody());
-    }) as unknown as typeof fetch;
+    });
     const { logs, restore } = captureLogs();
     try {
       await connectImport();
@@ -477,7 +492,8 @@ describe("connect import", () => {
   test("reports expiry once transient failures outlast the code", async () => {
     process.argv = ["bun", "cadet", "connect", "import", HOST];
     let exchanges = 0;
-    globalThis.fetch = (async (url: string) => {
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
       if (url === CHALLENGE_URL) {
         return jsonResponse(
           challengeBody({
@@ -488,7 +504,7 @@ describe("connect import", () => {
       }
       exchanges += 1;
       throw new Error("connect ECONNREFUSED");
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 
@@ -507,10 +523,10 @@ describe("connect import", () => {
     // ten-minute TTL.
     process.argv = ["bun", "cadet", "connect", "import", PAIRING_LINK];
     let attempts = 0;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       attempts += 1;
       throw new Error("connect ECONNREFUSED");
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 
@@ -532,10 +548,10 @@ describe("connect import", () => {
   test("rejects an unknown --flag instead of pairing against it", async () => {
     process.argv = ["bun", "cadet", "connect", "import", "--qr", HOST];
     let fetched = false;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       fetched = true;
       return jsonResponse({});
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 
@@ -560,10 +576,10 @@ describe("connect import", () => {
       "--frobnicate",
     ];
     let fetched = false;
-    globalThis.fetch = (async () => {
+    globalThis.fetch = withPreconnect(async () => {
       fetched = true;
       return jsonResponse({});
-    }) as unknown as typeof fetch;
+    });
 
     const { exited, out } = await runExpectingExit();
 

package/src/__tests__/debug.test.ts

@@ -20,6 +20,8 @@ import * as assistantConfig from "../lib/assistant-config.js";
 import * as guardianToken from "../lib/guardian-token.js";
 import * as localRuntimeClient from "../lib/local-runtime-client.js";
 import * as platformClient from "../lib/platform-client.js";
+import { withPreconnect } from "./helpers/http.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 const resolveTargetMock = spyOn(
   assistantConfig,
@@ -46,23 +48,25 @@ const pollMock = spyOn(
   jobId: "job-1",
   type: "export",
   status: "complete",
-} as unknown as Awaited<
-  ReturnType<typeof localRuntimeClient.localRuntimePollJobStatus>
->);
+});
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
-).mockReturnValue({
-  accessToken: "local-token",
-  accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
-} as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+).mockReturnValue(
+  makeGuardianTokenData({
+    accessToken: "local-token",
+    accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+  }),
+);
 const leaseGuardianTokenSpy = spyOn(
   guardianToken,
   "leaseGuardianToken",
-).mockResolvedValue({
-  accessToken: "leased-token",
-  accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
-} as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+).mockResolvedValue(
+  makeGuardianTokenData({
+    accessToken: "leased-token",
+    accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+  }),
+);
 
 const { debug } = await import("../commands/debug.js");
 
@@ -75,7 +79,7 @@ const LOCAL_ENTRY = {
   platformAssistantId: "11111111-2222-3333-4444-555555555555",
   platformBaseUrl: "https://cloud.mycadet.ai",
   platformOrganizationId: "org-1",
-} as unknown as assistantConfig.AssistantEntry;
+} satisfies assistantConfig.AssistantEntry;
 
 let originalFetch: typeof globalThis.fetch;
 let originalExit: typeof process.exit;
@@ -86,12 +90,12 @@ beforeEach(() => {
   process.argv = ["bun", "cadet", "debug"];
   originalFetch = globalThis.fetch;
   originalExit = process.exit;
-  process.exit = mock((code?: number) => {
+  process.exit = mock((code?: number | string | undefined): never => {
     throw new Error(`process.exit:${code}`);
-  }) as unknown as typeof process.exit;
+  });
   fetchCalls = [];
   uploadUrlStatus = 201;
-  globalThis.fetch = mock(
+  globalThis.fetch = withPreconnect(
     async (input: RequestInfo | URL, init?: RequestInit) => {
       fetchCalls.push({ url: String(input), init });
       return new Response(
@@ -102,7 +106,7 @@ beforeEach(() => {
         },
       );
     },
-  ) as unknown as typeof globalThis.fetch;
+  );
   resolveTargetMock.mockReset();
   resolveTargetMock.mockReturnValue(LOCAL_ENTRY);
   identityMock.mockReset();
@@ -140,9 +144,7 @@ describe("cadet debug", () => {
     );
     expect(fetchCalls[0].init?.method).toBe("POST");
     expect(
-      (fetchCalls[0].init?.headers as Record<string, string>)[
-        "Cadet-Organization-Id"
-      ],
+      new Headers(fetchCalls[0].init?.headers).get("Cadet-Organization-Id"),
     ).toBe("org-1");
 
     expect(exportMock).toHaveBeenCalledTimes(1);
@@ -196,9 +198,7 @@ describe("cadet debug", () => {
         jobId: "job-1",
         type: "export",
         status: "complete",
-      } as unknown as Awaited<
-        ReturnType<typeof localRuntimeClient.localRuntimePollJobStatus>
-      >;
+      };
     });
 
     await debug();
@@ -226,7 +226,7 @@ describe("cadet debug", () => {
     resolveTargetMock.mockReturnValue({
       ...LOCAL_ENTRY,
       cloud: "cadet",
-    } as unknown as assistantConfig.AssistantEntry);
+    });
     const errorSpy = spyOn(console, "error").mockImplementation(() => {});
     try {
       await expect(debug()).rejects.toThrow("process.exit:1");
@@ -240,7 +240,7 @@ describe("cadet debug", () => {
     resolveTargetMock.mockReturnValue({
       ...LOCAL_ENTRY,
       platformAssistantId: undefined,
-    } as unknown as assistantConfig.AssistantEntry);
+    });
     const errors: string[] = [];
     const errorSpy = spyOn(console, "error").mockImplementation((msg) => {
       errors.push(String(msg));