@mycadet/cli 0.12.6-dev.202610091338.ee7f3e3 → 0.12.7

package/src/__tests__/uninstall.test.ts

@@ -0,0 +1,171 @@
+import { afterAll, afterEach, describe, expect, spyOn, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join } from "path";
+
+import { uninstall } from "../commands/uninstall.js";
+import {
+  getConfigDirs,
+  getInputHistoryPath,
+  getLogDir,
+  getStateDir,
+} from "../lib/environments/paths.js";
+import { getCurrentEnvironment } from "../lib/environments/resolve.js";
+import type { AssistantEntry } from "../lib/assistant-config.js";
+
+// The command reads its argv at call time.
+const ORIGINAL_ARGV = process.argv;
+
+// Every XDG location the command touches MUST be redirected: the homedir
+// fallback would otherwise point at the real user's data dirs.
+function redirectXdg(): string {
+  const root = mkdtempSync(join(tmpdir(), "cadet-uninstall-"));
+  process.env.XDG_DATA_HOME = join(root, "data");
+  process.env.XDG_CONFIG_HOME = join(root, "config");
+  process.env.XDG_STATE_HOME = join(root, "state");
+  process.env.CADET_ENVIRONMENT = "production";
+  process.env.CADET_LOCKFILE_DIR = join(root, "lockdir");
+  mkdirSync(process.env.CADET_LOCKFILE_DIR, { recursive: true });
+  return root;
+}
+
+const RESTORED_ENV_KEYS = [
+  "XDG_DATA_HOME",
+  "XDG_CONFIG_HOME",
+  "XDG_STATE_HOME",
+  "CADET_ENVIRONMENT",
+  "CADET_LOCKFILE_DIR",
+] as const;
+
+function withRestoredEnv(run: () => Promise<void>): Promise<void> {
+  const before = Object.fromEntries(
+    RESTORED_ENV_KEYS.map((k) => [k, process.env[k]]),
+  );
+  return run().finally(() => {
+    for (const k of RESTORED_ENV_KEYS) {
+      if (before[k] === undefined) delete process.env[k];
+      else process.env[k] = before[k]!;
+    }
+    process.argv = ORIGINAL_ARGV;
+  });
+}
+
+function makeEntry(assistantId: string): AssistantEntry {
+  return {
+    assistantId,
+    runtimeUrl: "http://127.0.0.1:7801",
+    cloud: "local",
+    resources: {
+      instanceDir: join(tmpdir(), "cadet-uninstall-instance"),
+      daemonPort: 7801,
+      gatewayPort: 7831,
+      qdrantPort: 6334,
+      cesPort: 7790,
+    },
+  };
+}
+
+describe("cadet uninstall", () => {
+  const logSpy = spyOn(console, "log").mockImplementation(() => {});
+  const errorSpy = spyOn(console, "error").mockImplementation(() => {});
+  const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+
+  afterEach(() => {
+    logSpy.mockClear();
+    errorSpy.mockClear();
+    warnSpy.mockClear();
+  });
+
+  afterAll(() => {
+    logSpy.mockRestore();
+    errorSpy.mockRestore();
+    warnSpy.mockRestore();
+  });
+
+  test("refuses while assistants remain — retire them first", async () => {
+    await withRestoredEnv(async () => {
+      const root = redirectXdg();
+      // A remaining assistant in the lockfile means there is data that
+      // should be retired (and archived) first.
+      writeFileSync(
+        join(process.env.CADET_LOCKFILE_DIR!, "lockfile.json"),
+        JSON.stringify({ assistants: [makeEntry("test-assistant")] }) + "\n",
+      );
+
+      const exitMock = spyOn(process, "exit");
+      exitMock.mockImplementation((code?: number | string | undefined): never => {
+        throw new Error(`process.exit:${code}`);
+      });
+      try {
+        await expect(uninstall()).rejects.toThrow("process.exit:1");
+        expect(errorSpy).toHaveBeenCalledWith(
+          expect.stringContaining("Retire them first"),
+        );
+      } finally {
+        exitMock.mockRestore();
+      }
+      rmSync(root, { recursive: true, force: true });
+    });
+  });
+
+  test("refuses non-interactively without --yes", async () => {
+    await withRestoredEnv(async () => {
+      const root = redirectXdg();
+
+      const exitMock = spyOn(process, "exit");
+      exitMock.mockImplementation((code?: number | string | undefined): never => {
+        throw new Error(`process.exit:${code}`);
+      });
+      try {
+        process.argv = ["bun", "cadet", "uninstall"];
+        await expect(uninstall()).rejects.toThrow("process.exit:1");
+        expect(errorSpy).toHaveBeenCalledWith(
+          expect.stringContaining("non-interactive"),
+        );
+      } finally {
+        exitMock.mockRestore();
+      }
+      rmSync(root, { recursive: true, force: true });
+    });
+  });
+
+  test("--yes deletes the environment's XDG locations and leaves the source checkout alone", async () => {
+    await withRestoredEnv(async () => {
+      const root = redirectXdg();
+      const env = getCurrentEnvironment();
+
+      // Pre-create every target the command should delete, using the SAME
+      // path helpers so the test stays honest about what they resolve to.
+      const stateDir = getStateDir(env);
+      mkdirSync(join(stateDir, "assistants", "some-assistant"), {
+        recursive: true,
+      });
+      mkdirSync(join(stateDir, "retired"), { recursive: true });
+      const configDir = getConfigDirs(env)[0]!;
+      mkdirSync(configDir, { recursive: true });
+      const logDir = getLogDir(env);
+      mkdirSync(logDir, { recursive: true });
+      const historyPath = getInputHistoryPath();
+      mkdirSync(dirname(historyPath), { recursive: true });
+      writeFileSync(historyPath, "history");
+
+      process.argv = ["bun", "cadet", "uninstall", "--yes"];
+      await uninstall();
+
+      expect(existsSync(stateDir)).toBe(false);
+      expect(existsSync(configDir)).toBe(false);
+      expect(existsSync(logDir)).toBe(false);
+      expect(existsSync(historyPath)).toBe(false);
+
+      // Running under bun from a git checkout: self-removal must print the
+      // note and delete NOTHING outside the XDG targets.
+      const note = logSpy.mock.calls
+        .map((args) => args.map(String).join(" "))
+        .join("\n");
+      expect(note).toContain("source checkout");
+      expect(existsSync(process.execPath)).toBe(true);
+
+      rmSync(root, { recursive: true, force: true });
+    });
+  });
+});

package/src/commands/client.ts

@@ -77,9 +77,47 @@ import { relaunchDetached } from "../lib/detached-process.js";
 import { probePort } from "../lib/port-probe.js";
 import { openBrowser } from "../lib/open-browser";
 import { findWebDistDir } from "../lib/web-dist.js";
+import { z } from "zod";
+
+const AssistantIdBodySchema = z.object({
+  assistantId: z.string().optional(),
+});
+
+const TokenBodySchema = z.object({ token: z.unknown() }).nullable();
+
+const SyncPlatformBodySchema = z.object({
+  syncPlatform: z.unknown().optional(),
+  platformAssistants: z.array(z.record(z.string(), z.unknown())).optional(),
+  organizationId: z.string().optional(),
+  rename: z
+    .object({ assistantId: z.string(), name: z.string() })
+    .optional(),
+  assistant: z.record(z.string(), z.unknown()).optional(),
+  activeAssistant: z.string().optional(),
+});
+
+const RemoteBodySchema = z.object({ remote: z.string().optional() });
+
+const UnpairBodySchema = z.object({
+  assistantId: z.unknown().optional(),
+  hashedDeviceId: z.unknown().optional(),
+});
+
+const DeviceBodySchema = z.object({
+  address: z.unknown().optional(),
+  handle: z.unknown().optional(),
+  name: z.unknown().optional(),
+});
+
+function errnoCode(error: unknown): string | undefined {
+  if (!(error instanceof Error)) return undefined;
+  if (!("code" in error) || typeof error.code !== "string") return undefined;
+  return error.code;
+}
 
 const SUPPORTED_INTERFACES = ["cli", "web"] as const;
 type SupportedInterface = (typeof SUPPORTED_INTERFACES)[number];
+const SupportedInterfaceSchema = z.enum(SUPPORTED_INTERFACES);
 
 const ANSI = {
   reset: "\x1b[0m",
@@ -299,13 +337,14 @@ export function parseArgs(): ParsedArgs {
       assistantName = undefined;
     } else if ((flag === "--interface" || flag === "-i") && flagArgs[i + 1]) {
       const value = flagArgs[++i];
-      if (!(SUPPORTED_INTERFACES as readonly string[]).includes(value)) {
+      const parsedInterface = SupportedInterfaceSchema.safeParse(value);
+      if (!parsedInterface.success) {
         console.error(
           `Unknown interface '${value}'. Supported: ${SUPPORTED_INTERFACES.join(", ")}.`,
         );
         process.exit(1);
       }
-      interfaceId = value as SupportedInterface;
+      interfaceId = parsedInterface.data;
     }
   }
 
@@ -548,10 +587,11 @@ async function handleLocalEndpoints(
       return Response.json({ ok: true });
     }
     if (req.method === "POST") {
-      const body = (await req.json().catch(() => null)) as {
-        token?: unknown;
-      } | null;
-      const token = body?.token;
+      const parsed = TokenBodySchema.safeParse(
+        await req.json().catch(() => null),
+      );
+      const token =
+        parsed.success && parsed.data ? parsed.data.token : undefined;
       if (typeof token !== "string" || !/^[A-Za-z0-9]+$/.test(token)) {
         return Response.json(
           { ok: false, error: "Invalid token" },
@@ -575,9 +615,11 @@ async function handleLocalEndpoints(
       return new Response(null, { status: result.status });
     }
     if (req.method === "POST") {
-      let body: Record<string, unknown>;
+      let body: z.infer<typeof SyncPlatformBodySchema>;
       try {
-        body = (await req.json()) as Record<string, unknown>;
+        const parsed = SyncPlatformBodySchema.safeParse(await req.json());
+        if (!parsed.success) throw new Error("invalid body");
+        body = parsed.data;
       } catch {
         return Response.json(
           { ok: false, error: "Invalid JSON body" },
@@ -585,24 +627,23 @@ async function handleLocalEndpoints(
         );
       }
       let result;
-      if (body.syncPlatform && Array.isArray(body.platformAssistants)) {
+      if (body.syncPlatform && body.platformAssistants) {
         result = replacePlatformAssistants(
           lockfilePaths,
-          body.platformAssistants as Array<Record<string, unknown>>,
-          body.organizationId as string | undefined,
+          body.platformAssistants,
+          body.organizationId,
         );
-      } else if (body.rename && typeof body.rename === "object") {
-        const rename = body.rename as Record<string, unknown>;
+      } else if (body.rename) {
         result = renameLockfileAssistantIfPresent(
           lockfilePaths,
-          rename.assistantId as string,
-          rename.name as string,
+          body.rename.assistantId,
+          body.rename.name,
         );
       } else {
         result = upsertRendererLockfileAssistant(
           lockfilePaths,
-          body.assistant as Record<string, unknown>,
-          body.activeAssistant as string | undefined,
+          body.assistant ?? {},
+          body.activeAssistant,
         );
       }
       return Response.json(result, { status: result.ok ? 200 : result.status });
@@ -618,10 +659,8 @@ async function handleLocalEndpoints(
     const contentType = req.headers.get("content-type") ?? "";
     if (contentType.includes("json")) {
       try {
-        const body = (await req.json()) as {
-          remote?: string;
-        };
-        if (body.remote) remote = body.remote;
+        const parsed = RemoteBodySchema.safeParse(await req.json());
+        if (parsed.success && parsed.data.remote) remote = parsed.data.remote;
       } catch {
         return Response.json(
           { ok: false, error: "Invalid JSON body" },
@@ -656,8 +695,9 @@ async function handleLocalEndpoints(
 
     let assistantId: string | undefined;
     try {
-      const body = (await req.json()) as { assistantId?: string };
-      assistantId = body.assistantId;
+      const parsed = AssistantIdBodySchema.safeParse(await req.json());
+      if (!parsed.success) throw new Error("invalid body");
+      assistantId = parsed.data.assistantId;
     } catch {
       return Response.json(
         { ok: false, error: "Invalid JSON body" },
@@ -707,8 +747,9 @@ async function handleLocalEndpoints(
 
     let assistantId: string | undefined;
     try {
-      const body = (await req.json()) as { assistantId?: string };
-      assistantId = body.assistantId;
+      const parsed = AssistantIdBodySchema.safeParse(await req.json());
+      if (!parsed.success) throw new Error("invalid body");
+      assistantId = parsed.data.assistantId;
     } catch {
       return Response.json(
         { ok: false, error: "Invalid JSON body" },
@@ -743,7 +784,9 @@ async function handleLocalEndpoints(
 
     let body: { assistantId?: unknown; hashedDeviceId?: unknown };
     try {
-      body = (await req.json()) as typeof body;
+      const parsed = UnpairBodySchema.safeParse(await req.json());
+      if (!parsed.success) throw new Error("invalid body");
+      body = parsed.data;
     } catch {
       return Response.json(
         { ok: false, error: "Invalid JSON body" },
@@ -802,11 +845,9 @@ async function handleLocalEndpoints(
 
     let body: { address?: unknown; handle?: unknown; name?: unknown };
     try {
-      body = (await req.json()) as {
-        address?: unknown;
-        handle?: unknown;
-        name?: unknown;
-      };
+      const parsed = DeviceBodySchema.safeParse(await req.json());
+      if (!parsed.success) throw new Error("invalid body");
+      body = parsed.data;
     } catch {
       return Response.json(
         { ok: false, error: "Invalid JSON body" },
@@ -1044,10 +1085,11 @@ type WebFetchHandler = (
 ) => Promise<Response>;
 
 function isAddrInUse(err: unknown): boolean {
-  const e = err as { code?: string; message?: string } | undefined;
+  const code = errnoCode(err);
+  const message = err instanceof Error ? err.message : undefined;
   return (
-    e?.code === "EADDRINUSE" ||
-    /EADDRINUSE|address already in use/i.test(e?.message ?? "")
+    code === "EADDRINUSE" ||
+    /EADDRINUSE|address already in use/i.test(message ?? "")
   );
 }
 

package/src/commands/ps.ts

@@ -677,6 +677,7 @@ export async function listAllAssistants(verbose: boolean): Promise<void> {
   );
 
   printTable(rows, { name: "NAME", status: "STATUS", info: "INFO" });
+  console.log("");
 }
 
 // ── Entry point ─────────────────────────────────────────────────

package/src/commands/uninstall.ts

@@ -0,0 +1,228 @@
+import { existsSync, readFileSync, renameSync, rmSync, unlinkSync } from "fs";
+import { basename, dirname, join } from "path";
+import { fileURLToPath } from "url";
+
+import { loadAllAssistants } from "../lib/assistant-config.js";
+import {
+  canPromptForConfirmation,
+  confirmAction,
+} from "../lib/confirm-action.js";
+import {
+  getConfigDirs,
+  getInputHistoryPath,
+  getLogDir,
+  getStateDir,
+} from "../lib/environments/paths.js";
+import { getCurrentEnvironment } from "../lib/environments/resolve.js";
+
+/** A directory (or file) scheduled for deletion, with what it holds. */
+interface DeleteTarget {
+  path: string;
+  description: string;
+}
+
+/**
+ * Owning packages a global install of the CLI can live under, in priority
+ * order — @mycadet/cli always wins over its meta wrapper.
+ */
+const OWNED_PACKAGE_NAMES: ReadonlyArray<string> = [
+  "@mycadet/cli",
+  "@mycadet/meta",
+];
+
+/**
+ * Find the package root the CLI is running from (…/node_modules/mycadet),
+ * or null when running from a source tree. A `.git` ANYWHERE up the tree
+ * (repo root or monorepo parent — a checkout's cli/ subpackage has no .git
+ * of its own) means this is source, never an install.
+ */
+function findInstalledPackageRoot(startDir: string): string | null {
+  // Pass 1: any .git ancestor = a checkout, never an install.
+  for (let dir = startDir; ; dir = dirname(dir)) {
+    if (existsSync(join(dir, ".git"))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) break; // Reached the filesystem root.
+  }
+  // Pass 2: walk up looking for the owned package root, priority order —
+  // the whole chain is checked for each name in turn, so @mycadet/cli wins
+  // over @mycadet/meta wherever both appear.
+  for (const owned of OWNED_PACKAGE_NAMES) {
+    for (let dir = startDir; ; dir = dirname(dir)) {
+      const pkgPath = join(dir, "package.json");
+      if (existsSync(pkgPath)) {
+        try {
+          const parsed: unknown = JSON.parse(readFileSync(pkgPath, "utf8"));
+          if (
+            typeof parsed === "object" &&
+            parsed !== null &&
+            "name" in parsed &&
+            parsed.name === owned
+          ) {
+            return dir;
+          }
+        } catch {
+          // Unreadable package.json — keep walking up.
+        }
+      }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+    }
+  }
+  return null;
+}
+
+/**
+ * Remove the running CLI. Handles the two real install shapes:
+ *   - the compiled `cadet` binary (process.execPath IS the install)
+ *   - a global package install (bun install -g mycadet / npm install -g)
+ * Under a source checkout or a bare runtime (bun/node), nothing is deleted —
+ * the runtime binary must never be a deletion target.
+ */
+function selfDelete(): void {
+  const execPath = process.execPath;
+  const execBase = basename(execPath);
+  if (execBase === "cadet" || execBase === "cadet.exe") {
+    try {
+      if (process.platform === "win32") {
+        // Windows refuses to unlink a running executable — stage it under a
+        // junk name and delete that.
+        const stale = `${execPath}.uninstalled`;
+        renameSync(execPath, stale);
+        rmSync(stale, { force: true, recursive: true });
+      } else {
+        unlinkSync(execPath);
+      }
+      console.log(`Removed ${execPath}.`);
+      return;
+    } catch (err) {
+      console.warn(
+        `⚠️  Could not remove ${execPath}: ${
+          err instanceof Error ? err.message : String(err)
+        } — remove it by hand.`,
+      );
+      return;
+    }
+  }
+
+  // Package-manager install: remove the package directory we are running
+  // from, best-effort. Bin symlinks the package manager planted (e.g.
+  // ~/.bun/bin/cadet, the npm global bin) are left dangling — say so.
+  const runningFile = fileURLToPath(import.meta.url);
+  const pkgRoot = findInstalledPackageRoot(dirname(runningFile));
+  if (!pkgRoot) {
+    console.log(
+      "Cadet is running from a source checkout — skipping self-removal.",
+    );
+    console.log(
+      "Remove the installed copy with `bun remove -g mycadet` (or `npm uninstall -g mycadet`).",
+    );
+    return;
+  }
+  try {
+    rmSync(pkgRoot, { recursive: true, force: true });
+    console.log(`Removed ${pkgRoot}.`);
+    console.log(
+      "The `cadet` command on your PATH is now stale — remove it if your package manager didn't (`bun remove -g mycadet` or `npm uninstall -g mycadet`).",
+    );
+  } catch (err) {
+    console.warn(
+      `⚠️  Could not remove ${pkgRoot}: ${
+        err instanceof Error ? err.message : String(err)
+      } — remove it with \`bun remove -g mycadet\` (or \`npm uninstall -g mycadet\`).`,
+    );
+  }
+}
+
+function collectDeleteTargets(env = getCurrentEnvironment()): DeleteTarget[] {
+  const targets: DeleteTarget[] = [
+    {
+      path: getStateDir(env),
+      description: "assistant state, retired archives, and the assistants it holds",
+    },
+    ...getConfigDirs(env).map((dir) => ({
+      path: dir,
+      description: "config and lockfile",
+    })),
+    { path: getLogDir(env), description: "logs" },
+    // Not environment-scoped: deleting it affects every cadet CLI on the
+    // machine — called out in the prompt, not hidden.
+    { path: getInputHistoryPath(), description: "shared terminal input history" },
+  ];
+  // Only targets that exist — the prompt lists what will actually go.
+  return targets.filter((t) => existsSync(t.path));
+}
+
+function rmrf(target: string): void {
+  rmSync(target, { recursive: true, force: true });
+}
+
+export const uninstall = Object.assign(
+  async function uninstall(): Promise<void> {
+    const args = process.argv.slice(3);
+    if (args.includes("--help") || args.includes("-h")) {
+      console.log("Usage: cadet uninstall [--yes]");
+      console.log("");
+      console.log(
+        "Remove Cadet entirely: delete every location it uses for this environment (assistant state, retired archives, config, logs) and then delete the executable itself.",
+      );
+      process.exit(0);
+    }
+    const yes = args.includes("--yes");
+
+    // Retire tears down an assistant AND archives its data. Uninstall assumes
+    // an empty rack: retiring first is the way to keep an archive.
+    if (loadAllAssistants().length > 0) {
+      console.error(
+        "Error: You still have assistants. Retire them first (`cadet retire <name>`) — retiring archives their data before removing it.",
+      );
+      process.exit(1);
+    }
+
+    const env = getCurrentEnvironment();
+    const envLabel = env.name ?? "production";
+    const targets = collectDeleteTargets(env);
+    const execPath = process.execPath;
+
+    console.log(
+      `This removes Cadet entirely for the '${envLabel}' environment and cannot be undone.`,
+    );
+    if (targets.length === 0) {
+      console.log("No Cadet data directories found to delete.");
+    } else {
+      console.log("It will permanently delete:");
+      for (const t of targets) {
+        console.log(`  - ${t.path}  (${t.description})`);
+      }
+    }
+    const execBase = basename(execPath);
+    const isCompiledBinary = execBase === "cadet" || execBase === "cadet.exe";
+    if (isCompiledBinary) {
+      console.log(`It will then remove the Cadet executable at ${execPath}.`);
+    }
+
+    if (!yes) {
+      if (!canPromptForConfirmation()) {
+        console.error(
+          "Error: Refusing to uninstall without confirmation in a non-interactive terminal.",
+        );
+        console.error("Re-run with --yes to confirm from automation.");
+        process.exit(1);
+      }
+      const confirmed = await confirmAction(
+        "Press Enter to uninstall Cadet, or Esc/q to cancel: ",
+      );
+      if (!confirmed) {
+        console.log("Uninstall cancelled.");
+        process.exit(1);
+      }
+    }
+
+    for (const t of targets) {
+      rmrf(t.path);
+      console.log(`Deleted ${t.path}.`);
+    }
+
+    selfDelete();
+  },
+  { description: "Remove Cadet entirely" },
+);

package/src/index.ts

@@ -39,6 +39,7 @@ import { debug } from "./commands/debug";
 import { teleport } from "./commands/teleport";
 import { terminal } from "./commands/terminal";
 import { tunnel } from "./commands/tunnel";
+import { uninstall } from "./commands/uninstall";
 import { unpair } from "./commands/unpair";
 import { upgrade } from "./commands/upgrade";
 import { use } from "./commands/use";
@@ -81,6 +82,7 @@ const commands = {
   teleport,
   terminal,
   tunnel,
+  uninstall,
   unpair,
   upgrade,
   use,