@mycadet/cli 0.12.6-dev.202610091338.ee7f3e3 → 0.12.7

package/src/lib/platform-client.ts

@@ -16,6 +16,15 @@ import { getLockfilePlatformBaseUrl } from "./assistant-config.js";
 import { getConfigDir, getConfigDirs } from "./environments/paths.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
+import { z } from "zod";
+
+const PlatformErrorDetailSchema = z.object({
+  detail: z.string().optional(),
+});
+
+const InProgressResponseSchema = z.object({
+  in_progress: z.boolean().optional(),
+});
 
 function getPlatformTokenPath(): string {
   return join(getConfigDir(getCurrentEnvironment()), "platform-token");
@@ -200,6 +209,95 @@ export interface HatchedAssistant {
   status: string;
 }
 
+const HatchedAssistantSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  status: z.string(),
+});
+
+const HatchedListResponseSchema = z.object({
+  results: z.array(HatchedAssistantSchema).optional(),
+});
+
+const EnsureRegistrationResponseSchema = z.object({
+  assistant: z.object({ id: z.string(), name: z.string() }),
+  registration: z.object({
+    client_installation_id: z.string(),
+    runtime_assistant_id: z.string(),
+    client_platform: z.string(),
+  }),
+  assistant_api_key: z.string().nullable(),
+  webhook_secret: z.string(),
+});
+
+const ReprovisionApiKeyResponseSchema = z.object({
+  provisioning: z.object({ assistant_api_key: z.string() }),
+});
+
+const SecretReadResponseSchema = z
+  .object({
+    found: z.boolean(),
+    value: z.string().optional(),
+    unreachable: z.boolean().optional(),
+  })
+  .catch({ found: false });
+
+const ReleaseChannelResponseSchema = z.object({
+  current_release_version: z.string().nullable().optional(),
+  release_channel: z.string().optional(),
+});
+
+const OrganizationListResponseSchema = z.object({
+  results: z.array(z.object({ id: z.string(), name: z.string() })).optional(),
+});
+
+const AllauthSessionResponseSchema = z.object({
+  status: z.number(),
+  data: z.object({
+    user: z.object({ id: z.string(), email: z.string(), display: z.string() }),
+  }),
+});
+
+const VersionCheckResponseSchema = z
+  .object({
+    detail: z.string().optional(),
+    version: z.string().nullable().optional(),
+  })
+  .catch({});
+
+const PassthroughBodySchema = z.record(z.string(), z.unknown()).catch({});
+
+const BundleUploadUrlSchema = z.object({
+  url: z.string(),
+  bundle_key: z.string(),
+  expires_at: z.string(),
+  max_content_length: z.number().optional(),
+});
+
+const BundleImportErrorSchema = z
+  .object({
+    detail: z.string().optional(),
+    reason: z.string().optional(),
+    bundle_compat: z
+      .object({
+        min_runtime_version: z.string(),
+        max_runtime_version: z.string().nullable(),
+      })
+      .optional()
+      .catch(undefined),
+    target_runtime_version: z.string().optional(),
+  })
+  .catch({});
+
+const RawUnifiedJobStatusSchema = z.object({
+  job_id: z.string(),
+  type: z.enum(["export", "import"]),
+  status: z.enum(["processing", "complete", "failed"]),
+  bundle_key: z.string().optional(),
+  result: z.unknown().optional(),
+  error: z.string().optional(),
+});
+
 export interface HatchAssistantResult {
   assistant: HatchedAssistant;
   /** true when the platform returned an existing assistant (HTTP 200) */
@@ -276,7 +374,7 @@ export async function ensureSelfHostedLocalRegistration(
     );
   }
 
-  return (await response.json()) as EnsureRegistrationResponse;
+  return EnsureRegistrationResponseSchema.parse(await response.json());
 }
 
 // ---------------------------------------------------------------------------
@@ -342,7 +440,7 @@ export async function reprovisionAssistantApiKey(
     );
   }
 
-  return (await response.json()) as ReprovisionApiKeyResponse;
+  return ReprovisionApiKeyResponseSchema.parse(await response.json());
 }
 
 // ---------------------------------------------------------------------------
@@ -442,11 +540,7 @@ export async function readGatewayCredential(
       return { value: null, unreachable: response.status >= 500 };
     }
 
-    const json = (await response.json()) as {
-      found: boolean;
-      value?: string;
-      unreachable?: boolean;
-    };
+    const json = SecretReadResponseSchema.parse(await response.json());
     // The daemon's /v1/secrets/read returns `unreachable: true` when the
     // credential backend (CES) can't be reached. Respect that signal.
     if (json.unreachable) {
@@ -553,14 +647,14 @@ export async function hatchAssistant(
   });
 
   if (response.ok) {
-    const assistant = (await response.json()) as HatchedAssistant;
+    const assistant = HatchedAssistantSchema.parse(await response.json());
     return { assistant, reusedExisting: response.status === 200 };
   }
 
   if (response.status === 401 || response.status === 403) {
-    const detail = (await response.json().catch(() => ({}))) as {
-      detail?: string;
-    };
+    const detail = PlatformErrorDetailSchema
+      .catch({})
+      .parse(await response.json().catch(() => ({})));
     throw new Error(
       detail.detail ??
         "Invalid or expired token. Run `cadet login` to re-authenticate.",
@@ -571,9 +665,9 @@ export async function hatchAssistant(
     throw new Error("Insufficient balance to hatch a new assistant.");
   }
 
-  const errorBody = (await response.json().catch(() => ({}))) as {
-    detail?: string;
-  };
+  const errorBody = PlatformErrorDetailSchema
+    .catch({})
+    .parse(await response.json().catch(() => ({})));
   throw new Error(
     errorBody.detail ??
       `Platform API error: ${response.status} ${response.statusText}`,
@@ -614,11 +708,9 @@ export async function checkExistingPlatformAssistant(
       return null;
     }
 
-    const body = (await response.json()) as {
-      results?: HatchedAssistant[];
-    };
-    const active = body.results?.find((a) => a.status === "active");
-    return active ?? null;
+    const parsed = HatchedListResponseSchema.safeParse(await response.json());
+    const results = parsed.success ? parsed.data.results : undefined;
+    return results?.find((a) => a.status === "active") ?? null;
   } finally {
     clearTimeout(timeoutId);
   }
@@ -649,11 +741,10 @@ export async function fetchPlatformAssistants(
 
     if (!response.ok) return [];
 
-    const body = (await response.json()) as {
-      results?: HatchedAssistant[];
-    };
+    const parsed = HatchedListResponseSchema.safeParse(await response.json());
+    const results = parsed.success ? (parsed.data.results ?? []) : [];
 
-    return (body.results ?? []).filter((a) => a.status === "active");
+    return results.filter((a) => a.status === "active");
   } finally {
     clearTimeout(timeoutId);
   }
@@ -685,10 +776,10 @@ export async function fetchAssistantDetail(
 
     if (!response.ok) return null;
 
-    const body = (await response.json()) as {
-      current_release_version?: string | null;
-      release_channel?: string;
-    };
+    const parsed = ReleaseChannelResponseSchema.safeParse(
+      await response.json(),
+    );
+    const body = parsed.success ? parsed.data : {};
     return {
       currentReleaseVersion: body.current_release_version ?? null,
       releaseChannel: body.release_channel === "preview" ? "preview" : "stable",
@@ -720,8 +811,10 @@ export async function fetchUpgradeInProgress(
 
     if (!response.ok) return null;
 
-    const body = (await response.json()) as { in_progress?: boolean };
-    return typeof body.in_progress === "boolean" ? body.in_progress : null;
+    const parsed = InProgressResponseSchema.safeParse(await response.json());
+    return parsed.success && parsed.data.in_progress !== undefined
+      ? parsed.data.in_progress
+      : null;
   } catch {
     return null;
   }
@@ -733,10 +826,6 @@ export interface PlatformUser {
   display: string;
 }
 
-interface OrganizationListResponse {
-  results: { id: string; name: string }[];
-}
-
 export async function fetchOrganizationId(
   token: string,
   platformUrl?: string,
@@ -762,8 +851,10 @@ export async function fetchOrganizationId(
       );
     }
 
-    const body = (await response.json()) as OrganizationListResponse;
-    const orgId = body.results?.[0]?.id;
+    const parsed = OrganizationListResponseSchema.safeParse(
+      await response.json(),
+    );
+    const orgId = parsed.success ? parsed.data.results?.[0]?.id : undefined;
     if (!orgId) {
       throw new Error("No organization found for this account.");
     }
@@ -773,17 +864,6 @@ export async function fetchOrganizationId(
   }
 }
 
-interface AllauthSessionResponse {
-  status: number;
-  data: {
-    user: {
-      id: string;
-      email: string;
-      display: string;
-    };
-  };
-}
-
 export async function fetchCurrentUser(
   token: string,
   platformUrl?: string,
@@ -816,7 +896,7 @@ export async function fetchCurrentUser(
       );
     }
 
-    const body = (await response.json()) as AllauthSessionResponse;
+    const body = AllauthSessionResponseSchema.parse(await response.json());
     return body.data.user;
   } finally {
     clearTimeout(timeoutId);
@@ -843,10 +923,9 @@ export async function rollbackPlatformAssistant(
     },
   );
 
-  const body = (await response.json().catch(() => ({}))) as {
-    detail?: string;
-    version?: string | null;
-  };
+  const body = VersionCheckResponseSchema.parse(
+    await response.json().catch(() => ({})),
+  );
 
   if (response.status === 200) {
     return { detail: body.detail ?? "", version: body.version ?? null };
@@ -907,10 +986,9 @@ export async function platformImportPreflightFromGcs(
     },
   );
 
-  const body = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
+  const body = PassthroughBodySchema.parse(
+    await response.json().catch(() => ({})),
+  );
   return { statusCode: response.status, body };
 }
 
@@ -934,10 +1012,9 @@ export async function platformImportBundleFromGcs(
     throw new Error("Bundle too large to import");
   }
 
-  const body = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
+  const body = PassthroughBodySchema.parse(
+    await response.json().catch(() => ({})),
+  );
   return { statusCode: response.status, body };
 }
 
@@ -1128,12 +1205,7 @@ export async function platformRequestSignedUrl(
   }
 
   if (response.status === 201 || response.status === 200) {
-    const json = (await response.json()) as {
-      url: string;
-      bundle_key: string;
-      expires_at: string;
-      max_content_length?: number;
-    };
+    const json = BundleUploadUrlSchema.parse(await response.json());
     return {
       url: json.url,
       bundleKey: json.bundle_key,
@@ -1145,12 +1217,9 @@ export async function platformRequestSignedUrl(
   // Non-success body. Read once and reuse for both the 422 version-mismatch
   // branch and the generic-error fallthrough — `response.json()` consumes
   // the body, so a second read would always return undefined.
-  const errorBody = (await response.json().catch(() => ({}))) as {
-    detail?: string;
-    reason?: string;
-    bundle_compat?: BundleCompatibility;
-    target_runtime_version?: string;
-  };
+  const errorBody = BundleImportErrorSchema.parse(
+    await response.json().catch(() => ({})),
+  );
 
   if (
     response.status === 422 &&
@@ -1197,6 +1266,6 @@ export async function platformPollJobStatus(
     );
   }
 
-  const raw = (await response.json()) as RawUnifiedJobStatus;
+  const raw = RawUnifiedJobStatusSchema.parse(await response.json());
   return parseUnifiedJobStatus(raw);
 }

package/src/lib/retire-archive.ts

@@ -1,7 +1,9 @@
 import { mkdirSync } from "fs";
-import { homedir } from "os";
 import { join, posix, win32 } from "path";
 
+import { getStateDir } from "./environments/paths.js";
+import { getCurrentEnvironment } from "./environments/resolve.js";
+
 function isPathInside(
   parent: string,
   candidate: string,
@@ -17,9 +19,7 @@ function isPathInside(
 }
 
 export function getRetiredDir(): string {
-  const xdgData =
-    process.env.XDG_DATA_HOME?.trim() || join(homedir(), ".local", "share");
-  const dir = join(xdgData, "cadet", "retired");
+  const dir = join(getStateDir(getCurrentEnvironment()), "retired");
   mkdirSync(dir, { recursive: true });
   return dir;
 }

package/src/lib/retire-local.ts

@@ -128,34 +128,11 @@ export async function retireLocal(
 
   // Stop gateway via PID file — use a longer timeout because the gateway has a
   // drain window (5s) before it exits.
-  const gatewayPidFile = join(cadetDir, "gateway.pid");
-  await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
+  await stopProcessByPidFile(join(cadetDir, "gateway.pid"), "gateway", undefined, 7000);
 
   // Stop the CES sibling — it is stopped by its PID file, a no-op when the
   // PID file is absent (e.g. the sibling was never started or already exited).
-  const cesPidFile = join(cadetDir, "ces.pid");
-  const cesStopped = await stopProcessByPidFile(
-    cesPidFile,
-    "credential-executor",
-  );
-  if (cesStopped) {
-    reporter.log("credential-executor stopped.");
-  }
-
-  // Stop Qdrant. The daemon's graceful shutdown tries to stop it via
-  // qdrantManager.stop(), but a daemon that never completes that shutdown
-  // (crash, OOM kill, or the SIGKILL ceiling above) leaves Qdrant running as
-  // an orphan. Check both the current PID file location and the legacy one.
-  const qdrantPidFile = join(
-    cadetDir,
-    "workspace",
-    "data",
-    "qdrant",
-    "qdrant.pid",
-  );
-  const qdrantLegacyPidFile = join(cadetDir, "qdrant.pid");
-  await stopProcessByPidFile(qdrantPidFile, "qdrant", undefined, 5000);
-  await stopProcessByPidFile(qdrantLegacyPidFile, "qdrant", undefined, 5000);
+  await stopProcessByPidFile(join(cadetDir, "ces.pid"), "credential-executor");
 
   // Stop the nginx ingress if one is fronting this gateway — it would
   // otherwise be orphaned when the instance directory is archived.

package/src/lib/teleport-backup.ts

@@ -23,8 +23,23 @@ import {
 
 import type { AssistantEntry } from "./assistant-config.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { isJsonObject } from "./json";
 import { authHeaders, invalidateOrgIdCache } from "./platform-client.js";
+import { z } from "zod";
+
+const ManagedBackupEntrySchema = z.object({
+  snapshot_name: z.string().optional(),
+  created_at: z.string().optional(),
+  ready_to_use: z.boolean().optional(),
+});
+
+const ManagedBackupsResponseSchema = z.object({
+  backups: z.array(ManagedBackupEntrySchema).optional(),
+});
+
+const CreatedBackupResponseSchema = z.object({
+  snapshot_name: z.string().optional(),
+  ready_to_use: z.boolean().optional(),
+});
 
 type PlatformEntry = Pick<AssistantEntry, "runtimeUrl" | "assistantId">;
 
@@ -73,8 +88,8 @@ async function fetchPlatformBackups(
       `Cadet Cloud backup list failed ${await errorSuffix(response)}`,
     );
   }
-  const body = (await response.json()) as { backups?: ManagedBackupEntry[] };
-  return body.backups ?? [];
+  const parsed = ManagedBackupsResponseSchema.safeParse(await response.json());
+  return parsed.success ? (parsed.data.backups ?? []) : [];
 }
 
 /**
@@ -115,20 +130,14 @@ export async function createPlatformBackup(
     );
   }
   const body: unknown = await response.json().catch(() => null);
-  const created = isJsonObject(body)
-    ? {
-        snapshot_name:
-          typeof body.snapshot_name === "string" ? body.snapshot_name : undefined,
-        ready_to_use: body.ready_to_use === true ? true : undefined,
-      }
-    : null;
-  const snapshotName = created?.snapshot_name;
-  if (!snapshotName) {
+  const created = CreatedBackupResponseSchema.safeParse(body);
+  if (!created.success || !created.data.snapshot_name) {
     throw new Error("Cadet Cloud backup create returned no snapshot name");
   }
-  if (created?.ready_to_use === true) {
+  if (created.data.ready_to_use === true) {
     return;
   }
+  const snapshotName = created.data.snapshot_name;
 
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {

package/src/lib/terminal-client.ts

@@ -6,9 +6,19 @@
  * the web UI's xterm.js terminal uses.
  */
 
-import { authHeaders, getPlatformUrl } from "./platform-client.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { isJsonObject } from "./json";
+import { authHeaders, getPlatformUrl } from "./platform-client.js";
+import { z } from "zod";
+
+const TerminalSessionResponseSchema = z.object({ session_id: z.string() });
+
+const TerminalOutputEventSchema = z.object({
+  seq: z.number(),
+  /** Base64-encoded PTY output bytes. */
+  data: z.string(),
+});
+
+export type TerminalOutputEvent = z.infer<typeof TerminalOutputEventSchema>;
 
 // ---------------------------------------------------------------------------
 // Create / Close
@@ -41,11 +51,11 @@ export async function createTerminalSession(
       `Failed to create terminal session (${response.status}): ${detail || response.statusText}`,
     );
   }
-  const payloadBody: unknown = await response.json();
-  if (!isJsonObject(payloadBody) || typeof payloadBody.session_id !== "string") {
+  const parsed = TerminalSessionResponseSchema.safeParse(await response.json());
+  if (!parsed.success) {
     throw new Error("Terminal session response did not include a session_id.");
   }
-  return { session_id: payloadBody.session_id };
+  return parsed.data;
 }
 
 export async function closeTerminalSession(
@@ -125,12 +135,6 @@ export async function resizeTerminalSession(
 // SSE event stream
 // ---------------------------------------------------------------------------
 
-export interface TerminalOutputEvent {
-  seq: number;
-  /** Base64-encoded PTY output bytes. */
-  data: string;
-}
-
 /**
  * Subscribe to the terminal output SSE stream. Yields parsed events as they
  * arrive. The generator completes when the stream ends or is aborted.
@@ -175,7 +179,10 @@ export async function* subscribeTerminalEvents(
         const trimmed = line.trimEnd();
         if (trimmed.startsWith("data: ")) {
           try {
-            yield JSON.parse(trimmed.slice(6)) as TerminalOutputEvent;
+            const frame = TerminalOutputEventSchema.safeParse(
+              JSON.parse(trimmed.slice(6)),
+            );
+            if (frame.success) yield frame.data;
           } catch {
             // Skip malformed SSE frames
           }

package/src/lib/tunnel-edge.ts

@@ -14,7 +14,7 @@ import {
   loadRawConfig,
   parseGatewayPortFromEntryUrls,
 } from "./ingress-config.js";
-import { isJsonObject } from "./json";
+import { IngressConfigSchema } from "./ngrok.js";
 import {
   ensureTunnelEdge,
   formatEdgeMode,
@@ -34,12 +34,11 @@ export const DOCKER_GATEWAY_READY_TIMEOUT_MS = 5 * 60_000;
  * enabled with a saved public URL.
  */
 function wantsWebIngress(config: Record<string, unknown>): boolean {
-  const ingress = config.ingress;
+  const parsed = IngressConfigSchema.safeParse(config.ingress);
   return (
-    isJsonObject(ingress) &&
-    ingress.enabled === true &&
-    typeof ingress.publicBaseUrl === "string" &&
-    ingress.publicBaseUrl.trim() !== ""
+    parsed.success &&
+    parsed.data.enabled === true &&
+    (parsed.data.publicBaseUrl?.trim() ?? "") !== ""
   );
 }
 
@@ -189,17 +188,16 @@ function ownsSharedIngress(
   ) {
     return false;
   }
-  let publicBaseUrl: unknown;
+  let publicBaseUrl: string | undefined;
   try {
-    publicBaseUrl = (
-      loadRawConfig(workspaceDir).ingress as
-        | { publicBaseUrl?: unknown }
-        | undefined
-    )?.publicBaseUrl;
+    const parsed = IngressConfigSchema.safeParse(
+      loadRawConfig(workspaceDir).ingress,
+    );
+    publicBaseUrl = parsed.success ? parsed.data.publicBaseUrl : undefined;
   } catch {
     return true;
   }
-  if (typeof publicBaseUrl !== "string" || !publicBaseUrl.trim()) {
+  if (!publicBaseUrl || !publicBaseUrl.trim()) {
     return true;
   }
   if (entry.ingressUrl === publicBaseUrl) {

package/src/lib/upgrade-lifecycle.ts

@@ -25,6 +25,16 @@ import { getCurrentEnvironment } from "./environments/resolve.js";
 import { loadGuardianToken } from "./guardian-token.js";
 import { classifyReadyzResponse } from "./http-client.js";
 import { fetchReleases, resolveImageRefs } from "./platform-releases.js";
+import { z } from "zod";
+
+const GatewayHealthSchema = z.object({
+  version: z.string().optional(),
+});
+
+const MigrationGateBodySchema = z.object({
+  status: z.string().optional(),
+  reason: z.string().optional(),
+});
 import {
   getBuilderManagedEnvKeys,
   type DockerStatefulSetSpec,
@@ -289,8 +299,8 @@ export async function fetchCurrentVersion(
       signal: AbortSignal.timeout(5000),
     });
     if (resp.ok) {
-      const body = (await resp.json()) as { version?: string };
-      return body.version;
+      const parsed = GatewayHealthSchema.safeParse(await resp.json());
+      return parsed.success ? parsed.data.version : undefined;
     }
   } catch {
     // Best-effort
@@ -532,9 +542,11 @@ export async function rollbackMigrations(
         // The daemon's running-migrations 503 also says "starting" but
         // carries a `reason` field — don't retry against that one (the
         // rollback stays blocked until migrations leave the running state).
-        const parsed = JSON.parse(text) as { status?: string; reason?: string };
+        const parsed = MigrationGateBodySchema.safeParse(JSON.parse(text));
         gatewayStarting =
-          parsed.status === "starting" && parsed.reason === undefined;
+          parsed.success &&
+          parsed.data.status === "starting" &&
+          parsed.data.reason === undefined;
       } catch {
         // Non-JSON error body — not the starting gate.
       }