@mycadet/cli 0.12.7 → 0.12.8

package/src/__tests__/uninstall.test.ts

@@ -82,11 +82,12 @@ describe("cadet uninstall", () => {
     warnSpy.mockRestore();
   });
 
-  test("refuses while assistants remain — retire them first", async () => {
+  test("warns and retires remaining assistants, then proceeds to the confirm gate", async () => {
     await withRestoredEnv(async () => {
       const root = redirectXdg();
-      // A remaining assistant in the lockfile means there is data that
-      // should be retired (and archived) first.
+      // A remaining assistant is retired — with its data deleted — as part
+      // of the uninstall (v0.0.10 run feedback: the old hard refusal just
+      // blocked the uninstall; the fs sweep deletes the archives anyway).
       writeFileSync(
         join(process.env.CADET_LOCKFILE_DIR!, "lockfile.json"),
         JSON.stringify({ assistants: [makeEntry("test-assistant")] }) + "\n",
@@ -97,8 +98,16 @@ describe("cadet uninstall", () => {
         throw new Error(`process.exit:${code}`);
       });
       try {
+        // Non-interactive without --yes, the CONFIRM gate is what refuses —
+        // not an assistant guard.
         await expect(uninstall()).rejects.toThrow("process.exit:1");
-        expect(errorSpy).toHaveBeenCalledWith(
+        expect(warnSpy).toHaveBeenCalledWith(
+          expect.stringContaining("1 assistant(s) still exist"),
+        );
+        expect(warnSpy).toHaveBeenCalledWith(
+          expect.stringContaining("will be retired now"),
+        );
+        expect(errorSpy).not.toHaveBeenCalledWith(
           expect.stringContaining("Retire them first"),
         );
       } finally {

package/src/__tests__/upgrade-local.test.ts

@@ -20,7 +20,7 @@ import type { GuardianTokenData } from "../lib/guardian-token.js";
 import * as guardianToken from "../lib/guardian-token.js";
 import * as local from "../lib/local.js";
 import * as loopbackFetch from "../lib/loopback-fetch.js";
-import * as ngrok from "../lib/ngrok.js";
+import * as ngrok from "../lib/tunnels/ngrok.js";
 import * as upgradeLifecycle from "../lib/upgrade-lifecycle.js";
 
 const realAssistantConfig = { ...assistantConfig };
@@ -157,7 +157,7 @@ const maybeStartNgrokTunnelMock = mock<typeof ngrok.maybeStartNgrokTunnel>(
   async () => null,
 );
 
-mock.module("../lib/ngrok.js", () => ({
+mock.module("../lib/tunnels/ngrok.js", () => ({
   ...realNgrok,
   maybeStartNgrokTunnel: maybeStartNgrokTunnelMock,
 }));
@@ -302,7 +302,7 @@ afterAll(() => {
   mock.module("../lib/guardian-token.js", () => realGuardianToken);
   mock.module("../lib/local.js", () => realLocal);
   mock.module("../lib/loopback-fetch.js", () => realLoopbackFetch);
-  mock.module("../lib/ngrok.js", () => realNgrok);
+  mock.module("../lib/tunnels/ngrok.js", () => realNgrok);
   mock.module("../lib/upgrade-lifecycle.js", () => realUpgradeLifecycle);
 });
 

package/src/__tests__/upgrade-replay-env.test.ts

@@ -6,7 +6,7 @@ import { buildReplayEnv, buildReplayState } from "../lib/upgrade-lifecycle.js";
 import { snapshotEnv } from "./helpers/env.js";
 
 const restoreEnv = snapshotEnv([
-  "CADET_PLATFORM_URL",
+  "CADET_CLOUD_URL",
   "ANTHROPIC_API_KEY",
   "CADET_DEVICE_ID",
 ]);
@@ -24,33 +24,33 @@ describe("buildReplayEnv", () => {
       ACTOR_TOKEN_SIGNING_KEY: "s3",
       PATH: "/usr/bin",
       GATEWAY_PORT: "18080",
-      CADET_DISABLE_PLATFORM: "1",
+      CADET_DISABLE_CLOUD: "1",
       CADET_DEVICE_ID: "abc",
     };
 
     expect(buildReplayEnv(captured, "gateway")).toEqual({
-      CADET_DISABLE_PLATFORM: "1",
+      CADET_DISABLE_CLOUD: "1",
       CADET_DEVICE_ID: "abc",
     });
   });
 
-  test("gateway: captured CADET_PLATFORM_URL dropped when set on host", () => {
-    process.env.CADET_PLATFORM_URL = "https://host.example.com";
+  test("gateway: captured CADET_CLOUD_URL dropped when set on host", () => {
+    process.env.CADET_CLOUD_URL = "https://host.example.com";
     const replay = buildReplayEnv(
-      { CADET_PLATFORM_URL: "https://stale.example.com" },
+      { CADET_CLOUD_URL: "https://stale.example.com" },
       "gateway",
     );
     expect(replay).toEqual({});
   });
 
-  test("gateway: captured CADET_PLATFORM_URL kept when unset on host", () => {
-    delete process.env.CADET_PLATFORM_URL;
+  test("gateway: captured CADET_CLOUD_URL kept when unset on host", () => {
+    delete process.env.CADET_CLOUD_URL;
     const replay = buildReplayEnv(
-      { CADET_PLATFORM_URL: "https://stale.example.com" },
+      { CADET_CLOUD_URL: "https://stale.example.com" },
       "gateway",
     );
     expect(replay).toEqual({
-      CADET_PLATFORM_URL: "https://stale.example.com",
+      CADET_CLOUD_URL: "https://stale.example.com",
     });
   });
 
@@ -118,9 +118,9 @@ describe("buildReplayState", () => {
   });
 
   test("backfills CADET_DEVICE_ID on gateway replay env when absent", () => {
-    const state = buildReplayState({}, { CADET_DISABLE_PLATFORM: "1" });
+    const state = buildReplayState({}, { CADET_DISABLE_CLOUD: "1" });
     expect(state.extraGatewayEnv).toEqual({
-      CADET_DISABLE_PLATFORM: "1",
+      CADET_DISABLE_CLOUD: "1",
       CADET_DEVICE_ID: "host-device-id",
     });
   });

package/src/__tests__/wake.test.ts

@@ -20,10 +20,11 @@ import * as httpClient from "../lib/http-client.js";
 import * as ingressConfig from "../lib/ingress-config.js";
 import * as local from "../lib/local.js";
 import * as nginxIngress from "../lib/nginx-ingress.js";
-import * as ngrok from "../lib/ngrok.js";
+import * as ngrok from "../lib/tunnels/ngrok.js";
 import * as processLib from "../lib/process.js";
 import * as portAllocator from "../lib/port-allocator.js";
 import type { AssistantEntry } from "../lib/assistant-config.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 const realAssistantConfig = { ...assistantConfig };
 const realDocker = { ...docker };
@@ -61,11 +62,15 @@ const dockerResourceNamesMock = mock<typeof docker.dockerResourceNames>(
   realDocker.dockerResourceNames,
 );
 const wakeContainersMock = mock<typeof docker.wakeContainers>(async () => {});
+const recreateDockerContainersMock = mock<typeof docker.recreateDockerContainers>(
+  async () => {},
+);
 
 mock.module("../lib/docker.js", () => ({
   ...realDocker,
   dockerResourceNames: dockerResourceNamesMock,
   wakeContainers: wakeContainersMock,
+  recreateDockerContainers: recreateDockerContainersMock,
 }));
 
 const seedGuardianTokenFromSiblingEnvMock = mock<
@@ -73,18 +78,14 @@ const seedGuardianTokenFromSiblingEnvMock = mock<
 >(() => false);
 // Default: a token exists, so the re-provision recovery path is skipped. Tests
 // that exercise recovery override loadGuardianToken to return null.
-const loadGuardianTokenMock = mock<typeof guardianToken.loadGuardianToken>(
-  () =>
-    ({ accessToken: "existing" }) as ReturnType<
-      typeof guardianToken.loadGuardianToken
-    >,
+const loadGuardianTokenMock = mock<typeof guardianToken.loadGuardianToken>(() =>
+  makeGuardianTokenData({ accessToken: "existing" }),
 );
 const resetGuardianBootstrapMock = mock<
   typeof guardianToken.resetGuardianBootstrap
 >(async () => {});
 const leaseGuardianTokenMock = mock<typeof guardianToken.leaseGuardianToken>(
-  async () =>
-    ({}) as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>,
+  async () => makeGuardianTokenData(),
 );
 
 mock.module("../lib/guardian-token.js", () => ({
@@ -156,7 +157,7 @@ const maybeStartNgrokTunnelMock = mock<typeof ngrok.maybeStartNgrokTunnel>(
   async () => null,
 );
 
-mock.module("../lib/ngrok", () => ({
+mock.module("../lib/tunnels/ngrok", () => ({
   ...realNgrok,
   maybeStartNgrokTunnel: maybeStartNgrokTunnelMock,
 }));
@@ -288,15 +289,13 @@ beforeEach(() => {
   seedGuardianTokenFromSiblingEnvMock.mockReset();
   seedGuardianTokenFromSiblingEnvMock.mockReturnValue(false);
   loadGuardianTokenMock.mockReset();
-  loadGuardianTokenMock.mockReturnValue({
-    accessToken: "existing",
-  } as ReturnType<typeof guardianToken.loadGuardianToken>);
+  loadGuardianTokenMock.mockReturnValue(
+    makeGuardianTokenData({ accessToken: "existing" }),
+  );
   resetGuardianBootstrapMock.mockReset();
   resetGuardianBootstrapMock.mockResolvedValue(undefined);
   leaseGuardianTokenMock.mockReset();
-  leaseGuardianTokenMock.mockResolvedValue(
-    {} as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>,
-  );
+  leaseGuardianTokenMock.mockResolvedValue(makeGuardianTokenData());
   maybeStartNgrokTunnelMock.mockReset();
   maybeStartNgrokTunnelMock.mockResolvedValue(null);
   loadRawConfigMock.mockReset();
@@ -330,7 +329,7 @@ afterAll(() => {
   mock.module("../lib/process", () => realProcessLib);
   mock.module("../lib/port-allocator.js", () => realPortAllocator);
   mock.module("../lib/local", () => realLocal);
-  mock.module("../lib/ngrok", () => realNgrok);
+  mock.module("../lib/tunnels/ngrok", () => realNgrok);
   mock.module("../lib/ingress-config.js", () => realIngressConfig);
   mock.module("../lib/nginx-ingress.js", () => realNginxIngress);
   mock.module("../lib/http-client.js", () => realHttpClient);
@@ -819,11 +818,11 @@ describe("cadet wake: daemon startup failure", () => {
     // AND a foreign listener on the runtime HTTP port answers readiness in
     // the dead daemon's place
     probeDaemonReadinessWithRetryMock.mockResolvedValue("ready");
-    const exitSpy = spyOn(process, "exit").mockImplementation(((
-      code?: number,
-    ) => {
-      throw new Error(`process.exit:${code}`);
-    }) as never);
+    const exitSpy = spyOn(process, "exit").mockImplementation(
+      (code?: number | string | undefined): never => {
+        throw new Error(`process.exit:${code}`);
+      },
+    );
 
     // WHEN wake runs
     const result = wake();
@@ -945,7 +944,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
@@ -957,9 +956,13 @@ describe("cadet wake — tunnel edge restore", () => {
         workspaceDir: defaultWorkspace,
         gatewayPort: 7930,
       });
-      // Container wakes never tracked a spawned ngrok PID, so the auto-tunnel
-      // stays out of this path.
-      expect(maybeStartNgrokTunnelMock).not.toHaveBeenCalled();
+      // Container wakes run the same auto-tunnel as local wakes (docker
+      // parity); the spawned agent records itself in the root lockfile.
+      expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+        7840,
+        defaultWorkspace,
+        "docker-1",
+      );
       expect(logSpy).toHaveBeenCalledWith("Wake complete.");
     } finally {
       if (originalWorkspaceDir === undefined) {
@@ -971,6 +974,48 @@ describe("cadet wake — tunnel edge restore", () => {
     }
   });
 
+  test("a migrated docker assistant (containers never created) is recreated from the entry", async () => {
+    const defaultWorkspace = mkdtempSync(join(tmpdir(), "cadet-wake-default-"));
+    const originalWorkspaceDir = process.env.CADET_WORKSPACE_DIR;
+    process.env.CADET_WORKSPACE_DIR = defaultWorkspace;
+    const migratedEntry = {
+      assistantId: "docker-1",
+      runtimeUrl: "http://localhost:7930",
+      cloud: "docker" as const,
+      containerInfo: {
+        assistantImage: "mycadet/mycadet-assistant:v0.12.7",
+        gatewayImage: "mycadet/mycadet-gateway:v0.12.7",
+        cesImage: "mycadet/mycadet-credential-executor:v0.12.7",
+      },
+    };
+    resolveTargetAssistantMock.mockReturnValue(migratedEntry);
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    // The v0.0.10 run feedback: the containers were never created —
+    // `docker start` answers "No such container".
+    wakeContainersMock.mockImplementation(async () => {
+      throw new Error(
+        "Error response from daemon: No such container: docker-1-assistant",
+      );
+    });
+    process.argv = ["bun", "cadet", "wake", "docker-1"];
+
+    try {
+      await wake();
+
+      expect(recreateDockerContainersMock).toHaveBeenCalledWith(migratedEntry);
+      expect(logSpy).toHaveBeenCalledWith("Docker containers started.");
+      expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+    } finally {
+      wakeContainersMock.mockImplementation(async () => {});
+      if (originalWorkspaceDir === undefined) {
+        delete process.env.CADET_WORKSPACE_DIR;
+      } else {
+        process.env.CADET_WORKSPACE_DIR = originalWorkspaceDir;
+      }
+      rmSync(defaultWorkspace, { recursive: true, force: true });
+    }
+  });
+
   test("a docker wake leaves an edge fronting another container alone", async () => {
     const defaultWorkspace = mkdtempSync(join(tmpdir(), "cadet-wake-default-"));
     const originalWorkspaceDir = process.env.CADET_WORKSPACE_DIR;
@@ -980,7 +1025,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(true);
     readIngressStateMock.mockReturnValue({
@@ -1014,7 +1059,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(true);
     readIngressStateMock.mockReturnValue({
@@ -1052,7 +1097,7 @@ describe("cadet wake — tunnel edge restore", () => {
     }
   });
 
-  test("a failed docker edge restore does not claim webhooks still work", async () => {
+  test("a failed docker edge restore falls back to the gateway tunnel", async () => {
     const defaultWorkspace = mkdtempSync(join(tmpdir(), "cadet-wake-default-"));
     const originalWorkspaceDir = process.env.CADET_WORKSPACE_DIR;
     process.env.CADET_WORKSPACE_DIR = defaultWorkspace;
@@ -1061,7 +1106,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     ensureTunnelEdgeMock.mockRejectedValue(
       new Error("nginx is not installed."),
@@ -1071,11 +1116,14 @@ describe("cadet wake — tunnel edge restore", () => {
     try {
       await wake();
 
+      // Docker wakes get the same tunnel logic as local ones: when the edge
+      // cannot be rebuilt, the auto-tunnel still fronts the gateway port so
+      // webhook delivery survives.
       expect(warnSpy).toHaveBeenCalledWith(
-        expect.stringContaining("webhook delivery are unavailable"),
+        expect.stringContaining("Webhooks still work"),
       );
       expect(warnSpy).not.toHaveBeenCalledWith(
-        expect.stringContaining("Webhooks still work"),
+        expect.stringContaining("webhook delivery are unavailable"),
       );
     } finally {
       if (originalWorkspaceDir === undefined) {
@@ -1098,14 +1146,14 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://other.example.com",
-    } as AssistantEntry);
+    });
     loadAllAssistantsMock.mockReturnValue([
       {
         assistantId: "docker-2",
         runtimeUrl: "http://localhost:8030",
         cloud: "docker",
         ingressUrl: "https://assistant.example.com",
-      } as AssistantEntry,
+      },
     ]);
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(false);
@@ -1135,7 +1183,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
@@ -1163,7 +1211,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     waitForDaemonReadyMock.mockImplementation(async () => false);
     process.argv = ["bun", "cadet", "wake", "docker-1"];
@@ -1194,7 +1242,7 @@ describe("cadet wake — tunnel edge restore", () => {
       assistantId: "docker-1",
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
-    } as AssistantEntry);
+    });
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
     try {
@@ -1222,13 +1270,13 @@ describe("cadet wake — tunnel edge restore", () => {
       assistantId: "docker-1",
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
-    } as AssistantEntry);
+    });
     loadAllAssistantsMock.mockReturnValue([
       {
         assistantId: "docker-1",
         runtimeUrl: "http://localhost:7930",
         cloud: "docker",
-      } as AssistantEntry,
+      },
     ]);
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(false);
@@ -1260,14 +1308,14 @@ describe("cadet wake — tunnel edge restore", () => {
       assistantId: "docker-1",
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
-    } as AssistantEntry);
+    });
     loadAllAssistantsAcrossEnvsMock.mockReturnValue([
       {
         assistantId: "docker-2",
         runtimeUrl: "http://localhost:8030",
         cloud: "docker",
         ingressUrl: "https://assistant.example.com",
-      } as AssistantEntry,
+      },
     ]);
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(false);
@@ -1296,7 +1344,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
     try {
@@ -1541,4 +1589,173 @@ describe("cadet wake — tunnel edge restore", () => {
       "local-assistant",
     );
   });
+
+  describe("--all", () => {
+    function makeAllEntry(
+      assistantId: string,
+      instanceDir: string,
+    ): AssistantEntry {
+      return {
+        assistantId,
+        runtimeUrl: "http://127.0.0.1:7830",
+        cloud: "local",
+        resources: {
+          instanceDir,
+          daemonPort: 7821,
+          gatewayPort: 7830,
+          qdrantPort: 6333,
+          cesPort: 7822,
+          signingKey: "ab".repeat(32),
+        },
+      };
+    }
+
+    function makeAllEntries(): AssistantEntry[] {
+      mkdirSync(join(tempDir, "instance-1"), { recursive: true });
+      mkdirSync(join(tempDir, "instance-2"), { recursive: true });
+      return [
+        makeAllEntry("wake-all-1", join(tempDir, "instance-1")),
+        makeAllEntry("wake-all-2", join(tempDir, "instance-2")),
+      ];
+    }
+
+    // Cold-start both assistants so each wake's starts are observable.
+    function mockColdStart(): void {
+      resolveProcessStateMock.mockImplementation(async () => ({
+        status: "needs_start",
+        pid: null,
+      }));
+      isProcessAliveMock.mockReturnValue({ alive: true, pid: 123 });
+    }
+
+    test("starts every assistant in the lockfile", async () => {
+      mockColdStart();
+      loadAllAssistantsMock.mockReturnValue(makeAllEntries());
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      await wake();
+
+      expect(startCesMock).toHaveBeenCalledTimes(2);
+      expect(startLocalDaemonMock).toHaveBeenCalledTimes(2);
+      expect(startGatewayMock).toHaveBeenCalledTimes(2);
+    });
+
+    test("skips assistants whose lifecycle is managed elsewhere", async () => {
+      mockColdStart();
+      const entries = makeAllEntries();
+      entries[1] = {
+        assistantId: "paired-one",
+        runtimeUrl: "http://127.0.0.1:1",
+        cloud: "paired",
+      };
+      loadAllAssistantsMock.mockReturnValue(entries);
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      await wake();
+
+      expect(startCesMock).toHaveBeenCalledTimes(1);
+      expect(startLocalDaemonMock).toHaveBeenCalledTimes(1);
+      expect(startGatewayMock).toHaveBeenCalledTimes(1);
+      expect(logSpy.mock.calls.flat().join("\n")).toContain(
+        "Skipping 'paired-one' (paired) — its lifecycle is managed elsewhere.",
+      );
+    });
+
+    test("continues past a failing assistant and exits 1", async () => {
+      mockColdStart();
+      loadAllAssistantsMock.mockReturnValue([
+        // Missing resources is a deliberate refusal for this entry.
+        {
+          assistantId: "wake-all-1",
+          runtimeUrl: "http://127.0.0.1:7830",
+          cloud: "local",
+        },
+        makeAllEntry("wake-all-2", join(tempDir, "instance-2")),
+      ]);
+      mkdirSync(join(tempDir, "instance-2"), { recursive: true });
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        await expect(wake()).rejects.toThrow("process.exit:1");
+        expect(errorSpy.mock.calls.flat().join("\n")).toContain(
+          "failed to wake 'wake-all-1'",
+        );
+      } finally {
+        exitSpy.mockRestore();
+      }
+
+      // The healthy assistant was still started.
+      expect(startCesMock).toHaveBeenCalledTimes(1);
+      expect(startLocalDaemonMock).toHaveBeenCalledTimes(1);
+      expect(startGatewayMock).toHaveBeenCalledTimes(1);
+    });
+
+    test("exits 1 when there is nothing to start", async () => {
+      loadAllAssistantsMock.mockReturnValue([]);
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        await expect(wake()).rejects.toThrow("process.exit:1");
+        expect(errorSpy).toHaveBeenCalledWith(
+          expect.stringContaining("no assistants found"),
+        );
+      } finally {
+        exitSpy.mockRestore();
+      }
+    });
+
+    test("refuses --all combined with a name", async () => {
+      process.argv = ["bun", "cadet", "wake", "local-assistant", "--all"];
+
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        await expect(wake()).rejects.toThrow("process.exit:1");
+        expect(errorSpy).toHaveBeenCalledWith(
+          expect.stringContaining("--all cannot be combined"),
+        );
+      } finally {
+        exitSpy.mockRestore();
+      }
+    });
+
+    test("refuses --all with --foreground and --repair-guardian", async () => {
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        for (const flag of ["--foreground", "--repair-guardian"]) {
+          process.argv = ["bun", "cadet", "wake", "--all", flag];
+          await expect(wake()).rejects.toThrow("process.exit:1");
+        }
+      } finally {
+        exitSpy.mockRestore();
+      }
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          "--all cannot be combined with --foreground or --repair-guardian",
+        ),
+      );
+    });
+  });
 });

package/src/__tests__/workos-pkce.test.ts

@@ -88,7 +88,7 @@ describe("buildAuthorizeUrl", () => {
 });
 
 describe("selectWorkosClientId", () => {
-  // During coexistence the platform lists two providers that share the
+  // During coexistence the cloud lists two providers that share the
   // "workos-oidc" id; only the OAuth2 one (no discovery URL) is usable.
   const legacy = {
     id: "workos-oidc",
@@ -110,7 +110,7 @@ describe("selectWorkosClientId", () => {
     expect(selectWorkosClientId([modern, legacy])).toBe("client_um");
   });
 
-  test("returns null when the platform lacks token auth", () => {
+  test("returns null when the cloud lacks token auth", () => {
     const preTokenAuth = { ...modern, flows: ["provider_redirect"] };
     expect(selectWorkosClientId([legacy, preTokenAuth])).toBeNull();
     expect(selectWorkosClientId([])).toBeNull();