@mycadet/cli 0.12.7 → 0.12.8

package/src/lib/__tests__/{platform-client-signed-url.test.ts → cloud-client-signed-url.test.ts}

@@ -2,10 +2,10 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import {
   platformPollJobStatus,
-  platformRequestSignedUrl,
+  cloudRequestSignedUrl,
   VersionMismatchError,
   type UnifiedJobStatus,
-} from "../platform-client.js";
+} from "../cloud-client.js";
 
 const PLATFORM_URL = "https://platform.example.test";
 const VAK_TOKEN = "vak_test_1234567890"; // API-key path skips org-ID fetch.
@@ -69,7 +69,7 @@ afterEach(() => {
   globalThis.fetch = originalFetch;
 });
 
-describe("platformRequestSignedUrl", () => {
+describe("cloudRequestSignedUrl", () => {
   test("upload operation with just operation → posts correct body and parses response", async () => {
     const { calls, fetchMock } = captureFetch(() => {
       return new Response(
@@ -83,7 +83,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "upload" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -117,7 +117,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       {
         operation: "upload",
         contentType: "application/octet-stream",
@@ -148,7 +148,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "download", bundleKey: "bundles/xyz.tar.gz" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -182,7 +182,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "upload" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -263,7 +263,7 @@ describe("platformRequestSignedUrl", () => {
     );
     globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "upload" },
       SESSION_TOKEN,
       PLATFORM_URL,
@@ -305,7 +305,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    await platformRequestSignedUrl(
+    await cloudRequestSignedUrl(
       {
         operation: "upload",
         minRuntimeVersion: "1.2.3",
@@ -335,7 +335,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    await platformRequestSignedUrl(
+    await cloudRequestSignedUrl(
       {
         operation: "download",
         bundleKey: "bundles/dl-v.tar.gz",
@@ -370,7 +370,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         {
           operation: "download",
           bundleKey: "bundles/foo.tar.gz",
@@ -414,7 +414,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         {
           operation: "download",
           bundleKey: "bundles/foo.tar.gz",
@@ -444,7 +444,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         { operation: "download", bundleKey: "bundles/foo.tar.gz" },
         VAK_TOKEN,
         PLATFORM_URL,
@@ -483,7 +483,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         {
           operation: "download",
           bundleKey: "bundles/foo.tar.gz",
@@ -513,7 +513,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "download", bundleKey: "bundles/xyz.tar.gz" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -535,7 +535,7 @@ describe("platformRequestSignedUrl", () => {
     globalThis.fetch = fetchMock;
 
     await expect(
-      platformRequestSignedUrl(
+      cloudRequestSignedUrl(
         { operation: "upload" },
         VAK_TOKEN,
         PLATFORM_URL,

package/src/lib/__tests__/job-polling.test.ts

@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
 
 import { pollJobUntilDone } from "../job-polling.js";
-import type { UnifiedJobStatus } from "../platform-client.js";
+import type { UnifiedJobStatus } from "../cloud-client.js";
 
 describe("pollJobUntilDone", () => {
   test("returns terminal 'complete' after N processing polls", async () => {

package/src/lib/__tests__/local-runtime-client.test.ts

@@ -14,7 +14,7 @@ const TOKEN = "local-bearer-token";
 
 // All tests in this file exercise the local/docker code path (cloud="local"),
 // which builds `{runtimeUrl}/v1/migrations/<subpath>` URLs and uses
-// guardian-token bearer auth. The platform path (cloud="cadet") is covered
+// guardian-token bearer auth. The cloud path (cloud="cadet") is covered
 // by `runtime-url.test.ts` (URL construction) and the teleport tests
 // (call-site wiring).
 const ENTRY: Pick<AssistantEntry, "cloud" | "runtimeUrl" | "assistantId"> = {
@@ -384,7 +384,7 @@ describe("localRuntimePollJobStatus", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Platform-managed assistants (cloud="cadet") route through the platform's
+// Cloud assistants (cloud="cadet") route through the cloud's
 // wildcard runtime proxy at `/v1/assistants/<id>/migrations/...` with
 // platform-token auth (NOT guardian-token bearer). This block asserts the
 // actual URL and headers built by the helpers — not mocked, not abstracted.
@@ -588,7 +588,7 @@ describe("localRuntimeIdentity", () => {
   });
 
   // ---------------------------------------------------------------------
-  // 401-retry parity with platformRequestSignedUrl (Codex P2 regression
+  // 401-retry parity with cloudRequestSignedUrl (Codex P2 regression
   // guard). localRuntimeIdentity is the first network call in the
   // backup/teleport export flow for cadet-cloud assistants, so a stale
   // Cadet-Organization-Id cache entry would surface as a hard abort
@@ -613,7 +613,7 @@ describe("localRuntimeIdentity", () => {
         orgIdFetchedAs.push(`org-${orgIdFetchedAs.length + 1}`);
         return new Response(
           JSON.stringify({
-            results: [{ id: orgIdFetchedAs[orgIdFetchedAs.length - 1]! }],
+            results: [{ id: orgIdFetchedAs[orgIdFetchedAs.length - 1]!, name: "My Cadet" }],
           }),
           { status: 200 },
         );

package/src/lib/__tests__/runtime-url.test.ts

@@ -49,7 +49,7 @@ describe("resolveRuntimeMigrationUrl", () => {
     );
   });
 
-  test("cadet (platform-managed) cloud uses wildcard-proxy /v1/assistants/<id>/migrations/<subpath>", () => {
+  test("cadet (cloud-managed) cloud uses wildcard-proxy /v1/assistants/<id>/migrations/<subpath>", () => {
     const entry = makeEntry({
       cloud: "cadet",
       runtimeUrl: "https://cloud.mycadet.ai",

package/src/lib/assistant-api-key-resolution.ts

@@ -8,8 +8,8 @@
 import {
   readGatewayCredential,
   reprovisionAssistantApiKey,
-  verifyGatewayManagedCredential,
-} from "./platform-client.js";
+  verifyGatewayCloudCredential,
+} from "./cloud-client.js";
 
 /** Where the key came from, so callers can report what they did. */
 export type AssistantApiKeySource =
@@ -39,13 +39,13 @@ export interface ResolvedAssistantApiKey {
  * Three steps, in order: the key the registration just issued, the key the
  * assistant already holds, then a rotation.
  *
- * A stored key the platform has rejected is skipped, because reinjecting it
+ * A stored key the cloud has rejected is skipped, because reinjecting it
  * repairs nothing while looking like a repair. The verdict is asked for
  * before the key is read, so the key returned is one the verdict covers: a
  * repair that lands between the two requests is then read, not overwritten
  * by the value it replaced. Rotation is still withheld when the gateway is
  * merely unreachable: rotating without being able to store the replacement
- * would start the platform's grace clock on a key the assistant still needs,
+ * would start the cloud's grace clock on a key the assistant still needs,
  * with nothing to hand it in exchange.
  */
 export async function resolveAssistantApiKeyForInjection(
@@ -55,7 +55,7 @@ export async function resolveAssistantApiKeyForInjection(
     return { apiKey: args.registrationApiKey, source: "registration" };
   }
 
-  const status = await verifyGatewayManagedCredential(
+  const status = await verifyGatewayCloudCredential(
     args.runtimeUrl,
     args.bearerToken,
   );

package/src/lib/assistant-client.ts

@@ -14,10 +14,10 @@
  * The auth scheme follows the assistant's topology, so callers never pick it.
  * Platform-managed entries in particular have no local guardian token: they
  * authenticate against the wildcard runtime proxy at
- * `{platformUrl}/v1/assistants/<id>/<rest>` with the stored cloud credential.
+ * `{cloudUrl}/v1/assistants/<id>/<rest>` with the stored cloud credential.
  */
 
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import { resolveAssistant } from "./assistant-config.js";
 import { GATEWAY_PORT } from "./constants.js";
 import {
@@ -29,8 +29,8 @@ import { loopbackSafeFetch } from "./loopback-fetch.js";
 import {
   authHeaders,
   invalidateOrgIdCache,
-  readPlatformToken,
-} from "./platform-client.js";
+  readCloudToken,
+} from "./cloud-client.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const FALLBACK_RUNTIME_URL = `http://127.0.0.1:${GATEWAY_PORT}`;
@@ -54,7 +54,7 @@ export interface AssistantClientOpts {
    * sent as `X-Session-Token: <sessionToken>` and the org id is
    * sent via the `Cadet-Organization-Id` header.
    *
-   * Platform-managed assistants do NOT need this: they are detected from the
+   * Cloud assistants do NOT need this: they are detected from the
    * lockfile entry and authenticated from the stored platform token.
    */
   sessionToken?: string;
@@ -75,7 +75,7 @@ export class AssistantClient {
   private readonly _assistantId: string;
   /**
    * The credential for the current mode. Mutable: a 401 on the guardian path
-   * refreshes it in place (see request), and the platform path fills it in on
+   * refreshes it in place (see request), and the cloud path fills it in on
    * first use (see resolveAuthHeaders).
    */
   private token: string | undefined;
@@ -103,7 +103,7 @@ export class AssistantClient {
     }
 
     this._assistantId = entry.assistantId;
-    const platformManaged = !opts?.sessionToken && isManagedCloud(entry.cloud);
+    const platformManaged = !opts?.sessionToken && isCloudHome(entry.cloud);
     const platformHost = stripTrailingSlashes(entry.runtimeUrl);
 
     // SECURITY: a cloud credential is account-scoped, far broader than the
@@ -155,7 +155,7 @@ export class AssistantClient {
    * error rather than letting an anonymous request fall through to a bare 403.
    */
   private requirePlatformToken(): string {
-    const token = readPlatformToken();
+    const token = readCloudToken();
     if (!token) {
       throw new Error(
         "Not logged in. Run `cadet login` first to authenticate with Cadet Cloud.",

package/src/lib/assistant-config.ts

@@ -63,19 +63,11 @@ export type LocalInstanceResources = Omit<
   [key: string]: unknown;
 };
 
-/** Docker image metadata for the service group. Enables rollback to known-good digests. */
+/** Docker image metadata for the service group. Enables rollback to known-good refs. */
 export interface ContainerInfo {
   assistantImage: string;
   gatewayImage: string;
   cesImage: string;
-  /** sha256 digest of the assistant image at time of hatch/upgrade */
-  assistantDigest?: string;
-  /** sha256 digest of the gateway image at time of hatch/upgrade */
-  gatewayDigest?: string;
-  /** sha256 digest of the CES image at time of hatch/upgrade */
-  cesDigest?: string;
-  /** Docker network name for the service group */
-  networkName?: string;
   /**
    * Host-side port the assistant HTTP API is published on. Dynamically
    * allocated at hatch time so concurrent instances don't collide on the
@@ -159,10 +151,29 @@ export type AssistantLookupResult =
 interface LockfileData {
   assistants?: Record<string, unknown>[];
   activeAssistant?: string;
-  platformBaseUrl?: string;
+  cloudBaseUrl?: string;
+  tunnel?: RootProcessRecord;
+  app?: RootProcessRecord;
   [key: string]: unknown;
 }
 
+/**
+ * A CLI-managed OS process recorded at the lockfile root, keyed by what it is
+ * for — `tunnel` (the auto-tunnel agent fronting the edge) and `app` (the
+ * nginx ingress edge). `cadet ps` renders these alongside the per-assistant
+ * process trees, and the stop paths verify the pid before signaling it.
+ */
+export interface RootProcessRecord {
+  pid: number;
+  /** Which tunnel provider owns the process; "tunnel" entries only. */
+  provider?: string;
+  /** The assistant the process fronts, so `cadet ps` can nest the row. */
+  assistantId?: string;
+  startedAt: string;
+}
+
+export type RootProcessKind = "tunnel" | "app";
+
 /**
  * Derive the daemon PID file path from a resources object. The PID file
  * lives inside the instance's workspace directory. When no resources are
@@ -224,6 +235,40 @@ function withCliLockfileLock<T>(fn: () => T): T {
   return locked.value;
 }
 
+/** Record a CLI-managed root process (tunnel agent, app edge) by pid. */
+export function stampRootProcess(
+  kind: RootProcessKind,
+  record: RootProcessRecord,
+): void {
+  withCliLockfileLock(() => {
+    const data = readLockfile();
+    data[kind] = record;
+    writeLockfileUnlocked(data);
+  });
+}
+
+/** Drop the recorded root process entry, e.g. once the process is stopped. */
+export function clearRootProcess(kind: RootProcessKind): void {
+  withCliLockfileLock(() => {
+    const data = readLockfile();
+    if (data[kind] === undefined) return;
+    delete data[kind];
+    writeLockfileUnlocked(data);
+  });
+}
+
+/**
+ * Read the root-level process entries for `cadet ps`. Read-only: no lock, so
+ * a concurrently-updating lockfile is fine — the pid is verified separately.
+ */
+export function readRootProcesses(): {
+  tunnel?: RootProcessRecord;
+  app?: RootProcessRecord;
+} {
+  const data = readLockfile();
+  return { tunnel: data.tunnel, app: data.app };
+}
+
 /**
  * Try to extract a port number from a URL string (e.g. `http://localhost:7830`).
  * Returns undefined if the URL is malformed or has no explicit port.
@@ -746,13 +791,14 @@ export async function allocateLocalResources(
 }
 
 /**
- * Return `platformBaseUrl` from the lockfile, if set. This is the value
+ * Return `cloudBaseUrl` from the lockfile, if set. This is the value
  * persisted by {@link syncConfigToLockfile} the last time the active
  * assistant was hatched/waked, and is the source of truth for "which
  * platform does the currently-active assistant target".
  */
 export function getLockfilePlatformBaseUrl(): string | undefined {
-  const url = readLockfile().platformBaseUrl;
+  const lockfile = readLockfile();
+  const url = lockfile.cloudBaseUrl ?? lockfile.platformBaseUrl;
   if (typeof url === "string" && url.trim()) return url.trim();
   return undefined;
 }