@mycadet/cli 0.12.7 → 0.12.9-dev.202610131452.9acab64

package/src/__tests__/debug.test.ts

@@ -19,7 +19,9 @@ process.env.CADET_LOCKFILE_DIR = testDir;
 import * as assistantConfig from "../lib/assistant-config.js";
 import * as guardianToken from "../lib/guardian-token.js";
 import * as localRuntimeClient from "../lib/local-runtime-client.js";
-import * as platformClient from "../lib/platform-client.js";
+import * as cloudClient from "../lib/cloud-client.js";
+import { withPreconnect } from "./helpers/http.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 const resolveTargetMock = spyOn(
   assistantConfig,
@@ -27,9 +29,9 @@ const resolveTargetMock = spyOn(
 ).mockImplementation(() => {
   throw new Error("process.exit:1");
 });
-const readPlatformTokenMock = spyOn(
-  platformClient,
-  "readPlatformToken",
+const readCloudTokenMock = spyOn(
+  cloudClient,
+  "readCloudToken",
 ).mockReturnValue("platform-token");
 const exportMock = spyOn(
   localRuntimeClient,
@@ -46,23 +48,25 @@ const pollMock = spyOn(
   jobId: "job-1",
   type: "export",
   status: "complete",
-} as unknown as Awaited<
-  ReturnType<typeof localRuntimeClient.localRuntimePollJobStatus>
->);
+});
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
-).mockReturnValue({
-  accessToken: "local-token",
-  accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
-} as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+).mockReturnValue(
+  makeGuardianTokenData({
+    accessToken: "local-token",
+    accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+  }),
+);
 const leaseGuardianTokenSpy = spyOn(
   guardianToken,
   "leaseGuardianToken",
-).mockResolvedValue({
-  accessToken: "leased-token",
-  accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
-} as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+).mockResolvedValue(
+  makeGuardianTokenData({
+    accessToken: "leased-token",
+    accessTokenExpiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+  }),
+);
 
 const { debug } = await import("../commands/debug.js");
 
@@ -72,10 +76,10 @@ const LOCAL_ENTRY = {
   runtimeUrl: "http://127.0.0.1:7821",
   cloud: "local",
   hatchedAt: new Date().toISOString(),
-  platformAssistantId: "11111111-2222-3333-4444-555555555555",
-  platformBaseUrl: "https://cloud.mycadet.ai",
-  platformOrganizationId: "org-1",
-} as unknown as assistantConfig.AssistantEntry;
+  cloudAssistantId: "11111111-2222-3333-4444-555555555555",
+  cloudBaseUrl: "https://cloud.mycadet.ai",
+  cloudOrganizationId: "org-1",
+} satisfies assistantConfig.AssistantEntry;
 
 let originalFetch: typeof globalThis.fetch;
 let originalExit: typeof process.exit;
@@ -86,12 +90,12 @@ beforeEach(() => {
   process.argv = ["bun", "cadet", "debug"];
   originalFetch = globalThis.fetch;
   originalExit = process.exit;
-  process.exit = mock((code?: number) => {
+  process.exit = mock((code?: number | string | undefined): never => {
     throw new Error(`process.exit:${code}`);
-  }) as unknown as typeof process.exit;
+  });
   fetchCalls = [];
   uploadUrlStatus = 201;
-  globalThis.fetch = mock(
+  globalThis.fetch = withPreconnect(
     async (input: RequestInfo | URL, init?: RequestInit) => {
       fetchCalls.push({ url: String(input), init });
       return new Response(
@@ -102,14 +106,14 @@ beforeEach(() => {
         },
       );
     },
-  ) as unknown as typeof globalThis.fetch;
+  );
   resolveTargetMock.mockReset();
   resolveTargetMock.mockReturnValue(LOCAL_ENTRY);
   identityMock.mockReset();
   identityMock.mockResolvedValue({ version: "0.12.3" });
   leaseGuardianTokenSpy.mockClear();
-  readPlatformTokenMock.mockReset();
-  readPlatformTokenMock.mockReturnValue("platform-token");
+  readCloudTokenMock.mockReset();
+  readCloudTokenMock.mockReturnValue("platform-token");
   exportMock.mockClear();
   pollMock.mockClear();
 });
@@ -123,7 +127,7 @@ afterAll(() => {
   resolveTargetMock.mockRestore();
   identityMock.mockRestore();
   leaseGuardianTokenSpy.mockRestore();
-  readPlatformTokenMock.mockRestore();
+  readCloudTokenMock.mockRestore();
   exportMock.mockRestore();
   pollMock.mockRestore();
   loadGuardianTokenSpy.mockRestore();
@@ -131,7 +135,7 @@ afterAll(() => {
 });
 
 describe("cadet debug", () => {
-  test("mints the URL on the platform, exports with the debug profile, and waits", async () => {
+  test("mints the URL on the cloud, exports with the debug profile, and waits", async () => {
     await debug();
 
     expect(fetchCalls).toHaveLength(1);
@@ -140,9 +144,7 @@ describe("cadet debug", () => {
     );
     expect(fetchCalls[0].init?.method).toBe("POST");
     expect(
-      (fetchCalls[0].init?.headers as Record<string, string>)[
-        "Cadet-Organization-Id"
-      ],
+      new Headers(fetchCalls[0].init?.headers).get("Cadet-Organization-Id"),
     ).toBe("org-1");
 
     expect(exportMock).toHaveBeenCalledTimes(1);
@@ -155,7 +157,7 @@ describe("cadet debug", () => {
       profile: "debug",
     });
     expect(pollMock).toHaveBeenCalled();
-    // The daemon was checked for the debug profile before the platform call.
+    // The daemon was checked for the debug profile before the cloud call.
     expect(identityMock).toHaveBeenCalledTimes(1);
   });
 
@@ -196,9 +198,7 @@ describe("cadet debug", () => {
         jobId: "job-1",
         type: "export",
         status: "complete",
-      } as unknown as Awaited<
-        ReturnType<typeof localRuntimeClient.localRuntimePollJobStatus>
-      >;
+      };
     });
 
     await debug();
@@ -207,7 +207,7 @@ describe("cadet debug", () => {
     expect(polls).toBe(2);
   });
 
-  test("explains what to turn on when the platform refuses", async () => {
+  test("explains what to turn on when the cloud refuses", async () => {
     uploadUrlStatus = 403;
     const errors: string[] = [];
     const errorSpy = spyOn(console, "error").mockImplementation((msg) => {
@@ -226,7 +226,7 @@ describe("cadet debug", () => {
     resolveTargetMock.mockReturnValue({
       ...LOCAL_ENTRY,
       cloud: "cadet",
-    } as unknown as assistantConfig.AssistantEntry);
+    });
     const errorSpy = spyOn(console, "error").mockImplementation(() => {});
     try {
       await expect(debug()).rejects.toThrow("process.exit:1");
@@ -239,8 +239,8 @@ describe("cadet debug", () => {
   test("asks for a login when the assistant is not registered", async () => {
     resolveTargetMock.mockReturnValue({
       ...LOCAL_ENTRY,
-      platformAssistantId: undefined,
-    } as unknown as assistantConfig.AssistantEntry);
+      cloudAssistantId: undefined,
+    });
     const errors: string[] = [];
     const errorSpy = spyOn(console, "error").mockImplementation((msg) => {
       errors.push(String(msg));

package/src/__tests__/ensure-binary.test.ts

@@ -0,0 +1,182 @@
+import { describe, expect, test } from "bun:test";
+import { Readable, Writable } from "node:stream";
+
+import { ensureBinaryInstalled, readLineText } from "../lib/ensure-binary.js";
+
+/** A real Writable capturing everything written, as a test output stream. */
+function makeOutput(): { writable: Writable; text(): string } {
+  const captured: string[] = [];
+  const writable = new Writable({
+    write(chunk, _encoding, callback) {
+      captured.push(chunk.toString());
+      callback();
+    },
+  });
+  return { writable, text: () => captured.join("") };
+}
+
+describe("ensureBinaryInstalled", () => {
+  test("returns the existing probe result without prompting", async () => {
+    const output = makeOutput();
+    const version = await ensureBinaryInstalled({
+      binary: "nginx",
+      purpose: "the tunnel edge",
+      packages: { brew: ["brew", "install", "nginx"] },
+      manualHint: "install nginx",
+      probe: () => "nginx version 1.2",
+      confirmInstall: () => {
+        throw new Error("must not prompt for a present binary");
+      },
+      streams: { output: output.writable },
+    });
+    expect(version).toBe("nginx version 1.2");
+    expect(output.text()).toBe("");
+  });
+
+  test("offers to install and runs the first available package manager", async () => {
+    const output = makeOutput();
+    const installed: string[][] = [];
+    let probeCalls = 0;
+    const version = await ensureBinaryInstalled({
+      binary: "nginx",
+      purpose: "the tunnel edge",
+      packages: {
+        brew: ["brew", "install", "nginx"],
+        "apt-get": ["sudo", "apt-get", "install", "-y", "nginx"],
+      },
+      manualHint: "install nginx yourself",
+      probe: () => (++probeCalls > 1 ? "nginx version 1.2" : null),
+      pmAvailable: (pm) => pm === "apt-get",
+      runInstall: (argv) => {
+        installed.push(argv);
+        return true;
+      },
+      confirmInstall: async () => true,
+      streams: { output: output.writable },
+    });
+    expect(version).toBe("nginx version 1.2");
+    expect(installed).toEqual([["sudo", "apt-get", "install", "-y", "nginx"]]);
+    expect(output.text()).toContain("isn't installed");
+    expect(output.text()).not.toContain("apt-get install");
+  });
+
+  test("the default confirm takes Enter as yes", async () => {
+    const output = makeOutput();
+    const input = Object.assign(new Readable({ read() {} }), {
+      isTTY: true,
+    });
+    const installed: string[][] = [];
+    let probeCalls = 0;
+    const pending = ensureBinaryInstalled({
+      binary: "nginx",
+      purpose: "the tunnel edge",
+      packages: { brew: ["brew", "install", "nginx"] },
+      manualHint: "install nginx yourself",
+      probe: () => (++probeCalls > 1 ? "nginx version 1.2" : null),
+      pmAvailable: () => true,
+      runInstall: (argv) => {
+        installed.push(argv);
+        return true;
+      },
+      streams: { input, output: output.writable },
+    });
+    input.emit("data", "\n");
+    expect(await pending).toBe("nginx version 1.2");
+    expect(installed).toEqual([["brew", "install", "nginx"]]);
+    expect(output.text()).toContain("Install nginx now?");
+  });
+
+  test("a declined offer prints the manual hint and installs nothing", async () => {
+    const output = makeOutput();
+    let ran = false;
+    const version = await ensureBinaryInstalled({
+      binary: "ngrok",
+      purpose: "the ngrok tunnel",
+      packages: { brew: ["brew", "install", "ngrok/ngrok/ngrok"] },
+      manualHint: "get ngrok from ngrok.com",
+      probe: () => null,
+      runInstall: () => {
+        ran = true;
+        return true;
+      },
+      confirmInstall: async () => false,
+      streams: { output: output.writable },
+    });
+    expect(version).toBe(null);
+    expect(ran).toBe(false);
+    expect(output.text()).toContain("get ngrok from ngrok.com");
+  });
+
+  test("a failed install falls back to the manual hint", async () => {
+    const output = makeOutput();
+    const version = await ensureBinaryInstalled({
+      binary: "nginx",
+      purpose: "the tunnel edge",
+      packages: { brew: ["brew", "install", "nginx"] },
+      manualHint: "install nginx yourself",
+      probe: () => null,
+      runInstall: () => false,
+      confirmInstall: async () => true,
+      streams: { output: output.writable },
+    });
+    expect(version).toBe(null);
+    expect(output.text()).toContain("install nginx yourself");
+  });
+
+  test("no matching package manager prints the hint", async () => {
+    const output = makeOutput();
+    let ran = false;
+    const version = await ensureBinaryInstalled({
+      binary: "cloudflared",
+      purpose: "the cloudflare tunnel",
+      packages: { brew: ["brew", "install", "cloudflared"] },
+      manualHint: "cloudflared install docs",
+      probe: () => null,
+      pmAvailable: () => false,
+      runInstall: () => {
+        ran = true;
+        return true;
+      },
+      confirmInstall: async () => true,
+      streams: { output: output.writable },
+    });
+    expect(version).toBe(null);
+    expect(ran).toBe(false);
+    expect(output.text()).toContain("cloudflared install docs");
+  });
+
+  test("a non-interactive terminal declines instead of hanging", async () => {
+    const version = await ensureBinaryInstalled({
+      binary: "nginx",
+      purpose: "the tunnel edge",
+      packages: { brew: ["brew", "install", "nginx"] },
+      manualHint: "install nginx yourself",
+      probe: () => null,
+      confirmInstall: async () => {
+        throw new Error("Install confirm requires an interactive terminal.");
+      },
+    });
+    expect(version).toBe(null);
+  });
+});
+
+describe("readLineText", () => {
+  test("resolves the first line and ignores the rest", async () => {
+    const output = makeOutput();
+    const input = new Readable({ read() {} });
+    const pending = readLineText("token: ", {
+      input,
+      output: output.writable,
+    });
+    input.emit("data", "abc123\nsecond line\n");
+    expect(await pending).toBe("abc123");
+    expect(output.text()).toBe("token: ");
+  });
+
+  test("resolves an empty line on an immediate newline", async () => {
+    const input = new Readable({ read() {} });
+    const pending = readLineText("[Y/n] ", { input });
+    input.emit("data", "\n");
+    expect(await pending).toBe("");
+  });
+});

package/src/__tests__/guardian-token.test.ts

@@ -16,6 +16,8 @@ import { guardianTokenPath, resolveConfigDir } from "@mycadet/local-mode";
 import {
   getOrCreatePersistedDeviceId,
   guardianTokenDueForRenewal,
+  GuardianLeasePermanentError,
+  leaseGuardianToken,
   loadGuardianToken,
   refreshGuardianToken,
   refreshGuardianTokenResult,
@@ -25,6 +27,7 @@ import {
 } from "../lib/guardian-token.js";
 import { getConfigDir } from "../lib/environments/paths.js";
 import { getCurrentEnvironment } from "../lib/environments/resolve.js";
+import { withPreconnect } from "./helpers/http.js";
 
 function makeTokenData(suffix: string): GuardianTokenData {
   const now = new Date().toISOString();
@@ -286,19 +289,21 @@ describe("refreshGuardianToken", () => {
   test("refreshes, persists the rotated token, sends an abort signal, releases the lock", async () => {
     seed(future());
     let sawSignal = false;
-    globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
-      sawSignal = init?.signal instanceof AbortSignal;
-      return new Response(
-        JSON.stringify({
-          accessToken: "new-acc",
-          refreshToken: "new-ref",
-          accessTokenExpiresAt: future(),
-          refreshTokenExpiresAt: future(),
-          refreshAfter: "",
-        }),
-        { status: 200, headers: { "content-type": "application/json" } },
-      );
-    }) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, init?: RequestInit) => {
+        sawSignal = init?.signal instanceof AbortSignal;
+        return new Response(
+          JSON.stringify({
+            accessToken: "new-acc",
+            refreshToken: "new-ref",
+            accessTokenExpiresAt: future(),
+            refreshTokenExpiresAt: future(),
+            refreshAfter: "",
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      },
+    );
 
     const result = await refreshGuardianToken("https://gw.example.com", "px");
 
@@ -311,13 +316,81 @@ describe("refreshGuardianToken", () => {
     expect(existsSync(lockPath("px"))).toBe(false); // lock released
   });
 
+  test("leases against the gateway's real init shape — refreshAfter arrives as a number", async () => {
+    // The gateway's GuardianBootstrapResult serializes refreshAfter as a
+    // NUMBER of ms (mintRefreshToken), and the strict lease check rejects a
+    // response missing any field. A string-only schema read that number as
+    // malformed, so every real hatch failed its lease while the ISO-string
+    // test doubles here stayed green.
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.endsWith("/readyz")) {
+        return new Response("", { status: 404 }); // no starting gate — proceed
+      }
+      return new Response(
+        JSON.stringify({
+          guardianPrincipalId: "principal-lease",
+          accessToken: "access-lease",
+          accessTokenExpiresAt: Date.now() + 60 * 60 * 1000,
+          refreshToken: "refresh-lease",
+          refreshTokenExpiresAt: Date.now() + 365 * 24 * 60 * 60 * 1000,
+          refreshAfter: Date.now() + 48 * 60 * 60 * 1000,
+          isNew: true,
+          mintedOverPriorEvidence: false,
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      );
+    });
+
+    const leased = await leaseGuardianToken("https://gw.example.com", "px");
+
+    expect(leased.accessToken).toBe("access-lease");
+    expect(leased.refreshAfter).toBeDefined();
+    const stored = loadGuardianToken("px");
+    expect(stored?.accessToken).toBe("access-lease");
+    expect(stored?.refreshAfter).toBe(leased.refreshAfter);
+  });
+
+  test("a malformed 200 names the unusable fields and is not retried", async () => {
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.endsWith("/readyz")) {
+        return new Response("", { status: 404 });
+      }
+      return new Response(
+        JSON.stringify({
+          guardianPrincipalId: "principal-lease",
+          accessToken: 42,
+          refreshToken: "refresh-lease",
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      );
+    });
+
+    const err = await leaseGuardianToken("https://gw.example.com", "px").then(
+      () => null,
+      (e: unknown) => e,
+    );
+
+    if (!(err instanceof GuardianLeasePermanentError)) {
+      throw new Error(
+        `expected GuardianLeasePermanentError, got ${String(err)}`,
+      );
+    }
+    expect(err.message).toContain("(200)");
+    expect(err.message).toContain("accessToken arrived as number");
+    expect(err.message).toContain("refreshTokenExpiresAt arrived as absent");
+  });
+
   test("returns null without calling the gateway when the refresh token is expired", async () => {
     seed(new Date(Date.now() - 1000).toISOString());
     let called = false;
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-      called = true;
-      return new Response("", { status: 200 });
-    }) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) => {
+        called = true;
+        return new Response("", { status: 200 });
+      },
+    );
 
     expect(
       await refreshGuardianToken("https://gw.example.com", "px"),
@@ -327,10 +400,12 @@ describe("refreshGuardianToken", () => {
 
   test("returns null when there is no stored token", async () => {
     let called = false;
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-      called = true;
-      return new Response("", { status: 200 });
-    }) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) => {
+        called = true;
+        return new Response("", { status: 200 });
+      },
+    );
 
     expect(
       await refreshGuardianToken("https://gw.example.com", "missing"),
@@ -348,11 +423,13 @@ describe("refreshGuardianToken", () => {
     const old = new Date(Date.now() - 60_000);
     utimesSync(lp, old, old);
 
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) =>
-      new Response(JSON.stringify({ accessToken: "new-acc" }), {
-        status: 200,
-        headers: { "content-type": "application/json" },
-      })) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) =>
+        new Response(JSON.stringify({ accessToken: "new-acc" }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+    );
 
     const result = await refreshGuardianToken("https://gw.example.com", "px");
     expect(result?.accessToken).toBe("new-acc");
@@ -371,13 +448,15 @@ describe("refreshGuardianToken", () => {
     ]) {
       seed(future());
       let called = false;
-      globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-        called = true;
-        return new Response(JSON.stringify({ accessToken: "new-acc" }), {
-          status: 200,
-          headers: { "content-type": "application/json" },
-        });
-      }) as typeof fetch;
+      globalThis.fetch = withPreconnect(
+        async (_url: unknown, _init?: RequestInit) => {
+          called = true;
+          return new Response(JSON.stringify({ accessToken: "new-acc" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        },
+      );
 
       expect(await refreshGuardianToken(url, "px")).not.toBeNull();
       expect(called).toBe(true); // loopback http is allowed
@@ -387,10 +466,12 @@ describe("refreshGuardianToken", () => {
   test("refuses a non-loopback plaintext http URL: no fetch, returns null, warns", async () => {
     seed(future());
     let called = false;
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-      called = true;
-      return new Response("", { status: 200 });
-    }) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) => {
+        called = true;
+        return new Response("", { status: 200 });
+      },
+    );
 
     const origWarn = console.warn;
     let warned = false;
@@ -411,10 +492,12 @@ describe("refreshGuardianToken", () => {
   test("refuses a malformed gateway URL: no fetch, returns null", async () => {
     seed(future());
     let called = false;
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-      called = true;
-      return new Response("", { status: 200 });
-    }) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) => {
+        called = true;
+        return new Response("", { status: 200 });
+      },
+    );
 
     const origWarn = console.warn;
     console.warn = () => {};
@@ -428,11 +511,13 @@ describe("refreshGuardianToken", () => {
 
   test("an unreachable gateway is a 503, not a 401", async () => {
     seed(future());
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-      throw Object.assign(new TypeError("fetch failed"), {
-        cause: { code: "ECONNREFUSED" },
-      });
-    }) as unknown as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) => {
+        throw Object.assign(new TypeError("fetch failed"), {
+          cause: { code: "ECONNREFUSED" },
+        });
+      },
+    );
 
     const result = await refreshGuardianTokenResult(
       "http://127.0.0.1:59999",
@@ -451,8 +536,10 @@ describe("refreshGuardianToken", () => {
 
   test("an HTTP 401 from the gateway is a spent credential", async () => {
     seed(future());
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) =>
-      new Response("", { status: 401 })) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) =>
+        new Response("", { status: 401 }),
+    );
 
     expect(
       await refreshGuardianTokenResult("https://gw.example.com", "px"),
@@ -465,8 +552,10 @@ describe("refreshGuardianToken", () => {
 
   test("an HTTP 403 from the refresh route is a spent credential, not a loopback refusal", async () => {
     seed(future());
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) =>
-      new Response("", { status: 403 })) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) =>
+        new Response("", { status: 403 }),
+    );
 
     expect(
       await refreshGuardianTokenResult("https://gw.example.com", "px"),
@@ -480,10 +569,12 @@ describe("refreshGuardianToken", () => {
   test("an insecure gateway URL is a local 403, not a spent credential", async () => {
     seed(future());
     let called = false;
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) => {
-      called = true;
-      return new Response("", { status: 200 });
-    }) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) => {
+        called = true;
+        return new Response("", { status: 200 });
+      },
+    );
 
     const origWarn = console.warn;
     console.warn = () => {};
@@ -503,8 +594,10 @@ describe("refreshGuardianToken", () => {
 
   test("an HTTP 503 from a still-starting gateway is retryable", async () => {
     seed(future());
-    globalThis.fetch = (async (_url: unknown, _init?: RequestInit) =>
-      new Response("", { status: 503 })) as typeof fetch;
+    globalThis.fetch = withPreconnect(
+      async (_url: unknown, _init?: RequestInit) =>
+        new Response("", { status: 503 }),
+    );
 
     const result = await refreshGuardianTokenResult(
       "https://gw.example.com",