@mycadet/cli 0.12.7 → 0.12.9-dev.202610131452.9acab64

package/src/__tests__/hatch-provider-secrets.test.ts

@@ -292,7 +292,7 @@ describe("hatch provider secrets", () => {
   test("HATCH_PROVIDER_CHOICES only lists labeled providers", () => {
     for (const provider of HATCH_PROVIDER_CHOICES) {
       expect(formatProviderName(provider)).toBeTruthy();
-      // Cadet Cloud is the managed-connection exception: no env var, no
+      // Cadet Cloud is the cloud-connection exception: no env var, no
       // key collection — everything else must have a supported setup flow.
       if (provider !== "cadet") {
         expect(isSupportedLlmProvider(provider)).toBe(true);
@@ -313,7 +313,7 @@ describe("hatch provider secrets", () => {
     ]);
   });
 
-  test("Cadet Cloud configures silently through the managed connection", async () => {
+  test("Cadet Cloud configures silently through the cloud connection", async () => {
     const { calls, fetchImpl } = makeFetch([]);
     const logs: string[] = [];
 

package/src/__tests__/helpers/guardian-token.ts

@@ -0,0 +1,22 @@
+import type { GuardianTokenData } from "../../lib/guardian-token.js";
+
+/**
+ * A complete `GuardianTokenData` fixture with per-test overrides — the type's
+ * nine fields are all required, so partial fakes need this to stand in.
+ */
+export function makeGuardianTokenData(
+  over: Partial<GuardianTokenData> = {},
+): GuardianTokenData {
+  return {
+    guardianPrincipalId: "principal-1",
+    accessToken: "local-token",
+    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
+    refreshToken: "refresh-token",
+    refreshTokenExpiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+    refreshAfter: new Date(Date.now() + 30_000).toISOString(),
+    isNew: false,
+    deviceId: "device-1",
+    leasedAt: new Date().toISOString(),
+    ...over,
+  };
+}

package/src/__tests__/helpers/http.ts

@@ -0,0 +1,10 @@
+/**
+ * bun-types' global fetch carries a `preconnect` member; these mocks only need
+ * the call shape, so hand the assignment a member-complete callable. The SUT
+ * never calls `preconnect`.
+ */
+export function withPreconnect(
+  impl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>,
+): typeof globalThis.fetch {
+  return Object.assign(impl, { preconnect: () => {} });
+}

package/src/__tests__/nginx-ingress.test.ts

@@ -158,9 +158,8 @@ describe("buildIngressNginxConfig", () => {
     remoteWebIngress: {
       webDistDir: "/tmp/cadet web/dist",
       config: {
-        mode: "remote-gateway",
+        remote: "docker",
         apiBaseUrl: "/v1",
-        platformDisabled: true,
       },
     },
   });
@@ -330,7 +329,7 @@ describe("buildIngressNginxConfig", () => {
     expect(remoteConf).toContain("default_type application/json;");
     expect(remoteConf).toContain('add_header Cache-Control "no-store";');
     expect(remoteConf).toContain(
-      'return 200 "{\\"mode\\":\\"remote-gateway\\",\\"apiBaseUrl\\":\\"/v1\\",\\"platformDisabled\\":true,\\"disablePlatform\\":true}";',
+      'return 200 "{\\"remote\\":\\"docker\\",\\"apiBaseUrl\\":\\"/v1\\"}";',
     );
     expect(remoteConf).not.toContain("assistantId");
   });
@@ -347,7 +346,7 @@ describe("buildIngressNginxConfig", () => {
       },
     });
     expect(named).toContain(
-      'return 200 "{\\"mode\\":\\"remote-gateway\\",\\"apiBaseUrl\\":\\"/v1\\",\\"platformDisabled\\":true,\\"disablePlatform\\":true,\\"assistantName\\":\\"Homelab\\",\\"assistantId\\":\\"assistant-1\\",\\"hubUrl\\":\\"https://mycadet.ai/assistant\\"}";',
+      'return 200 "{\\"remote\\":\\"custom\\",\\"apiBaseUrl\\":\\"/v1\\",\\"assistantName\\":\\"Homelab\\",\\"assistantId\\":\\"assistant-1\\",\\"hubUrl\\":\\"https://mycadet.ai/assistant\\"}";',
     );
   });
 
@@ -447,19 +446,18 @@ describe("buildRemoteWebIndexHtml", () => {
     const html =
       '<html><head><script>window.__CADET_CONFIG__={"webUrl":"https://mycadet.ai"}</script></head><body></body></html>';
     const result = buildRemoteWebIndexHtml(html, {
-      mode: "remote-gateway",
+      remote: "docker",
       apiBaseUrl: "/v1",
-      disablePlatform: true,
     });
 
     expect(result).toContain(
       'window.__CADET_CONFIG__={"webUrl":"https://mycadet.ai"}',
     );
     expect(result).toContain(
-      'window.__CADET_CONFIG__={"mode":"remote-gateway","apiBaseUrl":"/v1","disablePlatform":true}',
+      'window.__CADET_CONFIG__={"remote":"docker","apiBaseUrl":"/v1"}',
     );
     expect(result.indexOf('"webUrl"')).toBeLessThan(
-      result.indexOf('"remote-gateway"'),
+      result.indexOf('"docker"'),
     );
   });
 
@@ -484,7 +482,7 @@ describe("buildRemoteWebIndexHtml", () => {
       "</head><body></body></html>",
     ].join("\n");
 
-    const result = buildRemoteWebIndexHtml(html, { mode: "remote-gateway" });
+    const result = buildRemoteWebIndexHtml(html, { remote: "docker" });
 
     expect(result.match(/rel="modulepreload"/g)).toHaveLength(4);
     expect(result).toContain('href="/assistant/assets/a-1.js"');
@@ -506,7 +504,7 @@ describe("buildRemoteWebIndexHtml", () => {
       "</head><body></body></html>",
     ].join("\n");
 
-    const result = buildRemoteWebIndexHtml(html, { mode: "remote-gateway" });
+    const result = buildRemoteWebIndexHtml(html, { remote: "docker" });
 
     expect(result).not.toContain("modulepreload");
     expect(result).not.toContain("/assistant/assets/chunk-0.js");
@@ -522,7 +520,7 @@ describe("buildRemoteWebIndexHtml", () => {
     );
     const html = `<html><head>${preloads.join("\n")}</head><body></body></html>`;
 
-    const result = buildRemoteWebIndexHtml(html, { mode: "remote-gateway" });
+    const result = buildRemoteWebIndexHtml(html, { remote: "docker" });
 
     expect(result.match(/rel="modulepreload"/g)).toHaveLength(
       MAX_PRESERVED_MODULE_PRELOADS,
@@ -862,10 +860,8 @@ function spaConfigHash(
       JSON.stringify({
         template: EDGE_TEMPLATE_VERSION,
         config: {
-          mode: "remote-gateway",
+          remote: "custom",
           apiBaseUrl: "/v1",
-          platformDisabled: true,
-          disablePlatform: true,
           ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
           ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
           hubUrl: PRODUCTION_HUB_URL,
@@ -988,7 +984,7 @@ describe("startRemoteWebIngress", () => {
       join(ws, "data", "ingress", "assistant-index.html"),
       "utf-8",
     );
-    expect(indexHtml).toContain("remote-gateway");
+    expect(indexHtml).toContain('"remote":"custom"');
     expect(indexHtml).toContain(`"hubUrl":"${PRODUCTION_HUB_URL}"`);
     // No assistant name was provided, so the served config omits the label.
     expect(indexHtml).not.toContain("assistantName");
@@ -1352,10 +1348,8 @@ describe("startRemoteWebIngress", () => {
         JSON.stringify({
           template: 1,
           config: {
-            mode: "remote-gateway",
+            remote: "custom",
             apiBaseUrl: "/v1",
-            platformDisabled: true,
-            disablePlatform: true,
             hubUrl: PRODUCTION_HUB_URL,
           },
         }),
@@ -2095,8 +2089,9 @@ describe("ensureTunnelEdge", () => {
       gatewayPort: 7830,
     });
 
-    await expect(promise).rejects.toThrow("brew install nginx");
-    await expect(promise).rejects.toThrow("apt install nginx");
+    await expect(promise).rejects.toThrow(
+      "See https://nginx.org/en/docs/install.html for how to install",
+    );
     await expect(promise).rejects.toThrow("NGINX_BIN");
     expect(spawnMock).not.toHaveBeenCalled();
   });

package/src/__tests__/ngrok-spawn.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+
+import { buildNgrokSpawnArgs, isNgrokAuthError } from "../lib/tunnels/ngrok.js";
+
+describe("buildNgrokSpawnArgs", () => {
+  test("spawns a plain http agent against the loopback edge", () => {
+    expect(buildNgrokSpawnArgs(7830)).toEqual([
+      "http",
+      "127.0.0.1:7830",
+      "--log=stdout",
+    ]);
+  });
+
+  test("never passes --config so the default (authtoken-bearing) config loads", () => {
+    const args = buildNgrokSpawnArgs(7830, "me.ngrok.app");
+    expect(args.some((arg) => arg.startsWith("--config"))).toBe(false);
+  });
+
+  test("binds a reserved domain when given", () => {
+    expect(buildNgrokSpawnArgs(7830, "my-assistant.ngrok.app")).toEqual([
+      "http",
+      "127.0.0.1:7830",
+      "--log=stdout",
+      "--domain=my-assistant.ngrok.app",
+    ]);
+  });
+});
+
+describe("isNgrokAuthError", () => {
+  test("recognizes the free-account authtoken requirement", () => {
+    expect(
+      isNgrokAuthError(
+        "FATAL: authentication failed: Usage of ngrok requires a free authtoken. ERR_NGROK_105",
+      ),
+    ).toBe(true);
+  });
+
+  test("recognizes an unauthorized token", () => {
+    expect(isNgrokAuthError("unauthorized authtoken ERR_NGROK_401")).toBe(true);
+  });
+
+  test("does not claim other startup failures are auth errors", () => {
+    expect(
+      isNgrokAuthError(
+        "creating tunnel session failed: dial tcp 3.219.x.x:443: connection refused",
+      ),
+    ).toBe(false);
+  });
+});

package/src/__tests__/orphan-detection.test.ts

@@ -141,7 +141,7 @@ describe("loadAllAssistantsAcrossEnvs", () => {
   function makeEnv(name: string, lockfileDir: string): EnvironmentDefinition {
     return {
       name,
-      platformUrl: "https://example.invalid",
+      cloudUrl: "https://example.invalid",
       webUrl: "https://example.invalid",
       lockfileDirOverride: lockfileDir,
     };

package/src/__tests__/pair.test.ts

@@ -4,6 +4,7 @@ import {
   beforeEach,
   describe,
   expect,
+  mock,
   spyOn,
   test,
 } from "bun:test";
@@ -19,15 +20,35 @@ process.env.CADET_LOCKFILE_DIR = testDir;
 const originalEnvironment = process.env.CADET_ENVIRONMENT;
 process.env.CADET_ENVIRONMENT = "production";
 
-import { buildAppConnectUrl, pair } from "../commands/pair.js";
+import { withPreconnect } from "./helpers/http.js";
+
+// The gateway-CLI mint runs in a SUBPROCESS for local and docker assistants;
+// answer it in-process and record the invocations (the fetch stubs below
+// still serve the loopback HTTP mint the other topologies keep using).
+const mintCalls: Array<{ command: string; args: readonly string[] }> = [];
+const actualStepRunner = await import("../lib/step-runner.js");
+const mockExecOutput = mock(
+  (command: string, args: readonly string[]): Promise<string> => {
+    mintCalls.push({ command, args });
+    const mintedUrl = args[args.length - 1] ?? "";
+    return Promise.resolve(
+      JSON.stringify({
+        deviceCode: "device-code",
+        userCode: "ABCD-EFGH",
+        verificationUri: `${mintedUrl}/assistant/pair`,
+        expiresAt: "2026-06-04T00:10:00.000Z",
+        expiresInSeconds: 600,
+        intervalSeconds: 5,
+      }),
+    );
+  },
+);
+mock.module("../lib/step-runner.js", () => ({
+  ...actualStepRunner,
+  execOutput: mockExecOutput,
+}));
 
-// bun-types' global fetch carries a `preconnect` member; these mocks only need
-// the call shape, so hand the assignment a member-complete callable.
-function withPreconnect(
-  impl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>,
-): typeof fetch {
-  return Object.assign(impl, { preconnect: () => {} });
-}
+const { buildAppConnectUrl, pair } = await import("../commands/pair.js");
 
 // Distinct loopback (mint) vs reachable (advertised) URLs to verify the split.
 const LOCAL_URL = "http://127.0.0.1:7830";
@@ -100,6 +121,7 @@ const ORIGINAL_ARGV = [...process.argv];
 
 describe("pair command", () => {
   beforeEach(() => {
+    mintCalls.length = 0;
     writeLockfile();
   });
 
@@ -137,18 +159,16 @@ describe("pair command", () => {
       globalThis.fetch = origFetch;
     }
 
-    // Mint over the loopback gateway, then approve: running this command on
-    // the host IS the approval, so the link alone completes the pairing.
-    expect(calls.map((c) => c[0])).toEqual([
-      `${LOCAL_URL}/v1/remote-web/pairing-challenge`,
-      `${LOCAL_URL}/v1/remote-web/pairing-verification`,
+    // Mint through the gateway CLI subprocess: process execution IS the
+    // local-presence proof and the approval, so the link alone completes
+    // the pairing — no HTTP at all for a local assistant.
+    expect(mintCalls).toHaveLength(1);
+    expect(mintCalls[0]?.args.slice(-3)).toEqual([
+      "pairing",
+      "mint",
+      PUBLIC_URL,
     ]);
-    expect(JSON.parse(String(calls[0][1]?.body))).toEqual({
-      publicBaseUrl: PUBLIC_URL,
-    });
-    expect(JSON.parse(String(calls[1][1]?.body))).toEqual({
-      userCode: "ABCD-EFGH",
-    });
+    expect(calls).toHaveLength(0);
 
     const output = logs.join("\n");
     // One artifact, two renderings: the link and the same link as a QR.
@@ -398,10 +418,9 @@ describe("pair command", () => {
     }
 
     // Resolution succeeded (no exit), so the challenge was minted.
-    expect(calls.map((c) => c[0])).toEqual([
-      `${LOCAL_URL}/v1/remote-web/pairing-challenge`,
-      `${LOCAL_URL}/v1/remote-web/pairing-verification`,
-    ]);
+    expect(mintCalls).toHaveLength(1);
+    expect(mintCalls[0]?.args.at(-1)).toBe(PUBLIC_URL);
+    expect(calls).toHaveLength(0);
   });
 
   test("rejects an unknown --flag before any network call", async () => {
@@ -594,11 +613,8 @@ describe("pair command", () => {
       globalThis.fetch = origFetch;
     }
 
-    // Mint still over loopback; the link advertises the override.
-    expect(calls[0][0]).toBe(`${LOCAL_URL}/v1/remote-web/pairing-challenge`);
-    expect(JSON.parse(String(calls[0][1]?.body))).toEqual({
-      publicBaseUrl: OVERRIDE,
-    });
+    // Mint still through the gateway CLI; the link advertises the override.
+    expect(mintCalls[0]?.args.at(-1)).toBe(OVERRIDE);
     expect(JSON.parse(logs.join("\n")).pairUrl).toBe(
       `${OVERRIDE}/assistant/pair#device_code=device-code`,
     );
@@ -1076,35 +1092,8 @@ describe("pair command", () => {
 
     const calls: string[] = [];
     const origFetch = globalThis.fetch;
-    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      calls.push(url);
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
-        // The minted challenge must advertise the entry's recorded URL.
-        expect(JSON.parse(String(init?.body))).toEqual({
-          publicBaseUrl: "https://saved.example.ts.net",
-        });
-        return new Response(
-          JSON.stringify({
-            deviceCode: "device-code",
-            userCode: "ABCD-EFGH",
-            verificationUri: "https://saved.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-            expiresInSeconds: 600,
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
-        return new Response(
-          JSON.stringify({
-            status: "approved",
-            verificationUri: "https://saved.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      calls.push(String(input));
       return new Response("not found", { status: 404 });
     });
 
@@ -1123,7 +1112,9 @@ describe("pair command", () => {
       globalThis.fetch = origFetch;
     }
 
-    expect(calls).toContain(`${LOCAL_URL}/v1/remote-web/pairing-challenge`);
+    // The minted challenge must advertise the entry's recorded URL.
+    expect(mintCalls[0]?.args.at(-1)).toBe("https://saved.example.ts.net");
+    expect(calls).toHaveLength(0);
     const output = logs.join("\n");
     expect(output).toContain(
       "Using saved ingress URL https://saved.example.ts.net",
@@ -1137,33 +1128,7 @@ describe("pair command", () => {
     writeLockfileWithIngress("https://saved.example.ts.net");
 
     const origFetch = globalThis.fetch;
-    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
-        expect(JSON.parse(String(init?.body))).toEqual({
-          publicBaseUrl: "https://explicit.example.ts.net",
-        });
-        return new Response(
-          JSON.stringify({
-            deviceCode: "device-code",
-            userCode: "ABCD-EFGH",
-            verificationUri: "https://explicit.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-            expiresInSeconds: 600,
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
-        return new Response(
-          JSON.stringify({
-            status: "approved",
-            verificationUri: "https://explicit.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
+    globalThis.fetch = withPreconnect(async () => {
       return new Response("not found", { status: 404 });
     });
 
@@ -1189,6 +1154,8 @@ describe("pair command", () => {
     }
 
     expect(logs.join("\n")).not.toContain("Using saved ingress URL");
+    // The override reached the mint.
+    expect(mintCalls[0]?.args.at(-1)).toBe("https://explicit.example.ts.net");
   });
 
   test("a non-https recorded ingress URL is ignored", async () => {
@@ -1270,4 +1237,101 @@ describe("pair command", () => {
     expect(errors.join("\n")).toContain(RUNTIME_URL);
     expect(minted).toBe(false);
   });
+
+  test("refuses a paired (connect-import) assistant before minting", async () => {
+    writeFileSync(
+      join(testDir, "lockfile.json"),
+      JSON.stringify({
+        assistants: [
+          {
+            assistantId: "pair-test",
+            runtimeUrl: RUNTIME_URL,
+            cloud: "paired",
+          },
+        ],
+        activeAssistant: "pair-test",
+      }),
+    );
+
+    const errors: string[] = [];
+    const errSpy = spyOn(console, "error").mockImplementation(
+      (...a: unknown[]) => {
+        errors.push(a.join(" "));
+      },
+    );
+    const exitSpy = spyOn(process, "exit").mockImplementation(
+      (code?: number | string | undefined): never => {
+        throw new Error(`exit:${code}`);
+      },
+    );
+
+    process.argv = ["bun", "cadet", "pair", "--url", PUBLIC_URL];
+    let exited = false;
+    try {
+      await pair();
+    } catch (e) {
+      exited = e instanceof Error && e.message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+
+    expect(exited).toBe(true);
+    expect(errors.join("\n")).toContain("was paired as a remote");
+    // Keyed on the entry's cloud, not on which fields happen to exist.
+    expect(mintCalls).toHaveLength(0);
+  });
+
+  test("a custom (ssh-managed) assistant keeps the loopback HTTP mint", async () => {
+    writeFileSync(
+      join(testDir, "lockfile.json"),
+      JSON.stringify({
+        assistants: [
+          {
+            assistantId: "pair-test",
+            runtimeUrl: LOCAL_URL,
+            cloud: "custom",
+          },
+        ],
+        activeAssistant: "pair-test",
+      }),
+    );
+
+    const calls: Array<[string, RequestInit | undefined]> = [];
+    const origFetch = globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = String(input);
+        calls.push([url, init]);
+        if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
+          return challengeResponse(PUBLIC_URL);
+        }
+        if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
+          return approvalResponse(PUBLIC_URL);
+        }
+        return new Response("not found", { status: 404 });
+      },
+    );
+
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+
+    process.argv = ["bun", "cadet", "pair", "--url", PUBLIC_URL];
+    try {
+      await pair();
+    } finally {
+      logSpy.mockRestore();
+      globalThis.fetch = origFetch;
+    }
+
+    // Not local/docker: no CLI execution — the mint rides the loopback HTTP
+    // route, keyed on the entry's cloud, not on containerInfo.
+    expect(mintCalls).toHaveLength(0);
+    expect(calls.map((c) => c[0])).toEqual([
+      `${LOCAL_URL}/v1/remote-web/pairing-challenge`,
+      `${LOCAL_URL}/v1/remote-web/pairing-verification`,
+    ]);
+    expect(JSON.parse(String(calls[0]?.[1]?.body))).toEqual({
+      publicBaseUrl: PUBLIC_URL,
+    });
+  });
 });