@mycadet/cli 0.12.7 → 0.12.9

package/src/__tests__/backup.test.ts

@@ -5,6 +5,7 @@ import {
   describe,
   expect,
   mock,
+  type Mock,
   spyOn,
   test,
 } from "bun:test";
@@ -30,26 +31,26 @@ import * as backupOps from "../lib/backup-ops.js";
 import * as guardianToken from "../lib/guardian-token.js";
 import * as localRuntimeClient from "../lib/local-runtime-client.js";
 import { MigrationInProgressError } from "../lib/local-runtime-client.js";
-import * as platformClient from "../lib/platform-client.js";
+import * as cloudClient from "../lib/cloud-client.js";
 
 const findAssistantByNameMock = spyOn(
   assistantConfig,
   "findAssistantByName",
 ).mockReturnValue(null);
 
-const readPlatformTokenMock = spyOn(
-  platformClient,
-  "readPlatformToken",
+const readCloudTokenMock = spyOn(
+  cloudClient,
+  "readCloudToken",
 ).mockReturnValue("platform-token");
 
-const getPlatformUrlMock = spyOn(
-  platformClient,
-  "getPlatformUrl",
+const getCloudUrlMock = spyOn(
+  cloudClient,
+  "getCloudUrl",
 ).mockReturnValue("https://cloud.mycadet.ai");
 
-const platformRequestSignedUrlMock = spyOn(
-  platformClient,
-  "platformRequestSignedUrl",
+const cloudRequestSignedUrlMock = spyOn(
+  cloudClient,
+  "cloudRequestSignedUrl",
 ).mockImplementation(async (params) => ({
   url:
     params.operation === "upload"
@@ -79,6 +80,7 @@ const localRuntimePollJobStatusMock = spyOn(
   result: { manifest_sha256: "abc123def456" },
 });
 
+/** A complete-but-fake guardian token; the SUT only reads the fields it sets. */
 // Mode 1 (runtime-direct local backup) uses guardian tokens. Don't exercise
 // it here, but the spies need to exist so the module under test can import
 // them without surprises. Saved to variables so afterAll can restore them —
@@ -87,31 +89,25 @@ const localRuntimePollJobStatusMock = spyOn(
 const loadGuardianTokenSpy = spyOn(
   guardianToken,
   "loadGuardianToken",
-).mockReturnValue({
-  accessToken: "local-token",
-  accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-} as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+).mockReturnValue(makeGuardianTokenData({ accessToken: "local-token" }));
 const leaseGuardianTokenSpy = spyOn(
   guardianToken,
   "leaseGuardianToken",
-).mockResolvedValue({
-  accessToken: "leased-token",
-  accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-} as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+).mockResolvedValue(makeGuardianTokenData({ accessToken: "leased-token" }));
 
 const getBackupsDirMock = spyOn(backupOps, "getBackupsDir").mockReturnValue(
   "/tmp/backups-default",
 );
 
 const mkdirSyncMock = spyOn(fs, "mkdirSync").mockImplementation(
-  (() => undefined) as never,
+  () => undefined,
 );
 const writeFileSyncMock = spyOn(fs, "writeFileSync").mockImplementation(
   () => undefined,
 );
 
 let originalFetch: typeof globalThis.fetch;
-let exitMock: ReturnType<typeof mock>;
+let exitMock: Mock<(code?: number | string | undefined) => never>;
 
 const CADET_ENTRY = {
   assistantId: "11111111-2222-3333-4444-555555555555",
@@ -126,19 +122,19 @@ function setArgv(...rest: string[]) {
 
 beforeEach(() => {
   originalFetch = globalThis.fetch;
-  exitMock = mock((code?: number) => {
+  exitMock = mock((code?: number | string | undefined): never => {
     throw new Error(`process.exit:${code}`);
   });
-  process.exit = exitMock as unknown as typeof process.exit;
+  process.exit = exitMock;
 
   findAssistantByNameMock.mockReset();
   findAssistantByNameMock.mockReturnValue(null);
-  readPlatformTokenMock.mockReset();
-  readPlatformTokenMock.mockReturnValue("platform-token");
-  getPlatformUrlMock.mockReset();
-  getPlatformUrlMock.mockReturnValue("https://cloud.mycadet.ai");
-  platformRequestSignedUrlMock.mockReset();
-  platformRequestSignedUrlMock.mockImplementation(async (params) => ({
+  readCloudTokenMock.mockReset();
+  readCloudTokenMock.mockReturnValue("platform-token");
+  getCloudUrlMock.mockReset();
+  getCloudUrlMock.mockReturnValue("https://cloud.mycadet.ai");
+  cloudRequestSignedUrlMock.mockReset();
+  cloudRequestSignedUrlMock.mockImplementation(async (params) => ({
     url:
       params.operation === "upload"
         ? "https://storage.googleapis.com/bucket/signed-upload"
@@ -162,17 +158,15 @@ beforeEach(() => {
   getBackupsDirMock.mockReset();
   getBackupsDirMock.mockReturnValue("/tmp/backups-default");
   loadGuardianTokenSpy.mockReset();
-  loadGuardianTokenSpy.mockReturnValue({
-    accessToken: "local-token",
-    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-  } as unknown as ReturnType<typeof guardianToken.loadGuardianToken>);
+  loadGuardianTokenSpy.mockReturnValue(
+    makeGuardianTokenData({ accessToken: "local-token" }),
+  );
   leaseGuardianTokenSpy.mockReset();
-  leaseGuardianTokenSpy.mockResolvedValue({
-    accessToken: "leased-token",
-    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
-  } as unknown as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>);
+  leaseGuardianTokenSpy.mockResolvedValue(
+    makeGuardianTokenData({ accessToken: "leased-token" }),
+  );
   mkdirSyncMock.mockReset();
-  mkdirSyncMock.mockImplementation((() => undefined) as never);
+  mkdirSyncMock.mockImplementation(() => undefined);
   writeFileSyncMock.mockReset();
   writeFileSyncMock.mockImplementation(() => undefined);
 });
@@ -185,9 +179,9 @@ afterAll(() => {
   // Restore module-level spies so they don't bleed into other test files
   // when bun test runs the whole suite.
   findAssistantByNameMock.mockRestore();
-  readPlatformTokenMock.mockRestore();
-  getPlatformUrlMock.mockRestore();
-  platformRequestSignedUrlMock.mockRestore();
+  readCloudTokenMock.mockRestore();
+  getCloudUrlMock.mockRestore();
+  cloudRequestSignedUrlMock.mockRestore();
   localRuntimeExportToGcsMock.mockRestore();
   localRuntimeIdentityMock.mockRestore();
   localRuntimePollJobStatusMock.mockRestore();
@@ -200,20 +194,26 @@ afterAll(() => {
 });
 
 import { backup } from "../commands/backup.js";
+import { withPreconnect } from "./helpers/http.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 // ---------------------------------------------------------------------------
 // Helper: simulated GCS download response
 // ---------------------------------------------------------------------------
-function mockGcsDownload(body: Uint8Array, ok = true, status = 200) {
-  globalThis.fetch = mock(async () => {
-    const responseBody: BodyInit = ok
-      ? new Blob([body as unknown as ArrayBuffer])
-      : "boom";
+function mockGcsDownload(
+  body: Uint8Array<ArrayBuffer>,
+  ok = true,
+  status = 200,
+) {
+  const gcsFetch = mock(async () => {
+    const responseBody: BodyInit = ok ? new Blob([body]) : "boom";
     return new Response(responseBody, {
       status,
       statusText: ok ? "OK" : "Error",
     });
-  }) as unknown as typeof globalThis.fetch;
+  });
+  globalThis.fetch = withPreconnect(gcsFetch);
+  return gcsFetch;
 }
 
 describe("cadet backup <local>: guardian bootstrap secret", () => {
@@ -228,11 +228,9 @@ describe("cadet backup <local>: guardian bootstrap secret", () => {
     loadGuardianTokenSpy.mockReturnValue(null);
     setArgv("my-local", "--output", "/tmp/local-backup.vbundle");
 
-    globalThis.fetch = mock(async () => {
-      return new Response(new Uint8Array([1, 2, 3]), {
-        status: 200,
-      });
-    }) as unknown as typeof globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async () => new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    );
 
     await backup();
 
@@ -294,9 +292,9 @@ describe("cadet backup: --export-timeout flag", () => {
       "/tmp/local-backup.vbundle",
     );
 
-    globalThis.fetch = mock(async () => {
-      return new Response(new Uint8Array([1, 2, 3]), { status: 200 });
-    }) as unknown as typeof globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async () => new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    );
 
     await backup();
 
@@ -307,18 +305,18 @@ describe("cadet backup: --export-timeout flag", () => {
   });
 });
 
-describe("cadet backup <platform-managed>: GCS happy path", () => {
+describe("cadet backup <cloud-managed>: GCS happy path", () => {
   test("requests upload URL → kicks off runtime export → polls → downloads from GCS → writes file", async () => {
     findAssistantByNameMock.mockReturnValue(CADET_ENTRY);
     setArgv("my-platform");
 
     const bytes = new Uint8Array([1, 2, 3, 4]);
-    mockGcsDownload(bytes);
+    const gcsFetch = mockGcsDownload(bytes);
 
     await backup();
 
-    // Upload-URL request to the platform.
-    expect(platformRequestSignedUrlMock).toHaveBeenCalledWith(
+    // Upload-URL request to the cloud.
+    expect(cloudRequestSignedUrlMock).toHaveBeenCalledWith(
       expect.objectContaining({
         operation: "upload",
         minRuntimeVersion: "0.6.5",
@@ -357,7 +355,7 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     // bundle to disk for offline storage; there is no target runtime to
     // gate against, and an older CLI must be able to download newer
     // assistant backups.
-    expect(platformRequestSignedUrlMock).toHaveBeenCalledWith(
+    expect(cloudRequestSignedUrlMock).toHaveBeenCalledWith(
       expect.objectContaining({
         operation: "download",
         bundleKey: "uploads/org-1/bundle-abc.vbundle",
@@ -365,14 +363,13 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
       "platform-token",
       "https://cloud.mycadet.ai",
     );
-    const downloadCall = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "download",
+    const downloadCall = cloudRequestSignedUrlMock.mock.calls.find(
+      (c) => c[0].operation === "download",
     );
     expect(downloadCall).toBeDefined();
     expect(downloadCall![0]).not.toHaveProperty("targetRuntimeVersion");
 
     // GCS fetch went directly to the signed download URL with no auth.
-    const gcsFetch = globalThis.fetch as unknown as ReturnType<typeof mock>;
     expect(gcsFetch).toHaveBeenCalledWith(
       "https://storage.googleapis.com/bucket/signed-download",
     );
@@ -382,7 +379,7 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     const [outputPath, written] = writeFileSyncMock.mock.calls[0]!;
     expect(written).toEqual(bytes);
     expect(typeof outputPath).toBe("string");
-    expect(outputPath as string).toMatch(
+    expect(outputPath).toMatch(
       /\/tmp\/backups-default\/my-platform-.*\.vbundle$/,
     );
     expect(mkdirSyncMock).toHaveBeenCalled();
@@ -411,22 +408,20 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     await backup();
 
     const [outputPath] = writeFileSyncMock.mock.calls[0]!;
-    expect(outputPath as string).toMatch(
-      /^\/tmp\/backups-default\/my-platform-/,
-    );
-    expect(outputPath as string).toMatch(/\.vbundle$/);
+    expect(outputPath).toMatch(/^\/tmp\/backups-default\/my-platform-/);
+    expect(outputPath).toMatch(/\.vbundle$/);
   });
 
-  test("signed-URL requests target entry.runtimeUrl, not getPlatformUrl() — regression for staging/dev assistants", async () => {
+  test("signed-URL requests target entry.runtimeUrl, not getCloudUrl() — regression for staging/dev assistants", async () => {
     // Assistant lives on a non-default platform instance (e.g. staging).
-    // `getPlatformUrl()` still returns the default — picking it up for
+    // `getCloudUrl()` still returns the default — picking it up for
     // signed URLs would target the wrong GCS bucket.
     const stagingEntry = {
       ...CADET_ENTRY,
       runtimeUrl: "https://staging-cloud.mycadet.ai",
     };
     findAssistantByNameMock.mockReturnValue(stagingEntry);
-    getPlatformUrlMock.mockReturnValue("https://cloud.mycadet.ai");
+    getCloudUrlMock.mockReturnValue("https://cloud.mycadet.ai");
     setArgv("my-platform");
 
     mockGcsDownload(new Uint8Array([9]));
@@ -434,9 +429,9 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     await backup();
 
     // Both upload and download URL requests are pinned to the entry's
-    // runtimeUrl. The signed URLs returned by the platform target the
+    // runtimeUrl. The signed URLs returned by the cloud target the
     // GCS bucket the runtime can reach, not the default platform's.
-    expect(platformRequestSignedUrlMock).toHaveBeenCalledWith(
+    expect(cloudRequestSignedUrlMock).toHaveBeenCalledWith(
       expect.objectContaining({
         operation: "upload",
         minRuntimeVersion: "0.6.5",
@@ -445,13 +440,13 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
       "platform-token",
       "https://staging-cloud.mycadet.ai",
     );
-    expect(platformRequestSignedUrlMock).toHaveBeenCalledWith(
+    expect(cloudRequestSignedUrlMock).toHaveBeenCalledWith(
       expect.objectContaining({ operation: "download" }),
       "platform-token",
       "https://staging-cloud.mycadet.ai",
     );
     // No call should have used the default platform URL.
-    const calls = platformRequestSignedUrlMock.mock.calls;
+    const calls = cloudRequestSignedUrlMock.mock.calls;
     for (const call of calls) {
       expect(call[2]).toBe("https://staging-cloud.mycadet.ai");
     }
@@ -471,20 +466,20 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
       status: "complete",
       result: {},
     }));
-    // Make readPlatformToken return a fresh value on the second call,
+    // Make readCloudToken return a fresh value on the second call,
     // mimicking the "user re-ran `cadet login` in another terminal"
     // scenario. The helper's pollJobUntilDone calls refreshOn401 only
     // when its own request 401s — for the test we drive the refresh
     // directly by overriding the mock to surface a fresh token at the
     // download-step boundary.
-    readPlatformTokenMock.mockReset();
-    readPlatformTokenMock.mockReturnValueOnce("platform-token-old");
-    readPlatformTokenMock.mockReturnValue("platform-token-new");
+    readCloudTokenMock.mockReset();
+    readCloudTokenMock.mockReturnValueOnce("platform-token-old");
+    readCloudTokenMock.mockReturnValue("platform-token-new");
 
     // Hook into pollJobUntilDone via overriding poll to intercept the
     // refresh call. Easier: just verify the second-arg token to the
     // download signed-URL request equals the one we'll inject by
-    // letting backup re-read the platform token mid-flight. The current
+    // letting backup re-read the cloud token mid-flight. The current
     // implementation only re-reads inside pollJobUntilDone's
     // `refreshOn401`, so we simulate a refresh by overriding poll to
     // throw-and-recover. Instead we directly assert the regression
@@ -499,13 +494,13 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
     // All four token-bearing platform calls (upload signed-URL, runtime
     // export-to-gcs kickoff, poll, download signed-URL) must use the
     // same token string. If the download step fell back to the captured
-    // `platformToken` parameter instead of `exportPlatformToken`, a
+    // `cloudToken` parameter instead of `exportPlatformToken`, a
     // future poll-loop refresh would silently break this invariant.
-    const uploadCallToken = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "upload",
+    const uploadCallToken = cloudRequestSignedUrlMock.mock.calls.find(
+      (c) => c[0].operation === "upload",
     )![1];
-    const downloadCallToken = platformRequestSignedUrlMock.mock.calls.find(
-      (c) => (c[0] as { operation: string }).operation === "download",
+    const downloadCallToken = cloudRequestSignedUrlMock.mock.calls.find(
+      (c) => c[0].operation === "download",
     )![1];
     expect(downloadCallToken).toBe(uploadCallToken);
     const kickoffToken = localRuntimeExportToGcsMock.mock.calls[0]![1];
@@ -515,10 +510,10 @@ describe("cadet backup <platform-managed>: GCS happy path", () => {
   });
 });
 
-describe("cadet backup <platform-managed>: failure cases", () => {
+describe("cadet backup <cloud-managed>: failure cases", () => {
   test("not logged in (no platform token) exits with 'Run cadet login'", async () => {
     findAssistantByNameMock.mockReturnValue(CADET_ENTRY);
-    readPlatformTokenMock.mockReturnValue(null);
+    readCloudTokenMock.mockReturnValue(null);
     setArgv("my-platform");
 
     const consoleErrorSpy = spyOn(console, "error").mockImplementation(
@@ -611,7 +606,7 @@ describe("cadet backup <platform-managed>: failure cases", () => {
 
 // NOTE: The `VersionMismatchError handling` describe block was removed when
 // backup stopped sending `targetRuntimeVersion` on the download signed-URL
-// request — without that field the platform doesn't run the version gate,
+// request — without that field the cloud doesn't run the version gate,
 // so 422 `version_mismatch` is no longer reachable from this code path.
 
 // ---------------------------------------------------------------------------
@@ -628,7 +623,7 @@ describe("upload signed-URL records source runtime version (not CLI version)", (
       callOrder.push("identity");
       return { version: "0.5.9" };
     });
-    platformRequestSignedUrlMock.mockImplementationOnce(async (params) => {
+    cloudRequestSignedUrlMock.mockImplementationOnce(async (params) => {
       callOrder.push("signed-url");
       return {
         url: "https://storage.googleapis.com/bucket/signed-upload",
@@ -644,7 +639,7 @@ describe("upload signed-URL records source runtime version (not CLI version)", (
     expect(callOrder[0]).toBe("identity");
     expect(callOrder[1]).toBe("signed-url");
 
-    expect(platformRequestSignedUrlMock).toHaveBeenCalledWith(
+    expect(cloudRequestSignedUrlMock).toHaveBeenCalledWith(
       expect.objectContaining({
         operation: "upload",
         minRuntimeVersion: "0.5.9",
@@ -655,7 +650,7 @@ describe("upload signed-URL records source runtime version (not CLI version)", (
     );
   });
 
-  test("identity is fetched against the platform-managed runtime entry with the platform token", async () => {
+  test("identity is fetched against the cloud-managed runtime entry with the cloud token", async () => {
     findAssistantByNameMock.mockReturnValue(CADET_ENTRY);
     setArgv("my-platform");
 
@@ -688,7 +683,7 @@ describe("upload signed-URL records source runtime version (not CLI version)", (
       await expect(backup()).rejects.toThrow("process.exit:1");
 
       // Signed-URL must NOT have been requested.
-      expect(platformRequestSignedUrlMock).not.toHaveBeenCalled();
+      expect(cloudRequestSignedUrlMock).not.toHaveBeenCalled();
       expect(localRuntimeExportToGcsMock).not.toHaveBeenCalled();
 
       expect(consoleErrorSpy).toHaveBeenCalledWith(

package/src/__tests__/client-token.test.ts

@@ -90,7 +90,7 @@ describe("client --token (ephemeral)", () => {
     expect(parsed.runtimeUrl).toBe(REMOTE_URL);
     expect(parsed.assistantId).toBe("self"); // DAEMON_INTERNAL_ASSISTANT_ID
     expect(parsed.bearerToken).toBe("test-jwt-token");
-    expect(parsed.platformToken).toBeUndefined();
+    expect(parsed.cloudToken).toBeUndefined();
   });
 
   test("--assistant-id overrides the default 'self' segment", () => {

package/src/__tests__/client-tui-refresh.test.ts

@@ -166,7 +166,7 @@ describe("resolveFreshBearerToken", () => {
     expect(refresh.hit()).toBe(false);
   });
 
-  test("never refreshes on the platform session-auth path", async () => {
+  test("never refreshes on the cloud session-auth path", async () => {
     seed({ accessToken: "old-acc", refreshToken: "ref", refreshAfter: past() });
     const refresh = stubRefresh(true);
 

package/src/__tests__/client-web-config.test.ts

@@ -12,8 +12,8 @@ import { buildWebInterfaceConfig } from "../commands/client.js";
 
 const BASE = {
   webUrl: "https://app.example.com",
-  platformUrl: "https://platform.example.com",
-  disablePlatform: true,
+  cloudUrl: "https://platform.example.com",
+  disableCloud: true,
 };
 
 describe("cadet client web __config", () => {