@mycadet/cli 0.12.7 → 0.12.9

package/src/__tests__/hatch-provider-secrets.test.ts

@@ -292,7 +292,7 @@ describe("hatch provider secrets", () => {
   test("HATCH_PROVIDER_CHOICES only lists labeled providers", () => {
     for (const provider of HATCH_PROVIDER_CHOICES) {
       expect(formatProviderName(provider)).toBeTruthy();
-      // Cadet Cloud is the managed-connection exception: no env var, no
+      // Cadet Cloud is the cloud-connection exception: no env var, no
       // key collection — everything else must have a supported setup flow.
       if (provider !== "cadet") {
         expect(isSupportedLlmProvider(provider)).toBe(true);
@@ -313,7 +313,7 @@ describe("hatch provider secrets", () => {
     ]);
   });
 
-  test("Cadet Cloud configures silently through the managed connection", async () => {
+  test("Cadet Cloud configures silently through the cloud connection", async () => {
     const { calls, fetchImpl } = makeFetch([]);
     const logs: string[] = [];
 

package/src/__tests__/helpers/guardian-token.ts

@@ -0,0 +1,22 @@
+import type { GuardianTokenData } from "../../lib/guardian-token.js";
+
+/**
+ * A complete `GuardianTokenData` fixture with per-test overrides — the type's
+ * nine fields are all required, so partial fakes need this to stand in.
+ */
+export function makeGuardianTokenData(
+  over: Partial<GuardianTokenData> = {},
+): GuardianTokenData {
+  return {
+    guardianPrincipalId: "principal-1",
+    accessToken: "local-token",
+    accessTokenExpiresAt: new Date(Date.now() + 60_000).toISOString(),
+    refreshToken: "refresh-token",
+    refreshTokenExpiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+    refreshAfter: new Date(Date.now() + 30_000).toISOString(),
+    isNew: false,
+    deviceId: "device-1",
+    leasedAt: new Date().toISOString(),
+    ...over,
+  };
+}

package/src/__tests__/helpers/http.ts

@@ -0,0 +1,10 @@
+/**
+ * bun-types' global fetch carries a `preconnect` member; these mocks only need
+ * the call shape, so hand the assignment a member-complete callable. The SUT
+ * never calls `preconnect`.
+ */
+export function withPreconnect(
+  impl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>,
+): typeof globalThis.fetch {
+  return Object.assign(impl, { preconnect: () => {} });
+}

package/src/__tests__/nginx-ingress.test.ts

@@ -158,9 +158,9 @@ describe("buildIngressNginxConfig", () => {
     remoteWebIngress: {
       webDistDir: "/tmp/cadet web/dist",
       config: {
-        mode: "remote-gateway",
+        remote: "docker",
         apiBaseUrl: "/v1",
-        platformDisabled: true,
+        cloudDisabled: true,
       },
     },
   });
@@ -330,7 +330,7 @@ describe("buildIngressNginxConfig", () => {
     expect(remoteConf).toContain("default_type application/json;");
     expect(remoteConf).toContain('add_header Cache-Control "no-store";');
     expect(remoteConf).toContain(
-      'return 200 "{\\"mode\\":\\"remote-gateway\\",\\"apiBaseUrl\\":\\"/v1\\",\\"platformDisabled\\":true,\\"disablePlatform\\":true}";',
+      'return 200 "{\\"remote\\":\\"docker\\",\\"apiBaseUrl\\":\\"/v1\\",\\"cloudDisabled\\":true,\\"disableCloud\\":true}";',
     );
     expect(remoteConf).not.toContain("assistantId");
   });
@@ -347,7 +347,7 @@ describe("buildIngressNginxConfig", () => {
       },
     });
     expect(named).toContain(
-      'return 200 "{\\"mode\\":\\"remote-gateway\\",\\"apiBaseUrl\\":\\"/v1\\",\\"platformDisabled\\":true,\\"disablePlatform\\":true,\\"assistantName\\":\\"Homelab\\",\\"assistantId\\":\\"assistant-1\\",\\"hubUrl\\":\\"https://mycadet.ai/assistant\\"}";',
+      'return 200 "{\\"remote\\":\\"custom\\",\\"apiBaseUrl\\":\\"/v1\\",\\"cloudDisabled\\":true,\\"disableCloud\\":true,\\"assistantName\\":\\"Homelab\\",\\"assistantId\\":\\"assistant-1\\",\\"hubUrl\\":\\"https://mycadet.ai/assistant\\"}";',
     );
   });
 
@@ -447,19 +447,19 @@ describe("buildRemoteWebIndexHtml", () => {
     const html =
       '<html><head><script>window.__CADET_CONFIG__={"webUrl":"https://mycadet.ai"}</script></head><body></body></html>';
     const result = buildRemoteWebIndexHtml(html, {
-      mode: "remote-gateway",
+      remote: "docker",
       apiBaseUrl: "/v1",
-      disablePlatform: true,
+      disableCloud: true,
     });
 
     expect(result).toContain(
       'window.__CADET_CONFIG__={"webUrl":"https://mycadet.ai"}',
     );
     expect(result).toContain(
-      'window.__CADET_CONFIG__={"mode":"remote-gateway","apiBaseUrl":"/v1","disablePlatform":true}',
+      'window.__CADET_CONFIG__={"remote":"docker","apiBaseUrl":"/v1","disableCloud":true}',
     );
     expect(result.indexOf('"webUrl"')).toBeLessThan(
-      result.indexOf('"remote-gateway"'),
+      result.indexOf('"docker"'),
     );
   });
 
@@ -484,7 +484,7 @@ describe("buildRemoteWebIndexHtml", () => {
       "</head><body></body></html>",
     ].join("\n");
 
-    const result = buildRemoteWebIndexHtml(html, { mode: "remote-gateway" });
+    const result = buildRemoteWebIndexHtml(html, { remote: "docker" });
 
     expect(result.match(/rel="modulepreload"/g)).toHaveLength(4);
     expect(result).toContain('href="/assistant/assets/a-1.js"');
@@ -506,7 +506,7 @@ describe("buildRemoteWebIndexHtml", () => {
       "</head><body></body></html>",
     ].join("\n");
 
-    const result = buildRemoteWebIndexHtml(html, { mode: "remote-gateway" });
+    const result = buildRemoteWebIndexHtml(html, { remote: "docker" });
 
     expect(result).not.toContain("modulepreload");
     expect(result).not.toContain("/assistant/assets/chunk-0.js");
@@ -522,7 +522,7 @@ describe("buildRemoteWebIndexHtml", () => {
     );
     const html = `<html><head>${preloads.join("\n")}</head><body></body></html>`;
 
-    const result = buildRemoteWebIndexHtml(html, { mode: "remote-gateway" });
+    const result = buildRemoteWebIndexHtml(html, { remote: "docker" });
 
     expect(result.match(/rel="modulepreload"/g)).toHaveLength(
       MAX_PRESERVED_MODULE_PRELOADS,
@@ -862,10 +862,10 @@ function spaConfigHash(
       JSON.stringify({
         template: EDGE_TEMPLATE_VERSION,
         config: {
-          mode: "remote-gateway",
+          remote: "custom",
           apiBaseUrl: "/v1",
-          platformDisabled: true,
-          disablePlatform: true,
+          cloudDisabled: true,
+          disableCloud: true,
           ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
           ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
           hubUrl: PRODUCTION_HUB_URL,
@@ -988,7 +988,7 @@ describe("startRemoteWebIngress", () => {
       join(ws, "data", "ingress", "assistant-index.html"),
       "utf-8",
     );
-    expect(indexHtml).toContain("remote-gateway");
+    expect(indexHtml).toContain('"remote":"custom"');
     expect(indexHtml).toContain(`"hubUrl":"${PRODUCTION_HUB_URL}"`);
     // No assistant name was provided, so the served config omits the label.
     expect(indexHtml).not.toContain("assistantName");
@@ -1352,10 +1352,10 @@ describe("startRemoteWebIngress", () => {
         JSON.stringify({
           template: 1,
           config: {
-            mode: "remote-gateway",
+            remote: "custom",
             apiBaseUrl: "/v1",
-            platformDisabled: true,
-            disablePlatform: true,
+            cloudDisabled: true,
+            disableCloud: true,
             hubUrl: PRODUCTION_HUB_URL,
           },
         }),
@@ -2095,8 +2095,9 @@ describe("ensureTunnelEdge", () => {
       gatewayPort: 7830,
     });
 
-    await expect(promise).rejects.toThrow("brew install nginx");
-    await expect(promise).rejects.toThrow("apt install nginx");
+    await expect(promise).rejects.toThrow(
+      "See https://nginx.org/en/docs/install.html for how to install",
+    );
     await expect(promise).rejects.toThrow("NGINX_BIN");
     expect(spawnMock).not.toHaveBeenCalled();
   });

package/src/__tests__/ngrok-spawn.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+
+import { buildNgrokSpawnArgs, isNgrokAuthError } from "../lib/tunnels/ngrok.js";
+
+describe("buildNgrokSpawnArgs", () => {
+  test("spawns a plain http agent against the loopback edge", () => {
+    expect(buildNgrokSpawnArgs(7830)).toEqual([
+      "http",
+      "127.0.0.1:7830",
+      "--log=stdout",
+    ]);
+  });
+
+  test("never passes --config so the default (authtoken-bearing) config loads", () => {
+    const args = buildNgrokSpawnArgs(7830, "me.ngrok.app");
+    expect(args.some((arg) => arg.startsWith("--config"))).toBe(false);
+  });
+
+  test("binds a reserved domain when given", () => {
+    expect(buildNgrokSpawnArgs(7830, "my-assistant.ngrok.app")).toEqual([
+      "http",
+      "127.0.0.1:7830",
+      "--log=stdout",
+      "--domain=my-assistant.ngrok.app",
+    ]);
+  });
+});
+
+describe("isNgrokAuthError", () => {
+  test("recognizes the free-account authtoken requirement", () => {
+    expect(
+      isNgrokAuthError(
+        "FATAL: authentication failed: Usage of ngrok requires a free authtoken. ERR_NGROK_105",
+      ),
+    ).toBe(true);
+  });
+
+  test("recognizes an unauthorized token", () => {
+    expect(isNgrokAuthError("unauthorized authtoken ERR_NGROK_401")).toBe(true);
+  });
+
+  test("does not claim other startup failures are auth errors", () => {
+    expect(
+      isNgrokAuthError(
+        "creating tunnel session failed: dial tcp 3.219.x.x:443: connection refused",
+      ),
+    ).toBe(false);
+  });
+});

package/src/__tests__/orphan-detection.test.ts

@@ -141,7 +141,7 @@ describe("loadAllAssistantsAcrossEnvs", () => {
   function makeEnv(name: string, lockfileDir: string): EnvironmentDefinition {
     return {
       name,
-      platformUrl: "https://example.invalid",
+      cloudUrl: "https://example.invalid",
       webUrl: "https://example.invalid",
       lockfileDirOverride: lockfileDir,
     };

package/src/__tests__/pair.test.ts

@@ -20,14 +20,7 @@ const originalEnvironment = process.env.CADET_ENVIRONMENT;
 process.env.CADET_ENVIRONMENT = "production";
 
 import { buildAppConnectUrl, pair } from "../commands/pair.js";
-
-// bun-types' global fetch carries a `preconnect` member; these mocks only need
-// the call shape, so hand the assignment a member-complete callable.
-function withPreconnect(
-  impl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>,
-): typeof fetch {
-  return Object.assign(impl, { preconnect: () => {} });
-}
+import { withPreconnect } from "./helpers/http.js";
 
 // Distinct loopback (mint) vs reachable (advertised) URLs to verify the split.
 const LOCAL_URL = "http://127.0.0.1:7830";

package/src/__tests__/{ps-platform-status.test.ts → ps-cloud-status.test.ts}

@@ -26,12 +26,16 @@ process.env.CADET_LOCKFILE_DIR = testDir;
 import * as assistantConfig from "../lib/assistant-config.js";
 import * as healthCheck from "../lib/health-check.js";
 import * as orphanDetection from "../lib/orphan-detection.js";
-import * as platformClient from "../lib/platform-client.js";
+import * as cloudClient from "../lib/cloud-client.js";
 
 const loadAllAssistantsMock = spyOn(
   assistantConfig,
   "loadAllAssistants",
 ).mockReturnValue([]);
+const readRootProcessesMock = spyOn(
+  assistantConfig,
+  "readRootProcesses",
+).mockReturnValue({});
 const getActiveAssistantMock = spyOn(
   assistantConfig,
   "getActiveAssistant",
@@ -40,31 +44,31 @@ const detectOrphanedProcessesMock = spyOn(
   orphanDetection,
   "detectOrphanedProcesses",
 ).mockResolvedValue([]);
-const getPlatformUrlMock = spyOn(
-  platformClient,
-  "getPlatformUrl",
+const getCloudUrlMock = spyOn(
+  cloudClient,
+  "getCloudUrl",
 ).mockReturnValue("http://platform.test");
 
-// Per-test toggle for `readPlatformToken`.
-const readPlatformTokenMock = spyOn(
-  platformClient,
-  "readPlatformToken",
+// Per-test toggle for `readCloudToken`.
+const readCloudTokenMock = spyOn(
+  cloudClient,
+  "readCloudToken",
 ).mockReturnValue(null);
 
-// `fetchCurrentUser` + `fetchPlatformAssistants` are spied so we can assert
+// `fetchCurrentUser` + `fetchCloudAssistants` are spied so we can assert
 // they're never invoked on the no-token path, and re-shaped per-test for the
 // token-but-unreachable path.
 const fetchCurrentUserMock = spyOn(
-  platformClient,
+  cloudClient,
   "fetchCurrentUser",
 ).mockResolvedValue({
   id: "u1",
   email: "test@example.com",
   display: "Test",
 });
-const fetchPlatformAssistantsMock = spyOn(
-  platformClient,
-  "fetchPlatformAssistants",
+const fetchCloudAssistantsMock = spyOn(
+  cloudClient,
+  "fetchCloudAssistants",
 ).mockResolvedValue([]);
 const checkManagedHealthMock = spyOn(
   healthCheck,
@@ -99,33 +103,36 @@ beforeEach(() => {
   }) as typeof process.stdout.write;
 });
 
+const NL = String.fromCharCode(10);
+
 afterEach(() => {
   console.log = originalLog;
   console.error = originalError;
   process.stdout.write = originalStdoutWrite;
   loadAllAssistantsMock.mockReturnValue([]);
   getActiveAssistantMock.mockReturnValue(null);
-  readPlatformTokenMock.mockReturnValue(null);
+  readCloudTokenMock.mockReturnValue(null);
   fetchCurrentUserMock.mockReset();
   fetchCurrentUserMock.mockResolvedValue({
     id: "u1",
     email: "test@example.com",
     display: "Test",
   });
-  fetchPlatformAssistantsMock.mockReset();
-  fetchPlatformAssistantsMock.mockResolvedValue([]);
+  fetchCloudAssistantsMock.mockReset();
+  fetchCloudAssistantsMock.mockResolvedValue([]);
   checkManagedHealthMock.mockReset();
   checkManagedHealthMock.mockResolvedValue({ status: "healthy", detail: null });
+  readRootProcessesMock.mockReturnValue({});
 });
 
 afterAll(() => {
   loadAllAssistantsMock.mockRestore();
   getActiveAssistantMock.mockRestore();
   detectOrphanedProcessesMock.mockRestore();
-  getPlatformUrlMock.mockRestore();
-  readPlatformTokenMock.mockRestore();
+  getCloudUrlMock.mockRestore();
+  readCloudTokenMock.mockRestore();
   fetchCurrentUserMock.mockRestore();
-  fetchPlatformAssistantsMock.mockRestore();
+  fetchCloudAssistantsMock.mockRestore();
   checkManagedHealthMock.mockRestore();
   rmSync(testDir, { recursive: true, force: true });
 });
@@ -142,7 +149,7 @@ import { listAllAssistants } from "../commands/ps.js";
 
 describe("cadet ps — platform status line", () => {
   test("no local token: no login-status line, skips ALL network fetches", async () => {
-    readPlatformTokenMock.mockReturnValue(null);
+    readCloudTokenMock.mockReturnValue(null);
 
     await listAllAssistants(false);
 
@@ -155,20 +162,20 @@ describe("cadet ps — platform status line", () => {
       false,
     );
 
-    // Structural guarantee: we never even tried to talk to the platform.
+    // Structural guarantee: we never even tried to talk to the cloud.
     expect(fetchCurrentUserMock).not.toHaveBeenCalled();
-    expect(fetchPlatformAssistantsMock).not.toHaveBeenCalled();
+    expect(fetchCloudAssistantsMock).not.toHaveBeenCalled();
   });
 
   test("local token present but platform is unreachable: no status line, no leaked org-fetch error", async () => {
-    readPlatformTokenMock.mockReturnValue("session_abc123");
+    readCloudTokenMock.mockReturnValue("session_abc123");
     // Simulate the exact Bun connect failure the user reported:
     //   "Unable to connect. Is the computer able to access the url?"
     const connectError = new Error(
       "Unable to connect. Is the computer able to access the url?",
     );
     fetchCurrentUserMock.mockRejectedValue(connectError);
-    fetchPlatformAssistantsMock.mockRejectedValue(connectError);
+    fetchCloudAssistantsMock.mockRejectedValue(connectError);
 
     await listAllAssistants(false);
 
@@ -183,13 +190,13 @@ describe("cadet ps — platform status line", () => {
   });
 
   test("local token present and platform reachable: no login-status line", async () => {
-    readPlatformTokenMock.mockReturnValue("session_abc123");
+    readCloudTokenMock.mockReturnValue("session_abc123");
     fetchCurrentUserMock.mockResolvedValue({
       id: "u1",
       email: "user@example.com",
       display: "Example User",
     });
-    fetchPlatformAssistantsMock.mockResolvedValue([]);
+    fetchCloudAssistantsMock.mockResolvedValue([]);
 
     await listAllAssistants(false);
 
@@ -217,6 +224,52 @@ describe("cadet ps — platform status line", () => {
     }
   });
 
+  test("CLI-managed root processes nest under the assistant they front", async () => {
+    loadAllAssistantsMock.mockReturnValue([
+      {
+        assistantId: "assistant-123",
+        name: "Alice",
+        runtimeUrl: "https://platform.example",
+        cloud: "cadet",
+      },
+      {
+        assistantId: "assistant-456",
+        name: "Bob",
+        runtimeUrl: "https://platform.example/b",
+        cloud: "cadet",
+      },
+    ]);
+    getActiveAssistantMock.mockReturnValue(null);
+    checkManagedHealthMock.mockImplementation(async () => ({
+      status: "healthy",
+      detail: null,
+    }));
+    // The tunnel fronts Alice (recorded id); the edge records no assistant.
+    readRootProcessesMock.mockReturnValue({
+      tunnel: {
+        pid: 4242,
+        provider: "ngrok",
+        startedAt: "2026-10-11T00:00:00.000Z",
+        assistantId: "assistant-123",
+      },
+      app: { pid: 77, startedAt: "2026-10-11T00:00:00.000Z" },
+    });
+
+    await listAllAssistants(false);
+
+    const output = stdout.join(NL);
+    // The tunnel nests under Alice — its name is just the provider now…
+    expect(output).toContain("└ ngrok");
+    // …the unattributed edge renders machine-level…
+    expect(output).toContain("nginx edge");
+    // …the type column distinguishes the three process kinds…
+    expect(output).toContain("🧑‍🚀 Assistant");
+    expect(output).toContain("🚇 Tunnel");
+    expect(output).toContain("🌐 App");
+    // …and the second table is gone: one header row only.
+    expect(output.match(/NAME/g)?.length).toBe(1);
+  });
+
   test("assistant rows use display name as primary label and keep id visible", async () => {
     loadAllAssistantsMock.mockReturnValue([
       {

package/src/__tests__/ps-table.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, test } from "bun:test";
+
+import { displayWidth, formatRow } from "../commands/ps.js";
+
+describe("displayWidth", () => {
+  test("ascii strings count one cell per character", () => {
+    expect(displayWidth("healthy")).toBe(7);
+    expect(displayWidth("")).toBe(0);
+  });
+
+  test("emoji count two cells", () => {
+    expect(displayWidth("🟢")).toBe(2);
+    expect(displayWidth("🚀")).toBe(2);
+  });
+
+  test("the ZWJ astronaut sequence counts two cells, not its UTF-16 length", () => {
+    // "🧑‍🚀" is 5 UTF-16 units but renders 2 cells wide.
+    expect(displayWidth("🧑‍🚀 Assistant")).toBe(12);
+  });
+
+  test("a variation selector widens a narrow symbol to two cells", () => {
+    expect(displayWidth("⚠️ warn")).toBe(7);
+  });
+});
+
+describe("ps table alignment", () => {
+  const colWidths = { name: 15, type: 14, status: 10, info: 0 };
+
+  /** The terminal column where `marker` starts (string indices shift under
+   * emoji, which render 2 cells but span 2 UTF-16 units or more). */
+  const columnOf = (s: string, marker: string): number =>
+    displayWidth(s.slice(0, s.indexOf(marker)));
+
+  test("emoji cells keep every later column aligned", () => {
+    const emojiRow = formatRow(
+      {
+        name: "slim-yak",
+        type: "🧑‍🚀 Assistant",
+        status: "🟢 healthy",
+        info: "http://x",
+      },
+      colWidths,
+    );
+    const asciiRow = formatRow(
+      {
+        name: "plain",
+        type: "Assistant",
+        status: "healthy",
+        info: "http://y",
+      },
+      colWidths,
+    );
+    expect(columnOf(emojiRow, "http://x")).toBe(columnOf(asciiRow, "http://y"));
+  });
+
+  test("the header separator matches the emoji row's column starts", () => {
+    const widths = {
+      name: displayWidth("slim-yak-yhpdq6"),
+      type: displayWidth("🧑‍🚀 Assistant"),
+      status: displayWidth("🟢 healthy"),
+      info: 0,
+    };
+    const header = formatRow(
+      { name: "NAME", type: "TYPE", status: "STATUS", info: "INFO" },
+      widths,
+    );
+    const row = formatRow(
+      {
+        name: "slim-yak-yhpdq6",
+        type: "🧑‍🚀 Assistant",
+        status: "🟢 healthy",
+        info: "http://127.0.0.1:7830",
+      },
+      widths,
+    );
+    expect(columnOf(header, "TYPE")).toBe(columnOf(row, "🧑‍🚀"));
+    expect(columnOf(header, "STATUS")).toBe(columnOf(row, "🟢"));
+  });
+});