@mycadet/cli 0.12.8 → 0.12.9-dev.202610131620.d833e01

package/src/lib/tunnels/ngrok.ts

@@ -13,6 +13,7 @@ import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 
 import { GATEWAY_PORT } from "../constants.js";
 import { clearRootProcess, stampRootProcess } from "../assistant-config.js";
+import { ensureBinaryInstalled, readLineText } from "../ensure-binary.js";
 import {
   clearIngressUrl,
   getDefaultWorkspaceDir,
@@ -81,6 +82,52 @@ export function getNgrokVersion(): string | null {
   }
 }
 
+/** Whether captured agent output says the startup failure was authentication. */
+export function isNgrokAuthError(output: string): boolean {
+  return /authtoken|authenticat|unauthorized|usage limit|ERR_NGROK_10\d\d|ERR_NGROK_40\d\d/i.test(
+    output,
+  );
+}
+
+/** An ngrok agent that exited during startup, with its captured output. */
+export class NgrokStartupError extends Error {
+  readonly exitCode: number;
+  readonly output: string;
+
+  constructor(exitCode: number, output: string) {
+    super(`ngrok exited with code ${exitCode}`);
+    this.exitCode = exitCode;
+    this.output = output;
+  }
+}
+
+/** Paste-in attempts before the tunnel command gives up and says how. */
+const MAX_AUTH_RETRIES = 2;
+
+/**
+ * Run `ngrok config add-authtoken <token>` — writing the user's default
+ * ngrok config, which is exactly the config the tunnel spawn loads. The
+ * token is never echoed: output is piped and any failure message has the
+ * token scrubbed.
+ */
+export function saveNgrokAuthToken(token: string): boolean {
+  try {
+    execFileSync("ngrok", ["config", "add-authtoken", token], {
+      encoding: "utf-8",
+      timeout: 10_000,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+    });
+    return true;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `⚠ Couldn't save the authtoken: ${message.replaceAll(token, "***")}`,
+    );
+    return false;
+  }
+}
+
 /**
  * Query the ngrok local API for running tunnels.
  * Returns the list of tunnels, or null if the API is unreachable.
@@ -159,11 +206,11 @@ type NgrokConfigFile = z.infer<typeof NgrokConfigFileSchema>;
 type NgrokTunnelDef = z.infer<typeof NgrokTunnelDefSchema>;
 
 /**
- * The ngrok-format config file this CLI owns in the XDG config dir, layered
- * over the user's root ngrok config at spawn time (`--config` files merge in
- * order, later wins; the user's authtoken keeps living in their root config).
- * It is also the source of truth for the reserved domain at this layer — the
- * workspace config no longer records one.
+ * The ngrok-format config file this CLI owns in the XDG config dir. It no
+ * longer participates in spawning (plain `ngrok http` loads the user's
+ * default config, keeping their authtoken in play); it is the source of
+ * truth for the reserved domain at this layer — the workspace config no
+ * longer records one.
  */
 export function ngrokConfigPath(): string {
   return join(getConfigDir(getCurrentEnvironment()), "tunnels", "ngrok.yaml");
@@ -250,43 +297,34 @@ function urlMatchesDomain(publicUrl: string, domain: string): boolean {
   }
 }
 
-/**
- * Write the cadet-owned XDG ngrok config for this run: the tunnel definition
- * `ngrok start` reads, carrying the loopback target and — when reserved — the
- * bound domain. The file is layered over the user's root ngrok config at
- * spawn, so their authtoken and settings keep applying untouched.
- */
-function writeNgrokConfig(targetPort: number, domain?: string): void {
-  const config = readNgrokConfigFile();
-  const cadet: NgrokTunnelDef = {
-    ...config.tunnels?.[NGROK_TUNNEL_NAME],
-    proto: "http",
-    // Explicit over a bare port, which ngrok expands to `localhost`, whose
-    // ::1 answer resolves first on macOS and races the edge's IPv4 bind.
-    addr: `127.0.0.1:${targetPort}`,
-  };
+/** The argv for an ngrok agent forwarding the edge port, domain when set. */
+export function buildNgrokSpawnArgs(
+  targetPort: number,
+  domain?: string,
+): string[] {
+  const args = ["http", `127.0.0.1:${targetPort}`, "--log=stdout"];
   if (domain) {
-    cadet.domain = domain;
+    args.push(`--domain=${domain}`);
   }
-  const tunnels: Record<string, NgrokTunnelDef> = { ...config.tunnels };
-  tunnels[NGROK_TUNNEL_NAME] = cadet;
-  const next: NgrokConfigFile = { ...config, version: config.version ?? "2" };
-  next.tunnels = tunnels;
-  writeNgrokConfigFile(next);
+  return args;
 }
 
 /**
- * Start an ngrok process tunneling HTTP traffic to the given local port, via
- * the cadet-owned XDG config (`ngrok start cadet`) so the agent never collides
- * with the host machine's root ngrok config.
+ * Start an ngrok process tunneling HTTP traffic to the given local port.
+ *
+ * Plain `ngrok http` is spawned deliberately: ngrok only loads the user's
+ * default config — where `ngrok config add-authtoken` writes — when no
+ * `--config` is passed, so this is what keeps the authtoken in play. The
+ * explicit `127.0.0.1:` host avoids a bare port, which ngrok expands to
+ * `localhost`, whose ::1 answer resolves first on macOS and races the edge's
+ * IPv4 bind.
  *
  * When `logFilePath` is provided, stdout/stderr are redirected to that file
  * instead of being piped. This avoids keeping pipe handles open in the
  * parent process — which would either prevent the CLI from exiting (if
  * handles are left open) or send SIGPIPE to ngrok (if destroyed).
  *
- * When `domain` is set, the spawned tunnel binds that reserved ngrok domain,
- * recorded in the XDG config alongside the loopback target.
+ * When `domain` is set, the spawned tunnel binds that reserved ngrok domain.
  *
  * Returns the spawned child process.
  */
@@ -304,15 +342,7 @@ export function startNgrokProcess(
     stdio = ["ignore", fd, fd];
   }
 
-  writeNgrokConfig(targetPort, domain);
-  const args = [
-    "start",
-    NGROK_TUNNEL_NAME,
-    `--config=${ngrokConfigPath()}`,
-    "--log=stdout",
-  ];
-
-  const child = spawn("ngrok", args, {
+  const child = spawn("ngrok", buildNgrokSpawnArgs(targetPort, domain), {
     detached: true,
     stdio,
     windowsHide: true,
@@ -534,18 +564,26 @@ export interface RunNgrokTunnelOptions {
 export async function runNgrokTunnel(
   opts: RunNgrokTunnelOptions = {},
 ): Promise<ProviderTunnelResult> {
-  const version = getNgrokVersion();
+  const version = await ensureBinaryInstalled({
+    binary: "ngrok",
+    purpose: "the ngrok tunnel",
+    packages: {
+      brew: ["brew", "install", "ngrok/ngrok/ngrok"],
+      snap: ["sudo", "snap", "install", "ngrok"],
+      choco: ["choco", "install", "-y", "ngrok"],
+      winget: [
+        "winget",
+        "install",
+        "--silent",
+        "--accept-package-agreements",
+        "--accept-source-agreements",
+        "ngrok.ngrok",
+      ],
+    },
+    manualHint: "See https://ngrok.com/download for how to install",
+    probe: getNgrokVersion,
+  });
   if (!version) {
-    console.error("Error: ngrok is not installed.");
-    console.error("");
-    console.error("Install ngrok:");
-    console.error("  macOS:  brew install ngrok/ngrok/ngrok");
-    console.error("  Linux:  sudo snap install ngrok");
-    console.error("");
-    console.error("Then authenticate: ngrok config add-authtoken <your-token>");
-    console.error(
-      "  Get your token at: https://dashboard.ngrok.com/get-started/your-authtoken",
-    );
     process.exit(1);
   }
 
@@ -607,12 +645,14 @@ export async function runNgrokTunnel(
   console.log(`Starting ngrok tunnel to localhost:${port}...`);
 
   let publicUrl: string | undefined;
-
-  const ngrokProcess = startNgrokProcess(port, undefined, domain);
+  // Points at the live agent across auth retries; signals and cleanup act on
+  // whichever attempt is current.
+  let currentNgrok: ChildProcess | null = null;
+  let authAttempts = 0;
 
   const cleanup = () => {
-    if (!ngrokProcess.killed) {
-      ngrokProcess.kill("SIGTERM");
+    if (currentNgrok && !currentNgrok.killed) {
+      currentNgrok.kill("SIGTERM");
     }
     clearRootProcess("tunnel");
     if (publicUrl) {
@@ -630,66 +670,116 @@ export async function runNgrokTunnel(
     process.exit(0);
   });
 
-  ngrokProcess.on("error", (err: Error) => {
-    console.error(`ngrok process error: ${err.message}`);
-    process.exit(1);
-  });
+  while (publicUrl === undefined) {
+    const ngrokProcess = startNgrokProcess(port, undefined, domain);
+    currentNgrok = ngrokProcess;
 
-  ngrokProcess.on("exit", (code: number | null) => {
-    if (code !== null && code !== 0) {
-      console.error(`ngrok exited with code ${code}.`);
-      console.error(
-        "Check that ngrok is authenticated: ngrok config add-authtoken <token>",
-      );
+    // Captured per attempt so an authentication failure can be told apart
+    // from other startup failures and recovered with a pasted-in token.
+    const ngrokOutput: string[] = [];
+
+    ngrokProcess.on("error", (err: Error) => {
+      console.error(`ngrok process error: ${err.message}`);
       process.exit(1);
+    });
+
+    // Pipe ngrok stdout/stderr to console for visibility
+    ngrokProcess.stdout?.on("data", (data: Buffer) => {
+      const line = data.toString().trim();
+      if (line) {
+        ngrokOutput.push(line);
+        console.log(`[ngrok] ${line}`);
+      }
+    });
+    ngrokProcess.stderr?.on("data", (data: Buffer) => {
+      const line = data.toString().trim();
+      if (line) {
+        ngrokOutput.push(line);
+        console.error(`[ngrok] ${line}`);
+      }
+    });
+
+    // An agent that exits during startup rejects this instead of leaving
+    // waitForNgrokUrl to poll a dead API for its full timeout.
+    const exitFailure = new Promise<never>((_, reject) => {
+      ngrokProcess.on("exit", (code: number | null) => {
+        if (code !== null && code !== 0) {
+          reject(new NgrokStartupError(code, ngrokOutput.join("\n")));
+        }
+      });
+    });
+
+    let url: string;
+    try {
+      url = await Promise.race([waitForNgrokUrl(port, domain), exitFailure]);
+    } catch (err) {
+      if (err instanceof NgrokStartupError && isNgrokAuthError(err.output)) {
+        if (authAttempts >= MAX_AUTH_RETRIES) {
+          console.error("\nngrok still rejects the tunnel as unauthenticated.");
+          console.error(
+            "Authenticate manually: ngrok config add-authtoken <your-token>",
+          );
+          console.error(
+            "  Get your token at: https://dashboard.ngrok.com/get-started/your-authtoken",
+          );
+          process.exit(1);
+        }
+        console.log("");
+        console.log("⚠ ngrok rejected the tunnel: it isn't authenticated.");
+        console.log(
+          "  Get your authtoken at: https://dashboard.ngrok.com/get-started/your-authtoken",
+        );
+        const token = (
+          await readLineText(
+            "Paste your ngrok authtoken to continue (Enter to cancel): ",
+          )
+        ).trim();
+        if (!token) {
+          console.log("No authtoken entered.");
+          process.exit(1);
+        }
+        authAttempts++;
+        if (saveNgrokAuthToken(token)) {
+          console.log("✅ ngrok authtoken saved. Retrying the tunnel...");
+        }
+        continue;
+      }
+      cleanup();
+      if (domain && !opts.domain) {
+        console.error(savedDomainRecoveryHint(domain));
+      }
+      throw err;
     }
-  });
+    publicUrl = url;
 
-  // Pipe ngrok stdout/stderr to console for visibility
-  ngrokProcess.stdout?.on("data", (data: Buffer) => {
-    const line = data.toString().trim();
-    if (line) console.log(`[ngrok] ${line}`);
-  });
-  ngrokProcess.stderr?.on("data", (data: Buffer) => {
-    const line = data.toString().trim();
-    if (line) console.error(`[ngrok] ${line}`);
-  });
+    console.log("");
+    console.log(`Tunnel established: ${publicUrl}`);
+    console.log(`Forwarding to:     localhost:${port}`);
 
-  try {
-    publicUrl = await waitForNgrokUrl(port, domain);
-  } catch (err) {
-    cleanup();
-    if (domain && !opts.domain) {
-      console.error(savedDomainRecoveryHint(domain));
+    // The domain is standing intent, not tunnel state: cleanup clears the
+    // ingress URL but leaves the domain saved for wake/daemon restores.
+    saveIngressUrl(workspaceDir, publicUrl, opts.assistantId, "ngrok");
+    if (ngrokProcess.pid) {
+      stampRootProcess("tunnel", {
+        pid: ngrokProcess.pid,
+        provider: "ngrok",
+        startedAt: new Date().toISOString(),
+        assistantId: opts.assistantId,
+      });
     }
-    throw err;
-  }
+    if (opts.domain) {
+      saveNgrokDomain(opts.domain);
+    }
+    console.log("Ingress URL saved to config.");
+    console.log("");
+    console.log("Press Ctrl+C to stop the tunnel and clear the ingress URL.");
 
-  console.log("");
-  console.log(`Tunnel established: ${publicUrl}`);
-  console.log(`Forwarding to:     localhost:${port}`);
-
-  // The domain is standing intent, not tunnel state: cleanup clears the
-  // ingress URL but leaves the domain saved for wake/daemon restores.
-  saveIngressUrl(workspaceDir, publicUrl, opts.assistantId, "ngrok");
-  if (ngrokProcess.pid) {
-    stampRootProcess("tunnel", {
-      pid: ngrokProcess.pid,
-      provider: "ngrok",
-      startedAt: new Date().toISOString(),
-      assistantId: opts.assistantId,
+    // Keep running until the ngrok process exits or we receive a signal
+    const waitForExit = new Promise<void>((resolve) => {
+      ngrokProcess.on("exit", () => resolve());
     });
+    return { publicUrl, waitForExit };
   }
-  if (opts.domain) {
-    saveNgrokDomain(opts.domain);
-  }
-  console.log("Ingress URL saved to config.");
-  console.log("");
-  console.log("Press Ctrl+C to stop the tunnel and clear the ingress URL.");
-
-  // Keep running until the ngrok process exits or we receive a signal
-  const waitForExit = new Promise<void>((resolve) => {
-    ngrokProcess.on("exit", () => resolve());
-  });
-  return { publicUrl, waitForExit };
+  // Unreachable: the loop only exits via return, process.exit, or a throw.
+  throw new Error("ngrok tunnel did not start.");
 }

package/src/lib/tunnels/tailscale.ts

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { win32 } from "node:path";
 
 import { GATEWAY_PORT } from "../constants.js";
+import { ensureBinaryInstalled } from "../ensure-binary.js";
 import {
   clearIngressUrl,
   getDefaultWorkspaceDir,
@@ -54,7 +55,7 @@ export function getTailscaleInstallMessage(
     hostPlatform === "win32"
       ? "  Windows: winget install Tailscale.Tailscale"
       : hostPlatform === "darwin"
-        ? "  macOS:  brew install tailscale   (or install the Tailscale app)"
+        ? "  macOS:  brew install tailscale, or install the Tailscale app"
         : "  Linux:  https://tailscale.com/download/linux";
   return [
     "Tailscale is not installed or could not be found.",
@@ -79,12 +80,12 @@ export interface TailscaleCommandResult {
  */
 export interface TailscaleDeps {
   /** Locate the tailscale CLI; returns the invocable path, null if absent. */
-  findBinary(): string | null;
+  findBinary(): Promise<string | null>;
   /** Run `<bin> <args>` synchronously (spawnSync semantics). */
   run(bin: string, args: string[]): TailscaleCommandResult;
 }
 
-function realFindBinary(): string | null {
+function probeTailscaleBinary(): string | null {
   for (const candidate of getTailscaleBinaryCandidates()) {
     const res = spawnSync(candidate, ["version"], {
       encoding: "utf-8",
@@ -99,6 +100,35 @@ function realFindBinary(): string | null {
   return null;
 }
 
+/**
+ * The real binary finder offers to install tailscale when it is missing
+ * (prompt-install via the shared helper; no-op hint on a non-interactive
+ * terminal) and re-probes after.
+ */
+async function realFindBinary(): Promise<string | null> {
+  const found = probeTailscaleBinary();
+  if (found) return found;
+  await ensureBinaryInstalled({
+    binary: "tailscale",
+    purpose: "the tailscale tunnel",
+    packages: {
+      brew: ["brew", "install", "tailscale"],
+      winget: [
+        "winget",
+        "install",
+        "--silent",
+        "--accept-package-agreements",
+        "--accept-source-agreements",
+        "Tailscale.Tailscale",
+      ],
+      choco: ["choco", "install", "-y", "tailscale"],
+    },
+    manualHint: getTailscaleInstallMessage(),
+    probe: () => probeTailscaleBinary(),
+  });
+  return probeTailscaleBinary();
+}
+
 function realRun(bin: string, args: string[]): TailscaleCommandResult {
   const res = spawnSync(bin, args, {
     encoding: "utf-8",
@@ -292,7 +322,7 @@ export async function startTailscaleServe(
   opts: RunTailscaleTunnelOptions = {},
   deps: TailscaleDeps = realTailscaleDeps(),
 ): Promise<TailscaleServeInfo> {
-  const binary = deps.findBinary();
+  const binary = await deps.findBinary();
   if (!binary) {
     throw new Error(getTailscaleInstallMessage());
   }

package/src/lib/upgrade-lifecycle.ts

@@ -17,6 +17,7 @@ import {
   dockerResourceNames,
   GATEWAY_INTERNAL_PORT,
   ASSISTANT_INTERNAL_PORT,
+  pullImage,
   startContainers,
   stopContainers,
 } from "./docker.js";
@@ -40,7 +41,7 @@ import {
   type DockerStatefulSetSpec,
   type ServiceName,
 } from "./statefulset.js";
-import { exec, execOutput } from "./step-runner.js";
+import { execOutput } from "./step-runner.js";
 import { compareVersions, stripVersionPrefix } from "./version-compat.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
 
@@ -418,7 +419,7 @@ export async function waitForReady(runtimeUrl: string): Promise<boolean> {
       const parts = [body?.status].filter(Boolean);
       if (body?.upstream != null) parts.push(`upstream=${body.upstream}`);
       const detail = parts.length > 0 ? ` — ${parts.join(", ")}` : "";
-      console.log(`Readiness check: ${resp.status}${detail} (retrying...)`);
+      console.log(`Readiness check: ${resp.status}${detail}, retrying...`);
     } catch {
       // Connection refused / timeout — not up yet
     }
@@ -754,7 +755,7 @@ export async function performDockerRollback(
     console.log(`   Backup saved: ${preRollbackBackupPath}\n`);
     pruneOldBackups(entry.assistantId, 3);
   } else {
-    console.warn("⚠️  Pre-rollback backup failed (continuing with rollback)\n");
+    console.warn("⚠️  Pre-rollback backup failed, continuing with rollback\n");
   }
 
   const {
@@ -806,7 +807,7 @@ export async function performDockerRollback(
   try {
     for (const [service, image] of pullImages) {
       console.log(`   Pulling ${service}: ${image}`);
-      await exec("docker", ["pull", image]);
+      await pullImage(image);
     }
   } catch (pullErr) {
     const detail = pullErr instanceof Error ? pullErr.message : String(pullErr);