@mycadet/cli 0.12.9-dev.202610131757.9cfb396 → 0.12.9-dev.202610142154.883240

package/README.md

@@ -14,6 +14,19 @@ bun run ./src/index.ts <command> [options]
 
 ## Commands
 
+### Version changes: `upgrade`, `restore`
+
+Use `cadet upgrade` to move to a newer release. Rollbacks must restore a backup
+through `cadet restore`; version changes and backup data belong to the same
+restore operation. The CLI has no standalone `rollback` command.
+
+```bash
+cadet restore my-assistant --from backup.tar.gz --version v1.2.3
+```
+
+Automatic failure recovery during an upgrade or restore uses the images and
+migration checkpoints captured in memory for that operation.
+
 ### Lifecycle: `ps`, `sleep`, `wake`
 
 Day-to-day process management for the assistant and gateway.

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.9-dev.202610131757.9cfb396",
+  "version": "0.12.9-dev.202610142154.0883240",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {
@@ -20,7 +20,7 @@
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "eslint --max-warnings 323",
+    "lint": "eslint --max-warnings 319",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "compile:check": "bun build --compile src/index.ts --outfile /dev/null",
     "test": "bun run scripts/run-tests.ts",
@@ -41,6 +41,7 @@
     "qrcode-terminal": "0.12.0",
     "react": "19.2.6",
     "react-devtools-core": "7.0.1",
+    "tar": "7.5.22",
     "yaml": "2.8.2",
     "zod": "4.3.6"
   },

package/src/__tests__/backup-ops-matching.test.ts

@@ -7,42 +7,44 @@ const STAMP = "2026-09-15T14-27-28-123Z";
 describe("assistantBackupFilenamePattern", () => {
   test("matches this CLI's backups for exactly the given assistant", () => {
     const pattern = assistantBackupFilenamePattern("alpha");
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(true);
-    expect(pattern.test(`alpha-pre-teleport-${STAMP}.vbundle`)).toBe(true);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-teleport-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-rollback-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
   });
 
   test("does not match an assistant whose id extends this one", () => {
     const pattern = assistantBackupFilenamePattern("alpha");
-    expect(pattern.test(`alpha-prod-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
-    expect(pattern.test(`alpha-prod-pre-teleport-${STAMP}.vbundle`)).toBe(
+    expect(pattern.test(`alpha-prod-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
+    expect(pattern.test(`alpha-prod-pre-teleport-${STAMP}.tar.gz`)).toBe(
       false,
     );
   });
 
   test("does not match a shorter id's backups from a longer id", () => {
     const pattern = assistantBackupFilenamePattern("alpha-prod");
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
   });
 
   test("ignores user-named cadet backup files and other kinds", () => {
     const pattern = assistantBackupFilenamePattern("alpha");
-    expect(pattern.test(`alpha-${STAMP}.vbundle`)).toBe(false);
-    expect(pattern.test(`alpha-manual-${STAMP}.vbundle`)).toBe(false);
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle.enc`)).toBe(false);
+    expect(pattern.test(`alpha-${STAMP}.tar.gz`)).toBe(false);
+    expect(pattern.test(`alpha-manual-${STAMP}.tar.gz`)).toBe(false);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz.enc`)).toBe(false);
   });
 
   test("restricts to the requested kinds", () => {
     const pattern = assistantBackupFilenamePattern("alpha", ["pre-teleport"]);
-    expect(pattern.test(`alpha-pre-teleport-${STAMP}.vbundle`)).toBe(true);
-    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
+    expect(pattern.test(`alpha-pre-teleport-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`alpha-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
     expect(
-      pattern.test(`alpha-pre-teleport-prod-pre-teleport-${STAMP}.vbundle`),
+      pattern.test(`alpha-pre-teleport-prod-pre-teleport-${STAMP}.tar.gz`),
     ).toBe(false);
   });
 
   test("escapes regex metacharacters in ids", () => {
     const pattern = assistantBackupFilenamePattern("a.b");
-    expect(pattern.test(`a.b-pre-upgrade-${STAMP}.vbundle`)).toBe(true);
-    expect(pattern.test(`axb-pre-upgrade-${STAMP}.vbundle`)).toBe(false);
+    expect(pattern.test(`a.b-pre-upgrade-${STAMP}.tar.gz`)).toBe(true);
+    expect(pattern.test(`axb-pre-upgrade-${STAMP}.tar.gz`)).toBe(false);
   });
 });

package/src/__tests__/backup-ops.test.ts

@@ -0,0 +1,105 @@
+import { afterAll, beforeEach, expect, spyOn, test } from "bun:test";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as config from "../lib/assistant-config.js";
+import * as backups from "../lib/backup-ops.js";
+import * as guardian from "../lib/guardian-token.js";
+import { stageRootArchive, STATE_ROOTS } from "../lib/root-backup.js";
+
+const directory = await mkdtemp(join(tmpdir(), "safety-root-backup-"));
+const root = join(directory, "instance");
+const backupDir = join(directory, "backups");
+const entry: config.AssistantEntry = {
+  assistantId: "alpha",
+  cloud: "local",
+  runtimeUrl: "http://127.0.0.1:1",
+  resources: {
+    instanceDir: root,
+    daemonPort: 1,
+    gatewayPort: 2,
+    cesPort: 3,
+    qdrantPort: 4,
+    signingKey: "07".repeat(32),
+  },
+};
+const lookup = spyOn(config, "findAssistantByName").mockReturnValue(entry);
+const location = spyOn(backups, "getBackupsDir").mockReturnValue(backupDir);
+const save = spyOn(config, "saveAssistantEntry").mockImplementation(() => {});
+const tokens = spyOn(guardian, "loadGuardianToken").mockImplementation(() => {
+  throw new Error("no guardian token access allowed");
+});
+beforeEach(async () => {
+  for (const name of STATE_ROOTS)
+    await mkdir(join(root, name), { recursive: true });
+  await writeFile(join(root, "workspace", "notes"), "original");
+  await writeFile(join(root, "gateway-security", "trust"), "gateway trust");
+  await writeFile(join(root, "ces-security", "keys.enc"), "opaque ciphertext", {
+    mode: 0o600,
+  });
+  await writeFile(join(root, "ces-data", "grants"), "CES policy");
+  lookup.mockReturnValue(entry);
+  tokens.mockClear();
+});
+afterAll(async () => {
+  for (const spy of [lookup, location, save, tokens]) spy.mockRestore();
+  await rm(directory, { recursive: true, force: true });
+});
+
+test("pre-upgrade safety backup captures all roots in XDG without a guardian token", async () => {
+  const path = await backups.createBackup(entry.runtimeUrl, entry.assistantId, {
+    prefix: "alpha-pre-upgrade",
+  });
+  expect(path).toMatch(
+    new RegExp(`^${backupDir}/alpha-pre-upgrade-.*\\.tar\\.gz$`),
+  );
+  const stage = await stageRootArchive(path!, directory);
+  for (const name of STATE_ROOTS)
+    expect(await readdir(join(stage, "state", name))).not.toHaveLength(0);
+  expect(
+    await readFile(join(stage, "state", "ces-security", "keys.enc"), "utf8"),
+  ).toBe("opaque ciphertext");
+  expect(tokens).not.toHaveBeenCalled();
+});
+
+test("rollback restores gateway and CES state as well as workspace", async () => {
+  const path = await backups.createBackup(entry.runtimeUrl, entry.assistantId, {
+    prefix: "alpha-pre-rollback",
+  });
+  for (const name of STATE_ROOTS)
+    await writeFile(join(root, name, "after-upgrade"), "stale");
+  await writeFile(join(root, "workspace", "notes"), "modified");
+  expect(
+    await backups.restoreBackup(entry.runtimeUrl, entry.assistantId, path!, {
+      resume: false,
+    }),
+  ).toBe(true);
+  expect(await readFile(join(root, "workspace", "notes"), "utf8")).toBe(
+    "original",
+  );
+  expect(await readFile(join(root, "gateway-security", "trust"), "utf8")).toBe(
+    "gateway trust",
+  );
+  expect(await readFile(join(root, "ces-data", "grants"), "utf8")).toBe(
+    "CES policy",
+  );
+  for (const name of STATE_ROOTS)
+    expect(await readdir(join(root, name))).not.toContain("after-upgrade");
+  expect(tokens).not.toHaveBeenCalled();
+});
+
+test("missing registry identity fails before capture instead of trying runtime export", async () => {
+  lookup.mockReturnValue(null);
+  expect(await backups.createBackup(entry.runtimeUrl, "missing")).toBeNull();
+  expect(
+    await backups.restoreBackup(entry.runtimeUrl, "missing", "missing.tar.gz"),
+  ).toBe(false);
+  expect(tokens).not.toHaveBeenCalled();
+});