@mycadet/cli 0.12.9 → 0.12.11

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/assistant-api/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/local-mode/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.9",
+  "version": "0.12.11",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {
@@ -20,11 +20,11 @@
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "eslint --max-warnings 322",
+    "lint": "eslint --max-warnings 323",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "compile:check": "bun build --compile src/index.ts --outfile /dev/null",
     "test": "bun run scripts/run-tests.ts",
-    "typecheck": "bunx tsc --noEmit"
+    "typecheck": "bunx tsgo --noEmit"
   },
   "author": "Cadet AI",
   "license": "MIT",
@@ -57,6 +57,7 @@
     "@types/bun": "1.3.11",
     "@types/qrcode-terminal": "0.12.2",
     "@types/react": "19.2.14",
+    "@typescript/native-preview": "7.0.0-dev.20260624.1",
     "eslint": "10.1.0",
     "knip": "5.88.1",
     "prettier": "3.8.1",

package/src/__tests__/client-web-config.test.ts

@@ -13,7 +13,6 @@ import { buildWebInterfaceConfig } from "../commands/client.js";
 const BASE = {
   webUrl: "https://app.example.com",
   cloudUrl: "https://platform.example.com",
-  disableCloud: true,
 };
 
 describe("cadet client web __config", () => {

package/src/__tests__/cloud-login-poll.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "bun:test";
+import { pollingCloudLogin } from "../lib/cloud-login-poll.js";
+
+const login = {
+  request_id: "a".repeat(64),
+  poll_secret: "b".repeat(64),
+  verification_uri: "https://example.com/account/cli?request=test",
+  user_code: "AAAAAAAA",
+  interval: 1,
+};
+
+describe("terminal login polling", () => {
+  test("prints the browser URL/code and waits for approval using a private poll secret", async () => {
+    const logs: string[] = [];
+    const bodies: unknown[] = [];
+    let polls = 0;
+    const request = async (url: string | URL | Request, init?: RequestInit) => {
+      bodies.push(init?.body);
+      if (String(url).endsWith("/start")) return Response.json(login);
+      return ++polls === 1
+        ? Response.json({ status: "pending" }, { status: 202 })
+        : Response.json({ session_token: "session-test" });
+    };
+    expect(
+      await pollingCloudLogin("https://cloud.example.com", {
+        fetch: request,
+        log: (line) => logs.push(line),
+      }),
+    ).toBe("session-test");
+    expect(polls).toBe(2);
+    expect(logs.join("\n")).toContain(login.verification_uri);
+    expect(logs.join("\n")).toContain(login.user_code);
+    expect(logs.join("\n")).not.toContain(login.poll_secret);
+    expect(JSON.parse(String(bodies[1]))).toEqual({
+      request_id: login.request_id,
+      poll_secret: login.poll_secret,
+    });
+  });
+
+  test("times out even while a network request is hung", async () => {
+    const request = async (_url: unknown, init?: RequestInit) =>
+      new Promise<Response>((_resolve, reject) => {
+        init?.signal?.addEventListener(
+          "abort",
+          () => reject(new Error("aborted")),
+          { once: true },
+        );
+      });
+    await expect(
+      pollingCloudLogin("https://example.com", {
+        fetch: request,
+        timeoutMs: 20,
+      }),
+    ).rejects.toThrow("Login timed out after 5 minutes");
+  });
+
+  test("expired approval fails without returning a token", async () => {
+    const request = async (url: unknown) =>
+      String(url).endsWith("/start")
+        ? Response.json(login)
+        : Response.json({}, { status: 410 });
+    await expect(
+      pollingCloudLogin("https://example.com", {
+        fetch: request,
+        log: () => {},
+      }),
+    ).rejects.toThrow("expired");
+  });
+});

package/src/__tests__/devices.test.ts

@@ -26,6 +26,7 @@ const ORIGINAL_FETCH = globalThis.fetch;
 
 import { createHash } from "node:crypto";
 
+import * as stepRunner from "../lib/step-runner.js";
 import { devices } from "../commands/devices.js";
 import { saveAssistantEntry } from "../lib/assistant-config.js";
 import { computeDeviceId } from "../lib/guardian-token.js";
@@ -102,6 +103,67 @@ describe("cadet devices", () => {
     stubFetch(() => jsonResponse({ error: "unexpected" }, 500));
   });
 
+  test("Docker devices list and revoke execute inside the gateway without a host port", async () => {
+    saveAssistantEntry({
+      assistantId: "docker-fixture",
+      cloud: "docker",
+      runtimeUrl: "https://tunnel.example",
+    });
+    const calls: string[][] = [];
+    const docker = spyOn(stepRunner, "execOutput").mockImplementation(
+      async (_command, args) => {
+        calls.push(args);
+        return JSON.stringify({
+          status: 200,
+          body: args.some((arg) => arg.endsWith("/revoke"))
+            ? '{"revoked":true}'
+            : '{"devices":[]}',
+        });
+      },
+    );
+    try {
+      process.argv = ["bun", "cadet", "devices", "docker-fixture", "--json"];
+      expect((await runDevices()).exited).toBe(false);
+      process.argv = [
+        "bun",
+        "cadet",
+        "devices",
+        "revoke",
+        "fixture-device",
+        "docker-fixture",
+        "--yes",
+        "--json",
+      ];
+      expect((await runDevices()).exited).toBe(false);
+      expect(calls).toHaveLength(2);
+      expect(calls[0].slice(0, 2)).toEqual(["exec", "docker-fixture-gateway"]);
+      expect(calls[0]).toContain("http://127.0.0.1:7830/v1/devices");
+      expect(calls[1]).toContain("http://127.0.0.1:7830/v1/devices/revoke");
+      expect(fetchCalls).toHaveLength(0);
+    } finally {
+      docker.mockRestore();
+    }
+  });
+
+  test("Docker gateway output rejects malformed status and body fields", async () => {
+    saveAssistantEntry({
+      assistantId: "docker-invalid",
+      cloud: "docker",
+      runtimeUrl: "https://tunnel.example",
+    });
+    const docker = spyOn(stepRunner, "execOutput").mockResolvedValue(
+      '{"status":"200","body":{}}',
+    );
+    try {
+      process.argv = ["bun", "cadet", "devices", "docker-invalid", "--json"];
+      const result = await runDevices();
+      expect(result.exited).toBe(true);
+      expect(result.errors).toContain("could not reach the gateway");
+    } finally {
+      docker.mockRestore();
+    }
+  });
+
   afterEach(() => {
     process.argv = [...ORIGINAL_ARGV];
     globalThis.fetch = ORIGINAL_FETCH;

package/src/__tests__/ensure-binary.test.ts

@@ -180,3 +180,55 @@ describe("readLineText", () => {
     expect(await pending).toBe("");
   });
 });
+
+test("a Mac without Homebrew asks separately before bootstrapping and installing nginx", async () => {
+  const installs: string[][] = [];
+  let homebrew = false;
+  let nginx = false;
+  let brewPrompts = 0;
+  const version = await ensureBinaryInstalled({
+    binary: "nginx",
+    purpose: "the tunnel edge",
+    platform: "darwin",
+    packages: { brew: ["brew", "install", "nginx"] },
+    manualHint: "install nginx",
+    probe: () => (nginx ? "nginx 1.2" : null),
+    pmAvailable: (pm) => pm === "brew" && homebrew,
+    confirmInstall: async () => true,
+    confirmHomebrewInstall: async () => {
+      brewPrompts++;
+      return true;
+    },
+    runInstall: (argv) => {
+      installs.push(argv);
+      if (argv[0] === "/bin/bash") homebrew = true;
+      if (argv[0] === "brew") nginx = true;
+      return true;
+    },
+  });
+  expect(version).toBe("nginx 1.2");
+  expect(brewPrompts).toBe(1);
+  expect(installs.length).toBe(2);
+  expect(installs[1]).toEqual(["brew", "install", "nginx"]);
+});
+
+test("declining Homebrew runs no installer", async () => {
+  const installs: string[][] = [];
+  const result = await ensureBinaryInstalled({
+    binary: "ngrok",
+    purpose: "a tunnel",
+    platform: "darwin",
+    packages: { brew: ["brew", "install", "ngrok/ngrok/ngrok"] },
+    manualHint: "install ngrok",
+    probe: () => null,
+    pmAvailable: () => false,
+    confirmInstall: async () => true,
+    confirmHomebrewInstall: async () => false,
+    runInstall: (argv) => {
+      installs.push(argv);
+      return true;
+    },
+  });
+  expect(result).toBeNull();
+  expect(installs).toEqual([]);
+});

package/src/__tests__/hatch-next-steps.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+
+import { logHatchNextSteps } from "../lib/hatch-next-steps";
+
+function captureNextSteps(): string[] {
+  const lines: string[] = [];
+  logHatchNextSteps((message) => lines.push(message));
+  return lines;
+}
+
+describe("logHatchNextSteps", () => {
+  test("names the production binary in a production environment", () => {
+    const prev = process.env.CADET_ENVIRONMENT;
+    try {
+      process.env.CADET_ENVIRONMENT = "production";
+      const lines = captureNextSteps();
+      expect(lines.join("\n")).toContain("`cadet client`");
+      expect(lines.join("\n")).toContain("`cadet tunnel`");
+      expect(lines.join("\n")).not.toContain("cadet-dev");
+    } finally {
+      if (prev === undefined) delete process.env.CADET_ENVIRONMENT;
+      else process.env.CADET_ENVIRONMENT = prev;
+    }
+  });
+
+  test("names the environment-suffixed binary in dev", () => {
+    const prev = process.env.CADET_ENVIRONMENT;
+    try {
+      process.env.CADET_ENVIRONMENT = "dev";
+      const lines = captureNextSteps();
+      expect(lines.join("\n")).toContain("`cadet-dev client`");
+      expect(lines.join("\n")).toContain("`cadet-dev tunnel`");
+    } finally {
+      if (prev === undefined) delete process.env.CADET_ENVIRONMENT;
+      else process.env.CADET_ENVIRONMENT = prev;
+    }
+  });
+});

package/src/__tests__/multi-local.test.ts

@@ -43,14 +43,14 @@ afterAll(() => {
 
 function writeLockfile(data: unknown): void {
   writeFileSync(
-    join(testDir, ".cadet.lock.json"),
+    join(testDir, "lockfile.json"),
     JSON.stringify(data, null, 2),
   );
 }
 
 function readLockfileRaw(): Record<string, unknown> {
   return JSON.parse(
-    readFileSync(join(testDir, ".cadet.lock.json"), "utf-8"),
+    readFileSync(join(testDir, "lockfile.json"), "utf-8"),
   ) as Record<string, unknown>;
 }
 
@@ -67,7 +67,7 @@ const makeEntry = (
 
 function resetLockfile(): void {
   try {
-    rmSync(join(testDir, ".cadet.lock.json"));
+    rmSync(join(testDir, "lockfile.json"));
   } catch {
     // file may not exist
   }

package/src/__tests__/nginx-ingress.test.ts

@@ -76,6 +76,7 @@ import {
   MAX_PRESERVED_MODULE_PRELOADS,
   ensureTunnelEdge,
   EDGE_TEMPLATE_VERSION,
+  findWebDistDir,
   startRemoteWebIngress,
   stopContainerTunnelEdge,
   stopIngressNginx,
@@ -160,7 +161,6 @@ describe("buildIngressNginxConfig", () => {
       config: {
         remote: "docker",
         apiBaseUrl: "/v1",
-        cloudDisabled: true,
       },
     },
   });
@@ -330,7 +330,7 @@ describe("buildIngressNginxConfig", () => {
     expect(remoteConf).toContain("default_type application/json;");
     expect(remoteConf).toContain('add_header Cache-Control "no-store";');
     expect(remoteConf).toContain(
-      'return 200 "{\\"remote\\":\\"docker\\",\\"apiBaseUrl\\":\\"/v1\\",\\"cloudDisabled\\":true,\\"disableCloud\\":true}";',
+      'return 200 "{\\"remote\\":\\"docker\\",\\"apiBaseUrl\\":\\"/v1\\"}";',
     );
     expect(remoteConf).not.toContain("assistantId");
   });
@@ -347,7 +347,7 @@ describe("buildIngressNginxConfig", () => {
       },
     });
     expect(named).toContain(
-      'return 200 "{\\"remote\\":\\"custom\\",\\"apiBaseUrl\\":\\"/v1\\",\\"cloudDisabled\\":true,\\"disableCloud\\":true,\\"assistantName\\":\\"Homelab\\",\\"assistantId\\":\\"assistant-1\\",\\"hubUrl\\":\\"https://mycadet.ai/assistant\\"}";',
+      'return 200 "{\\"remote\\":\\"custom\\",\\"apiBaseUrl\\":\\"/v1\\",\\"assistantName\\":\\"Homelab\\",\\"assistantId\\":\\"assistant-1\\",\\"hubUrl\\":\\"https://mycadet.ai/assistant\\"}";',
     );
   });
 
@@ -449,18 +449,15 @@ describe("buildRemoteWebIndexHtml", () => {
     const result = buildRemoteWebIndexHtml(html, {
       remote: "docker",
       apiBaseUrl: "/v1",
-      disableCloud: true,
     });
 
     expect(result).toContain(
       'window.__CADET_CONFIG__={"webUrl":"https://mycadet.ai"}',
     );
     expect(result).toContain(
-      'window.__CADET_CONFIG__={"remote":"docker","apiBaseUrl":"/v1","disableCloud":true}',
-    );
-    expect(result.indexOf('"webUrl"')).toBeLessThan(
-      result.indexOf('"docker"'),
+      'window.__CADET_CONFIG__={"remote":"docker","apiBaseUrl":"/v1"}',
     );
+    expect(result.indexOf('"webUrl"')).toBeLessThan(result.indexOf('"docker"'));
   });
 
   test("escapes config JSON before embedding it in a script tag", () => {
@@ -532,21 +529,13 @@ describe("buildRemoteWebIndexHtml", () => {
 
 describe("cloudWebHubUrl", () => {
   test("maps build environments to their cloud SPA base", () => {
-    expect(cloudWebHubUrl("production")).toBe(
-      "https://mycadet.ai/assistant",
-    );
+    expect(cloudWebHubUrl("production")).toBe("https://mycadet.ai/assistant");
     expect(cloudWebHubUrl("staging")).toBe(
       "https://staging.mycadet.ai/assistant",
     );
-    expect(cloudWebHubUrl("dev")).toBe(
-      "https://dev.mycadet.ai/assistant",
-    );
-    expect(cloudWebHubUrl("local")).toBe(
-      "https://dev.mycadet.ai/assistant",
-    );
-    expect(cloudWebHubUrl(undefined)).toBe(
-      "https://dev.mycadet.ai/assistant",
-    );
+    expect(cloudWebHubUrl("dev")).toBe("https://dev.mycadet.ai/assistant");
+    expect(cloudWebHubUrl("local")).toBe("https://dev.mycadet.ai/assistant");
+    expect(cloudWebHubUrl(undefined)).toBe("https://dev.mycadet.ai/assistant");
   });
 });
 
@@ -848,14 +837,19 @@ const PRODUCTION_HUB_URL = "https://mycadet.ai/assistant";
 
 /**
  * Mirror of the SPA config fingerprint the edge records in its ingress state
- * (sha256 over the edge template version and the injected config JSON). Pins
+ * (sha256 over the template, injected config, bundle directory and index). Pins
  * both the injected config shape and the hash format; assumes the
  * production-pinned environment. The version itself is imported rather than
  * mirrored: bumping it is the correct response to any template edit, so a
  * copy here would fail every such edit without naming a defect.
  */
 function spaConfigHash(
-  opts: { assistantName?: string; assistantId?: string } = {},
+  opts: {
+    assistantName?: string;
+    assistantId?: string;
+    indexHtml?: string;
+    webDistDir?: string;
+  } = {},
 ): string {
   return createHash("sha256")
     .update(
@@ -864,12 +858,12 @@ function spaConfigHash(
         config: {
           remote: "custom",
           apiBaseUrl: "/v1",
-          cloudDisabled: true,
-          disableCloud: true,
           ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
           ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
           hubUrl: PRODUCTION_HUB_URL,
         },
+        webDistDir: opts.webDistDir ?? findWebDistDir(),
+        indexHtml: opts.indexHtml ?? FAKE_INDEX_HTML,
       }),
     )
     .digest("hex");
@@ -1251,6 +1245,7 @@ describe("startRemoteWebIngress", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
+    mockWebDistPresent();
     const pid = mockRunningEdge(ws, {
       listenPort: 7845,
       gatewayPort: 7830,
@@ -1304,6 +1299,44 @@ describe("startRemoteWebIngress", () => {
     expect(spawnMock).not.toHaveBeenCalled();
   });
 
+  for (const drift of ["indexHtml", "webDistDir"] as const) {
+    test(`restarts a detached edge when the web bundle ${drift} changes`, async () => {
+      const ws = makeWorkspace();
+      mockNginxInstalled();
+      mockNginxSpawn();
+      mockWebDistPresent();
+      const pid = mockRunningEdge(ws, {
+        listenPort: 7845,
+        includeWebApp: true,
+        gatewayPort: 7830,
+        remoteWebConfigHash: spaConfigHash({
+          ...(drift === "indexHtml"
+            ? {
+                indexHtml:
+                  '<html><head><script src="/assistant/assets/old.js"></script></head></html>',
+              }
+            : { webDistDir: "/old-release/dist" }),
+        }),
+      });
+      const edge = mockKillableNginx(pid);
+      const result = await startRemoteWebIngress({
+        workspaceDir: ws,
+        gatewayPort: 7830,
+      });
+      expect(result).toMatchObject({ status: "started", listenPort: 7845 });
+      expect(edge.killed()).toBe(true);
+      expect(readConfig(ws).ingress?.nginx?.remoteWebConfigHash).toBe(
+        spaConfigHash(),
+      );
+      expect(
+        realFs.readFileSync(
+          join(ws, "data", "ingress", "assistant-index.html"),
+          "utf-8",
+        ),
+      ).not.toContain("old.js");
+    });
+  }
+
   test("restarts the edge when the injected SPA config drifts from the recorded one", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
@@ -1354,8 +1387,6 @@ describe("startRemoteWebIngress", () => {
           config: {
             remote: "custom",
             apiBaseUrl: "/v1",
-            cloudDisabled: true,
-            disableCloud: true,
             hubUrl: PRODUCTION_HUB_URL,
           },
         }),
@@ -1807,6 +1838,7 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
+    mockWebDistPresent();
     const pid = mockRunningEdge(ws, {
       listenPort: 7845,
       includeWebApp: true,