@mycadet/cli 0.12.9 → 0.12.11

package/src/__tests__/pair.test.ts

@@ -4,6 +4,7 @@ import {
   beforeEach,
   describe,
   expect,
+  mock,
   spyOn,
   test,
 } from "bun:test";
@@ -19,9 +20,36 @@ process.env.CADET_LOCKFILE_DIR = testDir;
 const originalEnvironment = process.env.CADET_ENVIRONMENT;
 process.env.CADET_ENVIRONMENT = "production";
 
-import { buildAppConnectUrl, pair } from "../commands/pair.js";
 import { withPreconnect } from "./helpers/http.js";
 
+// The gateway-CLI mint runs in a SUBPROCESS for local and docker assistants;
+// answer it in-process and record the invocations (the fetch stubs below
+// still serve the loopback HTTP mint the other topologies keep using).
+const mintCalls: Array<{ command: string; args: readonly string[] }> = [];
+const actualStepRunner = await import("../lib/step-runner.js");
+const mockExecOutput = mock(
+  (command: string, args: readonly string[]): Promise<string> => {
+    mintCalls.push({ command, args });
+    const mintedUrl = args[args.length - 1] ?? "";
+    return Promise.resolve(
+      JSON.stringify({
+        deviceCode: "device-code",
+        userCode: "ABCD-EFGH",
+        verificationUri: `${mintedUrl}/assistant/pair`,
+        expiresAt: "2026-06-04T00:10:00.000Z",
+        expiresInSeconds: 600,
+        intervalSeconds: 5,
+      }),
+    );
+  },
+);
+mock.module("../lib/step-runner.js", () => ({
+  ...actualStepRunner,
+  execOutput: mockExecOutput,
+}));
+
+const { buildAppConnectUrl, pair } = await import("../commands/pair.js");
+
 // Distinct loopback (mint) vs reachable (advertised) URLs to verify the split.
 const LOCAL_URL = "http://127.0.0.1:7830";
 const RUNTIME_URL = "http://192.168.1.50:7830";
@@ -93,6 +121,7 @@ const ORIGINAL_ARGV = [...process.argv];
 
 describe("pair command", () => {
   beforeEach(() => {
+    mintCalls.length = 0;
     writeLockfile();
   });
 
@@ -130,18 +159,16 @@ describe("pair command", () => {
       globalThis.fetch = origFetch;
     }
 
-    // Mint over the loopback gateway, then approve: running this command on
-    // the host IS the approval, so the link alone completes the pairing.
-    expect(calls.map((c) => c[0])).toEqual([
-      `${LOCAL_URL}/v1/remote-web/pairing-challenge`,
-      `${LOCAL_URL}/v1/remote-web/pairing-verification`,
+    // Mint through the gateway CLI subprocess: process execution IS the
+    // local-presence proof and the approval, so the link alone completes
+    // the pairing — no HTTP at all for a local assistant.
+    expect(mintCalls).toHaveLength(1);
+    expect(mintCalls[0]?.args.slice(-3)).toEqual([
+      "pairing",
+      "mint",
+      PUBLIC_URL,
     ]);
-    expect(JSON.parse(String(calls[0][1]?.body))).toEqual({
-      publicBaseUrl: PUBLIC_URL,
-    });
-    expect(JSON.parse(String(calls[1][1]?.body))).toEqual({
-      userCode: "ABCD-EFGH",
-    });
+    expect(calls).toHaveLength(0);
 
     const output = logs.join("\n");
     // One artifact, two renderings: the link and the same link as a QR.
@@ -391,10 +418,9 @@ describe("pair command", () => {
     }
 
     // Resolution succeeded (no exit), so the challenge was minted.
-    expect(calls.map((c) => c[0])).toEqual([
-      `${LOCAL_URL}/v1/remote-web/pairing-challenge`,
-      `${LOCAL_URL}/v1/remote-web/pairing-verification`,
-    ]);
+    expect(mintCalls).toHaveLength(1);
+    expect(mintCalls[0]?.args.at(-1)).toBe(PUBLIC_URL);
+    expect(calls).toHaveLength(0);
   });
 
   test("rejects an unknown --flag before any network call", async () => {
@@ -587,11 +613,8 @@ describe("pair command", () => {
       globalThis.fetch = origFetch;
     }
 
-    // Mint still over loopback; the link advertises the override.
-    expect(calls[0][0]).toBe(`${LOCAL_URL}/v1/remote-web/pairing-challenge`);
-    expect(JSON.parse(String(calls[0][1]?.body))).toEqual({
-      publicBaseUrl: OVERRIDE,
-    });
+    // Mint still through the gateway CLI; the link advertises the override.
+    expect(mintCalls[0]?.args.at(-1)).toBe(OVERRIDE);
     expect(JSON.parse(logs.join("\n")).pairUrl).toBe(
       `${OVERRIDE}/assistant/pair#device_code=device-code`,
     );
@@ -1069,35 +1092,8 @@ describe("pair command", () => {
 
     const calls: string[] = [];
     const origFetch = globalThis.fetch;
-    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      calls.push(url);
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
-        // The minted challenge must advertise the entry's recorded URL.
-        expect(JSON.parse(String(init?.body))).toEqual({
-          publicBaseUrl: "https://saved.example.ts.net",
-        });
-        return new Response(
-          JSON.stringify({
-            deviceCode: "device-code",
-            userCode: "ABCD-EFGH",
-            verificationUri: "https://saved.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-            expiresInSeconds: 600,
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
-        return new Response(
-          JSON.stringify({
-            status: "approved",
-            verificationUri: "https://saved.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
+    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL) => {
+      calls.push(String(input));
       return new Response("not found", { status: 404 });
     });
 
@@ -1116,7 +1112,9 @@ describe("pair command", () => {
       globalThis.fetch = origFetch;
     }
 
-    expect(calls).toContain(`${LOCAL_URL}/v1/remote-web/pairing-challenge`);
+    // The minted challenge must advertise the entry's recorded URL.
+    expect(mintCalls[0]?.args.at(-1)).toBe("https://saved.example.ts.net");
+    expect(calls).toHaveLength(0);
     const output = logs.join("\n");
     expect(output).toContain(
       "Using saved ingress URL https://saved.example.ts.net",
@@ -1130,33 +1128,7 @@ describe("pair command", () => {
     writeLockfileWithIngress("https://saved.example.ts.net");
 
     const origFetch = globalThis.fetch;
-    globalThis.fetch = withPreconnect(async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
-        expect(JSON.parse(String(init?.body))).toEqual({
-          publicBaseUrl: "https://explicit.example.ts.net",
-        });
-        return new Response(
-          JSON.stringify({
-            deviceCode: "device-code",
-            userCode: "ABCD-EFGH",
-            verificationUri: "https://explicit.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-            expiresInSeconds: 600,
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
-      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
-        return new Response(
-          JSON.stringify({
-            status: "approved",
-            verificationUri: "https://explicit.example.ts.net/assistant/pair",
-            expiresAt: "2026-06-04T00:10:00.000Z",
-          }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
-      }
+    globalThis.fetch = withPreconnect(async () => {
       return new Response("not found", { status: 404 });
     });
 
@@ -1182,6 +1154,8 @@ describe("pair command", () => {
     }
 
     expect(logs.join("\n")).not.toContain("Using saved ingress URL");
+    // The override reached the mint.
+    expect(mintCalls[0]?.args.at(-1)).toBe("https://explicit.example.ts.net");
   });
 
   test("a non-https recorded ingress URL is ignored", async () => {
@@ -1263,4 +1237,101 @@ describe("pair command", () => {
     expect(errors.join("\n")).toContain(RUNTIME_URL);
     expect(minted).toBe(false);
   });
+
+  test("refuses a paired (connect-import) assistant before minting", async () => {
+    writeFileSync(
+      join(testDir, "lockfile.json"),
+      JSON.stringify({
+        assistants: [
+          {
+            assistantId: "pair-test",
+            runtimeUrl: RUNTIME_URL,
+            cloud: "paired",
+          },
+        ],
+        activeAssistant: "pair-test",
+      }),
+    );
+
+    const errors: string[] = [];
+    const errSpy = spyOn(console, "error").mockImplementation(
+      (...a: unknown[]) => {
+        errors.push(a.join(" "));
+      },
+    );
+    const exitSpy = spyOn(process, "exit").mockImplementation(
+      (code?: number | string | undefined): never => {
+        throw new Error(`exit:${code}`);
+      },
+    );
+
+    process.argv = ["bun", "cadet", "pair", "--url", PUBLIC_URL];
+    let exited = false;
+    try {
+      await pair();
+    } catch (e) {
+      exited = e instanceof Error && e.message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+
+    expect(exited).toBe(true);
+    expect(errors.join("\n")).toContain("was paired as a remote");
+    // Keyed on the entry's cloud, not on which fields happen to exist.
+    expect(mintCalls).toHaveLength(0);
+  });
+
+  test("a custom (ssh-managed) assistant keeps the loopback HTTP mint", async () => {
+    writeFileSync(
+      join(testDir, "lockfile.json"),
+      JSON.stringify({
+        assistants: [
+          {
+            assistantId: "pair-test",
+            runtimeUrl: LOCAL_URL,
+            cloud: "custom",
+          },
+        ],
+        activeAssistant: "pair-test",
+      }),
+    );
+
+    const calls: Array<[string, RequestInit | undefined]> = [];
+    const origFetch = globalThis.fetch;
+    globalThis.fetch = withPreconnect(
+      async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = String(input);
+        calls.push([url, init]);
+        if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
+          return challengeResponse(PUBLIC_URL);
+        }
+        if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
+          return approvalResponse(PUBLIC_URL);
+        }
+        return new Response("not found", { status: 404 });
+      },
+    );
+
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+
+    process.argv = ["bun", "cadet", "pair", "--url", PUBLIC_URL];
+    try {
+      await pair();
+    } finally {
+      logSpy.mockRestore();
+      globalThis.fetch = origFetch;
+    }
+
+    // Not local/docker: no CLI execution — the mint rides the loopback HTTP
+    // route, keyed on the entry's cloud, not on containerInfo.
+    expect(mintCalls).toHaveLength(0);
+    expect(calls.map((c) => c[0])).toEqual([
+      `${LOCAL_URL}/v1/remote-web/pairing-challenge`,
+      `${LOCAL_URL}/v1/remote-web/pairing-verification`,
+    ]);
+    expect(JSON.parse(String(calls[0]?.[1]?.body))).toEqual({
+      publicBaseUrl: PUBLIC_URL,
+    });
+  });
 });

package/src/__tests__/ps-cloud-status.test.ts

@@ -258,10 +258,12 @@ describe("cadet ps — platform status line", () => {
     await listAllAssistants(false);
 
     const output = stdout.join(NL);
-    // The tunnel nests under Alice — its name is just the provider now…
-    expect(output).toContain("└ ngrok");
-    // …the unattributed edge renders machine-level…
-    expect(output).toContain("nginx edge");
+    // The tunnel and the edge render machine-level — root resources, never
+    // children of an assistant row…
+    expect(output).toContain("ngrok");
+    expect(output).not.toContain("└ ngrok");
+    expect(output).toContain("nginx");
+    expect(output).toContain("port ");
     // …the type column distinguishes the three process kinds…
     expect(output).toContain("🧑‍🚀 Assistant");
     expect(output).toContain("🚇 Tunnel");

package/src/__tests__/setup.test.ts

@@ -62,7 +62,7 @@ function writeLockfile(entry: AssistantEntry): void {
   const lockfileDir = process.env.CADET_LOCKFILE_DIR!;
   mkdirSync(lockfileDir, { recursive: true });
   writeFileSync(
-    join(lockfileDir, ".cadet.lock.json"),
+    join(lockfileDir, "lockfile.json"),
     JSON.stringify(
       {
         assistants: [entry],
@@ -119,6 +119,10 @@ function installFetchStub(
       });
     }
 
+    if (url.endsWith("/v1/config/llm/default-provider")) {
+      return Response.json({ provider: "anthropic" });
+    }
+
     if (url.endsWith("/v1/secrets/read")) {
       return new Response(JSON.stringify({ found: false }), {
         status: 200,
@@ -189,7 +193,9 @@ describe("setup command", () => {
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer guardian-token",
     );
@@ -245,7 +251,9 @@ describe("setup command", () => {
     // gate instead of burning retry attempts against it.
     expect(fetchCalls[0].url).toBe("http://127.0.0.1:3000/readyz");
     expect(fetchCalls[1].url).toBe("http://127.0.0.1:3000/v1/guardian/init");
-    expect(fetchCalls[2].url).toBe("http://127.0.0.1:3000/v1/secrets/read");
+    expect(fetchCalls[2].url).toBe(
+      "http://127.0.0.1:3000/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[2].headers.get("Authorization")).toBe(
       "Bearer leased-guardian-token",
     );
@@ -288,7 +296,9 @@ describe("setup command", () => {
 
     await setup();
 
-    expect(fetchCalls[0].url).toBe("https://assistant.example/v1/secrets/read");
+    expect(fetchCalls[0].url).toBe(
+      "https://assistant.example/v1/config/llm/default-provider",
+    );
     expect(fetchCalls[0].headers.get("Authorization")).toBe(
       "Bearer entry-token",
     );

package/src/__tests__/teleport.test.ts

@@ -2567,7 +2567,6 @@ describe("platform credential injection", () => {
         bearerToken: "local-bearer",
         assistantApiKey: "api-key-123",
         cloudAssistantId: "platform-assistant-1",
-        cloudBaseUrl: "https://cloud.mycadet.ai",
         organizationId: "org-1",
         userId: "user-1",
         webhookSecret: "webhook-secret-123",
@@ -3008,17 +3007,3 @@ describe("upload signed-URL records source runtime version (not CLI version)", (
   });
 });
 
-// ---------------------------------------------------------------------------
-// Misc: legacy --to deprecation
-// ---------------------------------------------------------------------------
-
-describe("misc", () => {
-  test("legacy --to flag shows deprecation message", async () => {
-    setArgv("--from", "source", "--to", "target");
-
-    await expect(teleport()).rejects.toThrow("process.exit:1");
-    expect(consoleErrorSpy).toHaveBeenCalledWith(
-      expect.stringContaining("--to is deprecated"),
-    );
-  });
-});

package/src/__tests__/tunnel-startup-summary.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, test } from "bun:test";
+import { createServer } from "node:net";
+
+import { findAvailableIngressPort } from "../lib/nginx-ingress";
+import { edgeServedRemote } from "../lib/nginx-ingress";
+import { summarizeStartupFailure } from "../lib/tunnel";
+
+function portOf(server: ReturnType<typeof createServer>): number {
+  const addr = server.address();
+  return typeof addr === "object" && addr !== null ? addr.port : -1;
+}
+
+describe("summarizeStartupFailure", () => {
+  test("names an nginx emerg line over generic log noise", () => {
+    const log = [
+      "Starting ngrok tunnel to localhost:7840...",
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain("[emerg]");
+  });
+
+  test("names an ngrok error code", () => {
+    expect(
+      summarizeStartupFailure(
+        "agent started\nERR_NGROK_4018: Authentication failed",
+      ),
+    ).toContain("ERR_NGROK_4018");
+  });
+
+  test("the last matching line wins", () => {
+    const log = [
+      "nginx: [emerg] bind() to 0.0.0.0:7840 failed (98: Address already in use)",
+      "nginx: [emerg] bind() to 0.0.0.0:7841 failed (98: Address already in use)",
+    ].join("\n");
+    expect(summarizeStartupFailure(log)).toContain(":7841");
+  });
+
+  test("falls back to the last non-empty line when nothing error-shaped appears", () => {
+    expect(summarizeStartupFailure("first line\nsome plain output")).toBe(
+      "some plain output",
+    );
+  });
+
+  test("an empty log summarizes to null", () => {
+    expect(summarizeStartupFailure("")).toBeNull();
+    expect(summarizeStartupFailure("\n  \n")).toBeNull();
+  });
+
+  test("long lines are capped", () => {
+    const long = `nginx: [emerg] ${"x".repeat(400)}`;
+    const summary = summarizeStartupFailure(long) ?? "";
+    expect(summary.length).toBeLessThanOrEqual(201);
+    expect(summary.endsWith("…")).toBe(true);
+  });
+});
+
+describe("findAvailableIngressPort", () => {
+  test("skips a port a foreign listener already holds", async () => {
+    const blocker = createServer();
+    await new Promise<void>((resolve) => {
+      blocker.listen(0, "127.0.0.1", resolve);
+    });
+    const occupied = portOf(blocker);
+    try {
+      const port = await findAvailableIngressPort(occupied);
+      expect(port).toBe(occupied + 1);
+    } finally {
+      await new Promise<void>((resolve) => blocker.close(() => resolve()));
+    }
+  });
+
+  test("returns null when the whole band is busy", async () => {
+    const scout = createServer();
+    await new Promise<void>((resolve) => scout.listen(0, "127.0.0.1", resolve));
+    const base = portOf(scout);
+    await new Promise<void>((resolve) => scout.close(() => resolve()));
+    // Hold both ports of a 2-port band with fresh listeners.
+    const first = createServer();
+    const second = createServer();
+    await new Promise<void>((resolve) =>
+      first.listen(base, "127.0.0.1", resolve),
+    );
+    await new Promise<void>((resolve) =>
+      second.listen(base + 1, "127.0.0.1", resolve),
+    );
+    try {
+      expect(await findAvailableIngressPort(base, 2)).toBeNull();
+    } finally {
+      await new Promise<void>((resolve) => first.close(() => resolve()));
+      await new Promise<void>((resolve) => second.close(() => resolve()));
+    }
+  });
+});
+
+describe("edgeServedRemote", () => {
+  test("a docker cadet is stamped truthfully", () => {
+    expect(edgeServedRemote("docker")).toBe("docker");
+  });
+
+  test("a custom cadet keeps its kind", () => {
+    expect(edgeServedRemote("custom")).toBe("custom");
+  });
+
+  test("local, paired, cloud, and unknown entries read as custom so the remote-gateway machinery always runs", () => {
+    expect(edgeServedRemote("local")).toBe("custom");
+    expect(edgeServedRemote("paired")).toBe("custom");
+    expect(edgeServedRemote("cloud")).toBe("custom");
+    expect(edgeServedRemote(undefined)).toBe("custom");
+  });
+});