@mycadet/gateway 0.12.10 → 0.13.0

package/src/ipc/feature-flag-handlers.ts

@@ -11,7 +11,6 @@ import { z } from "zod";
 
 import { loadFeatureFlagDefaults } from "../feature-flag-defaults.js";
 import { readEnvFeatureFlagOverrides } from "../feature-flag-env-overrides.js";
-import { readRemoteFeatureFlags } from "../feature-flag-remote-store.js";
 import { readPersistedFeatureFlags } from "../feature-flag-store.js";
 import type { IpcRoute } from "./server.js";
 
@@ -20,24 +19,18 @@ const GetFeatureFlagParamsSchema = z.object({
 });
 
 /**
- * Compute the merged feature flag state: defaults < remote < persisted.
+ * Compute the merged feature flag state: defaults < persisted.
  * Returns a `Record<string, boolean | string>` keyed by flag name.
  */
 export function getMergedFeatureFlags(): FeatureFlagsIpcResponse {
   const defaults = loadFeatureFlagDefaults();
   const persisted = readPersistedFeatureFlags();
-  const remote = readRemoteFeatureFlags();
 
   const result: Record<string, boolean | string> = {};
   for (const [key, def] of Object.entries(defaults)) {
     const persistedValue = persisted[key];
-    const remoteValue = remote[key];
     result[key] =
-      persistedValue !== undefined
-        ? persistedValue
-        : remoteValue !== undefined
-          ? remoteValue
-          : def.defaultEnabled;
+      persistedValue !== undefined ? persistedValue : def.defaultEnabled;
   }
 
   const envOverrides = readEnvFeatureFlagOverrides();

package/src/remote-web/pairing-challenge-store.ts

@@ -331,6 +331,21 @@ export function listPendingRemoteWebPairingChallenges(): RemoteWebPairingRequest
   }));
 }
 
+/**
+ * Every persisted pairing challenge — pending, approved, exchanging,
+ * consumed, or past expiry — newest first. Unlike the pending-list route
+ * this deletes nothing: expired challenges linger until their own
+ * verification/exchange paths clean them up, and this list is how the
+ * operator sees that tail state. Liveness (active vs expired) is the
+ * caller's call — it compares expiresAtMs against its own clock.
+ */
+export function listPersistedRemoteWebPairingChallenges(): PendingRemoteWebPairingChallenge[] {
+  loadFromDisk();
+  return [...challengesByUserCodeHash.values()].sort(
+    (a, b) => b.createdAtMs - a.createdAtMs,
+  );
+}
+
 export function approveRemoteWebPairingChallengeById(
   id: string,
 ): ApproveRemoteWebPairingChallengeResult {

package/src/risk/command-registry/commands/assistant.ts

@@ -33,19 +33,6 @@ const ASSISTANT_SUPPORTED_COMMAND_PATHS = [
   "avatar character update",
   "avatar character components",
   "avatar character ascii",
-  "backup",
-  "backup enable",
-  "backup disable",
-  "backup destinations",
-  "backup destinations list",
-  "backup destinations add",
-  "backup destinations remove",
-  "backup destinations set-encrypt",
-  "backup status",
-  "backup list",
-  "backup create",
-  "backup restore",
-  "backup verify",
   "bash",
   "browser",
   "browser navigate",
@@ -449,11 +436,6 @@ const riskOverrides: AssistantRiskOverride[] = [
     reason: "Deletes API key material",
   },
   // Destructive assistant-state operations
-  {
-    path: "backup restore",
-    risk: "high",
-    reason: "Restores backup and overwrites workspace state",
-  },
   {
     path: "conversations clear",
     risk: "medium",
@@ -471,12 +453,6 @@ const riskOverrides: AssistantRiskOverride[] = [
   { path: "avatar set", risk: "low" },
   { path: "avatar remove", risk: "low" },
   { path: "avatar character update", risk: "low" },
-  { path: "backup enable", risk: "low" },
-  { path: "backup disable", risk: "high" },
-  { path: "backup destinations add", risk: "high" },
-  { path: "backup destinations remove", risk: "high" },
-  { path: "backup destinations set-encrypt", risk: "high" },
-  { path: "backup create", risk: "low" },
   { path: "cache set", risk: "low" },
   { path: "cache delete", risk: "low" },
   { path: "channel-verification-sessions create", risk: "high" },

package/src/risk/command-registry.test.ts

@@ -525,8 +525,8 @@ describe("command-registry", () => {
         expect(assistantSubs.platform.baseRisk).toBe("low");
       });
 
-      test("assistant backup is low risk", () => {
-        expect(assistantSubs.backup.baseRisk).toBe("low");
+      test("assistant backup is not registered", () => {
+        expect(assistantSubs.backup).toBeUndefined();
       });
 
       test("assistant help is low risk", () => {
@@ -585,7 +585,6 @@ describe("command-registry", () => {
         "audit",
         "auth",
         "avatar",
-        "backup",
         "bash",
         "browser",
         "cache",
@@ -649,7 +648,6 @@ describe("command-registry", () => {
       expect(getAssistantPath("email send").baseRisk).toBe("high");
       expect(getAssistantPath("domain register").baseRisk).toBe("medium");
       expect(getAssistantPath("conversations clear").baseRisk).toBe("medium");
-      expect(getAssistantPath("backup restore").baseRisk).toBe("high");
       expect(getAssistantPath("inference session open").baseRisk).toBe("low");
       expect(getAssistantPath("inference session close").baseRisk).toBe("low");
       expect(getAssistantPath("inference session list").baseRisk).toBe("low");

package/src/schema.ts

@@ -3989,309 +3989,6 @@ export function buildSchema(): Record<string, unknown> {
           },
         },
       },
-      "/v1/migrations/export": {
-        post: {
-          summary: "Export workspace backup",
-          description:
-            "Proxies a migration export request to the assistant daemon. Returns a binary .vbundle backup of the workspace. Authenticated with an edge JWT. Timeout is 120 seconds to accommodate large workspaces.",
-          operationId: "migrationExport",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: false,
-            content: {
-              "application/json": {
-                schema: { type: "object", additionalProperties: true },
-              },
-            },
-          },
-          responses: {
-            "200": {
-              description: "Binary .vbundle backup file",
-              content: {
-                "application/octet-stream": {
-                  schema: { type: "string", format: "binary" },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/import": {
-        post: {
-          summary: "Import workspace backup",
-          description:
-            "Proxies a migration import request to the assistant. Request shapes:\n" +
-            "\n" +
-            "  - `application/octet-stream`: raw .vbundle body. The request is proxied synchronously and the caller's connection stays open for the full import duration (returns 200 on success).\n" +
-            '  - `application/json` with `{ "url": "<signed GCS URL>" }` or `{ "path": "<staged workspace path>" }`: the gateway generates a jobId, kicks off the upstream assistant call in the background, and returns `202 Accepted` with `{ job_id, status: "pending" }` immediately. Callers poll `GET /v1/migrations/import/{jobId}/status` for progress. The path form points at a `.vbundle` staged under the assistant workspace `.restore-staging` directory.\n' +
-            "\n" +
-            "Authenticated with an edge JWT. Synchronous-path timeout is 60 minutes to accommodate large 8 GB backups; the async path returns immediately.",
-          operationId: "migrationImport",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: true,
-            content: {
-              "application/octet-stream": {
-                schema: { type: "string", format: "binary" },
-              },
-              "application/json": {
-                schema: {
-                  oneOf: [
-                    {
-                      type: "object",
-                      required: ["url"],
-                      properties: {
-                        url: {
-                          type: "string",
-                          format: "uri",
-                          description:
-                            "Signed GCS URL pointing at a .vbundle archive.",
-                        },
-                      },
-                    },
-                    {
-                      type: "object",
-                      required: ["path"],
-                      properties: {
-                        path: {
-                          type: "string",
-                          minLength: 1,
-                          description:
-                            "Workspace-relative or absolute path to a staged .vbundle under .restore-staging.",
-                        },
-                      },
-                    },
-                  ],
-                },
-              },
-            },
-          },
-          responses: {
-            "200": {
-              description:
-                "Backup imported successfully (synchronous byte path).",
-            },
-            "202": {
-              description:
-                "Import accepted for async processing (JSON url or path body). Poll `/v1/migrations/import/{jobId}/status` for progress.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id", "status"],
-                    properties: {
-                      job_id: { type: "string" },
-                      status: { type: "string", enum: ["pending"] },
-                    },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/import/{jobId}/status": {
-        get: {
-          summary: "Poll async import job status",
-          description:
-            "Returns the current status of an async `.vbundle` import kicked off by `POST /v1/migrations/import` with a JSON `{url}` or `{path}` body. Finished jobs remain queryable for 30 minutes before being pruned.",
-          operationId: "migrationImportStatus",
-          security: [{ BearerAuth: [] }],
-          parameters: [
-            {
-              in: "path",
-              name: "jobId",
-              required: true,
-              schema: { type: "string" },
-              description:
-                "The `job_id` returned by the 202 response from `POST /v1/migrations/import`.",
-            },
-          ],
-          responses: {
-            "200": {
-              description: "Current job status.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id", "status"],
-                    properties: {
-                      job_id: { type: "string" },
-                      status: {
-                        type: "string",
-                        enum: ["pending", "processing", "complete", "failed"],
-                      },
-                      error: { type: "string" },
-                      result: {},
-                    },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "404": {
-              description:
-                "Unknown job — never issued, or pruned after 30-minute TTL.",
-            },
-          },
-        },
-      },
-      "/v1/migrations/export-to-gcs": {
-        post: {
-          summary: "Kick off an async export-to-GCS job",
-          description:
-            "Transparent proxy to the assistant daemon's `POST /v1/migrations/export-to-gcs` endpoint. The daemon schedules a background export job that streams the workspace backup to the supplied signed GCS upload URL and returns `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
-          operationId: "migrationExportToGcs",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: true,
-            content: {
-              "application/json": {
-                schema: { type: "object", additionalProperties: true },
-              },
-            },
-          },
-          responses: {
-            "202": {
-              description: "Export job accepted.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id"],
-                    properties: { job_id: { type: "string" } },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "409": {
-              description: "Another export is already in flight.",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/import-from-gcs": {
-        post: {
-          summary: "Kick off an async import-from-GCS job",
-          description:
-            "Transparent proxy to the assistant daemon's `POST /v1/migrations/import-from-gcs` endpoint. The daemon schedules a background import job that fetches a `.vbundle` archive at the supplied `bundle_url` and streams it through the importer, returning `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
-          operationId: "migrationImportFromGcs",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: true,
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  required: ["bundle_url"],
-                  properties: {
-                    bundle_url: {
-                      type: "string",
-                      format: "uri",
-                      description:
-                        "Signed GCS URL pointing at a .vbundle archive.",
-                    },
-                  },
-                },
-              },
-            },
-          },
-          responses: {
-            "202": {
-              description: "Import job accepted.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id"],
-                    properties: { job_id: { type: "string" } },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "409": {
-              description: "Another import is already in flight.",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/jobs/{jobId}": {
-        get: {
-          summary: "Poll unified migration job status",
-          description:
-            "Transparent proxy to the assistant daemon's `GET /v1/migrations/jobs/{job_id}` endpoint. Returns the current status of an async export-to-GCS or import-from-GCS job tracked by the daemon's migration job registry. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
-          operationId: "migrationJobStatus",
-          security: [{ BearerAuth: [] }],
-          parameters: [
-            {
-              in: "path",
-              name: "jobId",
-              required: true,
-              schema: { type: "string" },
-              description:
-                "The `job_id` returned by the 202 response from `POST /v1/migrations/export-to-gcs` or `POST /v1/migrations/import-from-gcs`.",
-            },
-          ],
-          responses: {
-            "200": {
-              description: "Current job status.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id", "type", "status"],
-                    properties: {
-                      job_id: { type: "string" },
-                      type: {
-                        type: "string",
-                        enum: ["export", "import"],
-                      },
-                      status: {
-                        type: "string",
-                        enum: ["processing", "complete", "failed"],
-                      },
-                      result: {},
-                      error: { type: "string" },
-                      error_code: { type: "string" },
-                      upstream_status: { type: "integer" },
-                    },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "404": {
-              description: "Unknown job_id.",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
       "/v1/admin/workspace-commit": {
         post: {
           summary: "Commit workspace changes",
@@ -4431,50 +4128,37 @@ export function buildSchema(): Record<string, unknown> {
           },
         },
       },
-      "/v1/backups": {
+      "/v1/devices/mine": {
         get: {
-          summary: "List backup snapshots",
+          summary: "The caller's own paired-device row",
           description:
-            "Lists local and offsite backup snapshots. The gateway owns the backup encryption key and performs all encrypt/decrypt operations.",
-          operationId: "backupsList",
+            "Returns the paired-device row matching the presenting bearer token, so the paired web UI can surface 'this device' for matching against the host-side `cadet devices` list. Browser-reachable: the bearer is the credential, and the route answers only for the token presenting it. Not available on cloud-hosted assistants (they have no paired-device rows).",
+          operationId: "getMyDevice",
           security: [{ BearerAuth: [] }],
           responses: {
             "200": {
-              description: "Backup snapshots listed",
+              description: "The caller's paired-device row",
               content: {
                 "application/json": {
                   schema: {
                     type: "object",
-                    required: ["local", "offsite"],
+                    required: ["device"],
                     properties: {
-                      local: {
+                      device: {
                         type: "object",
-                        required: ["directory", "snapshots"],
+                        required: ["hashedDeviceId", "platform", "issuedAt"],
                         properties: {
-                          directory: { type: "string" },
-                          snapshots: {
-                            type: "array",
-                            items: {
-                              $ref: "#/components/schemas/BackupSnapshot",
-                            },
+                          hashedDeviceId: { type: "string" },
+                          platform: { type: "string" },
+                          pairingUserAgent: {
+                            type: ["string", "null"],
                           },
-                        },
-                      },
-                      offsite: {
-                        type: "array",
-                        items: {
-                          type: "object",
-                          required: ["directory", "encrypted", "snapshots"],
-                          properties: {
-                            directory: { type: "string" },
-                            encrypted: { type: "boolean" },
-                            snapshots: {
-                              type: "array",
-                              items: {
-                                $ref: "#/components/schemas/BackupSnapshot",
-                              },
-                            },
+                          clientReportedName: {
+                            type: ["string", "null"],
                           },
+                          issuedAt: { type: "string" },
+                          expiresAt: { type: ["string", "null"] },
+                          lastUsedAt: { type: ["string", "null"] },
                         },
                       },
                     },
@@ -4483,51 +4167,22 @@ export function buildSchema(): Record<string, unknown> {
               },
             },
             "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "403": { description: "Insufficient scope" },
-            "500": { description: "Internal server error" },
-          },
-        },
-      },
-      "/v1/backups/create": {
-        post: {
-          summary: "Create backup snapshot",
-          description:
-            "Triggers a manual backup snapshot. The gateway exports a plaintext vbundle from the daemon, writes it locally, and encrypts + mirrors to offsite destinations.",
-          operationId: "backupsCreate",
-          security: [{ BearerAuth: [] }],
-          responses: {
-            "200": {
-              description: "Backup snapshot created",
+              description: "Missing or invalid bearer token",
               content: {
                 "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["success", "local", "offsite", "duration_ms"],
-                    properties: {
-                      success: { type: "boolean" },
-                      local: {
-                        $ref: "#/components/schemas/BackupSnapshot",
-                      },
-                      offsite: {
-                        type: "array",
-                        items: { type: "object", additionalProperties: true },
-                      },
-                      duration_ms: { type: "number" },
-                    },
-                  },
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
                 },
               },
             },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "403": { description: "Insufficient scope" },
-            "409": {
-              description: "A backup snapshot is already in progress",
+            "404": {
+              description:
+                "No paired-device row for this token, or the gateway is cloud-hosted",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
+                },
+              },
             },
-            "500": { description: "Internal server error" },
           },
         },
       },
@@ -4628,6 +4283,23 @@ export function buildSchema(): Record<string, unknown> {
                 },
               },
             },
+            "404": {
+              description: "Route not found on upstream runtime",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
+                },
+              },
+            },
+            "500": {
+              description:
+                "Server misconfigured (proxy auth enabled without token)",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
+                },
+              },
+            },
             "502": {
               description: "Upstream connection failed",
               content: {