@mycadet/gateway 0.12.11 → 0.13.0

package/src/__tests__/feature-flags-route.test.ts

@@ -11,10 +11,6 @@ import { testSecurityDir } from "./test-preload.js";
 
 const protectedDir = testSecurityDir;
 const featureFlagStorePath = join(protectedDir, "feature-flags.json");
-const remoteFeatureFlagStorePath = join(
-  protectedDir,
-  "feature-flags-remote.json",
-);
 
 // Write the test registry to an isolated temp path so we never touch
 // the committed gateway/src/feature-flag-registry.json file.
@@ -65,7 +61,6 @@ beforeEach(() => {
   _setRegistryCandidateOverrides([defaultsPath]);
   resetFeatureFlagDefaultsCache();
   clearFeatureFlagStoreCache();
-  clearRemoteFeatureFlagStoreCache();
 });
 
 afterEach(() => {
@@ -79,7 +74,6 @@ afterEach(() => {
   _setRegistryCandidateOverrides(null);
   resetFeatureFlagDefaultsCache();
   clearFeatureFlagStoreCache();
-  clearRemoteFeatureFlagStoreCache();
   resetEnvOverridesCache();
   delete process.env.CADET_FLAG_A2A_CHANNEL;
 });
@@ -93,8 +87,6 @@ const {
 } = await import("../feature-flag-defaults.js");
 const { clearFeatureFlagStoreCache, readPersistedFeatureFlags } =
   await import("../feature-flag-store.js");
-const { clearRemoteFeatureFlagStoreCache, writeRemoteFeatureFlags } =
-  await import("../feature-flag-remote-store.js");
 const { resetEnvOverridesCache } =
   await import("../feature-flag-env-overrides.js");
 
@@ -283,132 +275,13 @@ describe("GET /v1/feature-flags handler", () => {
     expect(browserFlag.defaultEnabled).toBe(true);
   });
 
-  test("remote values fill in when no local override exists", async () => {
-    // Write a remote store with a2a-channel enabled (overriding registry default of false)
-    writeFileSync(
-      remoteFeatureFlagStorePath,
-      JSON.stringify({
-        version: 1,
-        values: {
-          "a2a-channel": true,
-        },
-      }),
-    );
-    clearRemoteFeatureFlagStoreCache();
-
-    // No local override for a2a-channel
-    if (existsSync(featureFlagStorePath)) {
-      rmSync(featureFlagStorePath);
-    }
-    clearFeatureFlagStoreCache();
-
-    const handler = createFeatureFlagsGetHandler();
-    const res = await handler(
-      new Request("http://gateway.test/v1/feature-flags"),
-    );
-
-    expect(res.status).toBe(200);
-    const body = await res.json();
-
-    const a2aFlag = body.flags.find(
-      (f: { key: string }) => f.key === "a2a-channel",
-    );
-    expect(a2aFlag).toBeDefined();
-    // Remote value (true) overrides registry default (false)
-    expect(a2aFlag.enabled).toBe(true);
-  });
-
-  test("local overrides take precedence over remote values", async () => {
-    // Set remote value to true
-    writeFileSync(
-      remoteFeatureFlagStorePath,
-      JSON.stringify({
-        version: 1,
-        values: {
-          "a2a-channel": true,
-        },
-      }),
-    );
-    clearRemoteFeatureFlagStoreCache();
-
-    // Set local override to false
-    writeFileSync(
-      featureFlagStorePath,
-      JSON.stringify({
-        version: 1,
-        values: {
-          "a2a-channel": false,
-        },
-      }),
-    );
-    clearFeatureFlagStoreCache();
-
-    const handler = createFeatureFlagsGetHandler();
-    const res = await handler(
-      new Request("http://gateway.test/v1/feature-flags"),
-    );
-
-    expect(res.status).toBe(200);
-    const body = await res.json();
-
-    const a2aFlag = body.flags.find(
-      (f: { key: string }) => f.key === "a2a-channel",
-    );
-    expect(a2aFlag).toBeDefined();
-    // Local override (false) takes precedence over remote (true)
-    expect(a2aFlag.enabled).toBe(false);
-  });
-
-  test("reflects updated flags after remote sync writes new values (stale cache regression)", async () => {
-    // Scenario: the remote poller (RemoteFeatureFlagSync) writes
-    // a2a-channel: false, the gateway caches it, then a subsequent
-    // poll writes a2a-channel: true. The GET handler should return
-    // the updated value because writeRemoteFeatureFlags() updates
-    // both disk and the in-memory cache.
-
-    // Step 1: First poll writes a2a-channel: false (simulated via
-    // writeRemoteFeatureFlags, which is what the poller calls internally).
-    writeRemoteFeatureFlags({ "a2a-channel": false });
-
-    const handler = createFeatureFlagsGetHandler();
-    const res1 = await handler(
-      new Request("http://gateway.test/v1/feature-flags"),
-    );
-    const body1 = await res1.json();
-    const a2aFlag1 = body1.flags.find(
-      (f: { key: string }) => f.key === "a2a-channel",
-    );
-    expect(a2aFlag1.enabled).toBe(false);
-
-    // Step 2: Second poll writes a2a-channel: true — the poller
-    // calls writeRemoteFeatureFlags which updates file + cache.
-    writeRemoteFeatureFlags({ "a2a-channel": true });
-
-    // Step 3: The GET handler should immediately reflect the update
-    // without needing a file-watcher round-trip.
-    const res2 = await handler(
-      new Request("http://gateway.test/v1/feature-flags"),
-    );
-    const body2 = await res2.json();
-    const a2aFlag2 = body2.flags.find(
-      (f: { key: string }) => f.key === "a2a-channel",
-    );
-    expect(a2aFlag2.enabled).toBe(true);
-  });
-
-  test("registry default used when neither local nor remote is set", async () => {
+  test("registry default used when no local override is set", async () => {
     // No local override
     if (existsSync(featureFlagStorePath)) {
       rmSync(featureFlagStorePath);
     }
     clearFeatureFlagStoreCache();
 
-    // No remote value (empty remote store)
-    if (existsSync(remoteFeatureFlagStorePath)) {
-      rmSync(remoteFeatureFlagStorePath);
-    }
-    clearRemoteFeatureFlagStoreCache();
-
     const handler = createFeatureFlagsGetHandler();
     const res = await handler(
       new Request("http://gateway.test/v1/feature-flags"),
@@ -417,11 +290,11 @@ describe("GET /v1/feature-flags handler", () => {
     expect(res.status).toBe(200);
     const body = await res.json();
 
-    // a2a-channel has defaultEnabled: false in registry
     const a2aFlag = body.flags.find(
       (f: { key: string }) => f.key === "a2a-channel",
     );
     expect(a2aFlag).toBeDefined();
+    // Registry default (false) applies with no local override
     expect(a2aFlag.enabled).toBe(false);
     expect(a2aFlag.defaultEnabled).toBe(false);
 
@@ -434,51 +307,9 @@ describe("GET /v1/feature-flags handler", () => {
     expect(browserFlag.defaultEnabled).toBe(true);
   });
 
-  test("declared flags missing from a remote snapshot use their registry defaults", async () => {
-    // No local override
-    if (existsSync(featureFlagStorePath)) {
-      rmSync(featureFlagStorePath);
-    }
-    clearFeatureFlagStoreCache();
-
-    // Remote snapshot exists, but browser is absent as it would be when the
-    // platform has no LaunchDarkly value for that key.
-    writeFileSync(
-      remoteFeatureFlagStorePath,
-      JSON.stringify({
-        version: 1,
-        values: { "a2a-channel": true },
-      }),
-    );
-    clearRemoteFeatureFlagStoreCache();
-
-    const handler = createFeatureFlagsGetHandler();
-    const res = await handler(
-      new Request("http://gateway.test/v1/feature-flags"),
-    );
-
-    expect(res.status).toBe(200);
-    const body = await res.json();
-
-    const a2aFlag = body.flags.find(
-      (f: { key: string }) => f.key === "a2a-channel",
-    );
-    expect(a2aFlag.enabled).toBe(true);
-
-    const browserFlag = body.flags.find(
-      (f: { key: string }) => f.key === "browser",
-    );
-    expect(browserFlag).toBeDefined();
-    expect(browserFlag.enabled).toBe(true);
-    expect(browserFlag.defaultEnabled).toBe(true);
-  });
-
   test("string flag uses registry default when no override exists", async () => {
     if (existsSync(featureFlagStorePath)) rmSync(featureFlagStorePath);
-    if (existsSync(remoteFeatureFlagStorePath))
-      rmSync(remoteFeatureFlagStorePath);
     clearFeatureFlagStoreCache();
-    clearRemoteFeatureFlagStoreCache();
 
     const handler = createFeatureFlagsGetHandler();
     const res = await handler(
@@ -496,26 +327,6 @@ describe("GET /v1/feature-flags handler", () => {
     expect(modelFlag.defaultEnabled).toBe("claude-sonnet-4-6");
   });
 
-  test("remote string value overrides registry default for string flag", async () => {
-    writeRemoteFeatureFlags({ "default-model": "gpt-4" });
-    if (existsSync(featureFlagStorePath)) rmSync(featureFlagStorePath);
-    clearFeatureFlagStoreCache();
-
-    const handler = createFeatureFlagsGetHandler();
-    const res = await handler(
-      new Request("http://gateway.test/v1/feature-flags"),
-    );
-
-    expect(res.status).toBe(200);
-    const body = await res.json();
-
-    const modelFlag = body.flags.find(
-      (f: { key: string }) => f.key === "default-model",
-    );
-    expect(modelFlag).toBeDefined();
-    expect(modelFlag.enabled).toBe("gpt-4");
-  });
-
   test("env override takes precedence over persisted and default values", async () => {
     // Persisted value sets a2a-channel to false
     writeFileSync(

package/src/__tests__/guardian-bootstrap-lookups.test.ts

@@ -5,9 +5,9 @@
  * (via ensureCadetGuardianBinding / bootstrapGuardian) and its divergent
  * re-mint guard (evidence of a prior guardian refuses the implicit mint).
  *
- * The guardian-integrity reporter is silenced/observed via its test-only
- * overrides, and the integrity cache is busted between tests — same seam
- * conventions as the guardian-integrity test trio (no mock.module).
+ * The guardian-integrity reporter's report fns are observed via a pass-through
+ * spy on the module's live ESM bindings, and the integrity cache is busted
+ * between tests.
  *
  * Guardian rows are seeded ONLY in the gateway DB. By default the assistant
  * DB proxy is swapped for a backend that throws, proving the lookups never
@@ -25,7 +25,6 @@ import {
   expect,
   beforeAll,
   beforeEach,
-  afterEach,
   afterAll,
   mock,
 } from "bun:test";
@@ -84,10 +83,7 @@ import {
   actorTokenRecords,
   actorRefreshTokenRecords,
 } from "../db/schema.js";
-import {
-  resetGuardianIntegrityReporterForTesting,
-  setGuardianIntegrityReporterOverridesForTesting,
-} from "../guardian-integrity-reporter.js";
+import * as guardianIntegrityReporter from "../guardian-integrity-reporter.js";
 import { seedActorToken, seedContact } from "./helpers/contact-fixtures.js";
 
 // Initialize signing key so bootstrapGuardian's JWT minting works.
@@ -165,10 +161,22 @@ beforeAll(async () => {
   await initGatewayDb();
 });
 
-// Captured guardian-integrity reporter detail payloads (via the log
-// override): missing-guardian and mint-refused reports both land here.
+// Captured guardian-integrity reporter detail payloads (via module
+// re-registration — bun's spyOn does not intercept calls made through the
+// SUTs' direct ESM imports): missing-guardian and mint-refused reports both
+// land here.
 const reportCalls: Record<string, unknown>[] = [];
 
+mock.module("../guardian-integrity-reporter.js", () => ({
+  ...guardianIntegrityReporter,
+  reportMissingGuardian: (detail: Record<string, unknown>) => {
+    reportCalls.push(detail);
+  },
+  reportGuardianMintRefused: (detail: Record<string, unknown>) => {
+    reportCalls.push(detail);
+  },
+}));
+
 beforeEach(() => {
   const db = getGatewayDb();
   db.delete(contactChannels).run();
@@ -180,23 +188,8 @@ beforeEach(() => {
   bustGuardianIntegrityCache();
   assistantBackend = throwingBackend;
   reportCalls.length = 0;
-  resetGuardianIntegrityReporterForTesting();
-  setGuardianIntegrityReporterOverridesForTesting({
-    fetchImpl: async () => new Response("{}"),
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail) => {
-        reportCalls.push(detail);
-      },
-      warn: () => {},
-    },
-  });
 });
 
-afterEach(() => {
-  resetGuardianIntegrityReporterForTesting();
-});
 
 afterAll(() => {
   resetGatewayDb();

package/src/__tests__/guardian-integrity-reporter.test.ts

@@ -1,109 +1,78 @@
 /**
- * Fail-loud missing-guardian reporter (guardian-integrity-reporter.ts):
+ * Fail-loud guardian-integrity reporter (guardian-integrity-reporter.ts):
  *
- *  - First report emits one error log and one telemetry relay POST with the
- *    `gateway_guardian_missing` check name and the caller's detail.
- *  - Subsequent reports inside the hourly window are dropped (rate limit).
- *  - Relay failures never throw out of the caller.
+ *  - First report per check emits one error log carrying the caller's detail
+ *    and the failure copy.
+ *  - Subsequent reports inside the hourly window are dropped (rate limit);
+ *    the sibling check still reports (per-check rate limit).
  *
- * Logging is observed through the reporter's test-only `log` override —
- * bun's mock.module is process-global and would leak into other test files.
+ * Logs are observed by mocking the logger module (a side-effect boundary —
+ * the same convention as sleep-wake-detector.test.ts). Per-file CI truth:
+ * the mock is process-global, so this file pins nothing else.
  */
-import { beforeEach, afterEach, describe, expect, test } from "bun:test";
+import { beforeEach, describe, expect, mock, spyOn, test } from "bun:test";
 
-const errorLogs: unknown[] = [];
-const warnLogs: unknown[] = [];
+const errorLogs: [Record<string, unknown>, string][] = [];
+
+mock.module("../logger.js", () => ({
+  getLogger: () => ({
+    error: (detail: Record<string, unknown>, msg: string) => {
+      errorLogs.push([detail, msg]);
+    },
+    warn: () => {},
+  }),
+}));
 
 await import("./test-preload.js");
-const {
-  GUARDIAN_MISSING_CHECK_NAME,
-  flushGuardianIntegrityReporterForTesting,
-  reportMissingGuardian,
-  resetGuardianIntegrityReporterForTesting,
-  setGuardianIntegrityReporterOverridesForTesting,
-} = await import("../guardian-integrity-reporter.js");
+const { reportGuardianMintRefused, reportMissingGuardian } =
+  await import("../guardian-integrity-reporter.js");
 
-type FetchCall = { url: string; init: RequestInit };
-let fetchCalls: FetchCall[] = [];
-let fetchResult: () => Promise<Response> = async () => new Response("{}");
+let fakeNow = 1_000_000_000_000;
 
 beforeEach(() => {
-  fetchCalls = [];
-  fetchResult = async () => new Response("{}");
   errorLogs.length = 0;
-  warnLogs.length = 0;
-  resetGuardianIntegrityReporterForTesting();
-  setGuardianIntegrityReporterOverridesForTesting({
-    fetchImpl: async (url, init) => {
-      fetchCalls.push({ url: String(url), init: init ?? {} });
-      return fetchResult();
-    },
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail, msg) => {
-        errorLogs.push([detail, msg]);
-      },
-      warn: (detail, msg) => {
-        warnLogs.push([detail, msg]);
-      },
-    },
-  });
-});
-
-afterEach(() => {
-  resetGuardianIntegrityReporterForTesting();
+  fakeNow += 24 * 60 * 60 * 1000; // start each test outside prior windows
+  spyOn(Date, "now").mockImplementation(() => fakeNow);
 });
 
 describe("reportMissingGuardian", () => {
-  test("first report logs an error and relays one watchdog event", async () => {
+  test("first report logs one error with the detail + copy", () => {
     reportMissingGuardian({ has_contacts: true, has_actor_tokens: false });
-    await flushGuardianIntegrityReporterForTesting();
 
     expect(errorLogs.length).toBe(1);
-    expect(fetchCalls.length).toBe(1);
-    expect(fetchCalls[0].url).toBe(
-      "http://127.0.0.1:7821/v1/internal/telemetry/watchdog",
-    );
-    const headers = fetchCalls[0].init.headers as Record<string, string>;
-    expect(headers.Authorization).toBe("Bearer svc-token");
-    expect(JSON.parse(String(fetchCalls[0].init.body))).toEqual({
-      check_name: GUARDIAN_MISSING_CHECK_NAME,
-      detail: { has_contacts: true, has_actor_tokens: false },
+    expect(errorLogs[0]![0]).toMatchObject({
+      check: "gateway_guardian_missing",
+      has_contacts: true,
+      has_actor_tokens: false,
     });
+    expect(errorLogs[0]![1]).toContain("until the guardian is re-seeded");
   });
 
-  test("repeat reports inside the hourly window are dropped", async () => {
-    reportMissingGuardian({ has_contacts: true, has_actor_tokens: false });
-    reportMissingGuardian({ has_contacts: true, has_actor_tokens: false });
-    reportMissingGuardian({ has_contacts: true, has_actor_tokens: true });
-    await flushGuardianIntegrityReporterForTesting();
+  test("repeat reports inside the hourly window are dropped; the sibling check still fires", () => {
+    reportMissingGuardian({});
+    reportMissingGuardian({});
+    reportGuardianMintRefused({ integrity_state: "ok" });
 
-    expect(errorLogs.length).toBe(1);
-    expect(fetchCalls.length).toBe(1);
+    expect(errorLogs.length).toBe(2);
+    expect(errorLogs[0]![0]).toMatchObject({
+      check: "gateway_guardian_missing",
+    });
+    expect(errorLogs[1]![0]).toMatchObject({
+      check: "gateway_guardian_mint_refused",
+      integrity_state: "ok",
+    });
   });
+});
 
-  test("a rejected relay never throws out of the caller", async () => {
-    fetchResult = async () => {
-      throw new Error("daemon unreachable");
-    };
-
-    expect(() =>
-      reportMissingGuardian({ has_contacts: false, has_actor_tokens: true }),
-    ).not.toThrow();
-    await flushGuardianIntegrityReporterForTesting();
+describe("reportGuardianMintRefused", () => {
+  test("first report logs one error with the detail + copy", () => {
+    reportGuardianMintRefused({ integrity_state: "ok" });
 
     expect(errorLogs.length).toBe(1);
-    expect(warnLogs.length).toBe(1);
-  });
-
-  test("a non-ok relay response is swallowed with a warning", async () => {
-    fetchResult = async () => new Response("nope", { status: 500 });
-
-    reportMissingGuardian({ has_contacts: true, has_actor_tokens: true });
-    await flushGuardianIntegrityReporterForTesting();
-
-    expect(fetchCalls.length).toBe(1);
-    expect(warnLogs.length).toBe(1);
+    expect(errorLogs[0]![0]).toMatchObject({
+      check: "gateway_guardian_mint_refused",
+      integrity_state: "ok",
+    });
+    expect(errorLogs[0]![1]).toContain("guardian_repair_required");
   });
 });

package/src/__tests__/guardian-integrity.test.ts

@@ -12,7 +12,7 @@
  * files); its logging/relay behavior has its own tests
  * (guardian-integrity-reporter.test.ts).
  */
-import { beforeEach, afterEach, describe, expect, test } from "bun:test";
+import { beforeEach, afterEach, describe, expect, mock, test } from "bun:test";
 
 await import("./test-preload.js");
 const { initGatewayDb, resetGatewayDb, getGatewayDb } =
@@ -25,10 +25,8 @@ const {
 } = await import("../db/schema.js");
 const { seedActorToken, seedContact } =
   await import("./helpers/contact-fixtures.js");
-const {
-  resetGuardianIntegrityReporterForTesting,
-  setGuardianIntegrityReporterOverridesForTesting,
-} = await import("../guardian-integrity-reporter.js");
+const actualGuardianIntegrityReporter =
+  await import("../guardian-integrity-reporter.js");
 const {
   bustGuardianIntegrityCache,
   guardianIntegrityState,
@@ -37,10 +35,21 @@ const {
 const { applyGuardianBindingGatewayWrites } =
   await import("../auth/guardian-bootstrap.js");
 
-// The reporter's first-report error log carries the detail payload; capture
-// it as the "reported" signal.
+// The reporter's report fns carry the detail payload; capture it by
+// re-registering the reporter module with recorders (bun's spyOn does not
+// intercept calls made through the SUTs' direct ESM imports).
 const reportCalls: Record<string, unknown>[] = [];
 
+mock.module("../guardian-integrity-reporter.js", () => ({
+  ...actualGuardianIntegrityReporter,
+  reportMissingGuardian: (detail: Record<string, unknown>) => {
+    reportCalls.push(detail);
+  },
+  reportGuardianMintRefused: (detail: Record<string, unknown>) => {
+    reportCalls.push(detail);
+  },
+}));
+
 function insertRefreshToken(): void {
   const now = Date.now();
   getGatewayDb()
@@ -71,23 +80,10 @@ beforeEach(async () => {
   getGatewayDb().delete(actorRefreshTokenRecords).run();
   bustGuardianIntegrityCache();
   reportCalls.length = 0;
-  resetGuardianIntegrityReporterForTesting();
-  setGuardianIntegrityReporterOverridesForTesting({
-    fetchImpl: async () => new Response("{}"),
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail) => {
-        reportCalls.push(detail);
-      },
-      warn: () => {},
-    },
-  });
 });
 
 afterEach(() => {
   resetGatewayDb();
-  resetGuardianIntegrityReporterForTesting();
 });
 
 describe("hasEvidenceOfPriorGuardian", () => {

package/src/__tests__/handle-inbound-trust-verdict.test.ts

@@ -85,10 +85,6 @@ const {
 } = await import("../db/schema.js");
 const { bustGuardianIntegrityCache } =
   await import("../auth/guardian-integrity.js");
-const {
-  resetGuardianIntegrityReporterForTesting,
-  setGuardianIntegrityReporterOverridesForTesting,
-} = await import("../guardian-integrity-reporter.js");
 const { handleInbound } = await import("../handlers/handle-inbound.js");
 
 const CHANNEL = "telegram";
@@ -201,22 +197,13 @@ beforeEach(async () => {
   runtimePayloads = [];
   forwardToRuntimeMock.mockClear();
   interceptResult = { intercepted: false };
-  // The integrity state is TTL-cached process-wide; recompute per test and
-  // silence the fail-loud reporter (its behavior has its own suites).
+  // The integrity state is TTL-cached process-wide; recompute per test.
   bustGuardianIntegrityCache();
-  resetGuardianIntegrityReporterForTesting();
-  setGuardianIntegrityReporterOverridesForTesting({
-    fetchImpl: async () => new Response("{}"),
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: { error: () => {}, warn: () => {} },
-  });
 });
 
 afterEach(() => {
   resetAdmissionPolicyCache();
   resetGatewayDb();
-  resetGuardianIntegrityReporterForTesting();
 });
 
 describe("handle-inbound trust verdict stamping", () => {