@mycadet/gateway 0.12.9 → 0.12.11

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/ces-client/src/http-credentials.ts

@@ -143,6 +143,19 @@ export interface CesHttpCredentialClient {
 // Factory
 // ---------------------------------------------------------------------------
 
+function listErrorContext(
+  response: Response,
+  path: string,
+): Record<string, unknown> {
+  const requestId = response.headers.get("x-ces-error-id");
+  return {
+    status: response.status,
+    method: "GET",
+    path,
+    ...(requestId && /^[a-f0-9-]{36}$/i.test(requestId) ? { requestId } : {}),
+  };
+}
+
 export function createCesHttpCredentialClient(
   config: CesHttpCredentialConfig,
   logger: CesHttpLogger,
@@ -298,7 +311,7 @@ export function createCesHttpCredentialClient(
         if (!res) return { accounts: [], unreachable: true };
         if (!res.ok) {
           logger.warn(
-            { status: res.status },
+            listErrorContext(res, "/v1/credentials"),
             "CES credential list returned non-OK status",
           );
           return { accounts: [], unreachable: true };
@@ -399,6 +412,10 @@ export function createCesHttpCredentialClient(
           return { records: [], unreachable: true };
         }
         if (!res.ok) {
+          logger.warn(
+            listErrorContext(res, "/v1/metadata"),
+            "CES metadata list returned non-OK status",
+          );
           return { records: [], unreachable: true };
         }
         const data = (await res.json()) as {

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/gateway",
-  "version": "0.12.9",
+  "version": "0.12.11",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/credential-reader.test.ts

@@ -53,7 +53,7 @@ function getMachineEntropy(): string {
   } catch {
     parts.push("unknown-user");
   }
-  // Must match assistant/src/util/platform.ts#getPlatformName.
+  // Must match assistant/src/util/os.ts#getPlatformName.
   parts.push(process.platform);
   parts.push(process.arch);
   try {

package/src/__tests__/credential-watcher.test.ts

@@ -56,7 +56,7 @@ function getMachineEntropy(): string {
   } catch {
     parts.push("unknown-user");
   }
-  // Must mirror assistant/src/util/platform.ts#getPlatformName (raw platform).
+  // Must mirror assistant/src/util/os.ts#getPlatformName (raw platform).
   parts.push(process.platform);
   parts.push(process.arch);
   try {

package/src/__tests__/guardian-bootstrap-lookups.test.ts

@@ -337,7 +337,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
     assistantBackend = makeAssistantBackend();
 
     const principalId = await ensureCadetGuardianBinding();
-    expect(principalId).toMatch(/^cadet-principal-/);
+    expect(principalId).toMatch(/^principal-/);
 
     // Gateway now has the row; the assistant DB must not be read again.
     assistantBackend = throwingBackend;
@@ -350,7 +350,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
 
     const principalId = await ensureCadetGuardianBinding();
 
-    expect(principalId).toMatch(/^cadet-principal-/);
+    expect(principalId).toMatch(/^principal-/);
     const gwRows = gatewayCadetGuardians();
     expect(gwRows).toHaveLength(1);
     expect(gwRows[0]?.principalId).toBe(principalId);
@@ -383,7 +383,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
       deviceId: "device-1",
     });
 
-    expect(result.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(result.guardianPrincipalId).toMatch(/^principal-/);
     expect(result.isNew).toBe(true);
     expect(result.mintedOverPriorEvidence).toBe(false);
   });
@@ -606,7 +606,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
       deviceId: "device-1",
     });
 
-    expect(result.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(result.guardianPrincipalId).toMatch(/^principal-/);
     expect(result.isNew).toBe(true);
     expect(result.mintedOverPriorEvidence).toBe(true);
     expect(gatewayCadetGuardians()).toHaveLength(1);

package/src/__tests__/guardian-init-lockfile.test.ts

@@ -271,7 +271,7 @@ describe("guardian/init bootstrap secret", () => {
 
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(body.guardianPrincipalId).toMatch(/^principal-/);
     expect(body.accessToken).toBeTruthy();
     expect(body.refreshToken).toBeTruthy();
     expect(body.isNew).toBe(true);
@@ -391,7 +391,7 @@ describe("guardian/init one-time-use lockfile", () => {
 
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(body.guardianPrincipalId).toMatch(/^principal-/);
     expect(body.accessToken).toBeTruthy();
     expect(body.refreshToken).toBeTruthy();
     expect(lockFileExists()).toBe(true);

package/src/__tests__/remote-web-pairing-challenge.test.ts

@@ -1,3 +1,5 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { beforeEach, describe, expect, test } from "bun:test";
 
 const { handleCreateRemoteWebPairingChallenge } =
@@ -15,6 +17,7 @@ const {
 } = await import("../remote-web/pairing-challenge-store.js");
 const { resetRemoteWebPairingChallengeRateLimiterForTests } =
   await import("../remote-web/pairing-challenge-rate-limit-store.js");
+const { testSecurityDir } = await import("./test-preload.js");
 
 import {
   LOOPBACK_IP,
@@ -501,3 +504,37 @@ describe("remote web pairing request list/approve/deny", () => {
     });
   });
 });
+
+describe("file-backed persistence", () => {
+  test("persists challenges to the security dir for other processes", () => {
+    setRemoteWebPairingChallengeNowForTests(() => 1_000);
+    createRemoteWebPairingChallenge(PUBLIC_BASE_URL, TEST_REQUESTER);
+
+    const storePath = join(
+      testSecurityDir,
+      "remote-web-pairing-challenges.json",
+    );
+    expect(existsSync(storePath)).toBe(true);
+    const persisted: unknown[] = JSON.parse(readFileSync(storePath, "utf-8"));
+    expect(persisted).toHaveLength(1);
+
+    // The reset helper removes the file so other tests start empty.
+    resetRemoteWebPairingChallengesForTests();
+    expect(existsSync(storePath)).toBe(false);
+  });
+
+  test("starts empty and warns when the store file is corrupt", () => {
+    const storePath = join(
+      testSecurityDir,
+      "remote-web-pairing-challenges.json",
+    );
+    writeFileSync(storePath, "{not json", "utf-8");
+
+    const challenge = createRemoteWebPairingChallenge(
+      PUBLIC_BASE_URL,
+      TEST_REQUESTER,
+    );
+    const stored = getRemoteWebPairingChallengeForTests(challenge.userCode);
+    expect(stored).toBeDefined();
+  });
+});

package/src/__tests__/remote-web-pairing-token.test.ts

@@ -622,7 +622,7 @@ describe("remote web pairing token exchange", () => {
       .where(eq(contacts.role, "guardian"))
       .all();
     expect(gwGuardian).toHaveLength(1);
-    expect(gwGuardian[0].principalId).toMatch(/^cadet-principal-/);
+    expect(gwGuardian[0].principalId).toMatch(/^principal-/);
   });
 
   test("gateway binding write failure fails the mint and leaves the code retryable", async () => {

package/src/auth/guardian-bootstrap.ts

@@ -1220,7 +1220,7 @@ async function resolveOrCreateCadetGuardian(options: {
 
   // No gateway guardian — mint a fresh principal.
   const displayName = await fetchPlatformOwnerDisplayName();
-  const guardianPrincipalId = `cadet-principal-${uuid()}`;
+  const guardianPrincipalId = `principal-${uuid()}`;
   await createGuardianBinding({
     channel: "cadet",
     externalUserId: guardianPrincipalId,

package/src/cli/__tests__/pairing.test.ts

@@ -0,0 +1,131 @@
+/**
+ * Tests for the `gateway pairing mint <url>` CLI command. The mint executes
+ * the pairing logic DIRECTLY against the file-backed challenge store — no
+ * IPC (the assistant daemon shares the gateway's socket, so an IPC-exposed
+ * mint would let the assistant approve pairings for itself). These tests run
+ * the real command and pin both the printed challenge and its landing in
+ * the on-disk store the running gateway reads.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { z } from "zod";
+
+const { parsePairingArgs, runPairingCommand } = await import("../pairing.js");
+const {
+  getRemoteWebPairingChallengeForTests,
+  resetRemoteWebPairingChallengesForTests,
+} = await import("../../remote-web/pairing-challenge-store.js");
+const { resetRemoteWebPairingChallengeRateLimiterForTests } =
+  await import("../../remote-web/pairing-challenge-rate-limit-store.js");
+const { testSecurityDir } = await import("../../__tests__/test-preload.js");
+
+// ---------------------------------------------------------------------------
+// Test infrastructure
+// ---------------------------------------------------------------------------
+
+const PrintedChallengeSchema = z.object({
+  deviceCode: z.string().min(1),
+  userCode: z.string().regex(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/),
+  verificationUri: z.string(),
+  expiresAt: z.string(),
+  expiresInSeconds: z.number(),
+  intervalSeconds: z.number(),
+});
+
+let logs: string[];
+let errors: string[];
+let logSpy: ReturnType<typeof spyOn>;
+let errorSpy: ReturnType<typeof spyOn>;
+
+beforeEach(() => {
+  resetRemoteWebPairingChallengesForTests();
+  resetRemoteWebPairingChallengeRateLimiterForTests();
+
+  logs = [];
+  errors = [];
+  logSpy = spyOn(console, "log").mockImplementation((...args: unknown[]) => {
+    logs.push(args.map(String).join(" "));
+  });
+  errorSpy = spyOn(console, "error").mockImplementation(
+    (...args: unknown[]) => {
+      errors.push(args.map(String).join(" "));
+    },
+  );
+});
+
+afterEach(() => {
+  logSpy.mockRestore();
+  errorSpy.mockRestore();
+});
+
+function lastLoggedChallenge() {
+  const line = logs[logs.length - 1];
+  expect(line).toBeTruthy();
+  return PrintedChallengeSchema.parse(JSON.parse(line!));
+}
+
+describe("gateway pairing mint", () => {
+  test("mints an approved challenge directly against the file-backed store", async () => {
+    const code = await runPairingCommand([
+      "mint",
+      "https://my-assistant.ts.net",
+    ]);
+
+    expect(code).toBe(0);
+    const challenge = lastLoggedChallenge();
+    expect(challenge.verificationUri).toBe(
+      "https://my-assistant.ts.net/assistant/pair",
+    );
+    expect(challenge.intervalSeconds).toBe(5);
+
+    // Approved on the spot: the CLI invocation IS the approval.
+    const stored = getRemoteWebPairingChallengeForTests(challenge.userCode);
+    expect(stored?.status).toBe("approved");
+  });
+
+  test("persists the challenge to the store the running gateway reads", async () => {
+    const code = await runPairingCommand([
+      "mint",
+      "https://my-assistant.ts.net",
+    ]);
+    expect(code).toBe(0);
+
+    const storePath = join(
+      testSecurityDir,
+      "remote-web-pairing-challenges.json",
+    );
+    expect(existsSync(storePath)).toBe(true);
+    const raw = readFileSync(storePath, "utf-8");
+    expect(raw).toContain('"status":"approved"');
+    expect(raw).toContain('"requesterIp":"cli"');
+  });
+
+  test("rejects an unparseable public base URL", async () => {
+    const code = await runPairingCommand(["mint", "not-a-url"]);
+
+    expect(code).toBe(1);
+    expect(errors.join("\n")).toContain("publicBaseUrl is required");
+  });
+
+  test("requires the public base URL argument", async () => {
+    const code = await runPairingCommand(["mint"]);
+
+    expect(code).toBe(1);
+    expect(errors.join("\n")).toContain("mint requires the public base URL");
+  });
+});
+
+describe("parsePairingArgs", () => {
+  test("splits the subcommand and positional", () => {
+    expect(parsePairingArgs(["mint", "https://x.example"])).toEqual({
+      subcommand: "mint",
+      positional: "https://x.example",
+    });
+    expect(parsePairingArgs([])).toEqual({
+      subcommand: null,
+      positional: null,
+    });
+  });
+});

package/src/cli/index.ts

@@ -8,6 +8,7 @@
  */
 
 import { runContactsCommand } from "./contacts.js";
+import { runPairingCommand } from "./pairing.js";
 
 function printUsage(): void {
   console.log("Usage: gateway <command>");
@@ -15,7 +16,12 @@ function printUsage(): void {
   console.log("Operator commands for gateway-owned state.");
   console.log("");
   console.log("Commands:");
-  console.log("  contacts    Manage the contact ACL with list, get, set-risk-threshold");
+  console.log(
+    "  contacts    Manage the contact ACL with list, get, set-risk-threshold",
+  );
+  console.log(
+    "  pairing     Mint/approve a remote-web pairing challenge (mint <url>)",
+  );
 }
 
 const args = process.argv.slice(2);
@@ -31,6 +37,11 @@ if (command === "contacts") {
   process.exit(code);
 }
 
+if (command === "pairing") {
+  const code = await runPairingCommand(args.slice(1));
+  process.exit(code);
+}
+
 console.error(`Unknown command: ${command}`);
 printUsage();
 process.exit(1);

package/src/cli/pairing.ts

@@ -0,0 +1,71 @@
+/**
+ * `gateway pairing` — operator subcommands for the remote-web pairing flow.
+ *
+ *   gateway pairing mint <url>
+ *
+ * Mints (and approves) a remote-web pairing challenge by executing the
+ * pairing mint logic DIRECTLY in this process — deliberately NOT over the
+ * gateway's IPC socket, which the assistant daemon shares (an IPC-exposed
+ * mint would let the assistant mint + approve pairings for itself). The
+ * challenge persists to the file-backed pairing store under
+ * GATEWAY_SECURITY_DIR, so the running gateway's verification and
+ * token-exchange routes see it. This is the surface `cadet pair` invokes
+ * (directly on the host, or via `docker exec` inside the gateway container):
+ * process execution is the local-presence proof, so no loopback-peer check
+ * is needed and the topology (native or containerized) stops mattering.
+ * Prints the challenge response as single-line JSON on stdout; the caller
+ * parses it and renders the pairing link/QR.
+ */
+
+import { mintAndApproveRemoteWebPairingChallenge } from "../remote-web/pairing-mint.js";
+
+function printUsage(): void {
+  console.log("Usage: gateway pairing mint <url>");
+  console.log("");
+  console.log(
+    "Mint and approve a remote-web pairing challenge on this machine and",
+  );
+  console.log("print the challenge as JSON.");
+  console.log("");
+  console.log("Arguments:");
+  console.log("  <url>   Public base URL to advertise in the pairing link,");
+  console.log("          e.g. https://your-assistant.ts.net");
+}
+
+/** Parse `pairing` argv (after the command word) into a subcommand + arg. */
+export function parsePairingArgs(args: string[]): {
+  subcommand: string | null;
+  positional: string | null;
+} {
+  const [subcommand = null, positional = null] = args;
+  return { subcommand, positional };
+}
+
+export async function runPairingCommand(args: string[]): Promise<number> {
+  const { subcommand, positional } = parsePairingArgs(args);
+
+  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+    printUsage();
+    return subcommand ? 0 : 1;
+  }
+  if (subcommand !== "mint") {
+    console.error(`Error: unknown pairing subcommand '${subcommand}'.`);
+    printUsage();
+    return 1;
+  }
+  if (!positional) {
+    console.error("Error: mint requires the public base URL to advertise.");
+    printUsage();
+    return 1;
+  }
+
+  try {
+    const challenge = mintAndApproveRemoteWebPairingChallenge(positional);
+    console.log(JSON.stringify(challenge));
+    return 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`Error: pairing mint failed: ${message}`);
+    return 1;
+  }
+}

package/src/credential-reader.ts

@@ -46,7 +46,7 @@ type StoreFile = StoreFileV1 | StoreFileV2;
 const STORE_KEY_FILENAME = "store.key";
 
 function getPlatformName(): string {
-  // Must match assistant/src/util/platform.ts#getPlatformName exactly.
+  // Must match assistant/src/util/os.ts#getPlatformName exactly.
   // Using user-friendly labels like "macOS" here changes PBKDF2 entropy and
   // makes gateway unable to decrypt credentials written by the daemon.
   return process.platform;

package/src/http/routes/guardian-pin.ts

@@ -40,6 +40,7 @@ import { findCadetGuardian } from "../../auth/guardian-bootstrap.js";
 import type { GatewayConfig } from "../../config.js";
 import { requestHasTunnelBridgeAuth } from "../../tunnel/bridge-auth.js";
 import { readStoredCloudUserId } from "../../cloud-user-id.js";
+import { isWebsocketUpgradeRequest } from "../utils.js";
 
 const TUNNEL_USER_ID_HEADER = "x-tunnel-user-id";
 const TUNNEL_ORG_ID_HEADER = "x-tunnel-org-id";
@@ -175,7 +176,7 @@ export async function authorizeGuardianStream(
   // Checked here as well as in the shared gate, because the cloud path
   // below skips that gate entirely: without this, a cloud caller sending a
   // plain request would fall through to `server.upgrade` and get a 500.
-  if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+  if (!isWebsocketUpgradeRequest(req)) {
     return new Response("Upgrade Required", { status: 426 });
   }
 

package/src/http/routes/ingress-domains.test.ts

@@ -97,14 +97,17 @@ describe("POST /v1/ingress/domains", () => {
     expect(afterSecond).toBe(afterFirst);
   });
 
-  test("rejects non-loopback callers", async () => {
+  test("does not gate on the peer IP — auth lives in the edge-guardian strategy", async () => {
+    // The docker hatch's gateway sees the host CLI as a non-loopback peer
+    // (the docker bridge IP); peer-IP gating here 403'd valid
+    // guardian-token requests, so it moved to the auth strategy.
     const res = await handleSaveIngressDomain(
       request({ publicBaseUrl: "https://foo.ngrok.app" }),
       "10.0.0.1",
       new ConfigFileCache(),
     );
 
-    expect(res.status).toBe(403);
+    expect(res.status).toBe(200);
   });
 
   test("rejects a body without a usable public URL", async () => {