@serfab/cadre-host 0.10.0 → 0.12.0

package/src/__tests__/host-owner.smoke.test.ts

@@ -1,123 +1,123 @@
-/**
- * Server-level smoke: the /auth/* HTTP contract over the owner-node
- * channel adapter. Validates the two behaviours the realignment must
- * preserve:
- *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
- *   2. With the node refusing connections, GET /auth/trust-circle still lists
- *      local labels, and POST /auth/invites returns 503 (not a raw 500).
- *
- * The owner node is represented by a stub HTTP server matching the 6.6
- * admin contract (the spawn path itself is covered by
- * orchestrator-owner.test.ts).
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import Fastify from 'fastify';
-import http from 'node:http';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
-import { OwnerNodeClient } from '../owner/index.js';
-import { registerErrorHandler } from '../server/error-handler.js';
-import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
-import { EventBus } from '../server/events/bus.js';
-
-const TOKEN = 'tok';
-
-let tmpRoot: string;
-beforeEach(() => { tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-smoke-')); });
-afterEach(() => { try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ } });
-
-function buildApp(service: TrustCircleService) {
-  const app = Fastify();
-  registerErrorHandler(app);
-  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(service), events: new EventBus() });
-  return app;
-}
-
-describe('host /auth delegation — node up', () => {
-  let server: http.Server;
-  let baseUrl: string;
-
-  beforeEach(async () => {
-    server = http.createServer((req, res) => {
-      const chunks: Buffer[] = [];
-      req.on('data', (c) => chunks.push(c as Buffer));
-      req.on('end', () => {
-        if (req.headers['authorization'] !== `Bearer ${TOKEN}`) {
-          res.writeHead(401); res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'x' } })); return;
-        }
-        if (req.url === '/admin/invites' && req.method === 'POST') {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
-          return;
-        }
-        if (req.url === '/admin/members' && req.method === 'GET') {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { members: [] } }));
-          return;
-        }
-        res.writeHead(400); res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
-      });
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
-    const a = server.address();
-    baseUrl = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
-  });
-
-  afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
-
-  it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
-    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
-    const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
-    const app = buildApp(service);
-    try {
-      const res = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Mom' } });
-      expect(res.statusCode).toBe(200);
-      const body = res.json() as { encodedInvite: string };
-      expect(body.encodedInvite).toBe('ENC');
-    } finally {
-      await app.close();
-    }
-  });
-});
-
-describe('host /auth delegation — node refusing connections', () => {
-  let closedBaseUrl: string;
-
-  beforeEach(async () => {
-    const tmp = http.createServer();
-    const port = await new Promise<number>((resolve) => {
-      tmp.listen(0, '127.0.0.1', () => {
-        const a = tmp.address();
-        resolve(typeof a === 'object' && a ? a.port : 0);
-      });
-    });
-    await new Promise<void>((resolve) => tmp.close(() => resolve()));
-    closedBaseUrl = `http://127.0.0.1:${port}`;
-  });
-
-  it('GET /auth/trust-circle lists local labels and POST /auth/invites returns 503', async () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
-
-    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
-    const service = new TrustCircleService({ cadreNode: client, store });
-    const app = buildApp(service);
-    try {
-      const list = await app.inject({ method: 'GET', url: '/auth/trust-circle' });
-      expect(list.statusCode).toBe(200);
-      const snap = list.json() as { members: Array<{ peerId: string; label: string }> };
-      expect(snap.members.some((m) => m.peerId === '12D3KooWLocal' && m.label === 'My laptop')).toBe(true);
-
-      const invite = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Dad' } });
-      expect(invite.statusCode).toBe(503);
-      const body = invite.json() as { error: { code: string } };
-      expect(body.error.code).toBe('node_unavailable');
-    } finally {
-      await app.close();
-    }
-  });
-});
+/**
+ * Server-level smoke: the /auth/* HTTP contract over the owner-node
+ * channel adapter. Validates the two behaviours the realignment must
+ * preserve:
+ *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
+ *   2. With the node refusing connections, GET /auth/trust-circle still lists
+ *      local labels, and POST /auth/invites returns 503 (not a raw 500).
+ *
+ * The owner node is represented by a stub HTTP server matching the 6.6
+ * admin contract (the spawn path itself is covered by
+ * orchestrator-owner.test.ts).
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import Fastify from 'fastify';
+import http from 'node:http';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
+import { OwnerNodeClient } from '../owner/index.js';
+import { registerErrorHandler } from '../server/error-handler.js';
+import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
+import { EventBus } from '../server/events/bus.js';
+
+const TOKEN = 'tok';
+
+let tmpRoot: string;
+beforeEach(() => { tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-smoke-')); });
+afterEach(() => { try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ } });
+
+function buildApp(service: TrustCircleService) {
+  const app = Fastify();
+  registerErrorHandler(app);
+  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(service), events: new EventBus() });
+  return app;
+}
+
+describe('host /auth delegation — node up', () => {
+  let server: http.Server;
+  let baseUrl: string;
+
+  beforeEach(async () => {
+    server = http.createServer((req, res) => {
+      const chunks: Buffer[] = [];
+      req.on('data', (c) => chunks.push(c as Buffer));
+      req.on('end', () => {
+        if (req.headers['authorization'] !== `Bearer ${TOKEN}`) {
+          res.writeHead(401); res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'x' } })); return;
+        }
+        if (req.url === '/admin/invites' && req.method === 'POST') {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
+          return;
+        }
+        if (req.url === '/admin/members' && req.method === 'GET') {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, data: { members: [] } }));
+          return;
+        }
+        res.writeHead(400); res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    const a = server.address();
+    baseUrl = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
+  });
+
+  afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
+
+  it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
+    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
+    const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
+    const app = buildApp(service);
+    try {
+      const res = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Mom' } });
+      expect(res.statusCode).toBe(200);
+      const body = res.json() as { encodedInvite: string };
+      expect(body.encodedInvite).toBe('ENC');
+    } finally {
+      await app.close();
+    }
+  });
+});
+
+describe('host /auth delegation — node refusing connections', () => {
+  let closedBaseUrl: string;
+
+  beforeEach(async () => {
+    const tmp = http.createServer();
+    const port = await new Promise<number>((resolve) => {
+      tmp.listen(0, '127.0.0.1', () => {
+        const a = tmp.address();
+        resolve(typeof a === 'object' && a ? a.port : 0);
+      });
+    });
+    await new Promise<void>((resolve) => tmp.close(() => resolve()));
+    closedBaseUrl = `http://127.0.0.1:${port}`;
+  });
+
+  it('GET /auth/trust-circle lists local labels and POST /auth/invites returns 503', async () => {
+    const store = new TrustCircleStore(tmpRoot);
+    store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
+
+    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
+    const service = new TrustCircleService({ cadreNode: client, store });
+    const app = buildApp(service);
+    try {
+      const list = await app.inject({ method: 'GET', url: '/auth/trust-circle' });
+      expect(list.statusCode).toBe(200);
+      const snap = list.json() as { members: Array<{ peerId: string; label: string }> };
+      expect(snap.members.some((m) => m.peerId === '12D3KooWLocal' && m.label === 'My laptop')).toBe(true);
+
+      const invite = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Dad' } });
+      expect(invite.statusCode).toBe(503);
+      const body = invite.json() as { error: { code: string } };
+      expect(body.error.code).toBe('node_unavailable');
+    } finally {
+      await app.close();
+    }
+  });
+});

package/src/__tests__/orchestrator-env-scrub.test.ts

@@ -1,140 +1,140 @@
-/**
- * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
- * not leak `CADRE_*` config-override vars into spawned children.
- *
- * `launchChild` used to build each child's environment as
- * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
- * var set on the manager (not just the ones the orchestrator deliberately
- * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
- * `CADRE_*` var as a config override that beats the per-child config file, a
- * `CADRE_PARTY_ID` set on the manager could silently pull every child into
- * that party.
- *
- * A fake CLI records the vars under test from its environment to a file so
- * the scrub is observable without a real cadre node.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
-
-// Writes the vars under test (as seen in the child env) next to the startup token.
-const FAKE_CLI = `
-import fs from 'node:fs';
-import path from 'node:path';
-const args = process.argv.slice(2);
-const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
-const tokenPath = get('--startup-token-file');
-const token = process.env.CADRE_STARTUP_TOKEN ?? '';
-if (tokenPath) {
-  const dir = path.dirname(tokenPath);
-  const record = {
-    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
-    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
-    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
-    DEBUG: process.env.DEBUG ?? null,
-  };
-  try { fs.writeFileSync(path.join(dir, 'env-seen.json'), JSON.stringify(record), 'utf8'); } catch (e) { console.error(e); }
-  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
-}
-process.on('SIGTERM', () => process.exit(0));
-setInterval(() => {}, 1 << 30);
-`;
-
-let tmpRoot: string;
-let scriptPath: string;
-const orchestrators: HostProcessOrchestrator[] = [];
-let savedEnv: Record<string, string | undefined>;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
-  scriptPath = join(tmpRoot, 'fake-cli.mjs');
-  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
-  savedEnv = {
-    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
-    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
-    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
-    DEBUG: process.env.DEBUG,
-  };
-});
-
-afterEach(async () => {
-  for (const orch of orchestrators) {
-    for (const n of orch.listNodes()) {
-      try { await orch.removeContainer(n.dockerId); } catch { /* ignore */ }
-    }
-  }
-  orchestrators.length = 0;
-  await sleep(50);
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  for (const [key, value] of Object.entries(savedEnv)) {
-    if (value === undefined) delete process.env[key];
-    else process.env[key] = value;
-  }
-});
-
-function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
-  mkdirSync(rootDir, { recursive: true });
-  const orch = new HostProcessOrchestrator({
-    rootDir,
-    portRange: { start: 18000, end: 18499 },
-    stopTimeoutMs: 1500,
-    spawn: { entrypoint: scriptPath },
-  });
-  orchestrators.push(orch);
-  return orch;
-}
-
-async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (existsSync(path)) return readFileSync(path, 'utf8');
-    await sleep(50);
-  }
-  throw new Error(`file never appeared: ${path}`);
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((res) => setTimeout(res, ms));
-}
-
-describe('HostProcessOrchestrator child env scrub', () => {
-  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
-    process.env.CADRE_PARTY_ID = 'conflicting-party';
-    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
-    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
-    // command — so it only stays scrubbed if the scrub is prefix-wide.
-    process.env.CADRE_ADMIN_PORT = '19999';
-    process.env.DEBUG = 'some:value';
-
-    const rootDir = join(tmpRoot, 'a');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'child-1',
-      partyId: 'party-1',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-    await orch.createContainer({
-      containerId: 'child-2',
-      partyId: 'party-2',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-
-    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
-    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
-
-    for (const seen of [seen1, seen2]) {
-      expect(seen.CADRE_PARTY_ID).toBeNull();
-      expect(seen.CADRE_STORAGE_PATH).toBeNull();
-      expect(seen.CADRE_ADMIN_PORT).toBeNull();
-      expect(seen.DEBUG).toBe('some:value');
-    }
-  });
-});
+/**
+ * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
+ * not leak `CADRE_*` config-override vars into spawned children.
+ *
+ * `launchChild` used to build each child's environment as
+ * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
+ * var set on the manager (not just the ones the orchestrator deliberately
+ * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
+ * `CADRE_*` var as a config override that beats the per-child config file, a
+ * `CADRE_PARTY_ID` set on the manager could silently pull every child into
+ * that party.
+ *
+ * A fake CLI records the vars under test from its environment to a file so
+ * the scrub is observable without a real cadre node.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+
+// Writes the vars under test (as seen in the child env) next to the startup token.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  const record = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
+    DEBUG: process.env.DEBUG ?? null,
+  };
+  try { fs.writeFileSync(path.join(dir, 'env-seen.json'), JSON.stringify(record), 'utf8'); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+let savedEnv: Record<string, string | undefined>;
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+  savedEnv = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
+    DEBUG: process.env.DEBUG,
+  };
+});
+
+afterEach(async () => {
+  for (const orch of orchestrators) {
+    for (const n of orch.listNodes()) {
+      try { await orch.removeContainer(n.dockerId); } catch { /* ignore */ }
+    }
+  }
+  orchestrators.length = 0;
+  await sleep(50);
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18000, end: 18499 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator child env scrub', () => {
+  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
+    process.env.CADRE_PARTY_ID = 'conflicting-party';
+    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
+    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
+    // command — so it only stays scrubbed if the scrub is prefix-wide.
+    process.env.CADRE_ADMIN_PORT = '19999';
+    process.env.DEBUG = 'some:value';
+
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'child-1',
+      partyId: 'party-1',
+      bootstrapNodes: [],
+      profile: 'storage',
+    });
+    await orch.createContainer({
+      containerId: 'child-2',
+      partyId: 'party-2',
+      bootstrapNodes: [],
+      profile: 'storage',
+    });
+
+    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
+    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
+
+    for (const seen of [seen1, seen2]) {
+      expect(seen.CADRE_PARTY_ID).toBeNull();
+      expect(seen.CADRE_STORAGE_PATH).toBeNull();
+      expect(seen.CADRE_ADMIN_PORT).toBeNull();
+      expect(seen.DEBUG).toBe('some:value');
+    }
+  });
+});

package/src/__tests__/orchestrator-node-identity.test.ts

@@ -6,9 +6,9 @@
  * opens the file-backed bootstrap-peer / trusted-owner stores only when a
  * protobuf identity key file is configured). The orchestrator therefore writes
  * `<workdir>/identity.key` once per container and passes it as
- * `--identity-protobuf`.
+ * `--identity-file`.
  *
- * A fake CLI records the `--identity-protobuf` argument it was launched with, so
+ * A fake CLI records the `--identity-file` argument it was launched with, so
  * the spawn wiring is observable without a real cadre node.
  */
 
@@ -20,7 +20,7 @@ import { join } from 'node:path';
 import { HostProcessOrchestrator, OWNER_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
 import { loadIdentity } from '../installer/identity.js';
 
-// Writes the --identity-protobuf argument (as seen on its own command line) next
+// Writes the --identity-file argument (as seen on its own command line) next
 // to the startup token, then behaves like a minimal long-lived node.
 const FAKE_CLI = `
 import fs from 'node:fs';
@@ -31,7 +31,7 @@ const tokenPath = get('--startup-token-file');
 const token = process.env.CADRE_STARTUP_TOKEN ?? '';
 if (tokenPath) {
   const dir = path.dirname(tokenPath);
-  try { fs.writeFileSync(path.join(dir, 'identity-arg.txt'), get('--identity-protobuf') ?? '', 'utf8'); } catch (e) { console.error(e); }
+  try { fs.writeFileSync(path.join(dir, 'identity-arg.txt'), get('--identity-file') ?? '', 'utf8'); } catch (e) { console.error(e); }
   if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
 }
 process.on('SIGTERM', () => process.exit(0));
@@ -88,7 +88,7 @@ function sleep(ms: number): Promise<void> {
 }
 
 describe('HostProcessOrchestrator node identity', () => {
-  it('passes --identity-protobuf pointing at a real key inside the node workdir', async () => {
+  it('passes --identity-file pointing at a real key inside the node workdir', async () => {
     const rootDir = join(tmpRoot, 'a');
     const orch = makeOrchestrator(rootDir);
     await orch.init();