@serfab/cadre-host 0.11.0 → 0.12.0

package/src/installer/__tests__/config.test.ts

@@ -1,112 +1,134 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { readHostConfig, writeHostConfig, hostOwnsCadre, type HostConfigFile } from '../config.js';
-
-describe('host.config.json round-trip', () => {
-  let tmp: string;
-
-  beforeEach(() => {
-    tmp = mkdtempSync(join(tmpdir(), 'cadre-host-cfg-'));
-  });
-
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  function makeCfg(overrides: Partial<HostConfigFile> = {}): HostConfigFile {
-    return {
-      version: 2,
-      installId: 'abc123',
-      uiPort: 8765,
-      libp2pPort: 4001,
-      dataDir: tmp,
-      identityPath: join(tmp, 'identity.key'),
-      upnpEnabled: true,
-      installedAt: '2026-01-01T00:00:00.000Z',
-      installerVersion: '0.6.0',
-      updates: { autoApply: false },
-      ...overrides,
-    };
-  }
-
-  it('writes and reads the same shape', () => {
-    const cfg = makeCfg();
-    const path = join(tmp, 'host.config.json');
-    writeHostConfig(path, cfg);
-    expect(readHostConfig(path)).toEqual(cfg);
-  });
-
-  it('upgrades v1 files in place on read', () => {
-    const path = join(tmp, 'host.config.json');
-    const v1 = {
-      version: 1,
-      installId: 'abc123',
-      uiPort: 8765,
-      libp2pPort: 4001,
-      dataDir: tmp,
-      identityPath: join(tmp, 'identity.key'),
-      upnpEnabled: true,
-      installedAt: '2026-01-01T00:00:00.000Z',
-      installerVersion: '0.6.0',
-    };
-    writeFileSync(path, JSON.stringify(v1));
-    const upgraded = readHostConfig(path);
-    expect(upgraded.version).toBe(2);
-    expect(upgraded.updates).toEqual({ autoApply: false });
-    // Reading again should be idempotent and stay v2.
-    const reRead = readHostConfig(path);
-    expect(reRead.version).toBe(2);
-  });
-
-  it('rejects unknown versions', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, JSON.stringify({ ...makeCfg(), version: 99 }));
-    expect(() => readHostConfig(path)).toThrow(/unsupported version=99/);
-  });
-
-  it('rejects malformed JSON', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, 'not json');
-    expect(() => readHostConfig(path)).toThrow(/Failed to parse/);
-  });
-
-  it('rejects missing required fields', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, JSON.stringify({ version: 2, uiPort: 1234 }));
-    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
-  });
-
-  it('refuses to write the wrong version', () => {
-    const path = join(tmp, 'host.config.json');
-    expect(() => writeHostConfig(path, { ...makeCfg(), version: 3 as never })).toThrow(/version=3/);
-  });
-
-  it('round-trips ownCadre and hostOwnsCadre reflects it', () => {
-    const path = join(tmp, 'host.config.json');
-    const cfg = makeCfg({ ownCadre: { enabled: true } });
-    writeHostConfig(path, cfg);
-    const read = readHostConfig(path);
-    expect(read.ownCadre).toEqual({ enabled: true });
-    expect(hostOwnsCadre(read)).toBe(true);
-  });
-
-  it('treats an absent ownCadre as donor-only (hostOwnsCadre false)', () => {
-    // A pre-ownCadre v2 config (field absent) must read back cleanly and be
-    // donor-only — no migration, field stays absent.
-    const path = join(tmp, 'host.config.json');
-    const cfg = makeCfg();
-    writeHostConfig(path, cfg);
-    const read = readHostConfig(path);
-    expect(read.ownCadre).toBeUndefined();
-    expect(hostOwnsCadre(read)).toBe(false);
-  });
-
-  it('rejects a malformed ownCadre shape', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, JSON.stringify({ ...makeCfg(), ownCadre: { enabled: 'yes' } }));
-    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
-  });
-});
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { readHostConfig, updateHostConfig, writeHostConfig, hostOwnsCadre, type HostConfigFile } from '../config.js';
+
+describe('host.config.json round-trip', () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), 'cadre-host-cfg-'));
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  function makeCfg(overrides: Partial<HostConfigFile> = {}): HostConfigFile {
+    return {
+      version: 2,
+      installId: 'abc123',
+      uiPort: 8765,
+      libp2pPort: 4001,
+      dataDir: tmp,
+      identityPath: join(tmp, 'identity.key'),
+      upnpEnabled: true,
+      installedAt: '2026-01-01T00:00:00.000Z',
+      installerVersion: '0.6.0',
+      updates: { autoApply: false },
+      ...overrides,
+    };
+  }
+
+  it('writes and reads the same shape', () => {
+    const cfg = makeCfg();
+    const path = join(tmp, 'host.config.json');
+    writeHostConfig(path, cfg);
+    expect(readHostConfig(path)).toEqual(cfg);
+  });
+
+  it('rejects v1 files without rewriting them', () => {
+    const path = join(tmp, 'host.config.json');
+    const v1 = {
+      version: 1,
+      installId: 'abc123',
+      uiPort: 8765,
+      libp2pPort: 4001,
+      dataDir: tmp,
+      identityPath: join(tmp, 'identity.key'),
+      upnpEnabled: true,
+      installedAt: '2026-01-01T00:00:00.000Z',
+      installerVersion: '0.6.0',
+    };
+    const raw = JSON.stringify(v1);
+    writeFileSync(path, raw);
+    expect(() => readHostConfig(path)).toThrow(/unsupported version=1/);
+    expect(readFileSync(path, 'utf8')).toBe(raw);
+  });
+
+  it('rejects unknown versions', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ ...makeCfg(), version: 99 }));
+    expect(() => readHostConfig(path)).toThrow(/unsupported version=99/);
+  });
+
+  it('rejects a file with no version field', () => {
+    const { version: _version, ...noVersion } = makeCfg();
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify(noVersion));
+    expect(() => readHostConfig(path)).toThrow(/unsupported version=undefined/);
+  });
+
+  it('rejects malformed JSON', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, 'not json');
+    expect(() => readHostConfig(path)).toThrow(/Failed to parse/);
+  });
+
+  it('rejects missing required fields', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ version: 2, uiPort: 1234 }));
+    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
+  });
+
+  it('refuses to write the wrong version', () => {
+    const path = join(tmp, 'host.config.json');
+    expect(() => writeHostConfig(path, { ...makeCfg(), version: 3 as never })).toThrow(/version=3/);
+  });
+
+  it('update patches fields and re-stamps the current version', () => {
+    const path = join(tmp, 'host.config.json');
+    writeHostConfig(path, makeCfg());
+    const next = updateHostConfig(path, { updates: { autoApply: true } });
+    expect(next.version).toBe(2);
+    expect(next.updates).toEqual({ autoApply: true });
+    expect(next.installId).toBe('abc123');
+    expect(readHostConfig(path)).toEqual(next);
+  });
+
+  it('update never lets a patch downgrade the version', () => {
+    const path = join(tmp, 'host.config.json');
+    writeHostConfig(path, makeCfg());
+    const patch = { version: 1 } as unknown as Partial<Omit<HostConfigFile, 'version'>>;
+    expect(updateHostConfig(path, patch).version).toBe(2);
+    expect(readHostConfig(path).version).toBe(2);
+  });
+
+  it('round-trips ownCadre and hostOwnsCadre reflects it', () => {
+    const path = join(tmp, 'host.config.json');
+    const cfg = makeCfg({ ownCadre: { enabled: true } });
+    writeHostConfig(path, cfg);
+    const read = readHostConfig(path);
+    expect(read.ownCadre).toEqual({ enabled: true });
+    expect(hostOwnsCadre(read)).toBe(true);
+  });
+
+  it('treats an absent ownCadre as donor-only (hostOwnsCadre false)', () => {
+    // A pre-ownCadre v2 config (field absent) must read back cleanly and be
+    // donor-only — no migration, field stays absent.
+    const path = join(tmp, 'host.config.json');
+    const cfg = makeCfg();
+    writeHostConfig(path, cfg);
+    const read = readHostConfig(path);
+    expect(read.ownCadre).toBeUndefined();
+    expect(hostOwnsCadre(read)).toBe(false);
+  });
+
+  it('rejects a malformed ownCadre shape', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ ...makeCfg(), ownCadre: { enabled: 'yes' } }));
+    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
+  });
+});

package/src/installer/config.ts

@@ -5,10 +5,10 @@
  * orchestrator) each own their own files under `<dataDir>/`; this is NOT
  * an umbrella config.
  *
- * Schema versions:
- *   v1 — initial layout from 6.4.1.
- *   v2 — adds `updates: { autoApply, manifestUrl? }` for the update-flow
- *        (6.4.2). v1 files are silently upgraded on read with autoApply=false.
+ * Schema version: 2. `version` is a forward guard — a file whose version
+ * does not match `CURRENT_VERSION` is rejected on read rather than
+ * reinterpreted, so a future incompatible layout fails loudly instead of
+ * being silently misread.
  */
 
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -119,7 +119,7 @@ export function updateHostConfig(
     ...current,
     ...patch,
     updates: { ...current.updates, ...(patch.updates ?? {}) },
-    version: 2,
+    version: CURRENT_VERSION,
   };
   writeHostConfig(filePath, next);
   return next;
@@ -137,12 +137,6 @@ export function readHostConfig(filePath: string): HostConfigFile {
     throw new Error(`host.config.json at ${filePath} is not a JSON object`);
   }
   const obj = parsed as Record<string, unknown>;
-  if (obj.version === 1) {
-    // Silent in-place upgrade. v1 lacks `updates`; default to notify-only.
-    const upgraded = upgradeV1(obj, filePath);
-    writeHostConfig(filePath, upgraded);
-    return upgraded;
-  }
   if (obj.version !== CURRENT_VERSION) {
     throw new Error(
       `host.config.json at ${filePath} has unsupported version=${obj.version} (this build expects ${CURRENT_VERSION})`,
@@ -154,38 +148,6 @@ export function readHostConfig(filePath: string): HostConfigFile {
   return obj;
 }
 
-/** v1 → v2 migration: stamp `updates: { autoApply: false }` and bump version. */
-function upgradeV1(obj: Record<string, unknown>, filePath: string): HostConfigFile {
-  if (!isV1Shape(obj)) {
-    throw new Error(`host.config.json at ${filePath} is missing required v1 fields`);
-  }
-  return {
-    version: 2,
-    installId: obj.installId as string,
-    uiPort: obj.uiPort as number,
-    libp2pPort: obj.libp2pPort as number,
-    dataDir: obj.dataDir as string,
-    identityPath: obj.identityPath as string,
-    upnpEnabled: obj.upnpEnabled as boolean,
-    installedAt: obj.installedAt as string,
-    installerVersion: obj.installerVersion as string,
-    updates: { autoApply: false },
-  };
-}
-
-function isV1Shape(v: Record<string, unknown>): boolean {
-  return (
-    typeof v.installId === 'string' &&
-    typeof v.uiPort === 'number' &&
-    typeof v.libp2pPort === 'number' &&
-    typeof v.dataDir === 'string' &&
-    typeof v.identityPath === 'string' &&
-    typeof v.upnpEnabled === 'boolean' &&
-    typeof v.installedAt === 'string' &&
-    typeof v.installerVersion === 'string'
-  );
-}
-
 function isHostConfigShape(v: unknown): v is HostConfigFile {
   if (!v || typeof v !== 'object') return false;
   const o = v as Record<string, unknown>;

package/src/installer/identity.ts

@@ -9,7 +9,14 @@
  * We persist the protobuf form (not raw bytes) because that's the format
  * libp2p's `privateKeyFromProtobuf` consumes directly and it preserves the
  * key type tag — future migrations to a different key algorithm don't
- * require a schema change here.
+ * require a schema change here. Raw bytes carry no type tag AND no way to tell
+ * a damaged file from a valid one: `privateKeyFromRaw` accepts any 64 bytes as
+ * an Ed25519 key without checking that the public half matches the private, so
+ * a truncated file would load as a *different* working identity.
+ *
+ * This is the repo-wide identity file format, not a cadre-host-local choice:
+ * `cadre enroll create` writes exactly these bytes, and `cadre-cli`'s
+ * `identity.keyFile` accepts nothing else (`config/loader.ts` → `loadIdentityKey`).
  */
 
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';