@superblocksteam/sdk 2.0.123 → 2.0.124-next.1

package/src/cli-replacement/dev-s3-restore.test.mts

@@ -8,9 +8,11 @@ import { beforeEach, describe, expect, it, vi, type Mock } from "vitest";
 import { packageJsonSnapshot } from "./package-json-snapshot.mjs";
 
 const execMock = vi.fn();
+const execFileMock = vi.fn();
 vi.mock("node:child_process", () => ({
-  default: { exec: execMock },
+  default: { exec: execMock, execFile: execFileMock },
   exec: execMock,
+  execFile: execFileMock,
 }));
 
 vi.mock("node:readline", () => ({
@@ -56,6 +58,12 @@ const mockLogger = {
   debug: vi.fn(),
 };
 
+const mockAiServiceState = vi.hoisted(() => ({
+  npmRegistryClient: undefined as
+    | { getConfig: () => Promise<Record<string, unknown>> }
+    | undefined,
+}));
+
 vi.mock("../telemetry/logging.js", () => ({
   getLogger: () => mockLogger,
   getErrorMeta: vi.fn(() => ({})),
@@ -83,7 +91,12 @@ vi.mock("colorette", () => ({
   green: (s: string) => s,
 }));
 
-vi.mock("@superblocksteam/shared", () => ({
+vi.mock("@superblocksteam/shared", async (importOriginal) => ({
+  // dev.mts now transitively loads @superblocksteam/shared (via the npm-error
+  // classifier re-exported from vite-plugin-file-sync/npm-registry — APPS-4450),
+  // pulling in many named exports (DeploymentTypeEnum, ISocket, …). Spread the
+  // real module so the closed overrides below don't have to enumerate them.
+  ...((await importOriginal()) as Record<string, unknown>),
   buildGithubSuperblocksSyncWorkflow: vi.fn(),
   buildGithubSuperblocksSyncWorkflowFromBaseUrl: vi.fn(),
   ConflictError: class ConflictError extends Error {},
@@ -104,6 +117,12 @@ vi.mock("@superblocksteam/vite-plugin-file-sync/ai-service", () => ({
     initialize = vi.fn(async () => undefined);
     removeIntegrationCache = vi.fn(async () => undefined);
     chatSessionStore = { invalidateCache: vi.fn() };
+    // `dev.mts` reads this at startup for two paths: `syncHomeNpmrc`
+    // (APPS-4231 home `~/.npmrc` writer) and the startup `installPackages`
+    // call (APPS-4251 per-org `allow_install_scripts`). Returning undefined
+    // keeps the install path on the "no policy resolved" branch and is also
+    // valid input for the mocked-out `syncHomeNpmrc`.
+    getNpmRegistryClient = vi.fn(() => mockAiServiceState.npmRegistryClient);
   },
   AiServiceFeatureFlags: class {
     static create = vi.fn(() => ({}));
@@ -115,6 +134,21 @@ vi.mock("@superblocksteam/vite-plugin-file-sync/ai-service", () => ({
   stripResolvedFromLockfile: vi.fn(async () => undefined),
 }));
 
+vi.mock("@superblocksteam/vite-plugin-file-sync/npm-registry", () => ({
+  shouldIgnoreInstallScripts: vi.fn(() => false),
+  // Used by the dependency-install-classifier reachable from installPackages'
+  // catch path (APPS-4450). Previously the only test that hit this codepath
+  // (`logs a structured error when the background install fails`) didn't
+  // assert classification, so the missing exports surfaced silently as a
+  // ReferenceError instead of an InitialInstallFailed. The new
+  // restart-vs-degrade test depends on installPackages re-throwing an actual
+  // InitialInstallFailed marker, so stub all classifier-required exports.
+  scrubSecrets: vi.fn((value: string) => value),
+  parseNpmJsonDiagnostic: vi.fn(() => ""),
+  parseNpmJsonError: vi.fn(() => null),
+  classifyNpmExecStderr: vi.fn(() => null),
+}));
+
 vi.mock("@superblocksteam/vite-plugin-file-sync/git-service", () => ({
   createGitService: vi.fn(async () => undefined),
 }));
@@ -187,6 +221,25 @@ vi.mock("./automatic-upgrades.js", () => ({
   checkVersionsAndWritePackageJson: (
     ...args: Parameters<typeof mockCheckVersions>
   ) => mockCheckVersions(...args),
+  buildInstallEnv: (userconfigPath: string) => ({
+    ...process.env,
+    NPM_CONFIG_USERCONFIG: userconfigPath,
+    PNPM_CONFIG_USERCONFIG: userconfigPath,
+  }),
+}));
+
+// The home `~/.npmrc` writer (APPS-4231) is a best-effort step that runs
+// before auto-upgrade. Mock it out here so these tests stay focused on the
+// DBFS / S3 restore behaviour. The `AiService` mock above exposes a
+// minimal `getNpmRegistryClient()` stub so the call site doesn't `TypeError`
+// and silently swallow this mock.
+vi.mock("./home-npmrc.mjs", () => ({
+  syncHomeNpmrc: vi.fn(async () => ({
+    outcome: "skipped-not-configured",
+    path: "/tmp/.superblocks/npmrc",
+  })),
+  superblocksNpmrcPath: vi.fn(() => "/tmp/.superblocks/npmrc"),
+  superblocksLogsPath: vi.fn((appDir: string) => `${appDir}/.superblocks/logs`),
 }));
 
 vi.mock("./git-repo-setup.mjs", () => ({
@@ -246,6 +299,8 @@ function buildDevOptions(overrides: Record<string, unknown> = {}) {
     tokenManager: {
       getToken: vi.fn(() => "test-token"),
       onTokenRefresh: vi.fn(),
+      updateToken: vi.fn(),
+      getCurrentToken: vi.fn(() => "test-token"),
     },
     getCurrentToken: vi.fn(() => "test-token"),
     sdk: buildMockSdk(),
@@ -282,6 +337,7 @@ function expectInstallToHaveRun() {
 describe("dev startup after S3 workspace restore", () => {
   beforeEach(async () => {
     vi.clearAllMocks();
+    mockAiServiceState.npmRegistryClient = undefined;
     setupExecMock();
     mockCheckVersions.mockResolvedValue({
       cliUpdated: false,
@@ -597,6 +653,342 @@ describe("dev startup after S3 workspace restore", () => {
       await fs.rm(tmpDir, { recursive: true, force: true });
     }
   });
+
+  it("keeps forced npm install when unchanged restore inputs still need private registry validation", async () => {
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: { configured: true },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: { "@superblocksteam/library": "1.0.0" },
+    };
+    const { dev } = await import("./dev.mjs");
+
+    await dev(
+      buildDevOptions({
+        forcePackageInstall: true,
+        packageJsonSnapshotBeforeRestore:
+          packageJsonSnapshot(unchangedPackageJson),
+      }) as any,
+    );
+
+    expectInstallToHaveRun();
+    expect(mockLogger.info).toHaveBeenCalledWith(
+      "Package install decision",
+      expect.objectContaining({
+        forcePackageInstall: true,
+        forcePackageInstallRequested: true,
+        packageJsonRequiresInstall: false,
+      }),
+    );
+  });
+
+  it("runs npm install at startup when private registries are configured even without package changes", async () => {
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: { configured: true },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: { "@superblocksteam/library": "1.0.0" },
+    };
+    const { dev } = await import("./dev.mjs");
+
+    await dev(
+      buildDevOptions({
+        forcePackageInstall: false,
+        packageJsonSnapshotBeforeRestore:
+          packageJsonSnapshot(unchangedPackageJson),
+      }) as any,
+    );
+
+    expectInstallToHaveRun();
+    expect(mockLogger.info).toHaveBeenCalledWith(
+      "Package install decision",
+      expect.objectContaining({
+        forcePackageInstall: false,
+        forcePackageInstallRequested: false,
+        packageJsonRequiresInstall: false,
+        privateRegistryRequiresInstallValidation: true,
+      }),
+    );
+  });
+
+  it("does not upload package state when private registry validation install leaves the lockfile unchanged", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
+    const unchangedPackageJson = {
+      name: "test-app",
+      packageManager: "npm@10.0.0",
+      dependencies: { "@superblocksteam/library": "1.0.0" },
+    };
+
+    try {
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify({ name: "test-app", lockfileVersion: 3 }, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      mockAiServiceState.npmRegistryClient = {
+        getConfig: vi.fn(async () => ({
+          source: "configured",
+          config: { configured: true },
+        })),
+      };
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expectInstallToHaveRun();
+      expect(mockSyncService.uploadDirectory).not.toHaveBeenCalled();
+      expect(mockSyncService.uploadDirectoryNowIfNeeded).not.toHaveBeenCalled();
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("does NOT upload package state when the validation install only rewrites `resolved` URLs", async () => {
+    // The exact churn cycle flagged in review: `stripResolvedFromLockfile`
+    // removes every `resolved` URL before the install and npm writes them
+    // back, so a byte-level comparison would flag "changed" on EVERY
+    // registry-validation boot and re-upload the workspace to DBFS forever.
+    // `lockfileComparisonKey` ignores `resolved`, so a resolved-only rewrite
+    // must NOT trigger the upload.
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
+    const unchangedPackageJson = {
+      name: "test-app",
+      packageManager: "npm@10.0.0",
+      dependencies: { "@superblocksteam/library": "1.0.0" },
+    };
+    const strippedLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/@superblocksteam/library": { version: "1.0.0" },
+      },
+    };
+    const rewrittenLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/@superblocksteam/library": {
+          version: "1.0.0",
+          resolved:
+            "https://registry.example.com/@superblocksteam/library/-/library-1.0.0.tgz",
+        },
+      },
+    };
+
+    try {
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify(strippedLockfile, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      mockAiServiceState.npmRegistryClient = {
+        getConfig: vi.fn(async () => ({
+          source: "configured",
+          config: { configured: true },
+        })),
+      };
+      execMock.mockImplementation(
+        (
+          _cmd: string,
+          opts:
+            | { cwd?: string }
+            | ((err: null, result: { stdout: string }) => void),
+          cb?: (err: null, result: { stdout: string }) => void,
+        ) => {
+          const cwd = typeof opts === "object" ? opts.cwd : tmpDir;
+          void fs
+            .writeFile(
+              path.join(cwd ?? tmpDir, "package-lock.json"),
+              JSON.stringify(rewrittenLockfile, null, 2),
+            )
+            .then(() => {
+              if (typeof opts === "function") {
+                opts(null, { stdout: "installed" });
+              } else {
+                cb?.(null, { stdout: "installed" });
+              }
+            });
+        },
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expectInstallToHaveRun();
+      expect(mockSyncService.uploadDirectory).not.toHaveBeenCalled();
+      expect(mockSyncService.uploadDirectoryNowIfNeeded).not.toHaveBeenCalled();
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("uploads package state when private registry validation install rewrites the lockfile", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
+    const unchangedPackageJson = {
+      name: "test-app",
+      packageManager: "npm@10.0.0",
+      dependencies: { "@superblocksteam/library": "1.0.0" },
+    };
+
+    try {
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify({ name: "test-app", lockfileVersion: 3 }, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      mockAiServiceState.npmRegistryClient = {
+        getConfig: vi.fn(async () => ({
+          source: "configured",
+          config: { configured: true },
+        })),
+      };
+      execMock.mockImplementation(
+        (
+          _cmd: string,
+          opts:
+            | { cwd?: string }
+            | ((err: null, result: { stdout: string }) => void),
+          cb?: (err: null, result: { stdout: string }) => void,
+        ) => {
+          const cwd = typeof opts === "object" ? opts.cwd : tmpDir;
+          void fs
+            .writeFile(
+              path.join(cwd ?? tmpDir, "package-lock.json"),
+              JSON.stringify(
+                { name: "test-app", lockfileVersion: 3, packages: {} },
+                null,
+                2,
+              ),
+            )
+            .then(() => {
+              if (typeof opts === "function") {
+                opts(null, { stdout: "installed" });
+              } else {
+                cb?.(null, { stdout: "installed" });
+              }
+            });
+        },
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expectInstallToHaveRun();
+      expect(mockSyncService.uploadDirectory).toHaveBeenCalledWith("cli:sdk");
+      expect(mockSyncService.uploadDirectoryNowIfNeeded).toHaveBeenCalledWith(
+        "cli:sdk",
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("does NOT force the startup install when the registry config is unreachable (fail closed, APPS-4527)", async () => {
+    // `unreachable` with no last-known-good means we could not materialize
+    // the right `.npmrc`. Forcing an install would re-resolve a
+    // private-registry org's lockfile against whatever registry happens to
+    // be on disk — validating against the wrong host and writing its URLs
+    // back into the lockfile. Fail closed instead (APPS-4370 principle):
+    // keep today's snapshot decision and skip the install.
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({ source: "unreachable" })),
+    };
+    const { dev } = await import("./dev.mjs");
+
+    await dev(buildDevOptions() as any);
+
+    expect(execMock).not.toHaveBeenCalled();
+    expect(mockLogger.info).toHaveBeenCalledWith(
+      "Package install decision",
+      expect.objectContaining({
+        packageJsonRequiresInstall: false,
+        forcePackageInstall: false,
+        privateRegistryRequiresInstallValidation: false,
+      }),
+    );
+  });
+
+  it("does NOT force the startup install when registry config resolution throws (fail closed, APPS-4527)", async () => {
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => {
+        throw new Error("registry config fetch failed");
+      }),
+    };
+    const { dev } = await import("./dev.mjs");
+
+    await dev(buildDevOptions() as any);
+
+    expect(execMock).not.toHaveBeenCalled();
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      "Could not resolve npm registry config for startup install validation; preserving package snapshot decision",
+      expect.anything(),
+    );
+    expect(mockLogger.info).toHaveBeenCalledWith(
+      "Package install decision",
+      expect.objectContaining({
+        privateRegistryRequiresInstallValidation: false,
+      }),
+    );
+  });
 });
 
 // Wires up `execMock` so install calls hang until the test calls
@@ -661,6 +1053,7 @@ function setupDeferredInstallMock(
 describe("dev background package install join semantics", () => {
   beforeEach(async () => {
     vi.clearAllMocks();
+    mockAiServiceState.npmRegistryClient = undefined;
     mockCheckVersions.mockResolvedValue({
       cliUpdated: false,
       upgradePromises: [],
@@ -718,29 +1111,26 @@ describe("dev background package install join semantics", () => {
   it("logs a structured error when the background install fails", async () => {
     const deferred = setupDeferredInstallMock({ fail: true });
     // Use upgradePromises so the install runs without forcing the upload
-    // path — the failure then propagates through the pre-Vite join, whose
-    // outer catch only sets the span status and rethrows (no process.exit,
-    // which vitest replaces with a throw that becomes an unhandled error).
+    // path — the failure propagates through the pre-Vite join. With the
+    // dependency-install-classifier fully wired in tests, the rejection is
+    // an InitialInstallFailed marker and `handleStartupError` routes it to
+    // "degrade" (Vite still starts up, dev() resolves with the error
+    // recorded on devServerStatus). The point of THIS test is the
+    // independent `.catch` backstop on packageInstallPromise — it must
+    // log a structured error regardless of which downstream join consumes
+    // the rejection.
     mockCheckVersions.mockResolvedValue({
       cliUpdated: false,
       upgradePromises: [Promise.resolve()],
     });
     const { dev } = await import("./dev.mjs");
 
-    // Pre-attach a catcher so vitest's unhandled-rejection detector observes
-    // the rejection synchronously with promise creation; without this, the
-    // .catch backstop's logging counts as a handler but lands on the
-    // microtask queue after vitest's check.
-    let caughtError: unknown;
-    const devPromise = dev(buildDevOptions() as any).catch((err: unknown) => {
-      caughtError = err;
-    });
+    const devPromise = dev(buildDevOptions() as any).catch(() => undefined);
 
     await deferred.awaitInstallStarted();
     await deferred.finishInstall();
     await devPromise;
 
-    expect(caughtError).toBeDefined();
     // The .catch backstop fires regardless and tags the log with errorId so
     // alert rules can match without needing typed attributes.
     expect(
@@ -752,4 +1142,154 @@ describe("dev background package install join semantics", () => {
       ),
     ).toBe(true);
   });
+
+  // APPS-4450 review: an InitialInstallFailed observed in the "before upload"
+  // join must NOT preempt a successful CLI upgrade restart. Previously the
+  // join's rejection was caught by the outer sync/setup catch (→ degrade) and
+  // execution never reached the `hasCliUpdated` branch, so the restart was
+  // silently dropped. The fix catches the join locally when `hasCliUpdated`
+  // and falls through to the restart block.
+  it("prioritises CLI restart over install-failure degrade when both fire in the upload path", async () => {
+    const deferred = setupDeferredInstallMock({ fail: true });
+    // CLI upgrade succeeds + `forcePackageInstall` triggers the upload path.
+    mockCheckVersions.mockResolvedValue({
+      cliUpdated: true,
+      upgradePromises: [Promise.resolve()],
+    });
+
+    // Capture `process.exit` synchronously; the production path calls it on
+    // the restart with AUTO_UPGRADE_EXIT_CODE (mocked to 99). Track every
+    // call and throw a tagged error so the test can assert the exit code
+    // without actually terminating the vitest worker. We replace
+    // `process.exit` directly instead of `vi.spyOn` — vitest's `process`
+    // object is partially shadowed and `vi.spyOn(process, "exit")` swallows
+    // calls intermittently here.
+    const originalExit = process.exit;
+    const exitCalls: Array<number | undefined> = [];
+    (process as any).exit = (code?: number) => {
+      exitCalls.push(code);
+      throw new Error(`__test_process_exit__:${String(code)}`);
+    };
+
+    try {
+      const { dev } = await import("./dev.mjs");
+
+      let caughtError: unknown;
+      const devPromise = dev(
+        buildDevOptions({ forcePackageInstall: true }) as any,
+      ).catch((err: unknown) => {
+        caughtError = err;
+      });
+
+      await deferred.awaitInstallStarted();
+      await deferred.finishInstall();
+      await devPromise;
+
+      // First exit call MUST be the CLI-restart with AUTO_UPGRADE_EXIT_CODE
+      // (mocked to 99). The throw escapes through the outer catch, which
+      // routes the non-InitialInstallFailed thrown wrapper through
+      // handleStartupError → exit, so a follow-up `process.exit(1)` is
+      // expected and benign. The invariant is the FIRST call.
+      expect(exitCalls[0]).toBe(99);
+      // devPromise resolved (or rejected) after the chain settled.
+      expect(caughtError).toBeDefined();
+      // Upload was skipped — install failed before the upload body could run
+      // and the local catch routed straight to the restart branch.
+      expect(mockSyncService.uploadDirectory).not.toHaveBeenCalled();
+      expect(mockSyncService.uploadDirectoryNowIfNeeded).not.toHaveBeenCalled();
+      // Restart actually got reached (logged + skip-upload reason logged).
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        "CLI was updated, restarting the dev server…",
+      );
+      expect(
+        mockLogger.info.mock.calls.some(
+          (call) =>
+            typeof call[0] === "string" &&
+            call[0].includes(
+              "Initial package install failed before startup upload",
+            ),
+        ),
+      ).toBe(true);
+    } finally {
+      (process as any).exit = originalExit;
+    }
+  });
+
+  // APPS-4450 review (companion to above): the new local try/catch in the
+  // upload path must only swallow `InitialInstallFailed`. A non-marker
+  // rejection from `joinUpgradeThenInstall("before upload")` (e.g. a failed
+  // package upgrade) must rethrow so the outer sync/setup catch routes it to
+  // `process.exit(1)` — even when `hasCliUpdated` is true. Otherwise an
+  // upgrade rejection could be silently dropped on the upload path.
+  it("rethrows non-InitialInstallFailed join errors so the outer catch exits", async () => {
+    // Install succeeds instantly — only the UPGRADE rejects, so the join's
+    // first await (`joinPackageUpgrade`) is what surfaces.
+    execMock.mockImplementation(
+      (
+        _cmd: string,
+        opts: unknown,
+        cb?: (err: Error | null, result?: { stdout: string }) => void,
+      ) => {
+        const callback =
+          typeof opts === "function"
+            ? (opts as (err: Error | null, result?: { stdout: string }) => void)
+            : cb;
+        callback?.(null, { stdout: "installed" });
+      },
+    );
+    // hasCliUpdated=true ensures we'd hit the restart branch IF the local
+    // catch wrongly swallowed the rejection. A rejecting upgrade promise
+    // surfaces a generic Error (not InitialInstallFailed), so the local catch
+    // must rethrow.
+    mockCheckVersions.mockResolvedValue({
+      cliUpdated: true,
+      upgradePromises: [Promise.reject(new Error("simulated upgrade failure"))],
+    });
+
+    const originalExit = process.exit;
+    const exitCalls: Array<number | undefined> = [];
+    (process as any).exit = (code?: number) => {
+      exitCalls.push(code);
+      throw new Error(`__test_process_exit__:${String(code)}`);
+    };
+
+    try {
+      const { dev } = await import("./dev.mjs");
+
+      let caughtError: unknown;
+      await dev(buildDevOptions({ forcePackageInstall: true }) as any).catch(
+        (err: unknown) => {
+          caughtError = err;
+        },
+      );
+
+      // First exit MUST be the outer-catch exit(1), NOT the
+      // AUTO_UPGRADE_EXIT_CODE (99). If the local catch wrongly swallowed
+      // the upgrade rejection, execution would fall through to the
+      // `if (hasCliUpdated)` restart branch and call exit(99).
+      expect(exitCalls[0]).toBe(1);
+      expect(exitCalls[0]).not.toBe(99);
+      expect(caughtError).toBeDefined();
+      // Upload skipped — join rejected before the upload body could run.
+      expect(mockSyncService.uploadDirectory).not.toHaveBeenCalled();
+      expect(mockSyncService.uploadDirectoryNowIfNeeded).not.toHaveBeenCalled();
+      // Restart was NOT reached — outer catch exited before that block.
+      expect(mockLogger.info).not.toHaveBeenCalledWith(
+        "CLI was updated, restarting the dev server…",
+      );
+      // The skip-upload-for-restart log must NOT fire either; it's gated on
+      // the `InitialInstallFailed` branch of the local catch.
+      expect(
+        mockLogger.info.mock.calls.some(
+          (call) =>
+            typeof call[0] === "string" &&
+            call[0].includes(
+              "Initial package install failed before startup upload",
+            ),
+        ),
+      ).toBe(false);
+    } finally {
+      (process as any).exit = originalExit;
+    }
+  });
 });