@vellumai/cli 0.10.11 → 0.10.12-dev.202607242227.e52a30c

package/src/__tests__/platform-client.test.ts

@@ -240,7 +240,11 @@ describe("fetchAssistantDetail / fetchUpgradeInProgress", () => {
       current_release_version: "0.7.0",
       release_channel: "preview",
     });
-    const detail = await fetchAssistantDetail(TOKEN, ASSISTANT_ID, PLATFORM_URL);
+    const detail = await fetchAssistantDetail(
+      TOKEN,
+      ASSISTANT_ID,
+      PLATFORM_URL,
+    );
     expect(detail).toEqual({
       currentReleaseVersion: "0.7.0",
       releaseChannel: "preview",
@@ -251,7 +255,11 @@ describe("fetchAssistantDetail / fetchUpgradeInProgress", () => {
 
   test("fetchAssistantDetail defaults missing fields", async () => {
     mockFetchJson({});
-    const detail = await fetchAssistantDetail(TOKEN, ASSISTANT_ID, PLATFORM_URL);
+    const detail = await fetchAssistantDetail(
+      TOKEN,
+      ASSISTANT_ID,
+      PLATFORM_URL,
+    );
     expect(detail).toEqual({
       currentReleaseVersion: null,
       releaseChannel: "stable",

package/src/__tests__/statefulset.test.ts

@@ -56,7 +56,9 @@ describe("getBuilderManagedEnvKeys", () => {
 
   test("gateway hostForwarded equals the three spec host entries", () => {
     const { hostForwarded } = getBuilderManagedEnvKeys("gateway");
-    const sorted = [...hostForwarded].sort((a, b) => a.name.localeCompare(b.name));
+    const sorted = [...hostForwarded].sort((a, b) =>
+      a.name.localeCompare(b.name),
+    );
     expect(sorted).toEqual([
       { name: "VELAY_BASE_URL", hostVar: "VELAY_BASE_URL" },
       { name: "VELLUM_ENVIRONMENT", hostVar: "VELLUM_ENVIRONMENT" },

package/src/__tests__/tailscale-tunnel.test.ts

@@ -0,0 +1,229 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  normalizeDnsName,
+  resolveServeHostname,
+  shouldClearIngressUrl,
+  startTailscaleServe,
+  stopTailscaleServe,
+  type TailscaleCommandResult,
+  type TailscaleDeps,
+} from "../lib/tailscale-tunnel.js";
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+const tempDirs: string[] = [];
+
+function makeWorkspace(): string {
+  const dir = mkdtempSync(join(tmpdir(), "vellum-tailscale-test-"));
+  tempDirs.push(dir);
+  return dir;
+}
+
+const RUNNING_STATUS = JSON.stringify({
+  BackendState: "Running",
+  Self: { DNSName: "my-host.tail-scale.ts.net.", Online: true },
+});
+
+const ok = (stdout = "", stderr = ""): TailscaleCommandResult => ({
+  status: 0,
+  stdout,
+  stderr,
+});
+
+/**
+ * Build a fake {@link TailscaleDeps}. `binary` defaults to a present binary;
+ * pass `null` to simulate a missing install. `responses` is keyed by the
+ * space-joined args; unmatched calls return an empty success result.
+ */
+function makeDeps(opts: {
+  binary?: string | null;
+  responses?: Record<string, TailscaleCommandResult>;
+}): { deps: TailscaleDeps; calls: string[][] } {
+  const calls: string[][] = [];
+  const binary = opts.binary === undefined ? "tailscale" : opts.binary;
+  const deps: TailscaleDeps = {
+    findBinary: () => binary,
+    run: (_bin, args) => {
+      calls.push(args);
+      return opts.responses?.[args.join(" ")] ?? ok();
+    },
+  };
+  return { deps, calls };
+}
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ── normalizeDnsName ────────────────────────────────────────────────────────
+
+describe("normalizeDnsName", () => {
+  test("trims the trailing MagicDNS dot", () => {
+    expect(normalizeDnsName("host.tailnet.ts.net.")).toBe(
+      "host.tailnet.ts.net",
+    );
+  });
+
+  test("leaves a name without a trailing dot unchanged", () => {
+    expect(normalizeDnsName("host.tailnet.ts.net")).toBe("host.tailnet.ts.net");
+  });
+});
+
+// ── resolveServeHostname ──────────────────────────────────────────────────────
+
+describe("resolveServeHostname", () => {
+  test("returns the trimmed Self.DNSName for a running node", () => {
+    expect(resolveServeHostname(RUNNING_STATUS)).toBe(
+      "my-host.tail-scale.ts.net",
+    );
+  });
+
+  test("throws a login hint when logged out", () => {
+    const json = JSON.stringify({ BackendState: "NeedsLogin", Self: {} });
+    expect(() => resolveServeHostname(json)).toThrow("not logged in");
+  });
+
+  test("throws when the backend is not running", () => {
+    const json = JSON.stringify({
+      BackendState: "Stopped",
+      Self: { DNSName: "host.ts.net." },
+    });
+    expect(() => resolveServeHostname(json)).toThrow("not ready");
+  });
+
+  test("throws when the DNS name is missing", () => {
+    const json = JSON.stringify({ BackendState: "Running", Self: {} });
+    expect(() => resolveServeHostname(json)).toThrow("DNS name");
+  });
+
+  test("throws on unparseable JSON", () => {
+    expect(() => resolveServeHostname("not json")).toThrow("Could not parse");
+  });
+});
+
+// ── startTailscaleServe ───────────────────────────────────────────────────────
+
+describe("startTailscaleServe", () => {
+  test("throws install guidance when the binary is missing", async () => {
+    const { deps, calls } = makeDeps({ binary: null });
+    await expect(
+      startTailscaleServe({ port: 7840, workspaceDir: makeWorkspace() }, deps),
+    ).rejects.toThrow("Tailscale is not installed");
+    expect(calls).toHaveLength(0);
+  });
+
+  test("throws a login hint when logged out and never calls serve", async () => {
+    const { deps, calls } = makeDeps({
+      responses: {
+        "status --json": ok(
+          JSON.stringify({ BackendState: "NeedsLogin", Self: {} }),
+        ),
+      },
+    });
+    await expect(
+      startTailscaleServe({ port: 7840, workspaceDir: makeWorkspace() }, deps),
+    ).rejects.toThrow("not logged in");
+    expect(calls).not.toContainEqual(["serve", "--bg", "7840"]);
+  });
+
+  test("throws when the status query fails (daemon down)", async () => {
+    const { deps } = makeDeps({
+      responses: {
+        "status --json": {
+          status: 1,
+          stdout: "",
+          stderr: "failed to connect to local tailscaled",
+        },
+      },
+    });
+    await expect(
+      startTailscaleServe({ port: 7840, workspaceDir: makeWorkspace() }, deps),
+    ).rejects.toThrow("Could not query Tailscale");
+  });
+
+  test("serves the target port and persists the ingress URL on success", async () => {
+    const workspaceDir = makeWorkspace();
+    const { deps, calls } = makeDeps({
+      responses: {
+        "status --json": ok(RUNNING_STATUS),
+        "serve --bg 7840": ok(),
+      },
+    });
+
+    const info = await startTailscaleServe({ port: 7840, workspaceDir }, deps);
+
+    expect(info.publicUrl).toBe("https://my-host.tail-scale.ts.net");
+    expect(info.port).toBe(7840);
+    expect(info.viaIngress).toBe(false);
+    expect(calls).toContainEqual(["serve", "--bg", "7840"]);
+
+    const config = JSON.parse(
+      readFileSync(join(workspaceDir, "config.json"), "utf-8"),
+    );
+    expect(config.ingress.publicBaseUrl).toBe(
+      "https://my-host.tail-scale.ts.net",
+    );
+    expect(config.ingress.enabled).toBe(true);
+  });
+
+  test("surfaces tailscale's enable-URL guidance when serve is not enabled", async () => {
+    const workspaceDir = makeWorkspace();
+    const enableUrl = "https://login.tailscale.com/f/serve?node=abc123";
+    const { deps } = makeDeps({
+      responses: {
+        "status --json": ok(RUNNING_STATUS),
+        "serve --bg 7840": {
+          status: 1,
+          stdout: "",
+          stderr: `error: Serve is not enabled on your tailnet.\n\nTo enable, visit:\n  ${enableUrl}`,
+        },
+      },
+    });
+
+    await expect(
+      startTailscaleServe({ port: 7840, workspaceDir }, deps),
+    ).rejects.toThrow(enableUrl);
+
+    // A failed serve must not persist an ingress URL.
+    expect(existsSync(join(workspaceDir, "config.json"))).toBe(false);
+  });
+});
+
+// ── stopTailscaleServe ────────────────────────────────────────────────────────
+
+describe("stopTailscaleServe", () => {
+  test("turns off the HTTPS:443 serve (narrow off form)", () => {
+    const { deps, calls } = makeDeps({
+      responses: { "serve --https=443 off": ok() },
+    });
+    const result = stopTailscaleServe("tailscale", deps);
+    expect(result.status).toBe(0);
+    expect(calls).toContainEqual(["serve", "--https=443", "off"]);
+  });
+});
+
+// ── shouldClearIngressUrl ─────────────────────────────────────────────────────
+
+describe("shouldClearIngressUrl", () => {
+  test("clears only after a confirmed successful stop", () => {
+    expect(shouldClearIngressUrl({ status: 0, stdout: "", stderr: "" })).toBe(
+      true,
+    );
+  });
+
+  test("keeps the URL when the stop command fails", () => {
+    expect(
+      shouldClearIngressUrl({ status: 1, stdout: "", stderr: "boom" }),
+    ).toBe(false);
+  });
+
+  test("keeps the URL when the stop command threw before running", () => {
+    expect(shouldClearIngressUrl(null)).toBe(false);
+  });
+});

package/src/__tests__/tunnel.test.ts

@@ -5,6 +5,7 @@ import {
   describe,
   expect,
   mock,
+  spyOn,
   test,
 } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -145,6 +146,7 @@ describe("tunnel nginx ingress feature flag", () => {
     expect(init?.method).toBe("GET");
     expect(runNgrokTunnelMock).toHaveBeenCalledWith({
       port: 7830,
+      assistantId: "assistant-1",
       workspaceDir: join(entry.resources!.instanceDir, ".vellum", "workspace"),
       preferNginxIngress: true,
     });
@@ -161,4 +163,56 @@ describe("tunnel nginx ingress feature flag", () => {
     expect(runNgrokTunnelMock).not.toHaveBeenCalled();
     expect(runCloudflareTunnelMock).not.toHaveBeenCalled();
   });
+
+  test("rejects an unknown --provider with a stale-CLI hint", async () => {
+    process.argv = ["bun", "vellum", "tunnel", "--provider", "bogus"];
+    const errors: string[] = [];
+    const errSpy = spyOn(console, "error").mockImplementation(
+      (...a: unknown[]) => {
+        errors.push(a.join(" "));
+      },
+    );
+    const exitSpy = spyOn(process, "exit").mockImplementation(((
+      code?: number,
+    ) => {
+      throw new Error(`exit:${code}`);
+    }) as never);
+
+    let exited = false;
+    try {
+      await tunnel();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+
+    expect(exited).toBe(true);
+    const joined = errors.join("\n");
+    expect(joined).toContain("unknown tunnel provider 'bogus'");
+    expect(joined).toContain("your CLI may be out of date");
+    expect(joined).toContain("bun install -g vellum@latest");
+    expect(runNgrokTunnelMock).not.toHaveBeenCalled();
+    expect(runCloudflareTunnelMock).not.toHaveBeenCalled();
+  });
+
+  test("a not-yet-implemented provider error carries the stale-CLI hint", async () => {
+    // The default `vellum` provider has no runtime yet, so it exercises the
+    // not-yet-implemented path without any network call.
+    process.argv = ["bun", "vellum", "tunnel", "--provider", "vellum"];
+
+    let err: Error | undefined;
+    try {
+      await tunnel();
+    } catch (e) {
+      err = e as Error;
+    }
+
+    expect(err?.message).toContain("is not yet implemented");
+    expect(err?.message).toContain("your CLI may be out of date");
+    expect(err?.message).toContain("bun install -g vellum@latest");
+    expect(runNgrokTunnelMock).not.toHaveBeenCalled();
+    expect(runCloudflareTunnelMock).not.toHaveBeenCalled();
+  });
 });

package/src/__tests__/wake.test.ts

@@ -14,8 +14,11 @@ import { join } from "node:path";
 
 import * as assistantConfig from "../lib/assistant-config.js";
 import * as docker from "../lib/docker.js";
+import * as featureFlags from "../lib/feature-flags.js";
 import * as guardianToken from "../lib/guardian-token.js";
+import * as ingressConfig from "../lib/ingress-config.js";
 import * as local from "../lib/local.js";
+import * as nginxIngress from "../lib/nginx-ingress.js";
 import * as ngrok from "../lib/ngrok.js";
 import * as processLib from "../lib/process.js";
 import type { AssistantEntry } from "../lib/assistant-config.js";
@@ -27,9 +30,8 @@ const realLocal = { ...local };
 const realNgrok = { ...ngrok };
 const realProcessLib = { ...processLib };
 
-const resolveTargetAssistantMock = mock<
-  typeof assistantConfig.resolveTargetAssistant
->();
+const resolveTargetAssistantMock =
+  mock<typeof assistantConfig.resolveTargetAssistant>();
 const saveAssistantEntryMock = mock<typeof assistantConfig.saveAssistantEntry>(
   () => {},
 );
@@ -61,9 +63,10 @@ const seedGuardianTokenFromSiblingEnvMock = mock<
 // Default: a token exists, so the re-provision recovery path is skipped. Tests
 // that exercise recovery override loadGuardianToken to return null.
 const loadGuardianTokenMock = mock<typeof guardianToken.loadGuardianToken>(
-  () => ({ accessToken: "existing" }) as ReturnType<
-    typeof guardianToken.loadGuardianToken
-  >,
+  () =>
+    ({ accessToken: "existing" }) as ReturnType<
+      typeof guardianToken.loadGuardianToken
+    >,
 );
 const resetGuardianBootstrapMock = mock<
   typeof guardianToken.resetGuardianBootstrap
@@ -111,7 +114,9 @@ const isAssistantWatchModeAvailableMock = mock<
 const isGatewayWatchModeAvailableMock = mock<
   typeof local.isGatewayWatchModeAvailable
 >(() => false);
-const startLocalDaemonMock = mock<typeof local.startLocalDaemon>(async () => {});
+const startLocalDaemonMock = mock<typeof local.startLocalDaemon>(
+  async () => {},
+);
 const startGatewayMock = mock<typeof local.startGateway>(
   async () => "http://127.0.0.1:7830",
 );
@@ -136,11 +141,50 @@ mock.module("../lib/ngrok", () => ({
   maybeStartNgrokTunnel: maybeStartNgrokTunnelMock,
 }));
 
+const realFeatureFlags = { ...featureFlags };
+const realIngressConfig = { ...ingressConfig };
+const realNginxIngress = { ...nginxIngress };
+
+const isAssistantFeatureFlagEnabledMock = mock<
+  typeof featureFlags.isAssistantFeatureFlagEnabled
+>(async () => true);
+
+mock.module("../lib/feature-flags.js", () => ({
+  ...realFeatureFlags,
+  isAssistantFeatureFlagEnabled: isAssistantFeatureFlagEnabledMock,
+}));
+
+const loadRawConfigMock = mock<typeof ingressConfig.loadRawConfig>(() => ({}));
+
+mock.module("../lib/ingress-config.js", () => ({
+  ...realIngressConfig,
+  loadRawConfig: loadRawConfigMock,
+}));
+
+const isIngressRunningMock = mock<typeof nginxIngress.isIngressRunning>(
+  () => false,
+);
+const startRemoteWebIngressMock = mock<
+  typeof nginxIngress.startRemoteWebIngress
+>(async () => ({
+  status: "started",
+  listenPort: 7840,
+  webDistDir: "/tmp/web/dist",
+  version: "nginx/1.25.3",
+}));
+
+mock.module("../lib/nginx-ingress.js", () => ({
+  ...realNginxIngress,
+  isIngressRunning: isIngressRunningMock,
+  startRemoteWebIngress: startRemoteWebIngressMock,
+}));
+
 const { wake } = await import("../commands/wake.js");
 
 let tempDir: string;
 let originalArgv: string[];
 let logSpy: ReturnType<typeof spyOn>;
+let warnSpy: ReturnType<typeof spyOn>;
 
 function makeLocalEntry(): AssistantEntry {
   tempDir = mkdtempSync(join(tmpdir(), "vellum-wake-test-"));
@@ -165,6 +209,7 @@ beforeEach(() => {
   tempDir = "";
   process.argv = ["bun", "vellum", "wake", "--watch", "local-assistant"];
   logSpy = spyOn(console, "log").mockImplementation(() => {});
+  warnSpy = spyOn(console, "warn").mockImplementation(() => {});
 
   const entry = makeLocalEntry();
   resolveTargetAssistantMock.mockReset();
@@ -175,10 +220,12 @@ beforeEach(() => {
     join(resources!.instanceDir, ".vellum", "daemon.pid"),
   );
   resolveProcessStateMock.mockReset();
-  resolveProcessStateMock.mockImplementation(async (_pidFile, _port, label) => ({
-    status: "healthy",
-    pid: label === "Gateway" ? 456 : 123,
-  }));
+  resolveProcessStateMock.mockImplementation(
+    async (_pidFile, _port, label) => ({
+      status: "healthy",
+      pid: label === "Gateway" ? 456 : 123,
+    }),
+  );
   stopProcessByPidFileMock.mockReset();
   stopProcessByPidFileMock.mockResolvedValue(true);
   generateLocalSigningKeyMock.mockReset();
@@ -198,9 +245,9 @@ beforeEach(() => {
   seedGuardianTokenFromSiblingEnvMock.mockReset();
   seedGuardianTokenFromSiblingEnvMock.mockReturnValue(false);
   loadGuardianTokenMock.mockReset();
-  loadGuardianTokenMock.mockReturnValue({ accessToken: "existing" } as ReturnType<
-    typeof guardianToken.loadGuardianToken
-  >);
+  loadGuardianTokenMock.mockReturnValue({
+    accessToken: "existing",
+  } as ReturnType<typeof guardianToken.loadGuardianToken>);
   resetGuardianBootstrapMock.mockReset();
   resetGuardianBootstrapMock.mockResolvedValue(undefined);
   leaseGuardianTokenMock.mockReset();
@@ -209,11 +256,25 @@ beforeEach(() => {
   );
   maybeStartNgrokTunnelMock.mockReset();
   maybeStartNgrokTunnelMock.mockResolvedValue(null);
+  isAssistantFeatureFlagEnabledMock.mockReset();
+  isAssistantFeatureFlagEnabledMock.mockResolvedValue(true);
+  loadRawConfigMock.mockReset();
+  loadRawConfigMock.mockReturnValue({});
+  isIngressRunningMock.mockReset();
+  isIngressRunningMock.mockReturnValue(false);
+  startRemoteWebIngressMock.mockReset();
+  startRemoteWebIngressMock.mockResolvedValue({
+    status: "started",
+    listenPort: 7840,
+    webDistDir: "/tmp/web/dist",
+    version: "nginx/1.25.3",
+  });
 });
 
 afterEach(() => {
   process.argv = originalArgv;
   logSpy.mockRestore();
+  warnSpy.mockRestore();
   if (tempDir) {
     rmSync(tempDir, { recursive: true, force: true });
   }
@@ -226,6 +287,9 @@ afterAll(() => {
   mock.module("../lib/process", () => realProcessLib);
   mock.module("../lib/local", () => realLocal);
   mock.module("../lib/ngrok", () => realNgrok);
+  mock.module("../lib/feature-flags.js", () => realFeatureFlags);
+  mock.module("../lib/ingress-config.js", () => realIngressConfig);
+  mock.module("../lib/nginx-ingress.js", () => realNginxIngress);
 });
 
 describe("vellum wake", () => {
@@ -252,7 +316,13 @@ describe("vellum wake", () => {
   });
 
   test("re-provisions the guardian token when missing and --repair-guardian is passed", async () => {
-    process.argv = ["bun", "vellum", "wake", "--repair-guardian", "local-assistant"];
+    process.argv = [
+      "bun",
+      "vellum",
+      "wake",
+      "--repair-guardian",
+      "local-assistant",
+    ];
     loadGuardianTokenMock.mockReturnValue(null);
 
     await wake();
@@ -288,7 +358,13 @@ describe("vellum wake", () => {
     // (revoked, mis-seeded, wrong principal). The user explicitly confirmed
     // the destructive repair, so the flag forces a re-lease instead of
     // guessing from local token state and recreating the no-op loop.
-    process.argv = ["bun", "vellum", "wake", "--repair-guardian", "local-assistant"];
+    process.argv = [
+      "bun",
+      "vellum",
+      "wake",
+      "--repair-guardian",
+      "local-assistant",
+    ];
     // loadGuardianToken returns a healthy-looking token by default.
     await wake();
 
@@ -326,3 +402,121 @@ describe("vellum wake", () => {
     expect(startLocalDaemonMock).not.toHaveBeenCalled();
   });
 });
+
+describe("vellum wake — web ingress restore", () => {
+  const enabledConfig = {
+    ingress: { enabled: true, publicBaseUrl: "https://assistant.example.com" },
+  };
+
+  beforeEach(() => {
+    process.argv = ["bun", "vellum", "wake", "local-assistant"];
+  });
+
+  test("restores the edge when ingress is enabled, the flag is on, and it is not already running", async () => {
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+
+    await wake();
+
+    expect(isAssistantFeatureFlagEnabledMock).toHaveBeenCalledWith(
+      "local-assistant",
+      "web-remote-ingress",
+      { runtimeUrl: "http://127.0.0.1:7830" },
+    );
+    expect(startRemoteWebIngressMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceDir: join(tempDir, ".vellum", "workspace"),
+        gatewayPort: 7830,
+      }),
+    );
+    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+  });
+
+  test("does not attempt a restore when ingress is disabled", async () => {
+    loadRawConfigMock.mockReturnValue({ ingress: { enabled: false } });
+
+    await wake();
+
+    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
+    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+  });
+
+  test("does not attempt a restore when ingress config is absent", async () => {
+    loadRawConfigMock.mockReturnValue({});
+
+    await wake();
+
+    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
+    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+  });
+
+  test("does not attempt a restore when enabled but the public URL is missing", async () => {
+    loadRawConfigMock.mockReturnValue({ ingress: { enabled: true } });
+
+    await wake();
+
+    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
+    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+  });
+
+  test("does not start a second edge when one is already running", async () => {
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    isIngressRunningMock.mockReturnValue(true);
+
+    await wake();
+
+    // Already up — skip the flag probe and the start entirely.
+    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
+    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+  });
+
+  test("skips the restore quietly with a hint when the flag is off", async () => {
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    isAssistantFeatureFlagEnabledMock.mockResolvedValue(false);
+
+    await wake();
+
+    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("web-remote-ingress"),
+    );
+    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+  });
+
+  test("a thrown restore failure warns but does not fail the wake", async () => {
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    startRemoteWebIngressMock.mockRejectedValue(new Error("nginx boom"));
+
+    await wake();
+
+    expect(startRemoteWebIngressMock).toHaveBeenCalled();
+    expect(warnSpy).toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+  });
+
+  test("an unreachable edge warns but does not fail the wake", async () => {
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    startRemoteWebIngressMock.mockResolvedValue({
+      status: "unreachable",
+      listenPort: 7840,
+      logPath: "/tmp/nginx-ingress.log",
+    });
+
+    await wake();
+
+    expect(warnSpy).toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+  });
+
+  test("a failed flag probe warns and leaves the edge down without failing the wake", async () => {
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    isAssistantFeatureFlagEnabledMock.mockRejectedValue(
+      new Error("gateway unreachable"),
+    );
+
+    await wake();
+
+    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+    expect(warnSpy).toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+  });
+});