@vellumai/cli 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/node_modules/@vellumai/service-contracts/src/url-normalization.ts

@@ -0,0 +1,107 @@
+/**
+ * Canonical URL normalization for web tool inputs, shared by the gateway's
+ * risk classifiers and the daemon's URL safety checks.
+ *
+ * A URL a model passes to `web_fetch` / `network_request` reaches more than
+ * one consumer, and they must agree on what counts as the same target: the
+ * gateway builds the trust-rule ladder from it, and anything that later
+ * compares a URL to a saved rule has to fold the same spellings together. Two
+ * normalizations would mean two answers, so it lives here rather than in
+ * either process.
+ *
+ * Data-only in spirit: no imports, no config, no I/O.
+ */
+
+/** Whether a bare `host:port` (or `[v6]:port`) shorthand was written. */
+export function looksLikeHostPortShorthand(value: string): boolean {
+  if (/^\[[0-9a-fA-F:.%]+\]:\d+(?:[/?#]|$)/.test(value)) {
+    return true;
+  }
+  return /^[^/?#@\s:]+:\d+(?:[/?#]|$)/.test(value);
+}
+
+/** Whether the input is a path, query, or fragment rather than a URL. */
+export function looksLikePathOnlyInput(value: string): boolean {
+  return (
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../") ||
+    value.startsWith("?") ||
+    value.startsWith("#")
+  );
+}
+
+/**
+ * Strip the parts of a URL that must not affect a trust decision, and fold
+ * the encodings that would otherwise let one URL wear two spellings.
+ *
+ * Percent-escaped path segments are decoded (`/%70rivate` and `/private` are
+ * one path, so a path-scoped rule cannot be bypassed by escaping), a trailing
+ * root dot is dropped from the hostname, and fragment and userinfo are
+ * removed: the fragment never reaches the server, and credentials in the
+ * authority must never end up in a saved rule.
+ */
+export function canonicalizeWebUrl(parsed: URL): URL {
+  parsed.hash = "";
+  parsed.username = "";
+  parsed.password = "";
+
+  try {
+    parsed.pathname = decodeURI(parsed.pathname);
+  } catch {
+    // Keep the URL parser's canonical form when decoding fails.
+  }
+
+  if (parsed.hostname.endsWith(".")) {
+    parsed.hostname = parsed.hostname.replace(/\.+$/, "");
+  }
+
+  return parsed;
+}
+
+/**
+ * Parse and canonicalize a web tool's `url` input, or `null` when it is not a
+ * URL this system will fetch.
+ *
+ * Accepts `https://host/path`, `http://…`, bare `host/path`, and `host:port`
+ * shorthand. Rejects path-only input and any other scheme (`file:`, `data:`,
+ * `javascript:`), so a non-http target can never acquire a web trust rule.
+ */
+export function normalizeWebUrl(rawUrl: string): URL | null {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (looksLikeHostPortShorthand(trimmed)) {
+    try {
+      return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+    } catch {
+      return null;
+    }
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return canonicalizeWebUrl(parsed);
+    }
+    return null;
+  } catch {
+    // Not an absolute URL; fall through to the shorthand forms.
+  }
+
+  if (looksLikePathOnlyInput(trimmed)) {
+    return null;
+  }
+
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+
+  try {
+    return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+  } catch {
+    return null;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.11.3",
+  "version": "0.11.4-dev.202608190019.b94dbf2",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/assistant-config.test.ts

@@ -8,10 +8,12 @@ import {
   spyOn,
 } from "bun:test";
 import {
+  existsSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
   rmSync,
+  utimesSync,
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -97,6 +99,39 @@ describe("assistant-config", () => {
     expect(all[0].assistantId).toBe("test-1");
   });
 
+  test("saveAssistantEntry writes under the advisory lock and cleans it up", () => {
+    saveAssistantEntry(makeEntry("locked-1"));
+    expect(loadAllAssistants()).toHaveLength(1);
+    // The shared `${lockfilePath}.lock` key hosts contend on is released.
+    expect(existsSync(join(testDir, ".vellum.lock.json.lock"))).toBe(false);
+  });
+
+  test("saveAssistantEntry breaks a stale lock and still lands the write", () => {
+    const lockDir = join(testDir, ".vellum.lock.json.lock");
+    mkdirSync(lockDir);
+    const past = new Date(Date.now() - 60_000);
+    utimesSync(lockDir, past, past);
+
+    saveAssistantEntry(makeEntry("stale-lock-1"));
+    expect(loadAllAssistants()).toHaveLength(1);
+    expect(existsSync(lockDir)).toBe(false);
+  });
+
+  test("saveAssistantEntry fails fast without writing when another holder is fresh", () => {
+    const lockDir = join(testDir, ".vellum.lock.json.lock");
+    mkdirSync(lockDir);
+    try {
+      const start = Date.now();
+      expect(() => saveAssistantEntry(makeEntry("contended-1"))).toThrow(
+        /Timed out acquiring lockfile lock/,
+      );
+      expect(Date.now() - start).toBeLessThan(2_000);
+      expect(loadAllAssistants()).toEqual([]);
+    } finally {
+      rmSync(lockDir, { recursive: true, force: true });
+    }
+  });
+
   test("findAssistantByName returns matching entry", () => {
     writeLockfile({
       assistants: [makeEntry("alpha"), makeEntry("beta")],

package/src/__tests__/nginx-ingress-command.test.ts

@@ -120,11 +120,11 @@ describe("up", () => {
     logSpy.mockRestore();
   });
 
-  test("starts the webhooks-only edge when the flag is off and states the mode", async () => {
+  test("starts the edge and states the remote web mode", async () => {
     ensureTunnelEdgeMock.mockResolvedValue({
-      port: 7845,
+      port: 7840,
       started: true,
-      includesWebApp: false,
+      includesWebApp: true,
     });
 
     await up({
@@ -139,28 +139,9 @@ describe("up", () => {
       workspaceDir,
       gatewayPort: 7830,
     });
-    const output = logs.join("\n");
-    expect(output).toContain("http://127.0.0.1:7845 (webhooks only)");
-    expect(output).toContain("web-remote-ingress");
-    expect(output).toContain("vellum tunnel --provider ngrok");
-  });
-
-  test("states the remote web mode when the flag is on", async () => {
-    ensureTunnelEdgeMock.mockResolvedValue({
-      port: 7840,
-      started: true,
-      includesWebApp: true,
-    });
-
-    await up({
-      assistantId: "assistant-1",
-      workspaceDir,
-      gatewayPort: 7830,
-    });
-
     const output = logs.join("\n");
     expect(output).toContain("http://127.0.0.1:7840 (remote web + webhooks)");
-    expect(output).not.toContain("Enable the web-remote-ingress feature flag");
+    expect(output).toContain("vellum tunnel --provider ngrok");
   });
 });
 

package/src/__tests__/nginx-ingress.test.ts

@@ -23,12 +23,10 @@ import {
   test,
 } from "bun:test";
 
-import * as featureFlags from "../lib/feature-flags.js";
 import * as httpClient from "../lib/http-client.js";
 
 const realChildProcess = { ...childProcess };
 const realFs = { ...fsModule };
-const realFeatureFlags = { ...featureFlags };
 const realHttpClient = { ...httpClient };
 
 const execFileSyncMock = mock(childProcess.execFileSync);
@@ -60,21 +58,11 @@ mock.module("../lib/http-client.js", () => ({
   waitForDaemonReady: waitForDaemonReadyMock,
 }));
 
-const isFeatureFlagEnabledMock = mock<
-  typeof featureFlags.isAssistantFeatureFlagEnabled
->(async () => true);
-
-mock.module("../lib/feature-flags.js", () => ({
-  ...featureFlags,
-  isAssistantFeatureFlagEnabled: isFeatureFlagEnabledMock,
-}));
-
 // Restore the real modules once this file finishes so the mocks do not leak
 // into sibling test files in the same `bun test` run.
 afterAll(() => {
   mock.module("node:child_process", () => realChildProcess);
   mock.module("node:fs", () => realFs);
-  mock.module("../lib/feature-flags.js", () => realFeatureFlags);
   mock.module("../lib/http-client.js", () => realHttpClient);
 });
 
@@ -132,8 +120,6 @@ afterEach(() => {
   readFileSyncMock.mockImplementation(realFs.readFileSync);
   waitForDaemonReadyMock.mockReset();
   waitForDaemonReadyMock.mockImplementation(async () => true);
-  isFeatureFlagEnabledMock.mockReset();
-  isFeatureFlagEnabledMock.mockImplementation(async () => true);
   for (const dir of workspaces.splice(0)) {
     rmSync(dir, { recursive: true, force: true });
   }
@@ -201,6 +187,27 @@ describe("buildIngressNginxConfig", () => {
     expect(conf).toContain("location / {");
     expect(conf).toContain("proxy_pass http://127.0.0.1:7830;");
     expect(conf).toContain('proxy_set_header X-Vellum-Edge-Forwarded "1";');
+    expect(conf).toContain(
+      "proxy_set_header X-Vellum-Client-Ip $vellum_edge_client_ip;",
+    );
+  });
+
+  test("stamps the edge-observed client ip from the rightmost X-Forwarded-For entry", () => {
+    for (const config of [conf, remoteConf]) {
+      // Falls back to the raw peer when the TLS-terminating front sets no
+      // X-Forwarded-For; the client cannot smuggle a value because
+      // proxy_set_header overwrites inbound headers.
+      expect(config).toContain(
+        "map $http_x_forwarded_for $vellum_edge_client_ip {",
+      );
+      expect(config).toContain("default $remote_addr;");
+      expect(config).toContain(
+        '"~,?\\s*(?<vellum_last_xff>[^,\\s]+)\\s*$" $vellum_last_xff;',
+      );
+      expect(config).toContain(
+        "proxy_set_header X-Vellum-Client-Ip $vellum_edge_client_ip;",
+      );
+    }
   });
 
   test("blocks local-only bootstrap helpers before the catch-all proxy", () => {
@@ -326,6 +333,12 @@ describe("buildIngressNginxConfig", () => {
       "location = /v1/guardian/init/ { return 404; }",
       "location = /v1/guardian/reset-bootstrap { return 404; }",
       "location = /v1/guardian/reset-bootstrap/ { return 404; }",
+      "location = /v1/remote-web/pairing-requests { return 404; }",
+      "location = /v1/remote-web/pairing-requests/ { return 404; }",
+      "location = /v1/remote-web/pairing-requests/approve { return 404; }",
+      "location = /v1/remote-web/pairing-requests/approve/ { return 404; }",
+      "location = /v1/remote-web/pairing-requests/deny { return 404; }",
+      "location = /v1/remote-web/pairing-requests/deny/ { return 404; }",
       "location ^~ /assistant/__local/ { return 404; }",
       "location ^~ /assistant/__gateway/ { return 404; }",
       "location ^~ /assistant/__gateway-paired/ { return 404; }",
@@ -714,7 +727,7 @@ function spaConfigHash(assistantName?: string): string {
   return createHash("sha256")
     .update(
       JSON.stringify({
-        template: 2,
+        template: 3,
         config: {
           mode: "remote-gateway",
           apiBaseUrl: "/v1",
@@ -1617,7 +1630,7 @@ describe("ensureTunnelEdge", () => {
     expect(indexHtml).toContain(`"hubUrl":"${PRODUCTION_HUB_URL}"`);
   });
 
-  test("reuses a running edge that matches the flag-resolved mode", async () => {
+  test("reuses a running edge that already serves the SPA mode", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
@@ -1644,34 +1657,6 @@ describe("ensureTunnelEdge", () => {
     expect(spawnMock).not.toHaveBeenCalled();
   });
 
-  test("reuses a running webhooks-only edge and reports the recorded mode", async () => {
-    const ws = makeWorkspace();
-    mockNginxInstalled();
-    mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
-    const pid = mockRunningEdge(ws, {
-      listenPort: 7845,
-      includeWebApp: false,
-      gatewayPort: 7830,
-    });
-    const edge = mockKillableNginx(pid);
-
-    const result = await ensureTunnelEdge({
-      assistantId: ASSISTANT_ID,
-      workspaceDir: ws,
-      gatewayPort: 7830,
-    });
-
-    expect(result).toEqual({
-      port: 7845,
-      started: false,
-      includesWebApp: false,
-    });
-    expect(edge.killed()).toBe(false);
-    expect(spawnMock).not.toHaveBeenCalled();
-  });
-
   test("restarts the edge when the lockfile display name changes", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
@@ -1751,9 +1736,8 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
-    const pid = mockRunningEdge(ws, { listenPort: 7845, includeWebApp: true });
+    mockWebDistPresent();
+    const pid = mockRunningEdge(ws, { listenPort: 7845, includeWebApp: false });
     mockUnkillableNginx(pid);
 
     const promise = ensureTunnelEdge({
@@ -1763,7 +1747,7 @@ describe("ensureTunnelEdge", () => {
     });
 
     await expect(promise).rejects.toThrow(
-      "still running in web app mode and could not be restarted in webhooks-only mode",
+      "still running in webhooks-only mode and could not be restarted in web app mode",
     );
     await expect(promise).rejects.toThrow("vellum nginx-ingress down");
     expect(spawnMock).not.toHaveBeenCalled();
@@ -1773,12 +1757,12 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
+    mockWebDistPresent();
     const pid = mockRunningEdge(ws, {
       listenPort: 7845,
-      includeWebApp: false,
+      includeWebApp: true,
       gatewayPort: 7900,
+      remoteWebConfigHash: spaConfigHash(),
     });
     mockUnkillableNginx(pid);
 
@@ -1799,12 +1783,12 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
+    mockWebDistPresent();
     const pid = mockRunningEdge(ws, {
       listenPort: 7845,
-      includeWebApp: false,
+      includeWebApp: true,
       gatewayPort: 7900,
+      remoteWebConfigHash: spaConfigHash(),
     });
     const edge = mockKillableNginx(pid);
 
@@ -1817,26 +1801,19 @@ describe("ensureTunnelEdge", () => {
     expect(result).toEqual({
       port: REQUESTED_PORT,
       started: true,
-      includesWebApp: false,
+      includesWebApp: true,
     });
     expect(edge.killed()).toBe(true);
     const conf = realFs.readFileSync(ingressConfPath(ws), "utf-8");
-    expect(conf).toBe(
-      buildIngressNginxConfig({
-        gatewayPort: 7830,
-        listenPort: REQUESTED_PORT,
-        ipv6Loopback: hasIpv6Loopback(),
-      }),
-    );
+    expect(conf).toContain("location ^~ /assistant/ {");
   });
 
-  test("restarts a mode-drifted edge into the flag-resolved mode", async () => {
+  test("restarts a webhooks-only edge into the SPA mode", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
-    const pid = mockRunningEdge(ws, { listenPort: 7845, includeWebApp: true });
+    mockWebDistPresent();
+    const pid = mockRunningEdge(ws, { listenPort: 7845, includeWebApp: false });
     const edge = mockKillableNginx(pid);
 
     const result = await ensureTunnelEdge({
@@ -1848,20 +1825,14 @@ describe("ensureTunnelEdge", () => {
     expect(result).toEqual({
       port: REQUESTED_PORT,
       started: true,
-      includesWebApp: false,
+      includesWebApp: true,
     });
     expect(edge.killed()).toBe(true);
     const conf = realFs.readFileSync(ingressConfPath(ws), "utf-8");
-    expect(conf).toBe(
-      buildIngressNginxConfig({
-        gatewayPort: 7830,
-        listenPort: REQUESTED_PORT,
-        ipv6Loopback: hasIpv6Loopback(),
-      }),
-    );
+    expect(conf).toContain("location ^~ /assistant/ {");
   });
 
-  test("flag enabled starts the SPA edge", async () => {
+  test("starts the SPA edge", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
@@ -1878,11 +1849,6 @@ describe("ensureTunnelEdge", () => {
       started: true,
       includesWebApp: true,
     });
-    expect(isFeatureFlagEnabledMock).toHaveBeenCalledWith(
-      ASSISTANT_ID,
-      featureFlags.WEB_REMOTE_INGRESS_FLAG,
-      { runtimeUrl: "http://127.0.0.1:7830" },
-    );
     const conf = realFs.readFileSync(ingressConfPath(ws), "utf-8");
     expect(conf).toContain("location ^~ /assistant/ {");
     expect(conf).toContain("location ^~ /webhooks/ {");
@@ -1894,40 +1860,11 @@ describe("ensureTunnelEdge", () => {
     });
   });
 
-  test("flag disabled starts the webhooks-only edge", async () => {
-    const ws = makeWorkspace();
-    mockNginxInstalled();
-    mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
-
-    const result = await ensureTunnelEdge({
-      assistantId: ASSISTANT_ID,
-      workspaceDir: ws,
-      gatewayPort: 7830,
-    });
-
-    expect(result).toEqual({
-      port: REQUESTED_PORT,
-      started: true,
-      includesWebApp: false,
-    });
-    const conf = realFs.readFileSync(ingressConfPath(ws), "utf-8");
-    expect(conf).toContain("location = /v1/pair { return 404; }");
-    expect(conf).not.toContain("location ^~ /assistant/ {");
-    expect((readConfig(ws).ingress as Record<string, unknown>).nginx).toEqual({
-      listenPort: REQUESTED_PORT,
-      includeWebApp: false,
-      gatewayPort: 7830,
-    });
-  });
-
   test("forwards onStarting so callers can print progress", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
+    mockWebDistPresent();
     const onStarting = mock(
       (_info: {
         version: string;
@@ -1943,18 +1880,18 @@ describe("ensureTunnelEdge", () => {
       onStarting,
     });
 
-    expect(onStarting).toHaveBeenCalledWith({
-      version: NGINX_VERSION,
-      webDistDir: null,
-      listenPort: REQUESTED_PORT,
-    });
+    expect(onStarting).toHaveBeenCalledTimes(1);
+    const info = onStarting.mock.calls[0][0];
+    expect(info.version).toBe(NGINX_VERSION);
+    expect(info.listenPort).toBe(REQUESTED_PORT);
+    expect(typeof info.webDistDir).toBe("string");
   });
 
-  test("an entry without an assistant id gets the webhooks-only edge", async () => {
+  test("an entry without an assistant id still gets the SPA edge", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
+    mockWebDistPresent();
 
     const result = await ensureTunnelEdge({
       assistantId: undefined,
@@ -1965,11 +1902,10 @@ describe("ensureTunnelEdge", () => {
     expect(result).toEqual({
       port: REQUESTED_PORT,
       started: true,
-      includesWebApp: false,
+      includesWebApp: true,
     });
-    expect(isFeatureFlagEnabledMock).not.toHaveBeenCalled();
     const conf = realFs.readFileSync(ingressConfPath(ws), "utf-8");
-    expect(conf).not.toContain("location ^~ /assistant/ {");
+    expect(conf).toContain("location ^~ /assistant/ {");
   });
 
   test("missing nginx throws with install instructions", async () => {
@@ -1988,97 +1924,7 @@ describe("ensureTunnelEdge", () => {
     expect(spawnMock).not.toHaveBeenCalled();
   });
 
-  test("flag lookup failure throws the wake hint", async () => {
-    const ws = makeWorkspace();
-    mockNginxInstalled();
-    isFeatureFlagEnabledMock.mockImplementation(async () => {
-      throw new Error("connect ECONNREFUSED");
-    });
-
-    const promise = ensureTunnelEdge({
-      assistantId: ASSISTANT_ID,
-      workspaceDir: ws,
-      gatewayPort: 7830,
-    });
-
-    await expect(promise).rejects.toThrow(
-      "Could not verify the `web-remote-ingress` feature flag",
-    );
-    await expect(promise).rejects.toThrow("Try `vellum wake` and retry");
-    await expect(promise).rejects.toThrow("connect ECONNREFUSED");
-    expect(spawnMock).not.toHaveBeenCalled();
-  });
-
-  test("flagRetry retries a thrown flag lookup and then starts the edge", async () => {
-    const ws = makeWorkspace();
-    mockNginxInstalled();
-    mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock
-      .mockImplementationOnce(async () => {
-        throw new Error('HTTP 503 {"status":"starting"}');
-      })
-      .mockImplementationOnce(async () => {
-        throw new Error('HTTP 503 {"status":"starting"}');
-      })
-      .mockImplementationOnce(async () => false);
-
-    const result = await ensureTunnelEdge({
-      assistantId: ASSISTANT_ID,
-      workspaceDir: ws,
-      gatewayPort: 7830,
-      flagRetry: { attempts: 3, intervalMs: 1 },
-    });
-
-    expect(isFeatureFlagEnabledMock).toHaveBeenCalledTimes(3);
-    expect(result).toEqual({
-      port: REQUESTED_PORT,
-      started: true,
-      includesWebApp: false,
-    });
-  });
-
-  test("flagRetry does not retry a resolved false: it is a real answer", async () => {
-    const ws = makeWorkspace();
-    mockNginxInstalled();
-    mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
-
-    const result = await ensureTunnelEdge({
-      assistantId: ASSISTANT_ID,
-      workspaceDir: ws,
-      gatewayPort: 7830,
-      flagRetry: { attempts: 3, intervalMs: 1 },
-    });
-
-    expect(isFeatureFlagEnabledMock).toHaveBeenCalledTimes(1);
-    expect(result.includesWebApp).toBe(false);
-  });
-
-  test("an exhausted flagRetry throws the wake hint with the last error", async () => {
-    const ws = makeWorkspace();
-    mockNginxInstalled();
-    isFeatureFlagEnabledMock.mockImplementation(async () => {
-      throw new Error("connect ECONNREFUSED");
-    });
-
-    const promise = ensureTunnelEdge({
-      assistantId: ASSISTANT_ID,
-      workspaceDir: ws,
-      gatewayPort: 7830,
-      flagRetry: { attempts: 3, intervalMs: 1 },
-    });
-
-    await expect(promise).rejects.toThrow(
-      "Could not verify the `web-remote-ingress` feature flag",
-    );
-    await expect(promise).rejects.toThrow("connect ECONNREFUSED");
-    expect(isFeatureFlagEnabledMock).toHaveBeenCalledTimes(3);
-    expect(spawnMock).not.toHaveBeenCalled();
-  });
-
-  test("missing web dist with the flag enabled throws build guidance", async () => {
+  test("missing web dist throws build guidance", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockWebDistMissing();
@@ -2096,8 +1942,7 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawn();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
+    mockWebDistPresent();
     waitForDaemonReadyMock.mockImplementation(async () => false);
 
     await expect(
@@ -2113,8 +1958,7 @@ describe("ensureTunnelEdge", () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
     mockNginxSpawnExitsOnStartup();
-    mockWebDistMissing();
-    isFeatureFlagEnabledMock.mockImplementation(async () => false);
+    mockWebDistPresent();
     waitForDaemonReadyMock.mockImplementation(async () => true);
 
     const promise = ensureTunnelEdge({