@mycadet/assistant 0.12.7 → 0.12.8

package/src/__tests__/schedule-store.test.ts

@@ -6,7 +6,7 @@ import { mock } from "bun:test";
 // Stub the background-wake publisher so these store-level unit tests stay
 // hermetic. `notifySchedulesChanged()` fires a debounced background-wake
 // refresh on every mutation; left real, that 250ms timer performs a
-// synchronous DB read plus a platform-client lookup which compete with the
+// synchronous DB read plus a cloud-client lookup which compete with the
 // serialized async event delivery and can push a `sync_changed` past the
 // wait deadline on loaded runners. Background-wake behavior is covered by the
 // background-wake tests.

package/src/__tests__/search-skills-unified.test.ts

@@ -1,5 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setAllFlagsOnForTesting } from "../__tests__/feature-flag-test-helpers.js";
+
 // ---------------------------------------------------------------------------
 // Mock state
 // ---------------------------------------------------------------------------
@@ -102,9 +104,6 @@ mock.module("../skills/install-meta.js", () => ({
 }));
 
 // Stub remaining imports pulled in by skills.ts
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => true,
-}));
 mock.module("../config/skill-state.js", () => ({
   resolveSkillStates: () => [],
   skillFlagKey: () => null,
@@ -124,10 +123,10 @@ mock.module("../skills/catalog-cache.js", () => ({
 mock.module("../skills/catalog-install.js", () => ({
   installSkillLocally: async () => {},
 }));
-mock.module("../skills/managed-store.js", () => ({
-  createManagedSkill: () => ({ created: true }),
-  deleteManagedSkill: () => ({ deleted: true }),
-  validateManagedSkillId: () => null,
+mock.module("../skills/cloud-store.js", () => ({
+  createCloudSkill: () => ({ created: true }),
+  deleteCloudSkill: () => ({ deleted: true }),
+  validateCloudSkillId: () => null,
 }));
 mock.module("../plugins/defaults/memory/graph/capability-seed.js", () => ({
   deleteSkillCapabilityNode: () => {},
@@ -159,6 +158,9 @@ import { searchSkills } from "../daemon/handlers/skills.js";
 
 describe("searchSkills (unified)", () => {
   beforeEach(() => {
+    // Real flag resolution replaces the former blanket module mock.
+    setAllFlagsOnForTesting();
+
     mockCatalogSkills.mockReset();
     mockClawhubSearch.mockReset();
     mockSkillsshSearch.mockReset();

package/src/__tests__/{secret-routes-platform-proxy.test.ts → secret-routes-cloud-proxy.test.ts}

@@ -20,9 +20,8 @@ let providerRefreshCalls = 0;
 let identitySyncCalls = 0;
 let avatarSyncCalls = 0;
 
-const PLATFORM_BASE_URL = "https://platform.example.com";
+const CLOUD_BASE_URL = "https://platform.example.com";
 const ASSISTANT_API_KEY_PATH = credentialKey("cadet", "assistant_api_key");
-const PLATFORM_BASE_URL_PATH = credentialKey("cadet", "platform_base_url");
 const MANAGED_PROVIDERS = [
   "anthropic",
   "openai",
@@ -32,9 +31,8 @@ const MANAGED_PROVIDERS = [
   "typesafe",
 ] as const;
 
-let platformBaseUrlOverride: string | undefined;
-let platformAssistantIdOverride: string | undefined;
-let platformOrganizationIdOverride: string | undefined;
+let cloudAssistantIdOverride: string | undefined;
+let cloudOrganizationIdOverride: string | undefined;
 let platformUserIdOverride: string | undefined;
 
 mock.module("@google/genai", () => ({
@@ -61,18 +59,15 @@ mock.module("@google/genai", () => ({
 }));
 
 mock.module("../config/env.js", () => ({
-  getPlatformBaseUrl: () => PLATFORM_BASE_URL,
-  getPlatformAssistantId: () => platformAssistantIdOverride,
-  setPlatformBaseUrl: (value: string | undefined) => {
-    platformBaseUrlOverride = value;
+  getCloudBaseUrl: () => CLOUD_BASE_URL,
+  getCloudAssistantId: () => cloudAssistantIdOverride,
+  setCloudAssistantId: (value: string | undefined) => {
+    cloudAssistantIdOverride = value;
   },
-  setPlatformAssistantId: (value: string | undefined) => {
-    platformAssistantIdOverride = value;
+  setCloudOrganizationId: (value: string | undefined) => {
+    cloudOrganizationIdOverride = value;
   },
-  setPlatformOrganizationId: (value: string | undefined) => {
-    platformOrganizationIdOverride = value;
-  },
-  setPlatformUserId: (value: string | undefined) => {
+  setCloudUserId: (value: string | undefined) => {
     platformUserIdOverride = value;
   },
 }));
@@ -97,22 +92,22 @@ mock.module("../tools/credentials/metadata-store.js", () => ({
   },
 }));
 
-// `handleAddSecret` fires this detached when a managed-proxy credential lands —
+// `handleAddSecret` fires this detached when a cloud-proxy credential lands —
 // a v2-memory side effect outside this suite's provider-registry scope. Stub it
 // to a no-op; its behavior is covered by boot-maintenance.test.ts.
 mock.module("../plugins/defaults/memory/substrate/boot-maintenance.js", () => ({
-  maybeReseedCapabilitiesAfterManagedCredential: async () => {},
+  maybeReseedCapabilitiesAfterCloudCredential: async () => {},
 }));
 
 // Live platform registration (`cadet login` against a running assistant)
 // must re-enqueue the name and avatar syncs that no-op'd at startup.
-mock.module("../platform/sync-identity.js", () => ({
+mock.module("../cloud/sync-identity.js", () => ({
   syncWorkspaceIdentityToPlatform: () => {
     identitySyncCalls++;
   },
 }));
 mock.module("../avatar/sync-avatar.js", () => ({
-  syncAvatarToPlatform: () => {
+  syncAvatarToCloud: () => {
     avatarSyncCalls++;
   },
 }));
@@ -174,16 +169,15 @@ function deleteApiKey(name: string) {
   });
 }
 
-describe("secret routes managed proxy registry sync", () => {
+describe("secret routes cloud proxy registry sync", () => {
   beforeEach(async () => {
     secureKeyStore.clear();
     setWritesFail(false);
     metadataUpserts.length = 0;
     metadataDeletes.length = 0;
     lastGeminiConstructorOpts = null;
-    platformBaseUrlOverride = undefined;
-    platformAssistantIdOverride = undefined;
-    platformOrganizationIdOverride = undefined;
+    cloudAssistantIdOverride = undefined;
+    cloudOrganizationIdOverride = undefined;
     platformUserIdOverride = undefined;
     providerRefreshCalls = 0;
     identitySyncCalls = 0;
@@ -196,7 +190,7 @@ describe("secret routes managed proxy registry sync", () => {
     await initializeProviders(getConfig());
   });
 
-  test("adding cadet:assistant_api_key bootstraps managed fallback providers immediately", async () => {
+  test("adding cadet:assistant_api_key bootstraps cloud fallback providers immediately", async () => {
     expect(listProviders()).toEqual([]);
 
     const result = await addCredential(
@@ -214,7 +208,7 @@ describe("secret routes managed proxy registry sync", () => {
     expect(providers).toHaveLength(MANAGED_PROVIDERS.length);
     for (const provider of MANAGED_PROVIDERS) {
       expect(providers).toContain(provider);
-      expect(getProviderRoutingSource(provider)).toBe("managed-proxy");
+      expect(getProviderRoutingSource(provider)).toBe("cloud-proxy");
     }
     expect(lastGeminiConstructorOpts).toBeDefined();
   });
@@ -259,14 +253,11 @@ describe("secret routes managed proxy registry sync", () => {
 
   test("deleting a cadet credential is rejected without touching the vault", async () => {
     secureKeyStore.set(ASSISTANT_API_KEY_PATH, "ast-managed-key");
-    secureKeyStore.set(PLATFORM_BASE_URL_PATH, "https://managed.example.com");
-    platformBaseUrlOverride = "https://managed.example.com";
-    platformAssistantIdOverride = "asst-1";
+    cloudAssistantIdOverride = "asst-1";
     await initializeProviders(getConfig());
 
     for (const name of [
       "cadet:assistant_api_key",
-      "cadet:platform_base_url",
       "cadet:webhook_secret",
       "cadet:platform_assistant_id",
     ]) {
@@ -276,16 +267,12 @@ describe("secret routes managed proxy registry sync", () => {
     }
 
     expect(secureKeyStore.get(ASSISTANT_API_KEY_PATH)).toBe("ast-managed-key");
-    expect(secureKeyStore.get(PLATFORM_BASE_URL_PATH)).toBe(
-      "https://managed.example.com",
-    );
-    expect(platformBaseUrlOverride).toBe("https://managed.example.com");
-    expect(platformAssistantIdOverride).toBe("asst-1");
+    expect(cloudAssistantIdOverride).toBe("asst-1");
     expect(metadataDeletes).toEqual([]);
     expect(providerRefreshCalls).toBe(0);
   });
 
-  test("managed proxy credential writes notify live-conversation refresh listeners", async () => {
+  test("cloud proxy credential writes notify live-conversation refresh listeners", async () => {
     await addCredential("cadet:assistant_api_key", "ast-managed-key");
 
     expect(providerRefreshCalls).toBe(1);
@@ -294,8 +281,8 @@ describe("secret routes managed proxy registry sync", () => {
   /**
    * Verifies that rotating a credential refreshes providers for dependent connections.
    */
-  test("non-managed credentials refresh providers when a connection uses them", async () => {
-    // GIVEN a non-managed credential.
+  test("non-cloud credentials refresh providers when a connection uses them", async () => {
+    // GIVEN a non-cloud credential.
     // AND a provider connection references its canonical credential key.
     const now = Date.now();
     getDb()
@@ -322,8 +309,8 @@ describe("secret routes managed proxy registry sync", () => {
   /**
    * Verifies that rotating an unused credential does not refresh providers.
    */
-  test("non-managed credentials do not refresh providers when no connection uses them", async () => {
-    // GIVEN a non-managed credential.
+  test("non-cloud credentials do not refresh providers when no connection uses them", async () => {
+    // GIVEN a non-cloud credential.
     // AND no provider connection references its credential key.
     // WHEN the credential is rotated.
     await addCredential("openrouter:api_key", "openrouter-key");
@@ -332,14 +319,11 @@ describe("secret routes managed proxy registry sync", () => {
     expect(providerRefreshCalls).toBe(0);
   });
 
-  test("storing a platform registration credential enqueues name and avatar syncs", async () => {
-    for (const name of ["cadet:assistant_api_key", "cadet:platform_base_url"]) {
-      identitySyncCalls = 0;
-      avatarSyncCalls = 0;
-      await addCredential(name, "value");
-      expect(identitySyncCalls).toBe(1);
-      expect(avatarSyncCalls).toBe(1);
-    }
+  test("storing a cloud registration credential enqueues name and avatar syncs", async () => {
+    await addCredential("cadet:assistant_api_key", "value");
+
+    expect(identitySyncCalls).toBe(1);
+    expect(avatarSyncCalls).toBe(1);
   });
 
   test("unrelated credentials do not enqueue platform syncs", async () => {
@@ -353,7 +337,7 @@ describe("secret routes managed proxy registry sync", () => {
     setWritesFail(true);
 
     await expect(
-      addCredential("cadet:platform_base_url", "https://managed.example.com"),
+      addCredential("cadet:assistant_api_key", "ast-managed-key"),
     ).rejects.toThrow("Failed to store credential");
 
     expect(identitySyncCalls).toBe(0);
@@ -361,84 +345,53 @@ describe("secret routes managed proxy registry sync", () => {
   });
 
   test("unknown cadet credentials are rejected without persisting or binding identity", async () => {
-    platformAssistantIdOverride = "existing-asst";
-    platformOrganizationIdOverride = "existing-org";
+    cloudAssistantIdOverride = "existing-asst";
+    cloudOrganizationIdOverride = "existing-org";
     platformUserIdOverride = "existing-user";
 
+    // Identity ids are not credentials at all — they resolve from the
+    // assistant_api_key via validate and live in the in-memory identity.
     await expect(
-      addCredential("cadet:platform_assistant_id", "asst-1"),
-    ).rejects.toThrow("Unknown cadet credential: platform_assistant_id");
-    await expect(
-      addCredential("cadet:platform_organization_id", "org-1"),
-    ).rejects.toThrow("Unknown cadet credential: platform_organization_id");
-    await expect(
-      addCredential("cadet:platform_user_id", "user-1"),
-    ).rejects.toThrow("Unknown cadet credential: platform_user_id");
+      addCredential("cadet:cloud_assistant_id", "asst-1"),
+    ).rejects.toThrow("Unknown cadet credential: cloud_assistant_id");
 
     expect(
-      secureKeyStore.get(credentialKey("cadet", "platform_assistant_id")),
-    ).toBeUndefined();
-    expect(
-      secureKeyStore.get(credentialKey("cadet", "platform_organization_id")),
-    ).toBeUndefined();
-    expect(
-      secureKeyStore.get(credentialKey("cadet", "platform_user_id")),
+      secureKeyStore.get(credentialKey("cadet", "cloud_assistant_id")),
     ).toBeUndefined();
     expect(metadataUpserts).toEqual([]);
-    expect(platformAssistantIdOverride).toBe("existing-asst");
-    expect(platformOrganizationIdOverride).toBe("existing-org");
+    expect(cloudAssistantIdOverride).toBe("existing-asst");
+    expect(cloudOrganizationIdOverride).toBe("existing-org");
     expect(platformUserIdOverride).toBe("existing-user");
     expect(identitySyncCalls).toBe(0);
     expect(avatarSyncCalls).toBe(0);
   });
 
   test("an unknown cadet credential does not delete leftover vault copies", async () => {
-    const key = credentialKey("cadet", "platform_assistant_id");
+    const key = credentialKey("cadet", "cloud_assistant_id");
     secureKeyStore.set(key, "leftover-asst");
-    platformAssistantIdOverride = "asst-1";
+    cloudAssistantIdOverride = "asst-1";
 
     await expect(
-      addCredential("cadet:platform_assistant_id", "   "),
-    ).rejects.toThrow("Unknown cadet credential: platform_assistant_id");
+      addCredential("cadet:cloud_assistant_id", "   "),
+    ).rejects.toThrow("Unknown cadet credential: cloud_assistant_id");
 
     expect(secureKeyStore.get(key)).toBe("leftover-asst");
-    expect(platformAssistantIdOverride).toBe("asst-1");
+    expect(cloudAssistantIdOverride).toBe("asst-1");
     expect(metadataDeletes).toEqual([]);
     expect(identitySyncCalls).toBe(0);
     expect(avatarSyncCalls).toBe(0);
   });
 
-  test("storing cadet:platform_base_url sets override and triggers initializeProviders", async () => {
-    await addCredential(
-      "cadet:platform_base_url",
-      "https://managed.example.com",
-    );
-
-    expect(secureKeyStore.get(PLATFORM_BASE_URL_PATH)).toBe(
-      "https://managed.example.com",
-    );
-    expect(platformBaseUrlOverride).toBe("https://managed.example.com");
-    expect(metadataUpserts).toEqual([
-      { service: "cadet", field: "platform_base_url" },
-    ]);
-  });
-
-  test("storing both cadet:platform_base_url and cadet:assistant_api_key enables managed proxy", async () => {
+  test("storing cadet:assistant_api_key enables cloud proxy", async () => {
     expect(listProviders()).toEqual([]);
 
-    await addCredential(
-      "cadet:platform_base_url",
-      "https://managed.example.com",
-    );
-    expect(platformBaseUrlOverride).toBe("https://managed.example.com");
-
     await addCredential("cadet:assistant_api_key", "ast-managed-key");
 
     const providers = listProviders();
     expect(providers).toHaveLength(MANAGED_PROVIDERS.length);
     for (const provider of MANAGED_PROVIDERS) {
       expect(providers).toContain(provider);
-      expect(getProviderRoutingSource(provider)).toBe("managed-proxy");
+      expect(getProviderRoutingSource(provider)).toBe("cloud-proxy");
     }
   });
 });

package/src/__tests__/secret-routes-scrub.test.ts

@@ -6,7 +6,6 @@
  *   - scrubs the stored value exactly once, immediately after the
  *     secure-store write
  *   - never scrubs when validation rejects the request (nothing was stored)
- *   - still succeeds when the scrub itself rejects (best-effort hygiene)
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -21,7 +20,6 @@ import { useMemorySecureKeyMap } from "./helpers/secure-keys.js";
 const secureStore = useMemorySecureKeyMap();
 
 let scrubbedValues: string[];
-let scrubRejects: boolean;
 let anthropicKeyValid: boolean;
 let providersRefreshed: number;
 
@@ -32,9 +30,6 @@ let providersRefreshed: number;
 mock.module("../daemon/credential-transcript-scrub.js", () => ({
   scrubStoredCredentialFromTranscripts: mock(async (value: string) => {
     scrubbedValues.push(value);
-    if (scrubRejects) {
-      throw new Error("transcript sweep failed");
-    }
     return { dbMessagesScrubbed: 0, residentMessagesScrubbed: 0 };
   }),
 }));
@@ -87,7 +82,6 @@ describe("secrets_add api_key transcript scrub", () => {
   beforeEach(() => {
     secureStore.clear();
     scrubbedValues = [];
-    scrubRejects = false;
     anthropicKeyValid = true;
     providersRefreshed = 0;
   });
@@ -104,6 +98,8 @@ describe("secrets_add api_key transcript scrub", () => {
       API_KEY_VALUE,
     );
     expect(scrubbedValues).toEqual([API_KEY_VALUE]);
+    // The provider refresh still happens after the scrub.
+    expect(providersRefreshed).toBe(1);
   });
 
   test("an unknown provider is rejected and never triggers a scrub", async () => {
@@ -134,23 +130,6 @@ describe("secrets_add api_key transcript scrub", () => {
     expect(secureStore.size).toBe(0);
     expect(scrubbedValues).toEqual([]);
   });
-
-  test("the route still succeeds (and refreshes providers) when the scrub rejects", async () => {
-    scrubRejects = true;
-
-    const result = await addRoute.handler({
-      body: { type: "api_key", name: "fireworks", value: API_KEY_VALUE },
-    });
-
-    expect(result).toEqual(expect.objectContaining({ success: true }));
-    expect(secureStore.get(credentialKey("fireworks", "api_key"))).toBe(
-      API_KEY_VALUE,
-    );
-    // The scrub ran (once) even though it failed, and the failure stayed
-    // invisible to the caller — the provider refresh still happened.
-    expect(scrubbedValues).toEqual([API_KEY_VALUE]);
-    expect(providersRefreshed).toBe(1);
-  });
 });
 
 const CREDENTIAL_VALUE = "synthetic-credential-value-0987654321";
@@ -159,7 +138,6 @@ describe("secrets_add credential transcript scrub", () => {
   beforeEach(() => {
     secureStore.clear();
     scrubbedValues = [];
-    scrubRejects = false;
     anthropicKeyValid = true;
     providersRefreshed = 0;
   });
@@ -180,41 +158,6 @@ describe("secrets_add credential transcript scrub", () => {
     expect(scrubbedValues).toEqual([CREDENTIAL_VALUE]);
   });
 
-  test("the route still succeeds when the credential scrub rejects", async () => {
-    scrubRejects = true;
-
-    const result = await addRoute.handler({
-      body: {
-        type: "credential",
-        name: "github:api_token",
-        value: CREDENTIAL_VALUE,
-      },
-    });
-
-    expect(result).toEqual(expect.objectContaining({ success: true }));
-    expect(secureStore.get(credentialKey("github", "api_token"))).toBe(
-      CREDENTIAL_VALUE,
-    );
-    expect(scrubbedValues).toEqual([CREDENTIAL_VALUE]);
-  });
-
-  test("non-secret platform fields are not scrubbed", async () => {
-    const result = await addRoute.handler({
-      body: {
-        type: "credential",
-        name: "cadet:platform_base_url",
-        value: "0198f4c2-1111-2222-3333-444455556666",
-      },
-    });
-    expect(result).toEqual(expect.objectContaining({ success: true }));
-
-    expect(secureStore.size).toBe(1);
-    expect(secureStore.get(credentialKey("cadet", "platform_base_url"))).toBe(
-      "0198f4c2-1111-2222-3333-444455556666",
-    );
-    expect(scrubbedValues).toEqual([]);
-  });
-
   test("an unknown cadet credential is rejected and never triggers a scrub", async () => {
     await expect(
       addRoute.handler({

package/src/__tests__/secure-keys.test.ts

@@ -239,7 +239,7 @@ describe("secure-keys", () => {
   //
   // The reconnect callback runs while the credential resolver is waiting on
   // `_reconnectInFlight`. A nested `getSecureKeyAsync()` from inside the
-  // callback — e.g. `resolveManagedProxyContext()` reading the assistant API
+  // callback — e.g. `resolveCloudProxyContext()` reading the assistant API
   // key for the handshake — would recursively `await` the same in-flight
   // promise and deadlock for 45 seconds until `CREDENTIAL_OP_TIMEOUT_MS`
   // fires. The guard in `attemptCesReconnection` short-circuits that

package/src/__tests__/skill-load-plugin-scope.test.ts

@@ -4,7 +4,7 @@
  * it through when the plugin is in scope (or when there is no restriction).
  *
  * Fixture skills are real directories under the per-process workspace
- * (`plugins/p`, `plugins/q`, and a managed workspace skill for the
+ * (`plugins/p`, `plugins/q`, and a cloud workspace skill for the
  * always-allowed core child), so the real loader discovers them — no module
  * mocks.
  */
@@ -71,7 +71,7 @@ beforeAll(() => {
     body: "CHILD IN BODY",
   });
   // ── Include-path scope fixture ──────────────────────────────────────
-  // An in-scope parent (plugin "p") that includes three children: a managed
+  // An in-scope parent (plugin "p") that includes three children: a cloud
   // workspace child (no plugin owner — always allowed), an in-scope plugin
   // child (plugin "p"), and an out-of-scope plugin child (plugin "q", not in
   // the effective set).

package/src/__tests__/skill-load-tool.test.ts

@@ -830,7 +830,7 @@ describe("skill_load tool", () => {
   test("omits tools unsupported by the current client operating system", async () => {
     writeSkill(
       "platform-tools",
-      "Platform Tools",
+      "Cloud Tools",
       "Has platform-specific tools",
       "Body.",
     );

package/src/__tests__/skill-projection-feature-flag.test.ts

@@ -47,25 +47,6 @@ mock.module("../config/skill-state.js", () => ({
 // production's design: tests reach into `feature-flag-cache.ts` (or its
 // test-helper wrapper) to seed cached overrides, never through the
 // resolver module itself.
-let _mockOverrides: Record<string, boolean> = {};
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: (key: string, _config: unknown): boolean => {
-    const explicit = _mockOverrides[key];
-    if (typeof explicit === "boolean") {
-      return explicit;
-    }
-    return false; // undeclared flags default to disabled
-  },
-  clearFeatureFlagOverridesCache: () => {
-    _mockOverrides = {};
-  },
-  getAssistantFeatureFlagDefaults: () => ({}),
-}));
-mock.module("./feature-flag-test-helpers.js", () => ({
-  setOverridesForTesting: (overrides: Record<string, boolean>) => {
-    _mockOverrides = { ...overrides };
-  },
-}));
 
 mock.module("../skills/active-skill-tools.js", () => {
   const parseMarkers = (messages: Message[]) => {

package/src/__tests__/skill-projection.benchmark.test.ts

@@ -12,18 +12,14 @@
 import { beforeAll, describe, expect, mock, test } from "bun:test";
 
 import type { Message } from "../providers/types.js";
+import { setAllFlagsOnForTesting } from "./feature-flag-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Mocks — must be registered before importing the module under test
 // ---------------------------------------------------------------------------
 
-// Mock feature flags to avoid filesystem reads on CI.
-// The benchmark fixture treats every feature flag as enabled.
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => true,
-  loadDefaultsRegistry: () => ({}),
-  getFeatureFlagDefault: () => true,
-}));
+// Real flag resolution with every declared flag overridden on — the defaults
+// registry is never consulted, so there are no filesystem reads on CI.
 
 // Skill catalog: returns a configurable list of fake skills
 let catalogSkillIds: string[] = [];
@@ -271,6 +267,8 @@ function timeMs(fn: () => void): number {
 
 describe("Skill projection benchmark", () => {
   beforeAll(() => {
+    setAllFlagsOnForTesting();
+
     // Prime the real config loader and JIT the projection path once so the
     // first measured "cold" run reflects projection latency, not the one-time
     // loader/module warmup cost that a trivial config mock used to hide.

package/src/__tests__/skill-tool-factory.test.ts

@@ -827,7 +827,7 @@ describe("createSkillTool: bundled input repairs", () => {
   function makeScaffoldTool(bundled: boolean) {
     return createSkillTool(
       makeEntry({
-        name: "scaffold_managed_skill",
+        name: "scaffold_cloud_skill",
         executor: "echo.ts",
         input_schema: SCAFFOLD_SCHEMA,
       }),

package/src/__tests__/skills-file-content-endpoint.test.ts

@@ -24,6 +24,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setAllFlagsOnForTesting } from "../__tests__/feature-flag-test-helpers.js";
 import type { SkillSummary } from "../config/skills.js";
 import type { SlimSkillResponse } from "../daemon/message-types/skills.js";
 import type { SkillFileEntry } from "../skills/catalog-files.js";
@@ -93,10 +94,6 @@ mock.module("../config/skill-state.js", () => ({
   skillFlagKey: () => null,
 }));
 
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => true,
-}));
-
 mock.module("../skills/catalog-cache.js", () => ({
   getCatalog: async () => [],
 }));
@@ -238,10 +235,10 @@ mock.module("../skills/install-meta.js", () => ({
   readInstallMeta: () => null,
 }));
 
-mock.module("../skills/managed-store.js", () => ({
-  createManagedSkill: () => ({ created: true }),
-  deleteManagedSkill: () => ({ deleted: true }),
-  validateManagedSkillId: () => null,
+mock.module("../skills/cloud-store.js", () => ({
+  createCloudSkill: () => ({ created: true }),
+  deleteCloudSkill: () => ({ deleted: true }),
+  validateCloudSkillId: () => null,
 }));
 
 mock.module("../plugins/defaults/memory/graph/capability-seed.js", () => ({
@@ -263,12 +260,12 @@ mock.module("../providers/provider-send-message.js", () => ({
 // Real isTextMimeType — we want actual classification here.
 // No mock needed; let it fall through to the real implementation.
 
-let mockPlatformBaseUrl = "https://platform.test";
+let mockCloudBaseUrl = "https://platform.test";
 mock.module("../config/env.js", () => ({
-  getPlatformBaseUrl: () => mockPlatformBaseUrl,
+  getCloudBaseUrl: () => mockCloudBaseUrl,
 }));
 mock.module("../config/env.ts", () => ({
-  getPlatformBaseUrl: () => mockPlatformBaseUrl,
+  getCloudBaseUrl: () => mockCloudBaseUrl,
 }));
 
 mock.module("../daemon/handlers/shared.js", () => ({
@@ -332,9 +329,12 @@ function installedSkill(id: string, directoryPath: string) {
 // ---------------------------------------------------------------------------
 
 beforeEach(() => {
+  // Real flag resolution replaces the former blanket module mock.
+  setAllFlagsOnForTesting();
+
   originalFetch = globalThis.fetch;
   mockResolvedSkills = [];
-  mockPlatformBaseUrl = "https://platform.test";
+  mockCloudBaseUrl = "https://platform.test";
   providerReadCalls.length = 0;
   mockCadetProvider = makeNoopProvider("cadet");
   mockSkillsshProvider = makeNoopProvider("skillssh");