@mycadet/assistant 0.12.7 → 0.12.8

package/src/config/inference-profile-validation.ts

@@ -9,7 +9,7 @@ import { getConfigReadOnly } from "./loader.js";
  * Resolved through the `llm.default`-aware conversation view, since
  * every caller (schedules, subagent spawns, per-conversation pins) runs chat
  * turns on the result. Managed backup routes remain available to automatic
- * fallback resolution, and the managed Jev profile to the verdict call
+ * fallback resolution, and the cloud Jev profile to the verdict call
  * sites, but neither is reported as a selectable profile here.
  */
 export function validateInferenceProfileKey(profile: string): string | null {

package/src/config/llm-resolver.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
 
 import {
-  CADET_MANAGED_CONNECTION_NAME,
-  MANAGED_ROUTABLE_PROVIDERS,
+  CADET_CLOUD_CONNECTION_NAME,
+  CLOUD_ROUTABLE_PROVIDERS,
 } from "../providers/cadet-model-routing.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
 import {
@@ -435,14 +435,13 @@ function resolveOverrideOrDefault(
     if (implied !== undefined) {
       tweak.provider = implied;
       // A provider-specific connection must not pin a mismatch onto the
-      // implied provider — but the provider-agnostic Cadet managed
+      // implied provider — but the provider-agnostic Cadet Cloud
       // connection routes any managed-routable upstream and must survive,
       // or platform installs lose their only connection.
       if (
         !(
-          winnerFragment.provider_connection ===
-            CADET_MANAGED_CONNECTION_NAME &&
-          MANAGED_ROUTABLE_PROVIDERS.has(implied)
+          winnerFragment.provider_connection === CADET_CLOUD_CONNECTION_NAME &&
+          CLOUD_ROUTABLE_PROVIDERS.has(implied)
         )
       ) {
         delete winnerFragment.provider_connection;
@@ -457,19 +456,19 @@ function resolveOverrideOrDefault(
   );
   // A cadet winner's managed routing survives a concrete-provider tweak:
   // call-site fragments carry no connection, so a tweak pinning e.g.
-  // anthropic over a managed default would otherwise resolve to a
+  // anthropic over a cloud default would otherwise resolve to a
   // connection-less concrete provider — stranded on platform installs with
   // no BYOK row. The tweak keeps every field it sets; the winner contributes
-  // its routing via the provider-agnostic managed connection, which serves
+  // its routing via the provider-agnostic cloud connection, which serves
   // any managed-routable upstream.
   if (
     winnerFragment.provider === "cadet" &&
     typeof merged.provider === "string" &&
     merged.provider !== "cadet" &&
     merged.provider_connection == null &&
-    MANAGED_ROUTABLE_PROVIDERS.has(merged.provider)
+    CLOUD_ROUTABLE_PROVIDERS.has(merged.provider)
   ) {
-    merged.provider_connection = CADET_MANAGED_CONNECTION_NAME;
+    merged.provider_connection = CADET_CLOUD_CONNECTION_NAME;
   }
   return finalize(merged);
 }

package/src/config/loader.ts

@@ -34,7 +34,7 @@ let suppressConfigDiskWritesDepth = 0;
  * {@link validateWithSchema} on every validation-success path, then overwritten
  * by {@link loadConfig} with the deployment-context-filled config whenever
  * context defaults apply — so it reflects the config as consumers actually see
- * it (managed service modes and all), not just the pre-fill schema-defaulted
+ * it (cloud service modes and all), not just the pre-fill schema-defaulted
  * view. It is a safety net for the recovery ladder — when config.json later
  * fails validation even after per-key cleanup, the last-known-good config is
  * preferred over discarding the user's entire configuration and falling back to
@@ -126,27 +126,27 @@ function cloneDefaultConfig(): AssistantConfig {
 
 /**
  * Returns deployment-context-aware config defaults that override schema
- * defaults for platform-managed assistants. Applied to every `loadConfig()`
+ * defaults for cloud assistants. Applied to every `loadConfig()`
  * call as a fill-only pass — they only fill keys that are absent from the
  * raw config on disk, so an explicit user choice (e.g. saving "your-own"
  * via the macOS Models & Services UI) always wins.
  *
- * IS_PLATFORM is set by the Cadet Cloud launcher for all hosted
+ * IS_CLOUD is set by the Cadet Cloud launcher for all hosted
  * assistant deployments. Local, Docker, and bare-metal assistants are
  * unaffected.
  */
 export function getDeploymentContextDefaults(): Record<string, unknown> {
-  if (process.env.IS_PLATFORM !== "true" && process.env.IS_PLATFORM !== "1") {
+  if (process.env.IS_CLOUD !== "true" && process.env.IS_CLOUD !== "1") {
     return {};
   }
   // Web-search carries no deployment default: `provider` is its only axis,
   // the schema default (`inference-provider-native`) prefers native hosted
-  // search, and app-executed search falls back to the platform proxy when no
+  // search, and app-executed search falls back to the cloud proxy when no
   // BYOK key is configured. Filling a `mode` here would override BYOK
   // configs on every load.
   const managed = { mode: "managed" as const };
   return {
-    // Express platform intent that hosted assistants embed via the managed
+    // Express platform intent that hosted assistants embed via the cloud
     // Gemini backend. Fill-only (applied in-memory by
     // `fillContextDefaultsForMissingKeys`), so it expresses the default without
     // persisting it or overriding an explicit on-disk provider. The committed
@@ -156,8 +156,8 @@ export function getDeploymentContextDefaults(): Record<string, unknown> {
     // default (`gemini-embedding-2`).
     memory: { embeddings: { provider: "gemini" } },
     services: {
-      // Image-generation is provider-only for the managed axis: `cadet`
-      // generates through the platform runtime proxy (the backend derives
+      // Image-generation is provider-only for the cloud axis: `cadet`
+      // generates through the cloud runtime proxy (the backend derives
       // from the selected model's prefix at request time). Hosted assistants
       // default to it here; fill-only, so an explicit on-disk BYOK provider
       // (gemini/openai) always wins. Filling a `mode` instead would
@@ -390,7 +390,7 @@ function describeIssues(issues: ValidationIssue[]): string {
  * a `superRefine` violation until the strip unmasks it. Every rung of that
  * ladder leaves at least part of the user's saved configuration inactive, and
  * the rungs that reset a section (or the whole config) to schema defaults
- * silently revert settings the user never touched: managed service modes, model
+ * silently revert settings the user never touched: cloud service modes, model
  * choices, API keys. The on-disk file is left intact, so the user's values are
  * still present but inactive until the invalid entries are fixed.
  *
@@ -1118,13 +1118,13 @@ export function loadConfig(): AssistantConfig {
     // this run's effective values.
     const willSeed = !configFileExisted && suppressConfigDiskWritesDepth === 0;
 
-    // Layer deployment-context defaults (e.g. IS_PLATFORM=true → all service
+    // Layer deployment-context defaults (e.g. IS_CLOUD=true → all service
     // modes = "managed") onto the in-memory config for any leaves that aren't
     // explicitly set in `fileConfig`. This runs on every load — not just the
     // first — because the workspace config file is written by upstream
     // lifecycle steps (`mergeDefaultWorkspaceConfig`, `seedInferenceProfiles`)
     // before `loadConfig()` is reached. Gating on `!configFileExisted` would
-    // make the context defaults dead code on platform-managed daemons whose
+    // make the context defaults dead code on cloud-managed daemons whose
     // config.json was created by those earlier steps without service-mode
     // entries. Explicit user choices on disk are preserved because the helper
     // only fills missing keys.
@@ -1137,23 +1137,23 @@ export function loadConfig(): AssistantConfig {
       );
       // Refresh the last-known-good safety net with the effective config.
       // `validateWithSchema` captured a snapshot before these deployment-context
-      // fills (e.g. IS_PLATFORM=true → managed OAuth service modes) were layered
+      // fills (e.g. IS_CLOUD=true → cloud OAuth service modes) were layered
       // on, so its snapshot reflects pre-fill schema defaults. The fills are part
       // of this run's effective configuration, so a later recovery must restore
-      // them rather than flip a managed service mode back to its schema default.
+      // them rather than flip a cloud service mode back to its schema default.
       lastKnownGoodConfig = structuredClone(config);
     }
 
     // First-launch seed only: when config.json does not exist, write the
     // effective config to disk so users can discover and edit all available
-    // options. Deployment-context service-mode defaults (e.g. IS_PLATFORM=true →
-    // managed service modes) are included for discoverability, but the platform
+    // options. Deployment-context service-mode defaults (e.g. IS_CLOUD=true →
+    // cloud service modes) are included for discoverability, but the cloud
     // embedding-provider intent is OMITTED entirely — not even persisted as the
     // schema default "auto". `fillContextDefaultsForMissingKeys` only fills a
     // leaf absent from disk, so persisting any provider value (including "auto")
     // would be read back as an explicit user choice on the next load and
-    // permanently suppress re-applying the platform "gemini" default. Leaving
-    // the leaf absent keeps the platform intent in-memory-only yet re-applied on
+    // permanently suppress re-applying the cloud "gemini" default. Leaving
+    // the leaf absent keeps the cloud intent in-memory-only yet re-applied on
     // every load.
     //
     // When the file already exists, leave it alone — disk represents user
@@ -1412,6 +1412,22 @@ export function setNestedValue(
   current[keys[keys.length - 1]] = value;
 }
 
+/**
+ * Typed section-level write: replaces one parsed config section with the
+ * given value while leaving every other section's raw bytes untouched, so
+ * route handlers never need the raw-config API for writes. The raw base is
+ * preserved exactly like a surgical setNestedValue/saveRawConfig pair, but
+ * callers stay on the zod-inferred types.
+ */
+export function setConfigSection<K extends keyof AssistantConfig>(
+  section: K,
+  value: AssistantConfig[K],
+): void {
+  const raw = loadRawConfig();
+  raw[section] = value;
+  saveRawConfig(raw);
+}
+
 /**
  * Test-only alias for `writeQuarantineNotice`. Exists so the sentinel write
  * (and its overwrite/idempotency semantics) can be exercised directly with a

package/src/config/profile-materialization.ts

@@ -1,8 +1,8 @@
 import { getDb } from "../persistence/db-connection.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
-  getManagedUpstream,
-  MANAGED_ROUTABLE_PROVIDERS,
+  CADET_CLOUD_CONNECTION_NAME,
+  CLOUD_ROUTABLE_PROVIDERS,
+  getCloudUpstream,
 } from "../providers/cadet-model-routing.js";
 import { catalogProviderForProfile } from "../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
@@ -33,7 +33,7 @@ import {
  * - A model-only profile gets the provider the catalog implies: the base
  *   provider when it serves the model, else the model's catalog owner.
  *
- * Mix profiles (no config fields, schema-enforced) and managed profiles
+ * Mix profiles (no config fields, schema-enforced) and cloud profiles
  * (bodies owned by the code catalog) pass through untouched. Idempotent,
  * pure, and the result never aliases `dflt`'s nested objects.
  */
@@ -144,14 +144,14 @@ export function completeCustomProfile(
     profile.provider_connection === undefined &&
     dflt.provider_connection !== undefined
   ) {
-    if (dflt.provider_connection === CADET_MANAGED_CONNECTION_NAME) {
-      // Only managed-servable pairs inherit the managed binding; anything
+    if (dflt.provider_connection === CADET_CLOUD_CONNECTION_NAME) {
+      // Only managed-servable pairs inherit the cloud binding; anything
       // else inherits nothing and lets dispatch auto-resolve by vendor,
       // matching the pre-entries inheritance contract.
       if (
-        MANAGED_ROUTABLE_PROVIDERS.has(completed.provider) &&
+        CLOUD_ROUTABLE_PROVIDERS.has(completed.provider) &&
         completed.model !== undefined &&
-        getManagedUpstream(completed.model) !== null
+        getCloudUpstream(completed.model) !== null
       ) {
         completed.provider = "cadet";
       }

package/src/config/profile-text-generation.test.ts

@@ -15,7 +15,7 @@ describe("profileSupportsTextGeneration", () => {
     ).toBe(false);
   });
 
-  test("false for the managed Jev profile shape", () => {
+  test("false for the cloud Jev profile shape", () => {
     expect(
       profileSupportsTextGeneration(
         { provider: "cadet", model: "jev-latest" },

package/src/config/sanitize-for-transfer.ts

@@ -90,7 +90,7 @@ export function sanitizeConfigForTransfer(configJson: string): string {
   // config is misleading and brittle. Preserve an explicit
   // `enabled: false` opt-out, though — the schema default is `true`,
   // so unconditionally stripping this subobject would re-enable
-  // auto-attach after a platform→local teleport.
+  // auto-attach after a cloud→local teleport.
   if (config.hostBrowser && typeof config.hostBrowser === "object") {
     const hostBrowser = config.hostBrowser as Record<string, unknown>;
     if (hostBrowser.cdpInspect && typeof hostBrowser.cdpInspect === "object") {

package/src/config/schema.ts

@@ -23,6 +23,11 @@ import {
   TwilioConfigSchema,
   WhatsAppConfigSchema,
 } from "./schemas/channels.js";
+import {
+  CloudConfigSchema,
+  DaemonConfigSchema,
+  UiConfigSchema,
+} from "./schemas/cloud.js";
 import { CompactionConfigSchema } from "./schemas/compaction.js";
 import { CompactionLogsConfigSchema } from "./schemas/compaction-logs.js";
 import { ConversationsConfigSchema } from "./schemas/conversations.js";
@@ -42,11 +47,6 @@ import { MemoryConfigSchema } from "./schemas/memory.js";
 import { MigrationsConfigSchema } from "./schemas/migrations.js";
 import { MonitoringConfigSchema } from "./schemas/monitoring.js";
 import { NotificationsConfigSchema } from "./schemas/notifications.js";
-import {
-  DaemonConfigSchema,
-  PlatformConfigSchema,
-  UiConfigSchema,
-} from "./schemas/platform.js";
 import { PluginUpdatesConfigSchema } from "./schemas/plugin-updates.js";
 import { SecretDetectionConfigSchema } from "./schemas/security.js";
 import { ServicesSchema } from "./schemas/services.js";
@@ -122,7 +122,7 @@ export const AssistantConfigSchema = z.object({
   discord: DiscordConfigSchema.default(DiscordConfigSchema.parse({})),
   a2a: A2AConfigSchema.default(A2AConfigSchema.parse({})),
   ingress: IngressConfigSchema,
-  platform: PlatformConfigSchema.default(PlatformConfigSchema.parse({})),
+  cloud: CloudConfigSchema.default(CloudConfigSchema.parse({})),
   daemon: DaemonConfigSchema.default(DaemonConfigSchema.parse({})),
   notifications: NotificationsConfigSchema.default(
     NotificationsConfigSchema.parse({}),

package/src/config/schemas/__tests__/stt.test.ts

@@ -69,7 +69,7 @@ describe("SttServiceSchema", () => {
   test("language defaults to multilingual rather than staying absent", () => {
     // Every config carries a real language, so nothing downstream has to
     // infer one from an absent key. Omitting the param entirely is not a
-    // neutral state on Deepgram and the managed relay: it decodes as
+    // neutral state on Deepgram and the cloud relay: it decodes as
     // English, which is what this default exists to stop.
     const parsed = SttServiceSchema.parse({ provider: "cadet" });
     expect(parsed.language).toBe("multi");
@@ -104,7 +104,7 @@ describe("SttServiceSchema", () => {
   });
 });
 
-describe("managed provider", () => {
+describe("cloud provider", () => {
   test("accepts cadet as an ordinary provider choice", () => {
     const parsed = SttServiceSchema.parse({ provider: "cadet" });
     expect(parsed.provider).toBe("cadet");

package/src/config/schemas/call-site-catalog.ts

@@ -307,7 +307,7 @@ const CATALOG_RECORD: CatalogRecord = {
     id: "voiceEscalationJudge",
     displayName: "Voice Escalation Judge",
     description:
-      "Second opinion on the voice front door's escalate decision. Uses managed Jev when Cadet-managed inference is available, or an explicitly configured TypeSafe profile; a confident 'needs tools' verdict hands the turn to the escalated leg.",
+      "Second opinion on the voice front door's escalate decision. Uses managed Jev when Cadet Cloud inference is available, or an explicitly configured TypeSafe profile; a confident 'needs tools' verdict hands the turn to the escalated leg.",
     domain: "agentLoop",
   },
   voiceContinuationJudge: {

package/src/config/schemas/channels.ts

@@ -14,9 +14,17 @@ export const TwilioConfigSchema = z
       .boolean({ error: "twilio.setupStarted must be a boolean" })
       .default(false)
       .describe("Whether Twilio setup has ever been started"),
+    assistantPhoneNumbers: z
+      .record(z.string(), z.string())
+      .optional()
+      .describe(
+        "Per-assistant phone number assignments (assistant id to Twilio number)",
+      ),
   })
   .describe("Twilio account configuration");
 
+export type TwilioConfig = z.infer<typeof TwilioConfigSchema>;
+
 export const WhatsAppConfigSchema = z
   .object({
     phoneNumber: z

package/src/config/schemas/{platform.ts → cloud.ts}

@@ -33,21 +33,22 @@ function timezoneConfigField(path: string) {
         return z.NEVER;
       }
       return canonical;
-    });
+    })
+    .pipe(z.string());
 }
 
-export const PlatformConfigSchema = z
+export const CloudConfigSchema = z
   .object({
     baseUrl: z
-      .string({ error: "platform.baseUrl must be a string" })
+      .string({ error: "cloud.baseUrl must be a string" })
       .refine(
         (val) => val === "" || /^https?:\/\//i.test(val),
-        "platform.baseUrl must be an absolute URL starting with http:// or https://",
+        "cloud.baseUrl must be an absolute URL starting with http:// or https://",
       )
       .default("")
       .describe("Base URL of the Cadet Cloud API"),
     subdomain: z
-      .string({ error: "platform.subdomain must be a string" })
+      .string({ error: "cloud.subdomain must be a string" })
       .default("")
       .describe(
         "Registered subdomain on mycadet.bot (e.g. 'apollobot' → apollobot.mycadet.bot). Set automatically by 'assistant domain register'.",
@@ -55,7 +56,7 @@ export const PlatformConfigSchema = z
   })
   .describe("Cadet Cloud connection settings");
 
-export type PlatformConfig = z.infer<typeof PlatformConfigSchema>;
+export type CloudConfig = z.infer<typeof CloudConfigSchema>;
 
 export const DaemonConfigSchema = z
   .object({

package/src/config/schemas/host-browser.ts

@@ -61,6 +61,7 @@ const HostBrowserCdpInspectConfigSchema = z
       .string({ error: "hostBrowser.cdpInspect.host must be a string" })
       .transform((v) => v || "localhost")
       .default("localhost")
+      .pipe(z.string())
       .describe(
         "Host name or IP address where the host Chrome instance exposes its remote debugging endpoint.",
       ),

package/src/config/schemas/ingress.ts

@@ -94,14 +94,6 @@ const IngressBaseSchema = z
     rateLimit: IngressRateLimitConfigSchema.default(
       IngressRateLimitConfigSchema.parse({}),
     ),
-    shutdownDrainMs: z
-      .number({ error: "ingress.shutdownDrainMs must be a number" })
-      .int("ingress.shutdownDrainMs must be an integer")
-      .nonnegative("ingress.shutdownDrainMs must be a non-negative integer")
-      .default(5_000)
-      .describe(
-        "Time in milliseconds to drain in-flight requests during graceful shutdown",
-      ),
   })
   .describe(
     "Ingress HTTP server configuration — handles incoming webhooks, API requests, and channel events",
@@ -109,10 +101,7 @@ const IngressBaseSchema = z
 
 export const IngressConfigSchema = IngressBaseSchema.default(
   IngressBaseSchema.parse({}),
-).transform((val) => ({
-  ...val,
-  enabled: val.enabled,
-}));
+);
 
 export type IngressWebhookConfig = z.infer<typeof IngressWebhookConfigSchema>;
 export type IngressRateLimitConfig = z.infer<