@mycadet/assistant 0.12.7 → 0.12.8

package/src/oauth/oauth-store.ts

@@ -4,7 +4,7 @@
  * Backed by Drizzle + SQLite. All JSON fields (default_scopes, available_scopes,
  * extra_params, granted_scopes, metadata) are stored as serialized JSON strings.
  *
- * Note: TS field names use camelCase from the platform's naming
+ * Note: TS field names use camelCase from the cloud's naming
  * (provider, authorizeUrl, tokenExchangeUrl, displayLabel, authorizeParams),
  * while underlying SQL columns retain their original snake_case names
  * (provider_key, auth_url, token_url, display_name, extra_params).
@@ -56,7 +56,7 @@ export type OAuthConnectionRow = typeof oauthConnections.$inferSelect;
  * CONFLICT DO UPDATE so that implementation fields (authorizeUrl, tokenExchangeUrl,
  * refreshUrl, tokenEndpointAuthMethod, userinfoUrl, authorizeParams,
  * pingUrl, pingMethod, pingHeaders, pingBody, revokeUrl, revokeBodyTemplate,
- * managedServiceConfigKey,
+ * cloudServiceConfigKey,
  * loopbackPort, injectionTemplates, appType, setupNotes,
  * identityUrl, identityMethod, identityHeaders, identityBody,
  * identityResponsePaths, identityFormat, identityOkField, responseOkField, featureFlag,
@@ -87,7 +87,7 @@ export function seedProviders(
     availableScopes?: AvailableScopes;
     scopeSeparator?: string;
     authorizeParams?: Record<string, string>;
-    managedServiceConfigKey?: string;
+    cloudServiceConfigKey?: string;
     managedServiceIsPaid?: boolean;
     displayLabel?: string;
     description?: string;
@@ -150,7 +150,7 @@ export function seedProviders(
     const authorizeParams = p.authorizeParams
       ? JSON.stringify(p.authorizeParams)
       : null;
-    const managedServiceConfigKey = p.managedServiceConfigKey ?? null;
+    const cloudServiceConfigKey = p.cloudServiceConfigKey ?? null;
     const managedServiceIsPaid = p.managedServiceIsPaid === true;
     const displayLabel = p.displayLabel ?? null;
     const description = p.description ?? null;
@@ -199,7 +199,7 @@ export function seedProviders(
         pingBody,
         revokeUrl,
         revokeBodyTemplate,
-        managedServiceConfigKey,
+        cloudServiceConfigKey,
         managedServiceIsPaid,
         displayLabel,
         description,
@@ -243,7 +243,7 @@ export function seedProviders(
           pingBody,
           revokeUrl,
           revokeBodyTemplate,
-          managedServiceConfigKey,
+          cloudServiceConfigKey,
           managedServiceIsPaid,
           displayLabel,
           description,
@@ -339,7 +339,7 @@ export function registerProvider(params: {
   availableScopes?: AvailableScopes;
   scopeSeparator?: string;
   authorizeParams?: Record<string, string>;
-  managedServiceConfigKey?: string;
+  cloudServiceConfigKey?: string;
   managedServiceIsPaid?: boolean;
   displayLabel?: string;
   description?: string;
@@ -402,7 +402,7 @@ export function registerProvider(params: {
     revokeBodyTemplate: params.revokeBodyTemplate
       ? JSON.stringify(params.revokeBodyTemplate)
       : null,
-    managedServiceConfigKey: params.managedServiceConfigKey ?? null,
+    cloudServiceConfigKey: params.cloudServiceConfigKey ?? null,
     managedServiceIsPaid: params.managedServiceIsPaid === true,
     displayLabel: params.displayLabel ?? null,
     description: params.description ?? null,

package/src/oauth/provider-serializer.ts

@@ -36,7 +36,7 @@ export interface SerializedProviderSummary {
   client_id_placeholder: string | null;
   requires_client_secret: boolean;
   logo_url: string | null;
-  supports_managed_mode: boolean;
+  supports_cloud_mode: boolean;
   managed_service_is_paid: boolean;
   feature_flag: string | null;
   /**
@@ -46,7 +46,7 @@ export interface SerializedProviderSummary {
   category: IntegrationCategory | null;
   /**
    * Per-tenant providers only (Shopify): what a client must collect before
-   * starting a managed connect, since the provider's OAuth endpoints live on
+   * starting a cloud connect, since the provider's OAuth endpoints live on
    * the customer's own host. `null` for providers with one global host.
    */
   tenant_host: { pattern: string; label: string; placeholder: string } | null;
@@ -116,7 +116,7 @@ function _serializeProvider(
     logoUrl: row.logoUrl ?? null,
     clientIdPlaceholder: row.clientIdPlaceholder ?? null,
     requiresClientSecret: !!(row.requiresClientSecret ?? 1),
-    supportsManagedMode: !!row.managedServiceConfigKey,
+    supportsManagedMode: !!row.cloudServiceConfigKey,
     managedServiceIsPaid: !!row.managedServiceIsPaid,
     defaultScopes: row.defaultScopes ? JSON.parse(row.defaultScopes) : [],
     availableScopes: row.availableScopes
@@ -176,7 +176,7 @@ export function serializeProviderSummary(
     client_id_placeholder: row.clientIdPlaceholder ?? null,
     requires_client_secret: !!(row.requiresClientSecret ?? 1),
     logo_url: row.logoUrl ?? null,
-    supports_managed_mode: !!row.managedServiceConfigKey,
+    supports_cloud_mode: !!row.cloudServiceConfigKey,
     managed_service_is_paid: !!row.managedServiceIsPaid,
     feature_flag: row.featureFlag ?? null,
     category: PROVIDER_SEED_DATA[row.provider]?.category ?? null,

package/src/oauth/revoke.ts

@@ -1,7 +1,7 @@
 /**
  * Best-effort upstream OAuth token revocation.
  *
- * Mirrors the platform's `try_revoke_token` (django/app/assistant/oauth/providers/base.py).
+ * Mirrors the cloud's `try_revoke_token` (django/app/assistant/oauth/providers/base.py).
  * The HTTP shape is fixed: POST + application/x-www-form-urlencoded body, no auth headers
  * (credentials are expected to live in the body via {access_token}/{client_id} substitution),
  * 10 second timeout, all errors swallowed and logged as warnings.

package/src/oauth/seed-providers.ts

@@ -42,7 +42,7 @@ const SLACK_PROVIDER_INJECTION_TEMPLATES: NonNullable<
  * every startup. Only Cadet implementation fields (authorizeUrl, tokenExchangeUrl,
  * refreshUrl, tokenEndpointAuthMethod, userinfoUrl, authorizeParams,
  * pingUrl, pingMethod, pingHeaders, pingBody, revokeUrl, revokeBodyTemplate,
- * managedServiceConfigKey, managedServiceIsPaid,
+ * cloudServiceConfigKey, managedServiceIsPaid,
  * loopbackPort, injectionTemplates, appType, setupNotes,
  * identityUrl, identityMethod, identityHeaders, identityBody,
  * identityResponsePaths, identityFormat, identityOkField, featureFlag,
@@ -76,7 +76,7 @@ export const PROVIDER_SEED_DATA: Record<
     availableScopes?: AvailableScopes;
     scopeSeparator?: string;
     authorizeParams?: Record<string, string>;
-    managedServiceConfigKey?: string;
+    cloudServiceConfigKey?: string;
     managedServiceIsPaid?: boolean;
     displayLabel: string;
     description: string;
@@ -96,8 +96,8 @@ export const PROVIDER_SEED_DATA: Record<
     setupNotes?: string[];
     /**
      * Per-tenant providers only: the host the user supplies at connect time,
-     * which the platform substitutes into `{tenant_host}` URL placeholders.
-     * `pattern` mirrors the platform registry's validation so clients can
+     * which the cloud substitutes into `{tenant_host}` URL placeholders.
+     * `pattern` mirrors the cloud registry's validation so clients can
      * reject a malformed host before the request leaves the browser.
      */
     tenantHost?: { pattern: string; label: string; placeholder: string };
@@ -155,7 +155,7 @@ export const PROVIDER_SEED_DATA: Record<
       "https://developers.google.com/identity/protocols/oauth2/scopes",
     authorizeParams: { access_type: "offline", prompt: "consent" },
     loopbackPort: 17321,
-    managedServiceConfigKey: "google-oauth",
+    cloudServiceConfigKey: "google-oauth",
     injectionTemplates: [
       {
         hostPattern: "gmail.googleapis.com",
@@ -292,7 +292,7 @@ export const PROVIDER_SEED_DATA: Record<
     authorizeParams: { owner: "user" },
     tokenEndpointAuthMethod: "client_secret_basic",
     tokenExchangeBodyFormat: "json",
-    managedServiceConfigKey: "notion-oauth",
+    cloudServiceConfigKey: "notion-oauth",
     loopbackPort: 17323,
     injectionTemplates: [
       {
@@ -335,7 +335,7 @@ export const PROVIDER_SEED_DATA: Record<
       "https://developer.x.com/en/docs/authentication/oauth-2-0/authorization-code",
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17335,
-    managedServiceConfigKey: "twitter-oauth",
+    cloudServiceConfigKey: "twitter-oauth",
     managedServiceIsPaid: true,
     injectionTemplates: [
       {
@@ -372,7 +372,7 @@ export const PROVIDER_SEED_DATA: Record<
     defaultScopes: ["repo", "read:user", "notifications"],
     availableScopes:
       "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps",
-    managedServiceConfigKey: "github-oauth",
+    cloudServiceConfigKey: "github-oauth",
     loopbackPort: 17332,
     injectionTemplates: [
       {
@@ -421,7 +421,7 @@ export const PROVIDER_SEED_DATA: Record<
     scopeSeparator: ",",
     authorizeParams: { prompt: "consent" },
     loopbackPort: 17324,
-    managedServiceConfigKey: "linear-oauth",
+    cloudServiceConfigKey: "linear-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.linear.app",
@@ -506,7 +506,7 @@ export const PROVIDER_SEED_DATA: Record<
       { scope: "project:delete", description: "Delete entire projects" },
     ],
     loopbackPort: 17325,
-    managedServiceConfigKey: "todoist-oauth",
+    cloudServiceConfigKey: "todoist-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.todoist.com",
@@ -543,7 +543,7 @@ export const PROVIDER_SEED_DATA: Record<
     availableScopes:
       "https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes",
     loopbackPort: 17326,
-    managedServiceConfigKey: "discord-oauth",
+    cloudServiceConfigKey: "discord-oauth",
     injectionTemplates: [
       {
         hostPattern: "discord.com",
@@ -614,7 +614,7 @@ export const PROVIDER_SEED_DATA: Record<
     defaultScopes: ["default"],
     availableScopes: "https://developers.asana.com/docs/oauth-scopes",
     loopbackPort: 17328,
-    managedServiceConfigKey: "asana-oauth",
+    cloudServiceConfigKey: "asana-oauth",
     injectionTemplates: [
       {
         hostPattern: "app.asana.com",
@@ -683,7 +683,7 @@ export const PROVIDER_SEED_DATA: Record<
     availableScopes:
       "https://developers.hubspot.com/docs/guides/apps/authentication/scopes",
     loopbackPort: 17330,
-    managedServiceConfigKey: "hubspot-oauth",
+    cloudServiceConfigKey: "hubspot-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.hubapi.com",
@@ -860,7 +860,7 @@ export const PROVIDER_SEED_DATA: Record<
     // time); 17339 is the real next-free slot once all three are seeded
     // together.
     loopbackPort: 17339,
-    managedServiceConfigKey: "monday-oauth",
+    cloudServiceConfigKey: "monday-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.monday.com",
@@ -902,7 +902,7 @@ export const PROVIDER_SEED_DATA: Record<
     defaultScopes: [],
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17337,
-    managedServiceConfigKey: "eventbrite-oauth",
+    cloudServiceConfigKey: "eventbrite-oauth",
     injectionTemplates: [
       {
         hostPattern: "www.eventbriteapi.com",
@@ -1000,7 +1000,7 @@ export const PROVIDER_SEED_DATA: Record<
     // independently picked the next free port at the time); 17338 is the
     // real next-free slot once both are seeded together.
     loopbackPort: 17338,
-    managedServiceConfigKey: "calendly-oauth",
+    cloudServiceConfigKey: "calendly-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.calendly.com",
@@ -1172,7 +1172,7 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17331,
-    managedServiceConfigKey: "figma-oauth",
+    cloudServiceConfigKey: "figma-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.figma.com",
@@ -1231,7 +1231,7 @@ export const PROVIDER_SEED_DATA: Record<
     authorizeParams: { prompt: "select_account" },
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17334,
-    managedServiceConfigKey: "outlook-oauth",
+    cloudServiceConfigKey: "outlook-oauth",
     injectionTemplates: [
       {
         hostPattern: "graph.microsoft.com",
@@ -1374,13 +1374,13 @@ export const PROVIDER_SEED_DATA: Record<
     tokenEndpointAuthMethod: "client_secret_post",
     // Link's authorize request also needs a `key` param holding the Stripe
     // publishable key of the account behind the OAuth client. Cadet's own
-    // key lives in the platform registry, which is the only place it is the
-    // right answer: it pairs with the platform's client_id. Seeding it here
+    // key lives in the cloud registry, which is the only place it is the
+    // right answer: it pairs with the cloud's client_id. Seeding it here
     // would hand every self-hosted install our merchant identity to send
     // alongside their own client_id, so BYO is deliberately left without one.
     // See setupNotes.
     loopbackPort: 17340,
-    managedServiceConfigKey: "stripe-link-oauth",
+    cloudServiceConfigKey: "stripe-link-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.link.com",
@@ -1391,7 +1391,7 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     appType: "App",
     setupNotes: [
-      "Link is available in managed mode only. Its authorize endpoint requires a `key` parameter carrying the Stripe publishable key for the account that owns the OAuth client, and a bring-your-own connection has nowhere to put one: authorizeParams is re-stamped from seed data on every startup and no CLI or API surface sets it. Use managed mode, where the platform supplies both halves.",
+      "Link is available in managed mode only. Its authorize endpoint requires a `key` parameter carrying the Stripe publishable key for the account that owns the OAuth client, and a bring-your-own connection has nowhere to put one: authorizeParams is re-stamped from seed data on every startup and no CLI or API surface sets it. Use managed mode, where the cloud supplies both halves.",
     ],
     // /userinfo returns no id, so email is the only stable-ish handle; phone
     // backstops a wallet that has one but no email on file.
@@ -1581,8 +1581,8 @@ export const PROVIDER_SEED_DATA: Record<
       },
     ],
     loopbackPort: 17341,
-    managedServiceConfigKey: "shopify-oauth",
-    // Mirrors `extra_config.tenant_host` in the platform provider registry.
+    cloudServiceConfigKey: "shopify-oauth",
+    // Mirrors `extra_config.tenant_host` in the cloud provider registry.
     tenantHost: {
       pattern: "^[a-z0-9][a-z0-9-]*\\.myshopify\\.com$",
       label: "Shop domain",
@@ -1605,7 +1605,7 @@ export const PROVIDER_SEED_DATA: Record<
     // myshopify domain is the stable, human-recognisable handle.
     identityUrl: "https://{tenant_host}/admin/api/2026-07/shop.json",
     identityResponsePaths: ["shop.myshopify_domain", "shop.name"],
-    // Gated like monday/figma/stripe-link: the platform side and the
+    // Gated like monday/figma/stripe-link: the cloud side and the
     // shop-domain input in the clients land separately, and until both are
     // in place a visible Shopify tile would offer a connect flow that
     // cannot complete.
@@ -1618,21 +1618,21 @@ export const PROVIDER_SEED_DATA: Record<
     tokenExchangeUrl:
       "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
     // Access tokens live an hour; refresh tokens 100 days and are rotated on
-    // every refresh, which the platform persists. Both token endpoints
+    // every refresh, which the cloud persists. Both token endpoints
     // authenticate the client with HTTP Basic.
     refreshUrl: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
     tokenEndpointAuthMethod: "client_secret_basic",
     // No revokeUrl: Intuit's revocation endpoint wants a JSON body under HTTP
     // Basic client auth, and the daemon's revoke helper only posts an
     // unauthenticated form body, so a seeded URL would fail silently on every
-    // your-own disconnect. The platform registry revokes managed tokens itself.
+    // your-own disconnect. The cloud registry revokes managed tokens itself.
     // Every Accounting API path is scoped to the company (realm) the user
     // picked on Intuit's consent screen. The realm arrives only as the
-    // callback's `realmId` query parameter; the platform captures it into the
+    // callback's `realmId` query parameter; the cloud captures it into the
     // connection's `provider_params` and fills the `{realm_id}` placeholder
     // server-side, so managed callers send paths relative to the company
     // (`/query`, `/customer/123`). Production and sandbox keys use different
-    // hosts; the platform picks the host per environment.
+    // hosts; the cloud picks the host per environment.
     baseUrl: "https://quickbooks.api.intuit.com/v3/company/{realm_id}",
     // No pingUrl: the only company-independent probe would still need the
     // realm in its path, which the ping route cannot fill in (it sends the
@@ -1666,7 +1666,7 @@ export const PROVIDER_SEED_DATA: Record<
       { scope: "address", description: "The signing-in user's address" },
     ],
     loopbackPort: 17342,
-    managedServiceConfigKey: "quickbooks-oauth",
+    cloudServiceConfigKey: "quickbooks-oauth",
     injectionTemplates: [
       {
         hostPattern: "quickbooks.api.intuit.com",
@@ -1683,7 +1683,7 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     appType: "App",
     setupNotes: [
-      "QuickBooks scopes every Accounting API call to the company (realm) chosen on Intuit's consent screen. Managed connections carry the realm as provider_params.realm_id and requests are sent relative to /v3/company/{realmId}.",
+      "QuickBooks scopes every Accounting API call to the company (realm) chosen on Intuit's consent screen. Cloud connections carry the realm as provider_params.realm_id and requests are sent relative to /v3/company/{realmId}.",
       "Intuit development keys only authorize sandbox companies, which live on sandbox-quickbooks.api.intuit.com; production keys use quickbooks.api.intuit.com.",
       "The Accounting API returns XML unless the request carries Accept: application/json.",
     ],
@@ -1694,7 +1694,7 @@ export const PROVIDER_SEED_DATA: Record<
       "https://quickbooks.api.intuit.com/v3/company/{realm_id}/companyinfo/{realm_id}",
     identityHeaders: { Accept: "application/json" },
     identityResponsePaths: ["CompanyInfo.CompanyName", "CompanyInfo.LegalName"],
-    // Gated like figma/shopify: the platform side lands separately, and until
+    // Gated like figma/shopify: the cloud side lands separately, and until
     // the client ids are live a visible tile would offer a connect flow that
     // cannot complete.
     featureFlag: "quickbooks-oauth",

package/src/permissions/approval-provenance.ts

@@ -9,7 +9,7 @@ import type { ApprovalMode, ApprovalReason } from "./types.js";
  *   "allow"                 — auto-allowed by policy (sandbox, trust rule, or threshold)
  *   "deny"                  — user denied via interactive prompt
  *   "denied"                — system denied (no interactive client, or trust rule deny)
- *   "platform_auto_approve" — guardian bash in platform-hosted session
+ *   "platform_auto_approve" — guardian bash in cloud-hosted session
  *   "guardian_auto_approve" — non-interactive guardian session within background threshold
  */
 export function mapApprovalProvenance(

package/src/permissions/checker.test.ts

@@ -7,12 +7,11 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setAllFlagsOffForTesting } from "../__tests__/feature-flag-test-helpers.js";
+
 // ── Module mocks ─────────────────────────────────────────────────────────────
 
 // Mock feature flags to return false by default.
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => false,
-}));
 
 // `buildPolicyContext` (used by the integration tests below) precomputes the
 // retrospective skill-improvement gate. Keep the v3 tier active while the
@@ -196,6 +195,9 @@ import { RiskLevel } from "./types.js";
 
 describe("Permission Checker (gateway IPC)", () => {
   beforeEach(() => {
+    // Real flag resolution with every default-enabled flag pinned off —
+    // replaces the former blanket `() => false` module mock.
+    setAllFlagsOffForTesting();
     mockIsContainerized = false;
     mockIpcClassifyRiskResult = undefined;
     lastClassifyRiskParams = undefined;
@@ -883,7 +885,7 @@ describe("Permission Checker (gateway IPC)", () => {
     // ── Memory-retrospective skill-authoring auto-grant ─────────────────────
     // The background retrospective guardian session (sourceChannel "cadet",
     // trustClass "guardian", origin "memory_retrospective") cannot answer
-    // interactive prompts, so `scaffold_managed_skill`, `find_similar_skills`,
+    // interactive prompts, so `scaffold_cloud_skill`, `find_similar_skills`,
     // and `skill_load skill-management` resolve to allow without prompting. The
     // grant is scoped to that origin + those tools, and ONLY fires when the
     // feature is active (`procToSkillsActive: true`).
@@ -896,11 +898,11 @@ describe("Permission Checker (gateway IPC)", () => {
       procToSkillsActive: true,
     };
 
-    test("allows scaffold_managed_skill for the retrospective origin without prompting", async () => {
+    test("allows scaffold_cloud_skill for the retrospective origin without prompting", async () => {
       // High risk would normally force a prompt — the grant short-circuits
       // before classification, so no IPC result is needed.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         retrospectiveContext,
@@ -958,7 +960,7 @@ describe("Permission Checker (gateway IPC)", () => {
         scopeOptions: [],
       };
       const result = await check(
-        "delete_managed_skill",
+        "delete_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         retrospectiveContext,
@@ -975,7 +977,7 @@ describe("Permission Checker (gateway IPC)", () => {
       };
       // A normal interactive turn carries no retrospective origin signals.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         { executionContext: "conversation" },
@@ -994,7 +996,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // consolidation origin does not authorize skill authoring; only the
       // retrospective origin holds this grant.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         {
@@ -1018,7 +1020,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // Same guardian/cadet background trust, but a different origin (e.g.
       // the memory sweep job) must not inherit the retrospective grant.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         {
@@ -1040,7 +1042,7 @@ describe("Permission Checker (gateway IPC)", () => {
         scopeOptions: [],
       };
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         {
@@ -1065,7 +1067,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // inactive — `procToSkillsActive` is not true — so the grant must NOT
       // fire and the high-risk tool prompts.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         { ...retrospectiveContext, procToSkillsActive: false },
@@ -1083,7 +1085,7 @@ describe("Permission Checker (gateway IPC)", () => {
 
     /** A bare core tool — `buildPolicyContext` reads only `tool.name`/owner. */
     const scaffoldTool = {
-      name: "scaffold_managed_skill",
+      name: "scaffold_cloud_skill",
     } as unknown as Tool;
 
     /** The ToolContext a memory-retrospective pass produces. */
@@ -1116,7 +1118,7 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(policyContext.procToSkillsActive).toBe(true);
 
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         policyContext,
@@ -1148,7 +1150,7 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(policyContext.requestOrigin).toBeUndefined();
 
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         policyContext,
@@ -1176,7 +1178,7 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(policyContext.requestOrigin).toBe("memory_retrospective");
 
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         policyContext,

package/src/permissions/checker.ts

@@ -476,7 +476,7 @@ function buildClassifyRiskParams(
 
   // ── Skill tools ──
   if (
-    ["skill_load", "scaffold_managed_skill", "delete_managed_skill"].includes(
+    ["skill_load", "scaffold_cloud_skill", "delete_cloud_skill"].includes(
       toolName,
     )
   ) {
@@ -610,7 +610,7 @@ export async function classifyRisk(
 }
 
 // ── Background memory-retrospective skill-authoring auto-grant ────────────────
-// Skill scaffolding (`scaffold_managed_skill`, risk: high + allowlist-gated),
+// Skill scaffolding (`scaffold_cloud_skill`, risk: high + allowlist-gated),
 // finding similar skills (`find_similar_skills`), and loading the
 // `skill-management` skill (`skill_load skill-management`, which exposes the
 // scaffold tool) require an interactive approval. The memory-retrospective
@@ -640,7 +640,7 @@ function isRetrospectiveSkillAuthoringGrant(
   ) {
     return false;
   }
-  if (toolName === "scaffold_managed_skill") {
+  if (toolName === "scaffold_cloud_skill") {
     return true;
   }
   if (toolName === "find_similar_skills") {

package/src/persistence/compaction-log-store-clickhouse.ts

@@ -25,8 +25,8 @@
  * on first write so opting in requires no out-of-band DDL.
  */
 import type { AgentEvent } from "../agent/loop.js";
+import { resolveCloudAssistantIdOrNull } from "../config/cloud-identity.js";
 import { getConfig } from "../config/loader.js";
-import { resolvePlatformAssistantIdOrNull } from "../config/platform-identity.js";
 import type { CompactionLogsClickHouseConfig } from "../config/schemas/compaction-logs.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
@@ -164,7 +164,7 @@ export class ClickHouseCompactionLogStore {
       deps.resolvePassword ??
       (() => readCredentialOrNull("clickhouse", "password"));
     this.resolveAssistantId =
-      deps.resolveAssistantId ?? resolvePlatformAssistantIdOrNull;
+      deps.resolveAssistantId ?? resolveCloudAssistantIdOrNull;
     this.fetchImpl = deps.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
 
@@ -408,7 +408,7 @@ export class ClickHouseCompactionLogStore {
     const val = await this.resolveAssistantId();
     if (!val) {
       throw new Error(
-        "cadet:platform_assistant_id credential is required when compactionLogs.destination=clickhouse",
+        "Cadet Cloud assistant id is required when compactionLogs.destination=clickhouse",
       );
     }
     this.cachedAssistantId = val;

package/src/persistence/embeddings/embedding-backend.test.ts

@@ -31,14 +31,14 @@ function setKey(provider: string, value: string | undefined): void {
 
 const DISABLED_PROXY_CONTEXT = {
   enabled: false,
-  platformBaseUrl: "",
+  cloudBaseUrl: "",
   assistantApiKey: "",
 };
-const resolveManagedProxyContextMock = mock(async () => DISABLED_PROXY_CONTEXT);
-mock.module("../../providers/platform-proxy/context.js", () => ({
-  resolveManagedProxyContext: resolveManagedProxyContextMock,
-  hasManagedProxyPrereqs: mock(async () => false),
-  buildManagedBaseUrl: mock(async () => undefined),
+const resolveCloudProxyContextMock = mock(async () => DISABLED_PROXY_CONTEXT);
+mock.module("../../providers/cloud-proxy/context.js", () => ({
+  resolveCloudProxyContext: resolveCloudProxyContextMock,
+  hasCloudProxyPrereqs: mock(async () => false),
+  buildCloudBaseUrl: mock(async () => undefined),
   managedFallbackEnabledFor: mock(async () => false),
 }));
 
@@ -274,7 +274,7 @@ const GEMINI_CONFIG = {
 
 const ENABLED_PROXY_CONTEXT = {
   enabled: true,
-  platformBaseUrl: "https://proxy.example.com",
+  cloudBaseUrl: "https://proxy.example.com",
   assistantApiKey: "stale-platform-key",
 };
 
@@ -285,13 +285,13 @@ function jsonResponse(body: unknown, status: number): Response {
   });
 }
 
-describe("managed-proxy Gemini fallback to direct key", () => {
+describe("cloud-proxy Gemini fallback to direct key", () => {
   const originalFetch = globalThis.fetch;
   let fetchMock: ReturnType<typeof mock>;
 
   beforeEach(() => {
     clearEmbeddingBackendCache();
-    // Managed-proxy requests (proxy.example.com) are rejected like a platform
+    // Managed-proxy requests (proxy.example.com) are rejected like a cloud
     // proxy with a bad credential; direct Google API requests succeed.
     fetchMock = mock(async (url: string | URL) => {
       if (String(url).startsWith("https://proxy.example.com/")) {
@@ -306,14 +306,14 @@ describe("managed-proxy Gemini fallback to direct key", () => {
     globalThis.fetch = originalFetch;
     clearEmbeddingBackendCache();
     secureKeys.clear();
-    resolveManagedProxyContextMock.mockReset();
-    resolveManagedProxyContextMock.mockImplementation(
+    resolveCloudProxyContextMock.mockReset();
+    resolveCloudProxyContextMock.mockImplementation(
       async () => DISABLED_PROXY_CONTEXT,
     );
   });
 
-  test("falls back to the direct key when the managed-proxy primary fails", async () => {
-    resolveManagedProxyContextMock.mockImplementation(
+  test("falls back to the direct key when the cloud-proxy primary fails", async () => {
+    resolveCloudProxyContextMock.mockImplementation(
       async () => ENABLED_PROXY_CONTEXT,
     );
     setKey("gemini", "direct-key");
@@ -339,8 +339,8 @@ describe("managed-proxy Gemini fallback to direct key", () => {
     expect(directUrl).toContain("key=direct-key");
   });
 
-  test("surfaces the managed-proxy error when no direct key exists", async () => {
-    resolveManagedProxyContextMock.mockImplementation(
+  test("surfaces the cloud-proxy error when no direct key exists", async () => {
+    resolveCloudProxyContextMock.mockImplementation(
       async () => ENABLED_PROXY_CONTEXT,
     );
 
@@ -350,7 +350,7 @@ describe("managed-proxy Gemini fallback to direct key", () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
-  test("uses the direct key as primary when the managed proxy is disabled", async () => {
+  test("uses the direct key as primary when the cloud proxy is disabled", async () => {
     setKey("gemini", "direct-key");
 
     const result = await embedWithBackend(GEMINI_CONFIG, ["another input"]);