@mycadet/assistant 0.12.7 → 0.12.8

package/src/providers/{platform-proxy → cloud-proxy}/constants.ts

@@ -1,31 +1,31 @@
 /**
- * Provider metadata for managed proxy routing.
+ * Provider metadata for cloud proxy routing.
  *
  * Each managed-capable provider maps to a deterministic proxy base path
- * used when routing LLM requests through the platform's managed proxy.
+ * used when routing LLM requests through the cloud's cloud proxy.
  * Providers marked as non-managed (e.g. ollama) are excluded.
  */
 
-export interface ManagedProviderMeta {
+export interface CloudProviderMeta {
   /** Provider identifier matching the registry name. */
   name: string;
-  /** Whether this provider supports managed proxy routing. */
+  /** Whether this provider supports cloud proxy routing. */
   managed: boolean;
-  /** Proxy path segment appended to the platform base URL (only for managed providers). */
+  /** Proxy path segment appended to the cloud base URL (only for cloud providers). */
   proxyPath?: string;
 }
 
 /**
  * Explicit provider metadata for all known providers.
- * Managed providers get a deterministic proxy path; non-managed providers
+ * Cloud providers get a deterministic proxy path; non-cloud providers
  * are marked accordingly and have no proxy path.
  *
- * This table describes managed proxy routing capability only. It does not
+ * This table describes cloud proxy routing capability only. It does not
  * control which providers auto-bootstrap into the text-model registry when
- * managed credentials are present; that policy lives in the registry/context
+ * cloud credentials are present; that policy lives in the registry/context
  * fallback allowlists.
  */
-export const PLATFORM_PROVIDER_META: Record<string, ManagedProviderMeta> = {
+export const PLATFORM_PROVIDER_META: Record<string, CloudProviderMeta> = {
   openai: {
     name: "openai",
     managed: true,
@@ -54,8 +54,8 @@ export const PLATFORM_PROVIDER_META: Record<string, ManagedProviderMeta> = {
   cadet: {
     name: "cadet",
     managed: true,
-    // Wire contract with the platform's runtime proxy — the route segment
-    // is renamed in coordination with the platform deploy, not here.
+    // Wire contract with the cloud's runtime proxy — the route segment
+    // is renamed in coordination with the cloud deploy, not here.
     proxyPath: "/v1/runtime-proxy/cadet",
   },
   typesafe: {

package/src/providers/{platform-proxy → cloud-proxy}/context.ts

@@ -1,15 +1,15 @@
 /**
- * Managed proxy context resolver.
+ * Cloud proxy context resolver.
  *
  * Resolves the prerequisites for routing LLM provider requests through the
- * platform's managed proxy: the platform base URL and an assistant API key
+ * platform's cloud proxy: the cloud base URL and an assistant API key
  * stored as a secure credential.
  *
- * When both are present, providers can be initialized with a managed proxy
+ * When both are present, providers can be initialized with a cloud proxy
  * base URL instead of calling the upstream provider directly.
  */
 
-import { getPlatformBaseUrl } from "../../config/env.js";
+import { getCloudBaseUrl } from "../../config/env.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { PLATFORM_PROVIDER_META } from "./constants.js";
@@ -20,17 +20,17 @@ const ASSISTANT_API_KEY_STORAGE_KEY = credentialKey(
   "assistant_api_key",
 );
 
-export interface ManagedProxyContext {
-  /** Whether managed proxy prerequisites are satisfied. */
+export interface CloudProxyContext {
+  /** Whether cloud proxy prerequisites are satisfied. */
   enabled: boolean;
   /** Platform base URL (without trailing slash), or empty string if unavailable. */
-  platformBaseUrl: string;
-  /** Assistant API key for authenticating with the managed proxy, or empty string if unavailable. */
+  cloudBaseUrl: string;
+  /** Assistant API key for authenticating with the cloud proxy, or empty string if unavailable. */
   assistantApiKey: string;
 }
 
 /**
- * Cached result of the last `resolveManagedProxyContext()` call.
+ * Cached result of the last `resolveCloudProxyContext()` call.
  * Updated every time the context is resolved (startup, credential changes).
  * Defaults to `false` so that callers see a safe value before the first
  * async resolution completes.
@@ -38,36 +38,36 @@ export interface ManagedProxyContext {
 let _managedProxyEnabled = false;
 
 /**
- * Resolve managed proxy context from environment and secure storage.
+ * Resolve cloud proxy context from environment and secure storage.
  *
- * Returns an enabled context only when both the platform base URL and
+ * Returns an enabled context only when both the cloud base URL and
  * the assistant API key are present. Otherwise returns a disabled context.
  */
-export async function resolveManagedProxyContext(): Promise<ManagedProxyContext> {
-  const platformBaseUrl = getPlatformBaseUrl().replace(/\/+$/, "");
+export async function resolveCloudProxyContext(): Promise<CloudProxyContext> {
+  const cloudBaseUrl = getCloudBaseUrl().replace(/\/+$/, "");
   const assistantApiKey =
     (await getSecureKeyAsync(ASSISTANT_API_KEY_STORAGE_KEY)) ?? "";
-  const enabled = !!platformBaseUrl && !!assistantApiKey;
+  const enabled = !!cloudBaseUrl && !!assistantApiKey;
   _managedProxyEnabled = enabled;
 
-  return { enabled, platformBaseUrl, assistantApiKey };
+  return { enabled, cloudBaseUrl, assistantApiKey };
 }
 
 /**
- * Check whether managed proxy prerequisites are available.
+ * Check whether cloud proxy prerequisites are available.
  * Shorthand for checking that both platform URL and assistant API key exist.
  */
-export async function hasManagedProxyPrereqs(): Promise<boolean> {
-  return (await resolveManagedProxyContext()).enabled;
+export async function hasCloudProxyPrereqs(): Promise<boolean> {
+  return (await resolveCloudProxyContext()).enabled;
 }
 
 /**
- * Build the full managed proxy base URL for a given provider.
+ * Build the full cloud proxy base URL for a given provider.
  *
- * Combines the platform base URL with the provider's deterministic proxy path.
+ * Combines the cloud base URL with the provider's deterministic proxy path.
  * Returns undefined if the provider is not managed or prerequisites are missing.
  */
-export async function buildManagedBaseUrl(
+export async function buildCloudBaseUrl(
   provider: string,
 ): Promise<string | undefined> {
   const meta = PLATFORM_PROVIDER_META[provider];
@@ -75,18 +75,18 @@ export async function buildManagedBaseUrl(
     return undefined;
   }
 
-  const ctx = await resolveManagedProxyContext();
+  const ctx = await resolveCloudProxyContext();
   if (!ctx.enabled) {
     return undefined;
   }
 
-  return `${ctx.platformBaseUrl}${meta.proxyPath}`;
+  return `${ctx.cloudBaseUrl}${meta.proxyPath}`;
 }
 
 /**
- * Whether managed fallback is enabled for a given provider.
+ * Whether cloud fallback is enabled for a given provider.
  *
- * Returns true when the provider supports managed proxy routing and
+ * Returns true when the provider supports cloud proxy routing and
  * all prerequisites (platform URL + assistant API key) are satisfied.
  */
 export async function managedFallbackEnabledFor(
@@ -96,5 +96,5 @@ export async function managedFallbackEnabledFor(
   if (!meta?.managed) {
     return false;
   }
-  return await hasManagedProxyPrereqs();
+  return await hasCloudProxyPrereqs();
 }

package/src/providers/connection-resolution.ts

@@ -21,13 +21,13 @@
  *      free to treat null as "no provider available" and fall back to
  *      a graceful no-op (e.g. rollup producer skips, satellite throw
  *      with their own actionable message).
- *   4. Transient failures inside the resolver (managed-proxy context
+ *   4. Transient failures inside the resolver (cloud-proxy context
  *      lookup, credential read I/O) are caught and treated like a soft
  *      credential issue (return null). A transient blip should not take
  *      a conversation offline.
  */
 
-import { getIsPlatform } from "../config/env-registry.js";
+import { getIsCloud } from "../config/env-registry.js";
 import {
   resolveCallSiteConfig,
   selectWinningProfile,
@@ -38,11 +38,12 @@ import { credentialKey } from "../security/credential-key.js";
 import { ProviderNotConfiguredError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
-  getManagedUpstream,
-  isCadetManagedConnection,
-  MANAGED_ROUTABLE_PROVIDERS,
+  CADET_CLOUD_CONNECTION_NAME,
+  CLOUD_ROUTABLE_PROVIDERS,
+  getCloudUpstream,
+  isCadetCloudConnection,
 } from "./cadet-model-routing.js";
+import { resolveCloudProxyContext } from "./cloud-proxy/context.js";
 import {
   describeSubscriptionModelIncompatibility,
   isConnectionCompatibleWithModel,
@@ -56,7 +57,6 @@ import {
   getConnection,
   listConnections,
 } from "./inference/connections.js";
-import { resolveManagedProxyContext } from "./platform-proxy/context.js";
 import { checkCredentialPresence } from "./provider-availability.js";
 import { dispatchProviderResolvable } from "./provider-resolvability.js";
 import type { ProvidersConfig } from "./registry.js";
@@ -157,8 +157,8 @@ export function connectionProviderKind(
     if (!row) {
       return null;
     }
-    if (isCadetManagedConnection(row)) {
-      return model ? getManagedUpstream(model) : null;
+    if (isCadetCloudConnection(row)) {
+      return model ? getCloudUpstream(model) : null;
     }
     if (row.provider === "chatgpt") {
       return "openai";
@@ -195,7 +195,7 @@ export function catalogProviderForProfile(
   model: string,
 ): string | null {
   if (ROUTING_IDENTITY_PROVIDERS.has(provider)) {
-    return provider === "chatgpt" ? "openai" : getManagedUpstream(model);
+    return provider === "chatgpt" ? "openai" : getCloudUpstream(model);
   }
   return resolveEntryProviderKind(provider, model) ?? provider;
 }
@@ -262,12 +262,12 @@ export async function tryResolveProviderForConnectionName(
   // resolves on platform auth and ignores a user-owned row claiming that name
   // (boot seeding refuses to overwrite such a row, so these installs have no
   // canonical row at all). Keyed on the name rather than the declared
-  // provider: a call-site tweak pinning a concrete upstream over a managed
-  // profile keeps the managed connection while replacing the provider
+  // provider: a call-site tweak pinning a concrete upstream over a cloud
+  // profile keeps the cloud connection while replacing the provider
   // (`llm-resolver.ts`), and that route is platform-billed just the same.
   if (
-    connectionName === CADET_MANAGED_CONNECTION_NAME &&
-    !isCadetManagedConnection(connection)
+    connectionName === CADET_CLOUD_CONNECTION_NAME &&
+    !isCadetCloudConnection(connection)
   ) {
     const provider = await resolveThroughPlatform(
       config,
@@ -276,36 +276,36 @@ export async function tryResolveProviderForConnectionName(
     );
     return attachProviderRoute(provider, canonicalCadetConnection());
   }
-  // The provider-agnostic Cadet-managed connection carries only the `cadet`
+  // The provider-agnostic Cadet Cloud connection carries only the `cadet`
   // sentinel, so the usual `connection.provider === expectedProvider` equality
   // never holds. It routes by the resolving profile's declared provider
   // instead (threaded as `providerOverride` below), which must be present AND
-  // one of the managed-routable upstreams — the platform proxy can only serve
-  // those. A `cadet` connection paired with a non-managed provider
+  // one of the cloud-routable upstreams — the cloud proxy can only serve
+  // those. A `cadet` connection paired with a non-cloud provider
   // (openrouter/ollama/openai-compatible/…) is a genuine misconfiguration: it
   // falls through to the mismatch recovery/error path below rather than routing
   // as platform auth, which would otherwise fail as a soft miss and silently
   // fall back to the default provider.
-  const isCadet = isCadetManagedConnection(connection);
+  const isCadet = isCadetCloudConnection(connection);
   if (isCadet && !expectedProvider) {
     // An entry-name route carries no declared provider (the label is the
     // row's name, not a vendor); a cadet-kind row derives its upstream
     // from the model, same as the cadet identity itself.
     expectedProvider = model
-      ? (getManagedUpstream(model) ?? undefined)
+      ? (getCloudUpstream(model) ?? undefined)
       : undefined;
     if (!expectedProvider) {
       throw new ConnectionResolutionError(
         connectionName,
         "provider_mismatch",
-        `provider_connection "${connectionName}" is the provider-agnostic Cadet-managed connection but the resolving profile declared no provider — set the profile's provider so the upstream can be selected`,
+        `provider_connection "${connectionName}" is the provider-agnostic Cadet Cloud connection but the resolving profile declared no provider — set the profile's provider so the upstream can be selected`,
       );
     }
   }
   const isCadetRoute =
     isCadet &&
     !!expectedProvider &&
-    MANAGED_ROUTABLE_PROVIDERS.has(expectedProvider);
+    CLOUD_ROUTABLE_PROVIDERS.has(expectedProvider);
   // The ChatGPT-subscription row stores the "chatgpt" routing identity in
   // its provider column, so the equality never holds for its openai
   // upstream. The identity dispatches with the upstream threaded as
@@ -371,7 +371,7 @@ export async function tryResolveProviderForConnectionName(
     }
   }
   // `resolveProviderFromConnection` reaches into auth resolution (credential
-  // reads, managed-proxy context). A transient failure there is a soft
+  // reads, cloud-proxy context). A transient failure there is a soft
   // miss — log and return null so the caller can treat it the same as
   // "no usable credentials". Hard config errors are thrown above; this
   // catch is specifically for in-flight failures that should not take
@@ -416,14 +416,14 @@ function attachProviderRoute(
   if (provider) {
     provider.routeAttribution = {
       connectionName: connection.name,
-      isManagedRoute: isCadetManagedConnection(connection),
+      isCloudRoute: isCadetCloudConnection(connection),
     };
   }
   return provider;
 }
 
 /**
- * Whether a route through this connection name is Cadet-managed
+ * Whether a route through this connection name is Cadet Cloud
  * (platform-billed), for callers that hold only the name. Returns undefined
  * when the row can't be read, so the caller can fall back rather than assert
  * a BYOK route it never confirmed.
@@ -432,10 +432,10 @@ function attachProviderRoute(
  * ignored and the route resolves through platform auth regardless (see
  * `tryResolveProviderForConnectionName`).
  */
-export function isManagedConnectionRoute(
+export function isCloudConnectionRoute(
   connectionName: string,
 ): boolean | undefined {
-  if (connectionName === CADET_MANAGED_CONNECTION_NAME) {
+  if (connectionName === CADET_CLOUD_CONNECTION_NAME) {
     return true;
   }
   let connection;
@@ -444,11 +444,11 @@ export function isManagedConnectionRoute(
   } catch {
     return undefined;
   }
-  return connection ? isCadetManagedConnection(connection) : undefined;
+  return connection ? isCadetCloudConnection(connection) : undefined;
 }
 
 /**
- * Resolve a managed route through platform auth without reading a connection
+ * Resolve a cloud route through platform auth without reading a connection
  * row. Used when the canonical `cadet` row is claimed by a user-owned
  * connection, so the row boot seeding would have written does not exist.
  */
@@ -457,12 +457,12 @@ async function resolveThroughPlatform(
   upstream: string | undefined,
   model: string | undefined,
 ): Promise<Provider | null> {
-  if (!upstream || !MANAGED_ROUTABLE_PROVIDERS.has(upstream)) {
+  if (!upstream || !CLOUD_ROUTABLE_PROVIDERS.has(upstream)) {
     return null;
   }
   log.info(
     { upstream, model },
-    "Cadet-managed route resolved through platform auth: a user-owned connection claims the canonical connection name",
+    "Cadet Cloud route resolved through platform auth: a user-owned connection claims the canonical connection name",
   );
   try {
     return await resolveProviderFromConnection(
@@ -479,7 +479,7 @@ async function resolveThroughPlatform(
       /unresolved routing identity/.test(err.message)
     ) {
       throw new ConnectionResolutionError(
-        CADET_MANAGED_CONNECTION_NAME,
+        CADET_CLOUD_CONNECTION_NAME,
         "adapter_unavailable",
         err.message,
         { cause: err, model },
@@ -600,7 +600,7 @@ export async function resolveDefaultProvider(
  *
  *   - connection row missing (`not_found`)
  *   - connection bound to a different provider (`provider_mismatch`), with
- *     the provider-agnostic Cadet-managed exception for managed-routable
+ *     the provider-agnostic Cadet Cloud exception for managed-routable
  *     providers
  *   - API-key/subscription credential absent from the vault
  *     (`missing_credential`)
@@ -665,20 +665,20 @@ export async function preflightResolvedConfig(
     );
   }
   // Dispatch routes anything through the canonical name on platform auth, so
-  // preflight judges the platform rather than a claiming row's credentials.
+  // preflight judges the cloud rather than a claiming row's credentials.
   if (
-    connectionName === CADET_MANAGED_CONNECTION_NAME &&
-    !isCadetManagedConnection(connection)
+    connectionName === CADET_CLOUD_CONNECTION_NAME &&
+    !isCadetCloudConnection(connection)
   ) {
     connection = canonicalCadetConnection();
   }
 
-  if (isCadetManagedConnection(connection)) {
-    if (!MANAGED_ROUTABLE_PROVIDERS.has(provider)) {
+  if (isCadetCloudConnection(connection)) {
+    if (!CLOUD_ROUTABLE_PROVIDERS.has(provider)) {
       throw new ConnectionResolutionError(
         connectionName,
         "provider_mismatch",
-        `provider_connection "${connectionName}" is the Cadet-managed connection, which cannot serve provider "${provider}"`,
+        `provider_connection "${connectionName}" is the Cadet Cloud connection, which cannot serve provider "${provider}"`,
         errorOptions,
       );
     }
@@ -686,8 +686,8 @@ export async function preflightResolvedConfig(
     if (presence === "ok") {
       return;
     }
-    if (getIsPlatform()) {
-      // A platform-managed assistant cannot present a login screen or switch
+    if (getIsCloud()) {
+      // A cloud assistant cannot present a login screen or switch
       // providers, so the login-or-switch wording never fits. An unreachable
       // store is transient and recovers on its own, so it reads as a retry. A
       // reachable but empty store can only be fixed by re-provisioning the
@@ -776,18 +776,18 @@ export async function preflightResolvedConfig(
 
 /**
  * Platform-login state with the credential-store-outage case kept distinct:
- * `resolveManagedProxyContext` collapses an unreachable key read into
+ * `resolveCloudProxyContext` collapses an unreachable key read into
  * "no key", which must not be reported as a logout. A missing platform base
  * URL is definitively unauthenticated (it is config, not a credential read).
  */
 async function platformLoginPresence(): Promise<
   "ok" | "unauthenticated" | "indeterminate"
 > {
-  const ctx = await resolveManagedProxyContext();
+  const ctx = await resolveCloudProxyContext();
   if (ctx.enabled) {
     return "ok";
   }
-  if (!ctx.platformBaseUrl) {
+  if (!ctx.cloudBaseUrl) {
     return "unauthenticated";
   }
   const presence = await checkCredentialPresence(

package/src/providers/fallback-breaker.ts

@@ -1,5 +1,5 @@
 /**
- * Circuit breaker for managed fallback routes.
+ * Circuit breaker for cloud fallback routes.
  *
  * Once a backup profile has served a request, the primary route is known to be
  * down. Paying the full retry budget on every later request only adds latency
@@ -17,7 +17,7 @@
  * - An upstream outage (5xx, 429, transport failure, a broken managed
  *   credential) indicts the whole provider, so it is remembered under the
  *   upstream name and every model on it skips the primary.
- * - A retired or renamed model (404, `model_not_found`, the managed proxy's
+ * - A retired or renamed model (404, `model_not_found`, the cloud proxy's
  *   preflight 400) indicts one model. Remembering it provider-wide would
  *   divert healthy profiles on the same upstream to their backups for the
  *   whole cooldown, and would let a probe of some other healthy model close a

package/src/providers/fetch-provider-catalog.ts

@@ -7,7 +7,7 @@
  * `clients/web/src/assistant/generated/web-fetch-provider-catalog.gen.ts`.
  *
  * Mirrors `search-provider-catalog.ts`. Where web-search distinguishes
- * `managed` (platform proxy) from `byok` (user key), web-fetch has no managed
+ * `managed` (cloud proxy) from `byok` (user key), web-fetch has no managed
  * proxy yet, so the two kinds are:
  *
  *   - `builtin` — the daemon's own HTTP fetch + extract path (`default`). No
@@ -58,8 +58,8 @@ export interface FetchProviderCatalogEntry {
 export const FETCH_PROVIDER_CATALOG: readonly FetchProviderCatalogEntry[] = [
   {
     id: "default",
-    // Display-only: fetching runs in the daemon, not through the platform
-    // proxy. The id stays `default` until a managed fetch route exists.
+    // Display-only: fetching runs in the daemon, not through the cloud
+    // proxy. The id stays `default` until a cloud fetch route exists.
     displayName: "Cadet",
     displayNameLong: "Cadet built-in fetcher",
     kind: "builtin",

package/src/providers/gemini/client.ts

@@ -309,7 +309,7 @@ export function deriveGeminiReason(error: ApiError): ProviderErrorReason {
     return "network_error";
   }
 
-  // The managed proxy's daily-limit 402 body carries a specific code; match it
+  // The cloud proxy's daily-limit 402 body carries a specific code; match it
   // before the status branches so it isn't classified as a generic 4xx.
   if (FREE_TIER_DAILY_LIMIT_PATTERNS.some((re) => re.test(message))) {
     return "free_tier_daily_limit_reached";
@@ -403,8 +403,8 @@ export async function validateGeminiApiKey(
 
 export interface GeminiProviderOptions {
   streamTimeoutMs?: number;
-  /** When set, routes requests through the managed proxy at this base URL. */
-  managedBaseUrl?: string;
+  /** When set, routes requests through the cloud proxy at this base URL. */
+  cloudBaseUrl?: string;
 }
 
 export class GeminiProvider implements Provider {
@@ -418,11 +418,11 @@ export class GeminiProvider implements Provider {
     model: string,
     options: GeminiProviderOptions = {},
   ) {
-    this.client = options.managedBaseUrl
+    this.client = options.cloudBaseUrl
       ? new GoogleGenAI({
           apiKey,
           httpOptions: {
-            baseUrl: options.managedBaseUrl,
+            baseUrl: options.cloudBaseUrl,
           },
         })
       : new GoogleGenAI({ apiKey });

package/src/providers/inference/__tests__/adapter-factory-openai-compatible.test.ts

@@ -61,7 +61,7 @@ function retryOptions(adapter: unknown): RetryOptions {
 }
 
 describe("adapter factory", () => {
-  // Hermetic credential store: without this, the managed-proxy tests read
+  // Hermetic credential store: without this, the cloud-proxy tests read
   // whatever ambient backend the host has, and a stray assistant API key
   // flips the refresh-declines expectations.
   setSecureKeyBackendForTesting(memorySecureKeyBackend({}));
@@ -260,7 +260,7 @@ describe("adapter factory", () => {
     });
   });
 
-  test("wires managed connections to reload rotated assistant credentials", () => {
+  test("wires cloud connections to reload rotated assistant credentials", () => {
     const connection: ProviderConnection = {
       name: "cadet",
       provider: "cadet",
@@ -286,7 +286,7 @@ describe("adapter factory", () => {
     expect(adapter).not.toBeNull();
     const options = retryOptions(adapter);
     expect(options).toMatchObject({
-      credentialSource: "cadet-managed",
+      credentialSource: "cadet-cloud",
       connectionName: "cadet",
     });
     expect(typeof options.refreshCredentialProvider).toBe("function");

package/src/providers/inference/__tests__/base-url-route-validation.test.ts

@@ -43,7 +43,7 @@ mock.module("../../../config/assistant-feature-flags.js", () => ({
 // Mock platform detection: tests default to platform mode (SSRF enforced).
 // Individual tests can override via `mockIsPlatform = false`. Spread the real
 // module so the config loader's transitive `util/platform` imports still
-// resolve — only `getIsPlatform` is overridden.
+// resolve — only `getIsCloud` is overridden.
 let mockIsPlatform = true;
 
 const realEnvRegistry = {
@@ -51,7 +51,7 @@ const realEnvRegistry = {
 };
 mock.module("../../../config/env-registry.js", () => ({
   ...realEnvRegistry,
-  getIsPlatform: () => mockIsPlatform,
+  getIsCloud: () => mockIsPlatform,
 }));
 
 // Mock DNS resolution: all hostnames resolve to a public IP by default.
@@ -372,13 +372,13 @@ describe("base_url SSRF bypass for self-hosted daemons (create)", () => {
     mockIsPlatform = false;
   });
 
-  test("allows localhost when not platform-hosted", async () => {
+  test("allows localhost when not cloud-hosted", async () => {
     /**
      * Self-hosted users run LM Studio / vLLM / text-generation-webui on
      * their own machine. localhost is the expected target.
      */
 
-    // GIVEN a self-hosted daemon (IS_PLATFORM=false)
+    // GIVEN a self-hosted daemon (IS_CLOUD=false)
     // WHEN creating a connection with a localhost base_url
     const result = await handleCreate({
       body: {
@@ -397,12 +397,12 @@ describe("base_url SSRF bypass for self-hosted daemons (create)", () => {
     );
   });
 
-  test("allows private IP (192.168.x.x) when not platform-hosted", async () => {
+  test("allows private IP (192.168.x.x) when not cloud-hosted", async () => {
     /**
      * Self-hosted users may run model servers on LAN machines.
      */
 
-    // GIVEN a self-hosted daemon (IS_PLATFORM=false)
+    // GIVEN a self-hosted daemon (IS_CLOUD=false)
     // WHEN creating a connection with a private IP base_url
     const result = await handleCreate({
       body: {
@@ -421,12 +421,12 @@ describe("base_url SSRF bypass for self-hosted daemons (create)", () => {
     );
   });
 
-  test("allows 127.0.0.1 when not platform-hosted", async () => {
+  test("allows 127.0.0.1 when not cloud-hosted", async () => {
     /**
      * Loopback address variant of localhost.
      */
 
-    // GIVEN a self-hosted daemon (IS_PLATFORM=false)
+    // GIVEN a self-hosted daemon (IS_CLOUD=false)
     // WHEN creating a connection with a 127.0.0.1 base_url
     const result = await handleCreate({
       body: {

package/src/providers/inference/__tests__/base-url-security.test.ts

@@ -115,10 +115,10 @@ describe("resolveAuth defense-in-depth", () => {
   // exact credential name the tests pass to resolveAuth.
   useMemorySecureKeys({ "cred-test": "sk-test-key" });
 
-  // Mock the platform proxy context to avoid real platform calls.
-  mock.module("../../platform-proxy/context.js", () => ({
-    buildManagedBaseUrl: async () => null,
-    resolveManagedProxyContext: async () => ({
+  // Mock the cloud proxy context to avoid real platform calls.
+  mock.module("../../cloud-proxy/context.js", () => ({
+    buildCloudBaseUrl: async () => null,
+    resolveCloudProxyContext: async () => ({
       assistantApiKey: "platform-key",
     }),
   }));