@mycadet/assistant 0.12.7 → 0.12.8

package/src/runtime/routes/__tests__/default-plugin-routes.test.ts

@@ -2,12 +2,12 @@
  * Default-plugin route resolution: a first-party default plugin's routes are
  * served in the `/x/plugins/<name>/` namespace from the app source tree
  * (`plugins/defaults/<dir>/routes/`), where `<name>` is `default-<dir>` (e.g.
- * `default-platform-hosted`) — the same `default-…` name its `.disabled`
+ * `default-cloud-hosted`) — the same `default-…` name its `.disabled`
  * sentinel is keyed by — not its bare directory name. An installed workspace
  * plugin of the same name overrides the default.
  *
- * These tests exercise the real `platform-hosted` default plugin (namespace
- * `default-platform-hosted`), which ships `routes/reengage.ts`, a POST-only
+ * These tests exercise the real `cloud-hosted` default plugin (namespace
+ * `default-cloud-hosted`), which ships `routes/reengage.ts`, a POST-only
  * handler. A GET reaches the resolved source file and 405s — proving
  * resolution + source-tree module load without running the handler's heavy
  * background-turn logic.
@@ -37,7 +37,7 @@ import {
 } from "../user-route-resolution.js";
 
 /** The default plugin's source directory name. */
-const DEFAULT_PLUGIN_DIR = "platform-hosted";
+const DEFAULT_PLUGIN_DIR = "cloud-hosted";
 /** Its route namespace = `default-<dir>` by convention. */
 const DEFAULT_PLUGIN = `default-${DEFAULT_PLUGIN_DIR}`;
 
@@ -86,7 +86,7 @@ describe("default plugin route source resolution", () => {
     expect(getDefaultPluginRoutesDir("default-../util")).toBeNull();
   });
 
-  test("getDefaultPluginRouteRoots includes the platform-hosted plugin under its manifest name", () => {
+  test("getDefaultPluginRouteRoots includes the cloud-hosted plugin under its manifest name", () => {
     const roots = getDefaultPluginRouteRoots();
     const entry = roots.find((r) => r.pluginName === DEFAULT_PLUGIN);
     expect(entry).toBeDefined();

package/src/runtime/routes/__tests__/default-provider-routes.test.ts

@@ -13,10 +13,10 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 let managedProxyEnabled = false;
 let managedProxyBaseUrl = "https://platform.example";
-mock.module("../../../providers/platform-proxy/context.js", () => ({
-  resolveManagedProxyContext: async () => ({
+mock.module("../../../providers/cloud-proxy/context.js", () => ({
+  resolveCloudProxyContext: async () => ({
     enabled: managedProxyEnabled,
-    platformBaseUrl: managedProxyBaseUrl,
+    cloudBaseUrl: managedProxyBaseUrl,
     assistantApiKey: managedProxyEnabled ? "key" : "",
   }),
 }));
@@ -147,7 +147,7 @@ describe("GET config/llm/default-provider", () => {
     managedProxyBaseUrl = "";
     const result = await get();
     expect(availability(result).status).toBe("cadet_unauthenticated");
-    expect(availability(result).message).toContain("platform URL");
+    expect(availability(result).message).toContain("cloud URL");
   });
 
   test("cadet default with no canonical row → missing_connection", async () => {
@@ -157,7 +157,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).status).toBe("missing_connection");
   });
 
-  test("user-owned connection claiming the cadet name → the platform's own status", async () => {
+  test("user-owned connection claiming the cadet name → the cloud's own status", async () => {
     // seedCanonicalConnections skips reseeding when a user row claims the
     // name. Dispatch ignores that row and routes through cloud auth, so a
     // signed-in platform is genuinely usable and reads as ok.
@@ -174,7 +174,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).status).toBe("ok");
   });
 
-  test("cloud-auth connection for a non-managed provider → unsupported_auth even when signed in", async () => {
+  test("cloud-auth connection for a non-cloud provider → unsupported_auth even when signed in", async () => {
     seedConnection({
       name: "openrouter-personal",
       provider: "openrouter",
@@ -323,7 +323,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).message).toContain('"openai"');
   });
 
-  test("cadet-managed connection pinned for a managed-routable provider follows cloud auth", async () => {
+  test("cadet-cloud connection pinned for a cloud-routable provider follows cloud auth", async () => {
     seedConnection({
       name: "cadet",
       provider: "cadet",
@@ -338,7 +338,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(await get()).status).toBe("ok");
   });
 
-  test("cadet-managed connection pinned for a non-managed provider → provider_mismatch", async () => {
+  test("cadet-cloud connection pinned for a non-cloud provider → provider_mismatch", async () => {
     seedConnection({
       name: "cadet",
       provider: "cadet",
@@ -351,7 +351,7 @@ describe("GET config/llm/default-provider", () => {
 
     const result = await get();
     expect(availability(result).status).toBe("provider_mismatch");
-    expect(availability(result).message).toContain("Cadet-managed");
+    expect(availability(result).message).toContain("Cadet Cloud");
   });
 
   test("service_account connection with invalid credential → missing_credential", async () => {
@@ -368,7 +368,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).message).toContain("service-account");
   });
 
-  test("platform-auth connection follows managed-proxy state", async () => {
+  test("cloud-auth connection follows cloud-proxy state", async () => {
     seedConnection({
       name: "anthropic-personal",
       provider: "anthropic",

package/src/runtime/routes/__tests__/inference-profiles-routes.test.ts

@@ -6,7 +6,7 @@
  *   - bad provider (not in the LLMProvider enum)
  *   - uncataloged model without --allow-unlisted
  *   - missing provider connection
- *   - managed-profile create / update / delete rejection
+ *   - cloud-profile create / update / delete rejection
  *   - the dispatch-availability guard on create / update / set-active
  *
  * Routing-identity creates exercise the happy-path write end-to-end (through
@@ -32,13 +32,13 @@ mock.module("../../../persistence/embeddings/embedding-backend.js", () => ({
   clearEmbeddingBackendCache: () => {},
 }));
 
-// The availability guard judges the Cadet-managed route and the credential
+// The availability guard judges the Cadet Cloud route and the credential
 // store for real; both are stood in for here so tests can pick a state.
 let managedProxyEnabled = true;
-mock.module("../../../providers/platform-proxy/context.js", () => ({
-  resolveManagedProxyContext: async () => ({
+mock.module("../../../providers/cloud-proxy/context.js", () => ({
+  resolveCloudProxyContext: async () => ({
     enabled: managedProxyEnabled,
-    platformBaseUrl: "https://platform.example",
+    cloudBaseUrl: "https://platform.example",
     assistantApiKey: managedProxyEnabled ? "key" : "",
   }),
 }));
@@ -124,7 +124,7 @@ function seedKeyedConnection(provider: string): void {
   });
 }
 
-/** The Cadet-managed row every routing-identity profile resolves to. */
+/** The Cadet Cloud row every routing-identity profile resolves to. */
 function seedCadetConnection(): void {
   seedConnection("cadet", "cadet", { type: "platform" });
 }
@@ -205,7 +205,7 @@ describe("POST inference/profiles (create) validation", () => {
     ).rejects.toBeInstanceOf(BadRequestError);
   });
 
-  test("creates a cadet profile for a managed-routable model", async () => {
+  test("creates a cadet profile for a cloud-routable model", async () => {
     seedCadetConnection();
     const result = (await call("inference_profiles_create", {
       body: {
@@ -238,7 +238,7 @@ describe("POST inference/profiles (create) validation", () => {
     ).rejects.toThrow(/maxTokens/);
   });
 
-  test("rejects a cadet profile whose model has no managed upstream", async () => {
+  test("rejects a cadet profile whose model has no cloud upstream", async () => {
     await expect(
       call("inference_profiles_create", {
         body: {
@@ -248,7 +248,7 @@ describe("POST inference/profiles (create) validation", () => {
         },
       }),
     ).rejects.toThrow(
-      /"not-a-real-model" is not served by the Cadet managed route/,
+      /"not-a-real-model" is not served by the Cadet Cloud route/,
     );
   });
 
@@ -367,7 +367,7 @@ describe("POST inference/profiles (create) validation", () => {
     ).rejects.toThrow(/does not exist/);
   });
 
-  test("rejects creating a managed default name", async () => {
+  test("rejects creating a cloud default name", async () => {
     await expect(
       call("inference_profiles_create", {
         body: {
@@ -389,7 +389,7 @@ describe("inference-profile writes are availability-aware", () => {
     model: "gemini-3.6-flash",
   };
 
-  test("rejects a BYO provider with no connection and names the managed alternative", async () => {
+  test("rejects a BYO provider with no connection and names the cloud alternative", async () => {
     const promise = call("inference_profiles_create", { body: geminiBody });
     await expect(promise).rejects.toBeInstanceOf(BadRequestError);
     await expect(promise).rejects.toThrow(
@@ -402,7 +402,7 @@ describe("inference-profile writes are availability-aware", () => {
     expect(persistedProfiles()).toEqual({});
   });
 
-  test("falls back to the credential sequence when the managed route is unusable", async () => {
+  test("falls back to the credential sequence when the cloud route is unusable", async () => {
     managedProxyEnabled = false;
     secureKeyResults.clear();
     const promise = call("inference_profiles_create", { body: geminiBody });
@@ -552,7 +552,7 @@ describe("inference-profile writes are availability-aware", () => {
 // ── update validation ─────────────────────────────────────────────────────────
 
 describe("PATCH inference/profiles/:name (update) validation", () => {
-  test("rejects editing a managed default profile", async () => {
+  test("rejects editing a cloud default profile", async () => {
     setConfig("llm", {
       profiles: {
         balanced: {
@@ -567,7 +567,7 @@ describe("PATCH inference/profiles/:name (update) validation", () => {
         pathParams: { name: "balanced" },
         body: { effort: "low" },
       }),
-    ).rejects.toThrow(/managed profile/);
+    ).rejects.toThrow(/cloud profile/);
   });
 
   test("404s an unknown profile", async () => {
@@ -583,11 +583,11 @@ describe("PATCH inference/profiles/:name (update) validation", () => {
 // ── delete protection ───────────────────────────────────────────────────────
 
 describe("DELETE inference/profiles/:name protection", () => {
-  test("rejects deleting a managed default profile", async () => {
+  test("rejects deleting a cloud default profile", async () => {
     setConfig("llm", { profiles: { balanced: { source: "managed" } } });
     await expect(
       call("inference_profiles_delete", { pathParams: { name: "balanced" } }),
-    ).rejects.toThrow(/managed profile/);
+    ).rejects.toThrow(/cloud profile/);
   });
 
   test("404s an unknown profile", async () => {
@@ -796,7 +796,7 @@ describe("GET inference/profiles honors the llm.default blob", () => {
 // ── active-profile setter validation (Finding 3) ──────────────────────────────
 
 describe("POST inference/profiles/:name/validate billing guards", () => {
-  test("gives no verdict for a mix whose winning arm rides the managed route", async () => {
+  test("gives no verdict for a mix whose winning arm rides the cloud route", async () => {
     seedCadetConnection();
     setConfig("llm", {
       profiles: {
@@ -815,7 +815,7 @@ describe("POST inference/profiles/:name/validate billing guards", () => {
     expect(result.check).toBeNull();
   });
 
-  test("gives no verdict when a call-site override routes the probe onto the managed identity", async () => {
+  test("gives no verdict when a call-site override routes the probe onto the cloud identity", async () => {
     seedCadetConnection();
     setConfig("llm", {
       profiles: {

package/src/runtime/routes/__tests__/inference-provider-connection-routes.test.ts

@@ -228,7 +228,7 @@ describe("POST inference/provider-connections (create)", () => {
     ).catch((e: unknown) => e);
 
     expect(err).toBeInstanceOf(BadRequestError);
-    expect((err as BadRequestError).message).toContain("platform");
+    expect((err as BadRequestError).message).toContain("Cadet Cloud");
     expect((err as BadRequestError).message).toContain("cadet");
   });
 
@@ -679,7 +679,7 @@ describe("POST inference/provider-connections (create)", () => {
     });
   });
 
-  test("throws 400 on the reserved managed connection name", async () => {
+  test("throws 400 on the reserved cloud connection name", async () => {
     await expect(
       call(findHandler("inference_provider_connections_create"), {
         body: {
@@ -820,7 +820,7 @@ describe("PATCH inference/provider-connections/:name (update)", () => {
     ).catch((e: unknown) => e);
 
     expect(err).toBeInstanceOf(BadRequestError);
-    expect((err as BadRequestError).message).toContain("platform");
+    expect((err as BadRequestError).message).toContain("Cadet Cloud");
   });
 
   // A persisted row whose provider and auth disagree stays editable: both the
@@ -1400,7 +1400,7 @@ describe("PATCH with label", () => {
 
 // ── Managed-connection write protection ──────────────────────────────────────
 
-describe("Managed connection write protection", () => {
+describe("Cloud connection write protection", () => {
   const MANAGED_NAMES = ["cadet"] as const;
 
   describe("DELETE", () => {
@@ -1419,13 +1419,13 @@ describe("Managed connection write protection", () => {
 
         expect(err).toBeInstanceOf(BadRequestError);
         expect((err as BadRequestError).message).toContain(name);
-        expect((err as BadRequestError).message).toContain("managed");
+        expect((err as BadRequestError).message).toContain("Cadet Cloud");
       });
     }
 
     test("managed protection short-circuits before reference checks", async () => {
-      // Even though a profile references the managed connection, the error
-      // should be the managed-protection 400, not the references-409.
+      // Even though a profile references the cloud connection, the error
+      // should be the cloud-protection 400, not the references-409.
       seedConnection({
         name: "cadet",
         provider: "cadet",
@@ -1443,10 +1443,10 @@ describe("Managed connection write protection", () => {
       ).catch((e: unknown) => e);
 
       expect(err).toBeInstanceOf(BadRequestError);
-      expect((err as BadRequestError).message).toContain("managed");
+      expect((err as BadRequestError).message).toContain("Cadet Cloud");
     });
 
-    test("a user-owned row claiming the managed name stays deletable", async () => {
+    test("a user-owned row claiming the cloud name stays deletable", async () => {
       // Boot seeding refuses to overwrite it and managed routing ignores it,
       // so deleting is the only way to restore the canonical row. The cadet
       // default resolves to this same name, and that guard must not block the
@@ -1489,7 +1489,9 @@ describe("Managed connection write protection", () => {
 
         expect(err).toBeInstanceOf(BadRequestError);
         expect((err as BadRequestError).message).toContain(name);
-        expect((err as BadRequestError).message).toContain("platform");
+        expect((err as BadRequestError).message).toContain(
+          "cloud-authenticated",
+        );
       });
 
       test(`rejects auth change on ${name} from platform to none with 400`, async () => {
@@ -1525,16 +1527,16 @@ describe("Managed connection write protection", () => {
           pathParams: { name: "cadet" },
           body: {
             auth: { type: "platform" },
-            label: "Cadet-managed Anthropic",
+            label: "Cadet Cloud Anthropic",
           },
         },
       )) as { label: string | null };
-      expect(result.label).toBe("Cadet-managed Anthropic");
+      expect(result.label).toBe("Cadet Cloud Anthropic");
     });
   });
 
   describe("PATCH label (allowed)", () => {
-    test("allows relabeling a managed connection", async () => {
+    test("allows relabeling a cloud connection", async () => {
       seedConnection({
         name: "cadet",
         provider: "cadet",
@@ -1634,7 +1636,7 @@ describe("isManaged flag on connection responses", () => {
   });
 
   describe("GET single", () => {
-    test("returns isManaged: true for a managed name", async () => {
+    test("returns isManaged: true for a cloud name", async () => {
       seedConnection({
         name: "cadet",
         provider: "cadet",
@@ -1649,7 +1651,7 @@ describe("isManaged flag on connection responses", () => {
       expect(result.isManaged).toBe(true);
     });
 
-    test("returns isManaged: false for a user-owned row claiming a managed name", async () => {
+    test("returns isManaged: false for a user-owned row claiming a cloud name", async () => {
       // Clients gate edit and delete on this flag, so a claiming row must
       // report as the ordinary connection it is or the collision cannot be
       // cleared from the UI.
@@ -1701,7 +1703,7 @@ describe("isManaged flag on connection responses", () => {
   });
 
   describe("PATCH update", () => {
-    test("returns isManaged: true after relabeling a managed connection", async () => {
+    test("returns isManaged: true after relabeling a cloud connection", async () => {
       seedConnection({
         name: "cadet",
         provider: "cadet",

package/src/runtime/routes/__tests__/inference-send-routes.test.ts

@@ -248,7 +248,7 @@ describe("inference_send profile usability", () => {
     );
   }
 
-  test("rejects a disabled profile instead of running the managed default", async () => {
+  test("rejects a disabled profile instead of running the cloud default", async () => {
     const err = await rejection({ ...hermes, status: "disabled" });
     expect(err).toBeInstanceOf(BadRequestError);
     expect(err.message).toContain("disabled");

package/src/runtime/routes/__tests__/ingress-status-routes.test.ts

@@ -83,7 +83,7 @@ describe("integrations_ingress_status route", () => {
     });
   });
 
-  test("reports unconfigured for a platform-hosted assistant", async () => {
+  test("reports unconfigured for a cloud-hosted assistant", async () => {
     ingressConfig = {
       ...ingressConfig,
       publicBaseUrl: "https://platform.example.com/gateway/callbacks/a-1",

package/src/runtime/routes/__tests__/migration-cadet-metadata-reconcile.test.ts

@@ -2,15 +2,12 @@
  * Tests for the post-import cadet metadata reconciliation helper.
  *
  * After every bundle import, `reconcileCadetMetadataFromCes` walks the
- * platform-identity fields the gateway requires and, for each one that
+ * cadet credentials the gateway requires and, for each one that
  * CES already holds a value for, ensures `metadata.json` lists a
  * matching entry. This closes the race where a provisioning write to
  * CES completes successfully but its metadata upsert gets clobbered by
  * the import's in-place clear or atomic swap. The reconciled set covers
- * both the Django-provisioned fields (assistant_api_key,
- * platform_assistant_id, platform_base_url, webhook_secret) and the
- * client-injected identity fields (platform_organization_id,
- * platform_user_id).
+ * the Django-provisioned credentials (assistant_api_key, webhook_secret).
  *
  * We test the reconcile logic in isolation by mocking the secure-keys
  * and metadata-store modules — the real migration handler wires the
@@ -40,14 +37,7 @@ type MetadataRecord = {
   updatedAt: number;
 };
 
-const CADET_FIELDS = [
-  "platform_base_url",
-  "assistant_api_key",
-  "platform_assistant_id",
-  "platform_organization_id",
-  "platform_user_id",
-  "webhook_secret",
-] as const;
+const CADET_FIELDS = ["assistant_api_key", "webhook_secret"] as const;
 
 const upsertCalls: Array<{ service: string; field: string }> = [];
 let metadataStore: Map<string, MetadataRecord> = new Map();
@@ -143,7 +133,7 @@ describe("reconcileCadetMetadataFromCes", () => {
   test("CES holds all, metadata has 2 → only the missing ones upserted", async () => {
     seedAllInCes();
     // Pre-populate metadata for 2 of the fields.
-    const prepopulated = ["platform_base_url", "assistant_api_key"] as const;
+    const prepopulated = ["assistant_api_key", "webhook_secret"] as const;
     for (const field of prepopulated) {
       metadataStore.set(`cadet:${field}`, {
         credentialId: `id-cadet:${field}`,
@@ -174,14 +164,9 @@ describe("reconcileCadetMetadataFromCes", () => {
     await reconcileCadetMetadataFromCes(sink);
 
     const reconciled = new Set(upsertCalls.map((c) => c.field));
-    // Django-provisioned quartet.
-    expect(reconciled).toContain("platform_base_url");
+    // Django-provisioned trio.
     expect(reconciled).toContain("assistant_api_key");
-    expect(reconciled).toContain("platform_assistant_id");
     expect(reconciled).toContain("webhook_secret");
-    // Client-injected identity fields (onboarding / teleport / transfer).
-    expect(reconciled).toContain("platform_organization_id");
-    expect(reconciled).toContain("platform_user_id");
   });
 
   test("CES empty → nothing upserted", async () => {

package/src/runtime/routes/__tests__/migration-import-credential-filter.test.ts

@@ -2,7 +2,7 @@
  * Tests for platform credential filtering during bundle import.
  *
  * `migration-routes.ts` pushes every bundle credential through a filter that
- * must exclude platform-identity (`cadet:*`) entries so they can't overwrite
+ * must exclude cloud-identity (`cadet:*`) entries so they can't overwrite
  * the target's own Django-provisioned identity. The filter runs against the
  * raw CES account format — `credential/{service}/{field}` — produced by
  * `credentialKey()`, which is what `listSecureKeysAsync()` returns and what
@@ -20,7 +20,7 @@
  *   key format are excluded.
  * - User credentials (any other prefix) pass through unchanged.
  * - Mixed bundles correctly split platform vs user credentials.
- * - skippedPlatform count matches the number of excluded entries.
+ * - skippedCloud count matches the number of excluded entries.
  * - Regression: the prefix constant matches `credentialKey("cadet", "")`.
  */
 
@@ -98,8 +98,8 @@ function filterCredentials(
   const userCredentials = bundleCredentials.filter(
     (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
   );
-  const skippedPlatform = bundleCredentials.length - userCredentials.length;
-  return { userCredentials, skippedPlatform };
+  const skippedCloud = bundleCredentials.length - userCredentials.length;
+  return { userCredentials, skippedCloud };
 }
 
 // ---------------------------------------------------------------------------
@@ -110,10 +110,7 @@ describe("migration import credential filtering", () => {
   test("platform (cadet:*) credentials are excluded", () => {
     const cadetFields = [
       "assistant_api_key",
-      "platform_assistant_id",
-      "platform_base_url",
-      "platform_organization_id",
-      "platform_user_id",
+      "cloud_assistant_id",
       "webhook_secret",
     ] as const;
     const cadetPaths = cadetFields.map((f) =>
@@ -128,11 +125,11 @@ describe("migration import credential filtering", () => {
     const manifest = makeManifest(cadetPaths);
 
     const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedPlatform } =
+    const { userCredentials, skippedCloud } =
       filterCredentials(bundleCredentials);
 
     expect(userCredentials).toHaveLength(0);
-    expect(skippedPlatform).toBe(cadetFields.length);
+    expect(skippedCloud).toBe(cadetFields.length);
   });
 
   test("user credentials pass through unchanged", () => {
@@ -149,7 +146,7 @@ describe("migration import credential filtering", () => {
     ]);
 
     const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedPlatform } =
+    const { userCredentials, skippedCloud } =
       filterCredentials(bundleCredentials);
 
     expect(userCredentials).toHaveLength(2);
@@ -161,12 +158,12 @@ describe("migration import credential filtering", () => {
       account: anthropicAccount,
       value: "sk-ant-456",
     });
-    expect(skippedPlatform).toBe(0);
+    expect(skippedCloud).toBe(0);
   });
 
   test("mixed bundle with both platform and user credentials correctly splits", () => {
     const cadetApiKey = credentialKey("cadet", "assistant_api_key");
-    const cadetUserId = credentialKey("cadet", "platform_user_id");
+    const cadetUserId = credentialKey("cadet", "cloud_assistant_id");
     const openaiKey = credentialKey("openai", "api_key");
     const anthropicKey = credentialKey("anthropic", "api_key");
     const githubToken = credentialKey("github", "api_token");
@@ -187,7 +184,7 @@ describe("migration import credential filtering", () => {
     ]);
 
     const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedPlatform } =
+    const { userCredentials, skippedCloud } =
       filterCredentials(bundleCredentials);
 
     // Only user credentials should pass through.
@@ -201,33 +198,33 @@ describe("migration import credential filtering", () => {
     );
     expect(cadetCreds).toHaveLength(0);
 
-    expect(skippedPlatform).toBe(2);
+    expect(skippedCloud).toBe(2);
   });
 
-  test("skippedPlatform count is accurate with mixed credentials", () => {
+  test("skippedCloud count is accurate with mixed credentials", () => {
     const cadetApiKey = credentialKey("cadet", "assistant_api_key");
-    const cadetBaseUrl = credentialKey("cadet", "platform_base_url");
+    const cadetAssistantId = credentialKey("cadet", "cloud_assistant_id");
     const cadetWebhook = credentialKey("cadet", "webhook_secret");
     const userKey = credentialKey("github", "api_token");
 
     const entries = new Map<string, VBundleTarEntry>();
     entries.set(bundlePathFor(cadetApiKey), makeTarEntry("v1"));
-    entries.set(bundlePathFor(cadetBaseUrl), makeTarEntry("v2"));
+    entries.set(bundlePathFor(cadetAssistantId), makeTarEntry("v2"));
     entries.set(bundlePathFor(cadetWebhook), makeTarEntry("v3"));
     entries.set(bundlePathFor(userKey), makeTarEntry("user-val"));
 
     const manifest = makeManifest([
       bundlePathFor(cadetApiKey),
-      bundlePathFor(cadetBaseUrl),
+      bundlePathFor(cadetAssistantId),
       bundlePathFor(cadetWebhook),
       bundlePathFor(userKey),
     ]);
 
     const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedPlatform } =
+    const { userCredentials, skippedCloud } =
       filterCredentials(bundleCredentials);
 
-    expect(skippedPlatform).toBe(3);
+    expect(skippedCloud).toBe(3);
     expect(userCredentials).toHaveLength(1);
     expect(userCredentials[0]).toEqual({
       account: userKey,
@@ -236,7 +233,7 @@ describe("migration import credential filtering", () => {
 
     // Verify total = user + skipped
     expect(bundleCredentials.length).toBe(
-      userCredentials.length + skippedPlatform,
+      userCredentials.length + skippedCloud,
     );
   });