@mycadet/assistant 0.12.7 → 0.12.8

package/src/runtime/routes/conversation-query-routes.ts

@@ -35,7 +35,6 @@ import {
   scrubNulledChatSettings,
   validateChatSettingsWrite,
 } from "../../config/chat-settings.js";
-import { DefaultProviderSelectionSchema } from "../../config/default-provider.js";
 import {
   catalogEntryFor,
   type InputModalities,
@@ -44,10 +43,9 @@ import {
 } from "../../config/input-modalities.js";
 import {
   deepMergeOverwrite,
-  fillContextDefaultsForMissingKeys,
   getConfig,
-  getDeploymentContextDefaults,
   invalidateConfigCache,
+  loadConfig,
   loadRawConfig,
   saveRawConfig,
   setNestedValue,
@@ -58,22 +56,21 @@ import {
   completeCustomProfile,
   mergePreservingUnknownKeys,
 } from "../../config/profile-materialization.js";
-import { AssistantConfigSchema } from "../../config/schema.js";
+import {
+  type AssistantConfig,
+  AssistantConfigSchema,
+} from "../../config/schema.js";
 import { getSchemaAtPath } from "../../config/schema-utils.js";
-import { AutoArchiveConfigSchema } from "../../config/schemas/conversations.js";
 import {
   collectFallbackProfileIssues,
-  isDefaultProviderChoice,
   LLMConfigBase,
   LLMConfigFragment,
-  LLMDefaultConfigSchema,
   LLMSchema,
   ProfileEntry,
   routingIdentityModelIssue,
   unknownLlmProviderIssue,
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
-import { NotificationsConfigSchema } from "../../config/schemas/notifications.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
 import { isSidebarDoneEnabled } from "../../config/sidebar-done-gate.js";
 import {
@@ -123,12 +120,12 @@ import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
 import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/v2/activation-log-store.js";
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
-import { MANAGED_ROUTABLE_PROVIDERS } from "../../providers/cadet-model-routing.js";
+import { CLOUD_ROUTABLE_PROVIDERS } from "../../providers/cadet-model-routing.js";
 import { writableProfileProviderIssue } from "../../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
+  CADET_CLOUD_CONNECTION_NAME,
   createConnection,
   getConnection,
   LEGACY_MANAGED_CONNECTION_NAMES,
@@ -526,85 +523,6 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
   }
 }
 
-/**
- * Apply deployment-context defaults to a raw config payload before it goes
- * out over the wire from `GET /v1/config`. The in-memory `loadConfig()`
- * already layers these defaults for daemon-internal consumers; the GET
- * response needs the same treatment so external clients (macOS, web, CLI)
- * see the effective value rather than `undefined` when the daemon hasn't
- * persisted an explicit choice yet. For example, on a freshly-hatched
- * platform-managed assistant, `services.image-generation.provider` may be
- * absent from disk (only `llm.profiles` was written by
- * `seedInferenceProfiles`); the fill pass ensures clients receive `"cadet"`
- * rather than falling back to their own defaults.
- *
- * Guards against `loadRawConfig()` handing us a value that is technically
- * valid JSON but not a plain object (e.g. literal `null`, a number, or an
- * array). `loadRawConfig` is typed `Record<string, unknown>` but `JSON.parse`
- * itself doesn't enforce that — a malformed-but-parseable `config.json`
- * would blow up `fillContextDefaultsForMissingKeys` on its `target[key]` /
- * `fileConfig[key]` accesses, turning `GET /v1/config` into a 500 where it
- * used to succeed (returning the malformed payload as-is). When `raw` is
- * not a plain object, we return it unchanged.
- *
- * Exported for direct unit testing.
- */
-export function applyContextDefaultsToRawConfig(raw: unknown): unknown {
-  const contextDefaults = getDeploymentContextDefaults();
-  if (
-    Object.keys(contextDefaults).length === 0 ||
-    raw === null ||
-    typeof raw !== "object" ||
-    Array.isArray(raw)
-  ) {
-    return raw;
-  }
-  fillContextDefaultsForMissingKeys(
-    raw as Record<string, unknown>,
-    raw as Record<string, unknown>,
-    contextDefaults,
-  );
-  synthesizeLegacyInferenceModeForPlatform(raw as Record<string, unknown>);
-  return raw;
-}
-
-/**
- * Backwards-compat wire field for `GET /v1/config`. PR removed
- * `services.inference.mode` from the typed schema (routing is governed by
- * `provider_connections` rows + per-profile `provider_connection`), but
- * the macOS settings client (`SettingsStore.swift:loadServiceModes`) still
- * reads this field and falls back to its `@Published` default of "your-own"
- * when absent. On a platform-managed assistant served by a newer daemon and
- * an older macOS client, that fallback would show the wrong mode in the UI
- * until the user explicitly saved. Synthesize the value here so the wire
- * shape stays compatible during the rollout window. Remove once the macOS
- * Providers UI (the follow-up PR that retires this field on the client) has
- * shipped to the majority of installs.
- *
- * The synthesis is wire-only: it never persists to disk and never reaches
- * the typed `AssistantConfig` consumed by daemon-internal code. The on-disk
- * config is stripped of `mode` by workspace migration 076.
- *
- * Only runs when this function is reached, which is guarded by
- * `getDeploymentContextDefaults()` returning non-empty (IS_PLATFORM=true).
- */
-function synthesizeLegacyInferenceModeForPlatform(
-  root: Record<string, unknown>,
-): void {
-  const services = readPlainObject(root.services);
-  if (!services) {
-    return;
-  }
-  let inference = readPlainObject(services.inference);
-  if (!inference) {
-    inference = {};
-    services.inference = inference;
-  }
-  if (inference.mode === undefined) {
-    inference.mode = "managed";
-  }
-}
-
 function readPlainObject(value: unknown): Record<string, unknown> | undefined {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return undefined;
@@ -732,13 +650,6 @@ function nestPath(path: string, value: unknown): unknown {
   return current;
 }
 
-const WireProfileEntry = ProfileEntry.extend({
-  supportsVision: z.boolean().optional(),
-  invariant: z.boolean().optional(),
-})
-  .passthrough()
-  .meta({ id: "ProfileEntry" });
-
 /**
  * Wire shape of the `memory` section in config responses. Passthrough
  * preserves fields beyond `enabled` and `v2` so the client doesn't strip
@@ -752,97 +663,6 @@ const MemoryWireConfigSchema = z
   .passthrough()
   .meta({ id: "MemoryConfig" });
 
-/**
- * Response schema for `GET /v1/config`.
- *
- * Describes the wire shape of the raw `settings.json` response after
- * context-default filling and vision-flag enrichment. Chat settings include
- * effective defaults. Fields remain optional for older assistants and sparse
- * on-disk config. Additional top-level sections are preserved via
- * passthrough. This schema types the fields that web/macOS clients consume
- * without restricting the full config surface.
- */
-const ConfigGetResponseSchema = z
-  .object({
-    // A malformed or absent stored chat-settings subtree falls back to its
-    // schema defaults so one bad leaf can't fail the whole wire parse (which
-    // would strip every derived field from the response); the chat-settings
-    // read overlay refills both from the effective config.
-    conversations: z
-      .object({
-        autoArchive: AutoArchiveConfigSchema.passthrough().catch(
-          AutoArchiveConfigSchema.parse({}),
-        ),
-      })
-      .passthrough()
-      .optional(),
-    notifications: NotificationsConfigSchema.passthrough()
-      .optional()
-      .catch(undefined),
-    llm: z
-      .object({
-        default: LLMDefaultConfigSchema.optional(),
-        // Wire-compat view of the default provider, derived from `default`
-        // by the read overlay (the key is never stored anymore).
-        defaultProvider: DefaultProviderSelectionSchema.optional(),
-        profiles: z.record(z.string(), WireProfileEntry).optional(),
-        profileOrder: z.array(z.string()).optional(),
-        activeProfile: z.string().optional(),
-        // The profile the advisor consults; excluded from chat-profile pickers.
-        advisorProfile: z.string().optional(),
-        callSites: z
-          .record(
-            z.string(),
-            LLMConfigFragment.extend({
-              profile: z.string().optional(),
-            }).nullable(),
-          )
-          .optional(),
-        profileSession: z
-          .object({
-            defaultTtlSeconds: z.number().optional(),
-            maxTtlSeconds: z.number().optional(),
-          })
-          .optional(),
-        pricingOverrides: z.array(z.unknown()).optional(),
-      })
-      .passthrough()
-      .optional(),
-    memory: MemoryWireConfigSchema.optional(),
-    services: z
-      .object({
-        "web-search": z
-          .object({
-            provider: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        "web-fetch": z
-          .object({
-            provider: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        "image-generation": z
-          .object({
-            provider: z.string().optional(),
-            model: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        inference: z
-          .object({ mode: ServiceModeSchema.optional() })
-          .passthrough()
-          .optional(),
-      })
-      .passthrough()
-      .optional(),
-  })
-  .passthrough()
-  .meta({ id: "ConfigGetResponse" });
-
-type ConfigGetResponse = z.infer<typeof ConfigGetResponseSchema>;
-
 /**
  * Given a `z.object(...)` schema, returns a new schema where every property
  * is `.nullable().optional()`. Used to express PATCH body semantics where any
@@ -880,7 +700,7 @@ const CallSiteOverrideDraftSchema = nullablePartial(
  *
  * Mirrors the response shape but every field is `.nullable().optional()`:
  * omitted keys are left unchanged by the daemon's deep-merge, `null` values
- * delete the key. Uses the same Zod enums as `ConfigGetResponseSchema` so
+ * delete the key. Uses the same Zod enums as `AssistantConfigSchema` so
  * the generated SDK produces literal-union types — no hand-written patch
  * types needed downstream.
  */
@@ -953,54 +773,37 @@ const ConfigPatchRequestSchema = z
   .passthrough()
   .meta({ id: "ConfigPatchRequest" });
 
+/**
+ * The response contract for `GET`/`PATCH /v1/config` — the five subtrees
+ * external clients actually read, picked out of the full graph. Rendering
+ * the whole `AssistantConfigSchema` into the spec blasted openapi.yaml past
+ * 12K lines; we're not ready to trim the response schema itself yet, so the
+ * runtime still returns the full config and the spec documents these.
+ */
+const ConfigGetResponseSchema = AssistantConfigSchema.pick({
+  conversations: true,
+  notifications: true,
+  llm: true,
+  memory: true,
+  services: true,
+});
+
 function handleGetConfig() {
   try {
-    const config = applyContextDefaultsToRawConfig(loadRawConfig());
-    // One zod pass shapes the response: ConfigGetResponseSchema is this
-    // route's wire contract, so the overlays stamp their derived fields on
-    // the parsed view instead of digging handles out of raw objects. A
-    // config the schema rejects gets no overlays and is served raw.
-    const parsed = ConfigGetResponseSchema.safeParse(config);
-    if (!parsed.success) {
-      return config;
-    }
-    const wire = parsed.data;
-    overlayWorkspaceMcpForConfigRead(wire);
-    sanitizeMcpTransportHeadersForSettingsRead(wire);
-    overlayEffectiveProfilesForWire(wire);
-    enrichProfilesForWire(wire);
-    overlayDefaultProviderForWire(wire);
-    overlayChatSettingsForWire(wire);
-    return wire;
+    const config = loadConfig();
+    overlayWorkspaceMcpForConfigRead(config);
+    sanitizeMcpTransportHeadersForSettingsRead(config);
+    overlayEffectiveProfilesForWire(config);
+    enrichProfilesForWire(config);
+    overlayChatSettingsForWire(config);
+    return config;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     throw new InternalError(`Failed to read config: ${message}`);
   }
 }
 
-/**
- * Surface the default-provider selection on config reads. The selection lives
- * in the `llm.default` blob; the dedicated `defaultProvider` response field is
- * a derived wire-compat view (readers of the config GET predate the blob) and
- * is never stored on disk — it is stamped here from the blob on every read.
- */
-function overlayDefaultProviderForWire(config: ConfigGetResponse): void {
-  if (!config.llm) {
-    return;
-  }
-  const blob = config.llm.default;
-  const provider = blob?.provider;
-  if (provider != null && isDefaultProviderChoice(provider)) {
-    config.llm.defaultProvider = {
-      provider,
-      connectionName: blob?.provider_connection,
-    };
-  } else {
-    delete config.llm.defaultProvider;
-  }
-}
-
-function overlayChatSettingsForWire(config: ConfigGetResponse): void {
+function overlayChatSettingsForWire(config: AssistantConfig): void {
   const effective = getConfig();
   config.conversations = {
     ...config.conversations,
@@ -1023,7 +826,7 @@ function overlayChatSettingsForWire(config: ConfigGetResponse): void {
  * render labels/models — so the wire view materializes them, resolved through
  * `llm.default`'s column of the intent × provider matrix so a BYO
  * install sees the provider/model that actually dispatches. Wire-only:
- * `normalizeManagedProfileWrites` reduces echoed bodies back to the
+ * `normalizeCloudProfileWrites` reduces echoed bodies back to the
  * workspace-owned fields on the write paths, so a `config get` →
  * `config set` round-trip never persists catalog content — the two must
  * resolve through the same column or honest round-trips are rejected.
@@ -1033,10 +836,7 @@ function overlayChatSettingsForWire(config: ConfigGetResponse): void {
  * shields the matrix lookup from a persisted value the matrix cannot
  * implement, which a raw read would feed straight into resolution.
  */
-function overlayEffectiveProfilesForWire(config: ConfigGetResponse): void {
-  if (!config.llm) {
-    config.llm = {};
-  }
+function overlayEffectiveProfilesForWire(config: AssistantConfig): void {
   const parsedLlm = LLMSchema.safeParse(config.llm);
   config.llm.profiles = getUserSelectableProfilesForProvider(
     parsedLlm.success ? parsedLlm.data : undefined,
@@ -1097,7 +897,7 @@ function stripWireOnlyProfileKeys(patch: unknown): void {
  * `handleSetConfig`'s `raw` write, which shares object references with the
  * inspected patch shape.
  */
-export function normalizeManagedProfileWrites(patch: unknown): void {
+export function normalizeCloudProfileWrites(patch: unknown): void {
   const root = readPlainObject(patch);
   const llm = readPlainObject(root?.llm);
   const profiles = readPlainObject(llm?.profiles);
@@ -1182,15 +982,15 @@ export function normalizeManagedProfileWrites(patch: unknown): void {
       entry.status != null &&
       entry.status !== "active"
     ) {
-      throw new BadRequestError(`Cannot disable managed profile "${name}".`);
+      throw new BadRequestError(`Cannot disable cloud profile "${name}".`);
     }
     const residual = Object.keys(entry).filter(
       (key) => key !== "source" && key !== "status",
     );
     if (residual.length > 0) {
       throw new BadRequestError(
-        `Cannot edit managed profile "${name}" fields [${residual.join(", ")}]. ` +
-          `Managed profiles are read-only; duplicate to a custom profile to customize.`,
+        `Cannot edit cloud profile "${name}" fields [${residual.join(", ")}]. ` +
+          `Cloud profiles are read-only; duplicate to a custom profile to customize.`,
       );
     }
     entry.source = "managed";
@@ -1205,10 +1005,10 @@ export function normalizeManagedProfileWrites(patch: unknown): void {
  *   `inputModalities.image` override winning when set. Unknown (provider,
  *   model) pairs with no override default to `true` (fail-open) so image
  *   upload remains available for custom / unlisted models.
- * - `invariant`: `true` for managed-source entries of the managed profile
+ * - `invariant`: `true` for managed-source entries of the cloud profile
  *   names (`INVARIANT_PROFILE_NAMES`); absent otherwise. Source-gated to
  *   match `assertInvariantProfilesPreserved` — a user-owned profile sharing
- *   a managed name is fully editable, so it must render as a normal custom
+ *   a cloud name is fully editable, so it must render as a normal custom
  *   profile.
  */
 function enrichProfilesForWire(config: unknown): void {
@@ -1281,7 +1081,7 @@ function handleGetConfigSchema({ queryParams = {} }: RouteHandlerArgs) {
   };
 }
 
-export function rejectManagedProfileDeletion(
+export function rejectCloudProfileDeletion(
   body: Record<string, unknown>,
 ): void {
   const llm = asMutablePlainObject(body.llm);
@@ -1290,7 +1090,7 @@ export function rejectManagedProfileDeletion(
   }
   if ("profiles" in llm && llm.profiles === null) {
     throw new BadRequestError(
-      "Cannot null llm.profiles — managed profiles would be deleted.",
+      "Cannot null llm.profiles — cloud profiles would be deleted.",
     );
   }
   const profiles = asMutablePlainObject(llm.profiles);
@@ -1302,23 +1102,23 @@ export function rejectManagedProfileDeletion(
     if (profiles[name] !== null || !MANAGED_PROFILE_NAMES.has(name)) {
       continue;
     }
-    // Only block deletion when the on-disk entry is Cadet-managed. A
-    // user-owned profile sharing a managed name carries a non-managed `source`
+    // Only block deletion when the on-disk entry is Cadet Cloud. A
+    // user-owned profile sharing a cloud name carries a non-managed `source`
     // and is freely deletable.
     const existing = asMutablePlainObject(existingProfiles[name]);
     if (existing?.source === "managed") {
-      throw new BadRequestError(`Cannot delete managed profile "${name}".`);
+      throw new BadRequestError(`Cannot delete cloud profile "${name}".`);
     }
   }
 }
 
 /**
- * Enforce the managed-profile invariants at the config-write choke point.
+ * Enforce the cloud-profile invariants at the config-write choke point.
  *
  * Protects the thin managed stubs (`INVARIANT_PROFILE_NAMES`) that live in
  * workspace config. Default profile CONTENT is code-owned and only exists on
  * the wire, so the guard's job is the stub itself: it checks entries present
- * in the OLD config, and `normalizeManagedProfileWrites` reduces incoming
+ * in the OLD config, and `normalizeCloudProfileWrites` reduces incoming
  * managed entries to the workspace-owned fields before this comparison runs.
  *
  * Invariance is gated on managed ownership: a name is enforced only when the
@@ -1327,7 +1127,7 @@ export function rejectManagedProfileDeletion(
  * is real and supported, because the flag-gated reconcile refuses to
  * overwrite a same-named user profile.
  *
- * For each invariant name where the OLD raw config carries a managed-source
+ * For each invariant name where the OLD raw config carries a cloud-source
  * plain-object entry at `llm.profiles[name]`:
  *
  * - The NEW raw config must still carry a plain-object entry at the same
@@ -1376,17 +1176,17 @@ function assertInvariantProfilesPreserved(
       : null;
     if (!newEntry) {
       throw new BadRequestError(
-        `Cannot delete or replace managed profile "${name}". Managed profiles are read-only.`,
+        `Cannot delete or replace cloud profile "${name}". Cloud profiles are read-only.`,
       );
     }
 
     if (!isDeepStrictEqual(oldEntry.status, newEntry.status)) {
       if (newEntry.status === "disabled") {
-        throw new BadRequestError(`Cannot disable managed profile "${name}".`);
+        throw new BadRequestError(`Cannot disable cloud profile "${name}".`);
       }
       if (newEntry.status !== "active" && newEntry.status != null) {
         throw new BadRequestError(
-          `Cannot set status ${JSON.stringify(newEntry.status)} on managed profile "${name}". ` +
+          `Cannot set status ${JSON.stringify(newEntry.status)} on cloud profile "${name}". ` +
             `Only re-enabling (status "active") is allowed.`,
         );
       }
@@ -1402,8 +1202,8 @@ function assertInvariantProfilesPreserved(
     );
     if (changedKeys.length > 0) {
       throw new BadRequestError(
-        `Cannot edit managed profile "${name}" fields [${changedKeys.join(", ")}]. ` +
-          `Managed profiles are read-only; duplicate to a custom profile to customize.`,
+        `Cannot edit cloud profile "${name}" fields [${changedKeys.join(", ")}]. ` +
+          `Cloud profiles are read-only; duplicate to a custom profile to customize.`,
       );
     }
   }
@@ -1561,8 +1361,8 @@ function assertRoutableIdentityEntries(
 function assertCodeOwnedFallbackProfiles(raw: Record<string, unknown>): void {
   const llm = readPlainObject(raw.llm);
   const profiles = readPlainObject(llm?.profiles);
-  // The sibling `llm.default` decides whether the managed backups are valid
-  // fallback targets: they resolve on the managed column alone.
+  // The sibling `llm.default` decides whether the cloud backups are valid
+  // fallback targets: they resolve on the cloud column alone.
   const issues = collectFallbackProfileIssues(
     profiles ?? undefined,
     llm?.default,
@@ -1703,8 +1503,8 @@ async function handlePatchConfig({ body }: RouteHandlerArgs) {
     throw new BadRequestError(chatSettings.error.message);
   }
   stripWireOnlyProfileKeys(body);
-  normalizeManagedProfileWrites(body);
-  rejectManagedProfileDeletion(body as Record<string, unknown>);
+  normalizeCloudProfileWrites(body);
+  rejectCloudProfileDeletion(body as Record<string, unknown>);
   rejectMcpTransportHeaderWrite(body);
   stripMcpFromConfigWrite(body as Record<string, unknown>);
 
@@ -1772,24 +1572,24 @@ async function handleSetConfig({ body }: RouteHandlerArgs) {
   ) {
     return { ok: true };
   }
-  // Build the equivalent patch shape so the managed-profile guard can
+  // Build the equivalent patch shape so the cloud-profile guard can
   // inspect the touched subtree. `setNestedValue` places `value` into
   // `patchShape` by reference, so stripping wire-only profile keys here
   // also strips the object written to `raw` below.
   const patchShape: Record<string, unknown> = {};
   setNestedValue(patchShape, path, value);
   stripWireOnlyProfileKeys(patchShape);
-  normalizeManagedProfileWrites(patchShape);
-  rejectManagedProfileDeletion(patchShape);
+  normalizeCloudProfileWrites(patchShape);
+  rejectCloudProfileDeletion(patchShape);
   rejectMcpConfigSetPath(path, value);
   rejectMcpTransportHeaderWrite(patchShape);
 
   const raw = loadRawConfig();
   // A SET below the entry level (`llm.profiles.<name>.<leaf>`) writes the
   // primitive leaf directly into `raw`, bypassing the by-reference
-  // normalization above — creating an entry for a managed-owned name would
+  // normalization above — creating an entry for a cloud-owned name would
   // leave it source-less, and a source-less entry reads as a user shadow
-  // that blocks the catalog body. Stamp the managed marker onto the written
+  // that blocks the catalog body. Stamp the cloud marker onto the written
   // entry when the name was absent or managed-owned before this write.
   const managedEntryName =
     pathSegments[0] === "llm" &&
@@ -1890,12 +1690,12 @@ async function handleReplaceInferenceProfile({
     throw new BadRequestError(`Invalid profile fragment: ${detail}`);
   }
   // A managed name with no existing entry stays protected so users can't
-  // shadow a seeded managed profile. An existing entry carrying a non-managed
+  // shadow a seeded cloud profile. An existing entry carrying a non-managed
   // `source` is user-owned and remains fully editable.
   const existingProfile = asMutablePlainObject(
     getConfig().llm.profiles?.[name],
   );
-  const isManaged =
+  const isCloud =
     MANAGED_PROFILE_NAMES.has(name) &&
     (existingProfile == null || existingProfile.source === "managed");
   if (CODE_OWNED_PROFILE_NAMES.has(name)) {
@@ -1924,11 +1724,11 @@ async function handleReplaceInferenceProfile({
       `Profile "${name}" is not currently available and cannot be edited.`,
     );
   }
-  if (isManaged) {
-    // Managed profiles are daemon-seeded and read-only — the commit guard
+  if (isCloud) {
+    // Cloud profiles are daemon-seeded and read-only — the commit guard
     // (`assertInvariantProfilesPreserved`) rejects every write to them
     // except re-enabling a disabled profile. Enforce the same contract up
-    // front: the only body a managed PUT accepts is a pure status re-enable
+    // front: the only body a cloud PUT accepts is a pure status re-enable
     // (`{status: "active"}`, or `{status: null}` to clear back to
     // active-by-absence). Rejecting here keeps the error message ahead of
     // any side effects and mirrors the guard's wording.
@@ -1942,8 +1742,8 @@ async function handleReplaceInferenceProfile({
       const detail =
         disallowed.length > 0 ? ` fields [${disallowed.join(", ")}]` : "";
       throw new BadRequestError(
-        `Cannot edit managed profile "${name}"${detail}. ` +
-          `Managed profiles are read-only (a disabled profile can be re-enabled); ` +
+        `Cannot edit cloud profile "${name}"${detail}. ` +
+          `Cloud profiles are read-only (a disabled profile can be re-enabled); ` +
           `duplicate to a custom profile to customize.`,
       );
     }
@@ -2046,10 +1846,10 @@ async function handleReplaceInferenceProfile({
 
   // When the UI sends provider but no provider_connection, derive the connection
   // now so the config deep-merge doesn't inherit a stale connection from the
-  // default layer. Managed entries are excluded: the managed gate above
+  // default layer. Managed entries are excluded: the cloud gate above
   // already rejected any provider-carrying fragment, so their only surviving
   // body is a status re-enable, which derives no connection. A user-owned
-  // profile sharing a managed name is fully editable, so it takes the
+  // profile sharing a cloud name is fully editable, so it takes the
   // derivation like any other custom profile.
   const fragment = parsed.data as Record<string, unknown>;
   // Routing identities resolve their connection per-request from the
@@ -2057,7 +1857,7 @@ async function handleReplaceInferenceProfile({
   // ("cadet" is its stored provider) or create a junk "<identity>-personal"
   // connection for chatgpt.
   if (
-    !isManaged &&
+    !isCloud &&
     fragment.provider &&
     !fragment.provider_connection &&
     !ROUTING_IDENTITY_PROVIDERS.has(fragment.provider as string)
@@ -2074,12 +1874,12 @@ async function handleReplaceInferenceProfile({
     if (active) {
       fragment.provider_connection = active.name;
     } else if (
-      MANAGED_ROUTABLE_PROVIDERS.has(provider) &&
-      getConnection(db, CADET_MANAGED_CONNECTION_NAME)
+      CLOUD_ROUTABLE_PROVIDERS.has(provider) &&
+      getConnection(db, CADET_CLOUD_CONNECTION_NAME)
     ) {
-      // Managed-routable providers are served by the single Cadet-managed
+      // Managed-routable providers are served by the single Cadet Cloud
       // connection; prefer it over lazily creating a personal connection.
-      fragment.provider_connection = CADET_MANAGED_CONNECTION_NAME;
+      fragment.provider_connection = CADET_CLOUD_CONNECTION_NAME;
     } else if (!PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)) {
       const connectionName = `${provider}-personal`;
       const isKeyless = provider === "ollama";
@@ -2100,13 +1900,13 @@ async function handleReplaceInferenceProfile({
   }
 
   const raw = loadRawConfig();
-  if (isManaged) {
+  if (isCloud) {
     // Partial overlay: keep every existing key intact, only apply the status
-    // re-enable (the sole body the managed gate above admits). Using
+    // re-enable (the sole body the cloud gate above admits). Using
     // `replaceInferenceProfileConfig` here would wipe the seed-owned fields
     // (provider, model, advanced params) because that function assumes the
     // body carries the full UI surface.
-    applyManagedProfileReenable(raw, name, fragment.status as "active" | null);
+    applyCloudProfileReenable(raw, name, fragment.status as "active" | null);
   } else {
     replaceInferenceProfileConfig(raw, name, fragment);
   }
@@ -2115,7 +1915,7 @@ async function handleReplaceInferenceProfile({
   // `handleSetConfig`: file-watcher suppression so the in-process reload
   // doesn't race the explicit reinit, embedding backend cache clear,
   // in-process `getConfig` cache invalidation, and provider registry
-  // reinitialization. `status: "disabled"` on a managed profile (and any
+  // reinitialization. `status: "disabled"` on a cloud profile (and any
   // `provider` / `model` / `provider_connection` change on a custom
   // profile) must take effect immediately rather than waiting for the
   // next watcher tick.
@@ -2124,11 +1924,11 @@ async function handleReplaceInferenceProfile({
 }
 
 /**
- * Apply the disabled→active re-enable to a managed profile entry, preserving
+ * Apply the disabled→active re-enable to a cloud profile entry, preserving
  * every other field already on disk (provider, model, advanced params, etc).
  * `status: "active"` sets the key; `null` clears it (active-by-absence).
  */
-function applyManagedProfileReenable(
+function applyCloudProfileReenable(
   raw: Record<string, unknown>,
   name: string,
   status: "active" | null,
@@ -2149,7 +1949,7 @@ function applyManagedProfileReenable(
     ...(asMutablePlainObject(profiles[name]) ?? {}),
   };
   // Only reached for managed-owned names (the route's managed gate), so a
-  // freshly created stub must carry the managed marker the effective view
+  // freshly created stub must carry the cloud marker the effective view
   // and write guards key on.
   nextProfile.source = "managed";
   if (status === null) {