@mycadet/assistant 0.12.7 → 0.12.8

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -4,20 +4,20 @@
  * GET    /v1/inference/provider-connections          — list all connections (optional ?provider= filter)
  * GET    /v1/inference/provider-connections/:name    — single connection by name
  * POST   /v1/inference/provider-connections          — create a new connection
- * PATCH  /v1/inference/provider-connections/:name    — update auth/label (cannot rename or change provider; auth is locked to platform for managed connections)
- * DELETE /v1/inference/provider-connections/:name    — delete (rejects if profiles or call sites reference it; rejects outright for managed connections)
+ * PATCH  /v1/inference/provider-connections/:name    — update auth/label (cannot rename or change provider; auth is locked to platform for cloud connections)
+ * DELETE /v1/inference/provider-connections/:name    — delete (rejects if profiles or call sites reference it; rejects outright for cloud connections)
  */
 
 import { z } from "zod";
 
 import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { resolveDefaultConnectionName } from "../../config/default-provider-resolution.js";
-import { getIsPlatform } from "../../config/env-registry.js";
+import { getIsCloud } from "../../config/env-registry.js";
 import { getConfigReadOnly } from "../../config/loader.js";
 import { getDb } from "../../persistence/db-connection.js";
 import {
-  CADET_MANAGED_PROVIDER,
-  isCadetManagedConnection,
+  CADET_CLOUD_PROVIDER,
+  isCadetCloudConnection,
 } from "../../providers/cadet-model-routing.js";
 import {
   type Auth,
@@ -91,7 +91,7 @@ const savedConnectionResponseSchema = ProviderConnectionSchema.extend({
  * with a `base_url` pointing to their own server, which would redirect all
  * LLM calls (and the API key) to the attacker.
  *
- * Even for allowed providers, a platform-hosted daemon rejects `base_url`
+ * Even for allowed providers, a cloud-hosted daemon rejects `base_url`
  * values that point to private networks or cloud metadata endpoints
  * (SSRF protection). Self-hosted daemons allow those addresses because
  * localhost and LAN hosts are the expected target.
@@ -141,11 +141,11 @@ async function parseCustomProviderFields(
       }
 
       // SSRF protection: reject private IPs, localhost, cloud metadata
-      // endpoints — but only for platform-hosted daemons where the container
+      // endpoints — but only for cloud-hosted daemons where the container
       // runs on Cadet infrastructure. Self-hosted daemons run on the user's
       // own machine, so localhost/private addresses are the expected target
       // (e.g. LM Studio, vLLM, text-generation-webui).
-      if (getIsPlatform()) {
+      if (getIsCloud()) {
         const hostname = parsed.hostname;
         if (isPrivateOrLocalHost(hostname)) {
           throw new BadRequestError(
@@ -212,20 +212,20 @@ function deriveConnectionAuth(provider: string, credential: unknown): Auth {
 }
 
 /**
- * Platform auth and `provider: "cadet"` record the same fact (the managed
+ * Platform auth and `provider: "cadet"` record the same fact (the cloud
  * route) in two columns, and derivation always sets them together. Only an
  * explicit `auth` object can split them, producing a row dispatch bills to
- * the platform while every provider-keyed check reads it as BYOK, or the
+ * the cloud while every provider-keyed check reads it as BYOK, or the
  * reverse.
  */
 function assertAuthMatchesProvider(provider: string, auth: Auth): void {
   const managedAuth = auth.type === "platform";
-  const managedProvider = provider === CADET_MANAGED_PROVIDER;
+  const managedProvider = provider === CADET_CLOUD_PROVIDER;
   if (managedAuth !== managedProvider) {
     throw new BadRequestError(
       managedAuth
-        ? `Auth type "platform" is only valid for provider "${CADET_MANAGED_PROVIDER}", not "${provider}". Cadet-managed routing is selected by the provider, so omit "auth" to derive it.`
-        : `Provider "${CADET_MANAGED_PROVIDER}" is always platform-authenticated; "${auth.type}" auth is not valid for it. Omit "auth" to derive it, or name a real provider for key-based auth.`,
+        ? `Auth type "platform" is only valid for provider "${CADET_CLOUD_PROVIDER}", not "${provider}". Cadet Cloud routing is selected by the provider, so omit "auth" to derive it.`
+        : `Provider "${CADET_CLOUD_PROVIDER}" is always cloud-authenticated; "${auth.type}" auth is not valid for it. Omit "auth" to derive it, or name a real provider for key-based auth.`,
     );
   }
   // Same rule for the subscription identity: provider "chatgpt" and
@@ -344,11 +344,11 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
   }
 
   // Canonical names belong to boot seeding, which skips a name already taken
-  // by a user-owned row, leaving the install with no managed connection and a
+  // by a user-owned row, leaving the install with no cloud connection and a
   // BYOK row that managed routing then ignores. Refuse the name up front.
   if (MANAGED_CONNECTION_NAMES.has(name)) {
     throw new BadRequestError(
-      `Connection name "${name}" is reserved for the Cadet-managed connection. Pick another name.`,
+      `Connection name "${name}" is reserved for the Cadet Cloud connection. Pick another name.`,
     );
   }
   // Provider ids and routing identities are labels in profile config, so an
@@ -597,21 +597,21 @@ async function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
     throw new NotFoundError(`Connection "${name}" not found.`);
   }
 
-  // Managed connections are write-protected: `seedCanonicalConnections` would
+  // Cloud connections are write-protected: `seedCanonicalConnections` would
   // re-upsert them on the next daemon boot anyway, so a successful delete here
   // produces a confusing delete → reappear loop. Reject outright. Mirrors
-  // `rejectManagedProfileDeletion` for managed profiles (which are similarly
+  // `rejectCloudProfileDeletion` for cloud profiles (which are similarly
   // re-overlaid by `seed-inference-profiles.ts` on boot).
   //
   // Gated on the row, not the name: an install predating the reserved name can
   // hold a user-owned row here, which boot seeding refuses to overwrite and
   // managed routing ignores. That row must stay deletable, since deleting it
-  // is what lets boot seeding restore the real managed connection.
+  // is what lets boot seeding restore the real cloud connection.
   const claimsManagedName =
-    MANAGED_CONNECTION_NAMES.has(name) && !isCadetManagedConnection(existing);
+    MANAGED_CONNECTION_NAMES.has(name) && !isCadetCloudConnection(existing);
   if (MANAGED_CONNECTION_NAMES.has(name) && !claimsManagedName) {
     throw new BadRequestError(
-      `Cannot delete managed connection "${name}". This is a Cadet-managed connection that is re-seeded on every startup.`,
+      `Cannot delete cloud connection "${name}". This is a Cadet Cloud connection that is re-seeded on every startup.`,
     );
   }
 
@@ -805,7 +805,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Update a provider connection",
     description:
-      "Update an existing connection. Cannot rename or change the provider. Omitting auth keeps the stored auth; passing credential alone rotates the key via provider-derived api_key auth. An explicit auth object must agree with the connection's provider; platform auth belongs to cadet and only to cadet. For the Cadet-managed connection (cadet) the auth is locked to platform; label remains editable.",
+      "Update an existing connection. Cannot rename or change the provider. Omitting auth keeps the stored auth; passing credential alone rotates the key via provider-derived api_key auth. An explicit auth object must agree with the connection's provider; platform auth belongs to cadet and only to cadet. For the Cadet Cloud connection (cadet) the auth is locked to platform; label remains editable.",
     tags: ["inference"],
     pathParams: [{ name: "name", description: "Connection name" }],
     requestBody: z.object({
@@ -819,7 +819,7 @@ export const ROUTES: RouteDefinition[] = [
     additionalResponses: {
       "400": {
         description:
-          "Invalid auth schema, or attempt to change auth on a managed connection",
+          "Invalid auth schema, or attempt to change auth on a cloud connection",
       },
       "404": { description: "Connection not found" },
     },
@@ -835,14 +835,14 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Delete a provider connection",
     description:
-      "Delete a provider connection. Fails with 400 for the Cadet-managed connection (cadet) which is re-seeded on boot. Fails with 409 if any profile or call-site references the connection.",
+      "Delete a provider connection. Fails with 400 for the Cadet Cloud connection (cadet) which is re-seeded on boot. Fails with 409 if any profile or call-site references the connection.",
     tags: ["inference"],
     pathParams: [{ name: "name", description: "Connection name" }],
     responseBody: z.object({ ok: z.literal(true) }),
     additionalResponses: {
       "400": {
         description:
-          "Connection is a Cadet-managed connection and cannot be deleted",
+          "Connection is a Cadet Cloud connection and cannot be deleted",
       },
       "404": { description: "Connection not found" },
       "409": {

package/src/runtime/routes/ingress-status-routes.ts

@@ -172,7 +172,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Get ingress tunnel status",
     description:
-      "Probe the configured public ingress URL and report whether a tunnel is serving this assistant. `unconfigured` means no tunnel has ever been recorded (or the ingress is managed for this assistant, as it is when platform-hosted or fronted by a Tunnel), `stopped` means a tunnel ran before and is not running now (callback ingress is explicitly switched off, or its URL is gone), `healthy` means the URL answers and fronts this assistant's web app, `unpairable` means it answers but does not serve that app, so a pairing link minted against it would not open, `unreachable` means it does not answer, and `foreign` means it answers for a different assistant. `lastTunnel` names the tunnel to restart, on the states where a recorded one applies to the configured URL.",
+      "Probe the configured public ingress URL and report whether a tunnel is serving this assistant. `unconfigured` means no tunnel has ever been recorded (or the ingress is managed for this assistant, as it is when cloud-hosted or fronted by a Tunnel), `stopped` means a tunnel ran before and is not running now (callback ingress is explicitly switched off, or its URL is gone), `healthy` means the URL answers and fronts this assistant's web app, `unpairable` means it answers but does not serve that app, so a pairing link minted against it would not open, `unreachable` means it does not answer, and `foreign` means it answers for a different assistant. `lastTunnel` names the tunnel to restart, on the states where a recorded one applies to the configured URL.",
     tags: ["config"],
     handler: handleIngressStatus,
     responseBody: IngressStatusResponseSchema,

package/src/runtime/routes/integrations/a2a.ts

@@ -293,7 +293,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Complete A2A invite (sender side)",
     description:
-      "Called by the platform to finalize the sender side of a link-based A2A connection.",
+      "Called by the cloud to finalize the sender side of a link-based A2A connection.",
     tags: ["integrations"],
     handler: handleCompleteA2AInvite,
     responseBody: CompleteA2AInviteResultSchema,
@@ -308,7 +308,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Redeem A2A invite (receiver side)",
     description:
-      "Called by the platform to create a trusted contact on the receiver side of a link-based A2A connection.",
+      "Called by the cloud to create a trusted contact on the receiver side of a link-based A2A connection.",
     tags: ["integrations"],
     handler: handleRedeemA2AInvite,
     responseBody: RedeemA2AInviteResultSchema,

package/src/runtime/routes/integrations/twilio.ts

@@ -20,13 +20,9 @@ import {
   releasePhoneNumber,
   searchAvailableNumbers,
 } from "../../../calls/twilio-rest.js";
-import {
-  getConfig,
-  loadRawConfig,
-  saveRawConfig,
-} from "../../../config/loader.js";
+import { getConfig, setConfigSection } from "../../../config/loader.js";
+import type { TwilioConfig } from "../../../config/schemas/channels.js";
 import { syncTwilioWebhooks } from "../../../daemon/handlers/config-ingress.js";
-import type { IngressConfig } from "../../../inbound/public-ingress-urls.js";
 import { credentialKey } from "../../../security/credential-key.js";
 import {
   deleteSecureKeyAsync,
@@ -81,14 +77,12 @@ const TwilioNumberMutationResultSchema = z.object({
 
 /** Helper to clear stale assistant phone number mappings. */
 function pruneAssistantPhoneNumbers(
-  twilio: Record<string, unknown>,
+  twilio: TwilioConfig,
   keepNumber: string,
   mode: "keep" | "remove",
 ): void {
-  const mappings = twilio.assistantPhoneNumbers as
-    | Record<string, string>
-    | undefined;
-  if (mappings && typeof mappings === "object") {
+  const mappings = twilio.assistantPhoneNumbers;
+  if (mappings) {
     for (const [key, value] of Object.entries(mappings)) {
       const shouldDelete =
         mode === "keep" ? value !== keepNumber : value === keepNumber;
@@ -174,11 +168,11 @@ export async function handleSetTwilioCredentials({
     throw new InternalError("Failed to store Auth Token in secure storage");
   }
 
-  const raw = loadRawConfig();
-  const twilio = (raw?.twilio ?? {}) as Record<string, unknown>;
-  twilio.accountSid = accountSid;
-  twilio.setupStarted = true;
-  saveRawConfig({ ...raw, twilio });
+  setConfigSection("twilio", {
+    ...getConfig().twilio,
+    accountSid,
+    setupStarted: true,
+  });
 
   upsertCredentialMetadata("twilio", "account_sid", {
     allowedTools: ["bash"],
@@ -224,10 +218,7 @@ export async function handleClearTwilioCredentials() {
     );
   }
 
-  const raw = loadRawConfig();
-  const twilio = (raw?.twilio ?? {}) as Record<string, unknown>;
-  delete twilio.accountSid;
-  saveRawConfig({ ...raw, twilio });
+  setConfigSection("twilio", { ...getConfig().twilio, accountSid: "" });
 
   deleteCredentialMetadata("twilio", "account_sid");
   deleteCredentialMetadata("twilio", "auth_token");
@@ -284,18 +275,16 @@ export async function handleProvisionTwilioNumber({ body }: RouteHandlerArgs) {
     available[0].phoneNumber,
   );
 
-  const raw = loadRawConfig();
-  const twilio = (raw?.twilio ?? {}) as Record<string, unknown>;
-  twilio.phoneNumber = purchased.phoneNumber;
+  const twilio = { ...getConfig().twilio, phoneNumber: purchased.phoneNumber };
   pruneAssistantPhoneNumbers(twilio, purchased.phoneNumber, "keep");
-  saveRawConfig({ ...raw, twilio });
+  setConfigSection("twilio", twilio);
 
   // Best-effort webhook configuration
   const webhookResult = await syncTwilioWebhooks(
     purchased.phoneNumber,
     accountSid,
     authToken,
-    loadRawConfig() as IngressConfig,
+    { ingress: getConfig().ingress },
   );
 
   return {
@@ -315,11 +304,9 @@ export async function handleAssignTwilioNumber({
     throw new BadRequestError("phoneNumber is required");
   }
 
-  const raw = loadRawConfig();
-  const twilio = (raw?.twilio ?? {}) as Record<string, unknown>;
-  twilio.phoneNumber = phoneNumber;
+  const twilio = { ...getConfig().twilio, phoneNumber };
   pruneAssistantPhoneNumbers(twilio, phoneNumber, "keep");
-  saveRawConfig({ ...raw, twilio });
+  setConfigSection("twilio", twilio);
 
   // Best-effort webhook configuration when credentials are available
   let webhookWarning: string | undefined;
@@ -330,7 +317,7 @@ export async function handleAssignTwilioNumber({
       phoneNumber,
       acctSid,
       acctToken,
-      loadRawConfig() as IngressConfig,
+      { ingress: getConfig().ingress },
     );
     webhookWarning = webhookResult.warning;
   }
@@ -357,9 +344,8 @@ async function handleReleaseTwilioNumber({ body }: RouteHandlerArgs) {
   const { phoneNumber: requestedNumber } = body as {
     phoneNumber?: string;
   };
-  const raw = loadRawConfig();
-  const twilio = (raw?.twilio ?? {}) as Record<string, unknown>;
-  const phoneNumber = requestedNumber || (twilio.phoneNumber as string) || "";
+  const twilio = { ...getConfig().twilio };
+  const phoneNumber = requestedNumber || twilio.phoneNumber || "";
 
   if (!phoneNumber) {
     throw new BadRequestError(
@@ -372,10 +358,10 @@ async function handleReleaseTwilioNumber({ body }: RouteHandlerArgs) {
   await releasePhoneNumber(accountSid, authToken, phoneNumber);
 
   if (twilio.phoneNumber === phoneNumber) {
-    delete twilio.phoneNumber;
+    twilio.phoneNumber = "";
   }
   pruneAssistantPhoneNumbers(twilio, phoneNumber, "remove");
-  saveRawConfig({ ...raw, twilio });
+  setConfigSection("twilio", twilio);
 
   return {
     success: true,

package/src/runtime/routes/internal-telemetry-routes.ts

@@ -5,7 +5,7 @@
  * POST /v1/internal/telemetry/auth-fallback — record aggregated counts of
  * requests served via the legacy loopback auth fallback. The gateway counts
  * fallbacks in memory and flushes them here per window; the usage telemetry
- * reporter ships the persisted rows to the platform.
+ * reporter ships the persisted rows to the cloud.
  *
  * POST /v1/internal/telemetry/watchdog — relay a gateway-origin watchdog
  * event straight to platform ingest via the direct (unbuffered) emit path,
@@ -16,7 +16,7 @@
 
 import { z } from "zod";
 
-import { getRawShareAnalytics } from "../../platform/consent-cache.js";
+import { getRawShareAnalytics } from "../../cloud/consent-cache.js";
 import {
   type AuthFallbackCount,
   recordAuthFallbackCounts,

package/src/runtime/routes/live-voice-routes.test.ts

@@ -1,7 +1,7 @@
 /**
  * Tests for the live-voice preflight and session-end routes.
  *
- * The handler must run managed-speech defaulting first, then return the
+ * The handler must run cloud-speech defaulting first, then return the
  * live-voice credential readiness verdict verbatim:
  * - ready → { status: "ready" }
  * - not-ready → passes through the missing gaps + userMessage
@@ -23,8 +23,8 @@ const calls: string[] = [];
 let readiness: LiveVoiceCredentialReadiness = { status: "ready" };
 let releaseResult: LiveVoiceSessionReleaseResult = { released: false };
 
-mock.module("../../config/managed-speech-defaults.js", () => ({
-  maybeDefaultSpeechToManaged: async () => {
+mock.module("../../config/cloud-speech-defaults.js", () => ({
+  maybeDefaultSpeechToCloud: async () => {
     calls.push("default");
   },
 }));
@@ -80,7 +80,7 @@ describe("live_voice_preflight_post", () => {
     expect(result).toEqual(readiness);
   });
 
-  test("runs managed-speech defaulting before resolving readiness", async () => {
+  test("runs cloud-speech defaulting before resolving readiness", async () => {
     calls.length = 0;
     readiness = { status: "ready" };
 

package/src/runtime/routes/live-voice-routes.ts

@@ -1,7 +1,7 @@
 /**
  * Transport-agnostic route definitions for live-voice preflight.
  *
- * POST /v1/live-voice/preflight — ensure managed-speech defaulting has run,
+ * POST /v1/live-voice/preflight — ensure cloud-speech defaulting has run,
  * then report whether the daemon can run both audio legs of a live voice
  * session. Lets the web client verify voice is configured BEFORE opening the
  * voice-room WebSocket, instead of opening it and reacting to an error frame.
@@ -22,12 +22,12 @@ import type { RouteDefinition } from "./types.js";
 // ---------------------------------------------------------------------------
 
 async function handleLiveVoicePreflight() {
-  const { maybeDefaultSpeechToManaged } =
-    await import("../../config/managed-speech-defaults.js");
+  const { maybeDefaultSpeechToCloud } =
+    await import("../../config/cloud-speech-defaults.js");
   const { resolveLiveVoiceCredentialReadiness } =
     await import("../../live-voice/live-voice-credential-preflight.js");
 
-  await maybeDefaultSpeechToManaged();
+  await maybeDefaultSpeechToCloud();
   return resolveLiveVoiceCredentialReadiness();
 }
 
@@ -52,7 +52,7 @@ export const ROUTES: RouteDefinition[] = [
     endpoint: "live-voice/preflight",
     method: "POST",
     // Requires settings.write, not a read scope: the handler runs
-    // maybeDefaultSpeechToManaged(), which can persist config changes
+    // maybeDefaultSpeechToCloud(), which can persist config changes
     // (switching services.stt/tts.provider to "cadet"). This matches the
     // secret/settings config writers, which all require settings.write.
     policy: {
@@ -61,7 +61,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Live voice preflight",
     description:
-      "Ensure managed speech defaulting has run, then report whether live voice can start.",
+      "Ensure cloud speech defaulting has run, then report whether live voice can start.",
     tags: ["live-voice"],
     responseBody: z.object({
       status: z.enum(["ready", "not-ready"]),