@mycadet/assistant 0.12.7 → 0.12.8

package/src/tools/skills/skill-script-runner.ts

@@ -57,8 +57,8 @@ export async function runSkillToolScript(
   // capability reserved for bundled skills, which ship trusted, in-repo
   // executors. A non-bundled skill (managed, workspace, plugin, extra) that
   // declares `execution_target: host` must be refused: otherwise an
-  // attacker-planted TOOLS.json — e.g. written into a managed skill dir via
-  // scaffold_managed_skill companion files, or shipped in a third-party skill —
+  // attacker-planted TOOLS.json — e.g. written into a cloud skill dir via
+  // scaffold_cloud_skill companion files, or shipped in a third-party skill —
   // could get arbitrary code imported into the host process and auto-approved
   // under the low-risk threshold. Non-bundled skills must run their tools in the
   // sandbox (handled above); host execution here is a hard, fail-closed deny.

package/src/tools/terminal/safe-env.ts

@@ -41,7 +41,7 @@ export const SAFE_ENV_VARS = [
   "CADET_SLOW_SYNC_THRESHOLD_MS",
   "CADET_SLOW_QUERY_THRESHOLD_MS",
   "CADET_DEVICE_ID",
-  "CADET_DISABLE_PLATFORM",
+  "CADET_DISABLE_CLOUD",
   "CADET_ENVIRONMENT",
   "CADET_TEST_LOG_LEVEL",
 
@@ -51,7 +51,7 @@ export const SAFE_ENV_VARS = [
   "ASSISTANT_IPC_SOCKET_DIR",
   "GATEWAY_IPC_SOCKET_DIR",
   "GATEWAY_SECURITY_DIR",
-  "CADET_PLATFORM_URL",
+  "CADET_CLOUD_URL",
   "CADET_ASSISTANT_PLATFORM_URL",
   "CADET_DOCS_BASE_URL",
   "CADET_WEB_URL",
@@ -72,7 +72,7 @@ export const SAFE_ENV_VARS = [
   // QdrantManager into external mode and bypasses the local managed lifecycle.
   "QDRANT_HTTP_PORT",
   "IS_CONTAINERIZED",
-  "IS_PLATFORM",
+  "IS_CLOUD",
   "CADET_CLOUD",
   "CADET_SANDBOX_RUNTIME",
   "CADET_PROFILER_RUN_ID",

package/src/tools/tool-types.ts

@@ -330,8 +330,8 @@ export interface ToolContext {
    * the assistant narrows to the concrete `HostFileProxy` class.
    */
   hostFileProxy?: unknown;
-  /** True when the assistant is running as a platform-managed remote instance. Used to auto-approve sandboxed bash tools. */
-  isPlatformHosted?: boolean;
+  /** True when the assistant is running as a cloud-managed remote instance. Used to auto-approve sandboxed bash tools. */
+  isCloudHosted?: boolean;
   /**
    * CES RPC client for credential execution operations. Held as `unknown`
    * here; the assistant narrows to the concrete `CesClient` class.

package/src/tools/types.ts

@@ -440,10 +440,10 @@ export interface ToolContext {
    */
   toolUseId?: string;
   /**
-   * True when the assistant is running as a platform-managed remote instance. Used to auto-approve sandboxed bash tools.
+   * True when the assistant is running as a cloud-managed remote instance. Used to auto-approve sandboxed bash tools.
    * @legacy
    */
-  isPlatformHosted?: boolean;
+  isCloudHosted?: boolean;
   /**
    * The interface ID of the connected client driving the current turn (e.g.
    * "macos", "chrome-extension"). Browser backend policy uses this to decide

package/src/tools/ui-surface/surface-shape-docs.ts

@@ -130,9 +130,9 @@ export const SURFACE_SHAPE_DOCS: Record<string, SurfaceShapeDoc> = {
         : "`data` must carry at least a summary, metrics, or sections",
   },
   oauth_connect: {
-    purpose: "managed OAuth connection button for an integration account",
+    purpose: "cloud OAuth connection button for an integration account",
     shape:
-      "{ providerKey, requestedScopes?, displayName?, description?, logoUrl? }: managed OAuth connection CTA; use when the task needs a managed integration account (Google, Linear, GitHub, ...) instead of settings or shell OAuth. requestedScopes is an optional FULL replacement set of OAuth scopes: when set, the connection is granted exactly these scopes instead of the platform defaults, so include every scope the connection should keep; omit it to use the platform's default scopes",
+      "{ providerKey, requestedScopes?, displayName?, description?, logoUrl? }: cloud OAuth connection CTA; use when the task needs a cloud integration account (Google, Linear, GitHub, ...) instead of settings or shell OAuth. requestedScopes is an optional FULL replacement set of OAuth scopes: when set, the connection is granted exactly these scopes instead of the cloud defaults, so include every scope the connection should keep; omit it to use the cloud's default scopes",
     missingContent: (data) =>
       isNonEmptyString(data.providerKey)
         ? null

package/src/tools/workflows/manage-workflows.ts

@@ -200,7 +200,7 @@ export async function executeManageWorkflows(
       // valid `profile` for `run_workflow` (an unknown profile throws).
       const { llm } = loadConfig();
       // A workflow leaf runs chat turns, so this is the conversation view,
-      // which leaves out the managed Jev profile.
+      // which leaves out the cloud Jev profile.
       const profiles = getConversationProfilesForProvider(llm);
       return {
         content: JSON.stringify({

package/src/tools/workspace-tools/loader.ts

@@ -711,7 +711,7 @@ async function reconcileWorkspaceTools(
     const tool = await loadDesiredLiveTool(stem, entry, importTimeoutMs);
     if (!tool) {
       // Import failed (already logged). Leave any prior registration intact
-      // and keep the managed entry so a later fix re-imports cleanly.
+      // and keep the cloud entry so a later fix re-imports cleanly.
       continue;
     }
 

package/src/tts/__tests__/cadet-provider.test.ts

@@ -7,7 +7,7 @@ let synthesizeCalls: Array<{
   signal?: AbortSignal;
 }> = [];
 
-mock.module("../../platform/managed-speech.js", () => ({
+mock.module("../../cloud/cloud-speech.js", () => ({
   managedSpeechSynthesize: async (input: {
     text: string;
     format: string;
@@ -97,7 +97,7 @@ describe("cadet TTS adapter", () => {
     expect(result.contentType).toBe("audio/mpeg");
   });
 
-  test("PCM hint maps to the platform's fixed 16 kHz PCM format", async () => {
+  test("PCM hint maps to the cloud's fixed 16 kHz PCM format", async () => {
     const provider = createCadetProvider();
     await provider.synthesize(request({ outputFormat: "pcm" }));
 
@@ -109,7 +109,7 @@ describe("cadet TTS adapter", () => {
     expect(provider.resolveOutputSampleRateHz?.(request())).toBeUndefined();
   });
 
-  test("forwards the abort signal to the platform call", async () => {
+  test("forwards the abort signal to the cloud call", async () => {
     const controller = new AbortController();
     const provider = createCadetProvider();
     await provider.synthesize(request({ signal: controller.signal }));
@@ -236,12 +236,12 @@ describe("cadet TTS definition", () => {
     expect(cadetTtsProviderDefinition.mediaStreamPlayback.outputFormat).toBe(
       "pcm",
     );
-    // True since managed voice selection: clients gate their voice dropdown
+    // True since cloud voice selection: clients gate their voice dropdown
     // on this flag (old daemons report false and show no selector).
     expect(cadetTtsProviderDefinition.supportsVoiceSelection).toBe(true);
   });
 
-  test("requires only the platform connection credential", () => {
+  test("requires only the cloud connection credential", () => {
     expect(cadetTtsProviderDefinition.secretRequirements).toEqual([
       {
         credentialStoreKey: "credential/cadet/assistant_api_key",

package/src/tts/provider-catalog.ts

@@ -54,7 +54,7 @@ const DEFINITIONS = {
 /**
  * Definitions in display order (e.g. settings dropdowns).
  */
-// cadet leads: it is the managed option, selected like any other provider.
+// cadet leads: it is the cloud option, selected like any other provider.
 const CATALOG: readonly TtsProviderDefinition[] = [
   DEFINITIONS.cadet,
   DEFINITIONS.elevenlabs,

package/src/tts/providers/cadet-provider.ts

@@ -1,5 +1,5 @@
 /**
- * Cadet-managed TTS: synthesis through the platform's managed speech
+ * Cadet Cloud TTS: synthesis through the cloud's cloud speech
  * surfaces (Cadet-held Deepgram key, billed to Cadet credits). No provider
  * API key exists on this machine — the cloud connection is the credential.
  *
@@ -15,12 +15,12 @@
  * messages rather than returning silence.
  */
 
-import { getConfig } from "../../config/loader.js";
 import {
-  type ManagedSpeechResult,
+  type CloudSpeechResult,
+  type CloudSpeechTtsFormat,
   managedSpeechSynthesize,
-  type ManagedSpeechTtsFormat,
-} from "../../platform/managed-speech.js";
+} from "../../cloud/cloud-speech.js";
+import { getConfig } from "../../config/loader.js";
 import {
   mapTunnelError,
   probeTunnelRejection,
@@ -41,42 +41,42 @@ const log = getLogger("cadet-tts");
 const TTS_STREAM_PATH = "/v1/speech/tts/stream";
 
 /**
- * The platform's PCM format is fixed at 16 kHz, 16-bit LE mono — the
+ * The cloud's PCM format is fixed at 16 kHz, 16-bit LE mono — the
  * media-stream transcoder needs to know the rate regardless of hints.
  */
 const CADET_PCM_SAMPLE_RATE_HZ = 16_000;
 
-type ManagedSpeechFailure = Extract<ManagedSpeechResult<never>, { ok: false }>;
+type CloudSpeechFailure = Extract<CloudSpeechResult<never>, { ok: false }>;
 
 /**
- * Map the synthesis request onto the platform's format vocabulary.
+ * Map the synthesis request onto the cloud's format vocabulary.
  *
  * The PCM hint (media-stream playback) maps to raw 16 kHz PCM for mu-law
  * transcoding; every other use case gets mp3.
  */
 function resolveManagedFormat(
   request: TtsSynthesisRequest,
-): ManagedSpeechTtsFormat {
+): CloudSpeechTtsFormat {
   return request.outputFormat === "pcm" ? "pcm_16000" : "mp3";
 }
 
 /**
- * The configured managed voice, if any. A request-level voiceId wins over
- * config; undefined means the platform's default voice.
+ * The configured cloud voice, if any. A request-level voiceId wins over
+ * config; undefined means the cloud's default voice.
  */
-function resolveManagedVoice(request: TtsSynthesisRequest): string | undefined {
+function resolveCloudVoice(request: TtsSynthesisRequest): string | undefined {
   return request.voiceId ?? getConfig().services.tts.providers.cadet.model;
 }
 
-function synthesisError(failure: ManagedSpeechFailure): Error {
+function synthesisError(failure: CloudSpeechFailure): Error {
   if (failure.code === "insufficient_balance") {
     return new Error(
-      "Cadet credits are exhausted — add funds to your Cadet account to continue using managed speech.",
+      "Cadet credits are exhausted — add funds to your Cadet account to continue using cloud speech.",
     );
   }
   if (failure.kind === "unavailable") {
     return new Error(
-      `Managed speech is unavailable: ${failure.message} Run 'assistant cloud connect' to connect your Cadet account.`,
+      `Cloud speech is unavailable: ${failure.message} Run 'assistant cloud connect' to connect your Cadet account.`,
     );
   }
   return new Error(failure.message);
@@ -88,7 +88,7 @@ async function performSynthesis(
   const result = await managedSpeechSynthesize({
     text: request.text,
     format: resolveManagedFormat(request),
-    model: resolveManagedVoice(request),
+    model: resolveCloudVoice(request),
     signal: request.signal,
   });
   if (!result.ok) {
@@ -119,7 +119,7 @@ async function performStreamingSynthesis(
   const connection = await resolveSpeechRelayConnection();
   if (!connection) {
     throw new Error(
-      "Managed speech is unavailable: the assistant cannot reach its speech relay. Run 'assistant cloud connect' to connect your Cadet account.",
+      "Cloud speech is unavailable: the assistant cannot reach its speech relay. Run 'assistant cloud connect' to connect your Cadet account.",
     );
   }
 
@@ -131,7 +131,7 @@ async function performStreamingSynthesis(
     // consumes headerless PCM, so RIFF header bytes would play as static.
     container: "none",
   });
-  const voice = resolveManagedVoice(request);
+  const voice = resolveCloudVoice(request);
   if (voice) {
     params.set("model", voice);
   }
@@ -196,7 +196,7 @@ export function createCadetProvider(): TtsProvider {
     id: "cadet",
     capabilities,
     // Per the TtsProvider contract this returns undefined for non-PCM
-    // output; the platform's PCM format is pinned to 16 kHz.
+    // output; the cloud's PCM format is pinned to 16 kHz.
     resolveOutputSampleRateHz: (request) =>
       request.outputFormat === "pcm" ? CADET_PCM_SAMPLE_RATE_HZ : undefined,
     synthesize: performSynthesis,
@@ -205,7 +205,7 @@ export function createCadetProvider(): TtsProvider {
 }
 
 /**
- * The complete Cadet managed provider definition — catalog metadata plus
+ * The complete Cadet Cloud provider definition — catalog metadata plus
  * the runtime adapter — assembled into the canonical catalog by
  * `provider-catalog.ts`.
  */
@@ -214,14 +214,14 @@ export const cadetTtsProviderDefinition: TtsProviderDefinition = {
   displayName: "Cadet",
   subtitle:
     "Text-to-speech through your Cadet account — billed to Cadet credits, no separate API key needed.",
-  // Advertises managed voice selection (`services.tts.providers.cadet.model`)
+  // Advertises cloud voice selection (`services.tts.providers.cadet.model`)
   // to clients; web gates its voice dropdown on this flag, so daemons that
   // predate the field never show a selector whose writes they would ignore.
   supportsVoiceSelection: true,
   apiKeyPlaceholder: "Connected via your Cadet account",
   credentialsGuide: {
     description:
-      "Connect this assistant to your Cadet account; managed speech uses that connection instead of a provider API key.",
+      "Connect this assistant to your Cadet account; cloud speech uses that connection instead of a provider API key.",
     url: "https://cloud.mycadet.ai/",
     linkLabel: "Open Cadet Cloud",
   },
@@ -231,7 +231,7 @@ export const cadetTtsProviderDefinition: TtsProviderDefinition = {
     supportsStreaming: true,
     supportedFormats: ["mp3", "pcm"],
   },
-  // The adapter honours the PCM hint via the platform's pcm_16000 format.
+  // The adapter honours the PCM hint via the cloud's pcm_16000 format.
   mediaStreamPlayback: { outputFormat: "pcm" },
   secretRequirements: [
     {

package/src/tts/providers/cadet-tts-socket.ts

@@ -1,5 +1,5 @@
 /**
- * Cadet managed TTS WebSocket streaming session.
+ * Cadet Cloud TTS WebSocket streaming session.
  *
  * Runs a single-utterance synthesis session against the gateway's managed
  * speech relay (`/v1/speech/tts/stream`, gateway → tunnel → Deepgram; tunnel
@@ -100,7 +100,7 @@ export interface CadetTtsSocketOptions extends StreamReadTimeouts {
 }
 
 /**
- * Synthesize one utterance over the managed speech relay, resolving with
+ * Synthesize one utterance over the cloud speech relay, resolving with
  * the complete audio. Binary chunks are forwarded to `onChunk` as they
  * arrive. Abort sends `Clear` (barge-in: discard buffered synthesis)
  * before closing the socket.

package/src/tts/tts-config-resolver.ts

@@ -36,7 +36,7 @@ export interface ResolvedTtsConfig {
  *
  * `providerOverride` selects a provider other than the configured one and
  * returns that provider's config block — used by callers that resolve the
- * provider themselves (e.g. live voice, which runs on the managed-speech
+ * provider themselves (e.g. live voice, which runs on the cloud-speech
  * effective provider).
  */
 export function resolveTtsConfig(

package/src/tts/tts-voice-field.ts

@@ -4,8 +4,8 @@
  *
  * A voice change (the `voice_config_update` tool's `tts_voice_id` setting and
  * the `assistant tts voice` CLI command) must write to the entry for the
- * *active* provider — a managed (cadet) assistant's voice is a Deepgram Aura
- * model id (or an ElevenLabs voice id, since managed speech serves both) at
+ * *active* provider — a cloud (cadet) assistant's voice is a Deepgram Aura
+ * model id (or an ElevenLabs voice id, since cloud speech serves both) at
  * `.cadet.model`, not an ElevenLabs voice id at `.elevenlabs.voiceId`.
  * Writing the wrong field is a silent no-op: the write "succeeds" but the
  * active provider keeps its old voice.
@@ -32,7 +32,7 @@ export const TTS_VOICE_FIELD_BY_PROVIDER: Record<string, TtsVoiceField> = {
   },
   cadet: {
     path: "services.tts.providers.cadet.model",
-    label: "Cadet managed voice",
+    label: "Cadet Cloud voice",
     alphanumericOnly: false,
   },
   deepgram: {

package/src/usage/subagent-attribution.ts

@@ -43,7 +43,7 @@ const cache = new Map<string, SubagentAttribution>();
  *
  * Never throws. This runs on the provider dispatch hot path and attribution
  * must never be able to take a model request down. Any failure degrades to
- * "no attribution", which is exactly how the platform treats a missing header.
+ * "no attribution", which is exactly how the cloud treats a missing header.
  */
 export function resolveSubagentAttribution(
   conversationId: string | undefined,

package/src/util/__tests__/process-table.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  dropProcessTableSelfRows,
   parsePsProcessTable,
   parseWindowsProcessTable,
 } from "../process-table.js";
@@ -64,3 +65,49 @@ describe("parseWindowsProcessTable", () => {
     ).toEqual([{ pid: 100, ppid: 4, command: "worker.exe" }]);
   });
 });
+
+describe("dropProcessTableSelfRows", () => {
+  test("drops the ps enumeration's own row", () => {
+    const rows = [
+      { pid: 1, ppid: 0, command: "/sbin/launchd" },
+      { pid: 100, ppid: 42, command: "ps -A -ww -o pid=,ppid=,command=" },
+      { pid: 101, ppid: 42, command: "bun run /app/daemon/main.ts" },
+    ];
+    expect(dropProcessTableSelfRows(rows)).toEqual([
+      { pid: 1, ppid: 0, command: "/sbin/launchd" },
+      { pid: 101, ppid: 42, command: "bun run /app/daemon/main.ts" },
+    ]);
+  });
+
+  test("drops the PowerShell enumeration's own row case-insensitively", () => {
+    const rows = [
+      {
+        pid: 50,
+        ppid: 4,
+        command: "C:\\Program Files\\Bun\\bun.exe worker.ts",
+      },
+      {
+        pid: 51,
+        ppid: 50,
+        command:
+          "PowerShell.exe -NoProfile -NonInteractive -Command Get-CimInstance Win32_Process | ConvertTo-Json",
+      },
+    ];
+    expect(dropProcessTableSelfRows(rows)).toEqual([
+      {
+        pid: 50,
+        ppid: 4,
+        command: "C:\\Program Files\\Bun\\bun.exe worker.ts",
+      },
+    ]);
+  });
+
+  test("keeps ordinary processes — a bare ps invocation without the enumeration args is a real process", () => {
+    const rows = [
+      { pid: 60, ppid: 4, command: "ps" },
+      { pid: 61, ppid: 4, command: "ps aux" },
+      { pid: 62, ppid: 4, command: "qdrant" },
+    ];
+    expect(dropProcessTableSelfRows(rows)).toEqual(rows);
+  });
+});

package/src/util/canonicalize-identity.ts

@@ -7,7 +7,7 @@
  *
  * Phone-like channels (voice, whatsapp) normalize to E.164 using the
  * existing phone utilities. Email channels are lowercased (RFC 5321).
- * Other channels (telegram, slack, etc.) pass through the platform-stable
+ * Other channels (telegram, slack, etc.) pass through the cloud-stable
  * ID as-is after whitespace trimming.
  */
 

package/src/util/cgroup-cpu.ts

@@ -9,7 +9,7 @@
 import { readFileSync } from "node:fs";
 import { availableParallelism, cpus } from "node:os";
 
-import { getCpuLimit, getIsPlatform } from "../config/env-registry.js";
+import { getCpuLimit, getIsCloud } from "../config/env-registry.js";
 import { parseKeyedCounts } from "./cgroup-memory.js";
 
 export interface ContainerCpuStat {
@@ -78,7 +78,7 @@ export function parseK8sCpuCores(value: string): number | null {
  * 4. os.cpus().length as last resort.
  */
 export function getContainerCpuCores(): number {
-  // 1. Prefer the explicit env var set by the platform StatefulSet template.
+  // 1. Prefer the explicit env var set by the cloud StatefulSet template.
   try {
     const envLimit = getCpuLimit();
     if (envLimit) {
@@ -101,8 +101,8 @@ export function getContainerCpuCores(): number {
       if (!isNaN(quota) && !isNaN(period) && period > 0 && quota > 0) {
         const cores = quota / period;
         // Sanity check: if the value looks like the node's full CPU count
-        // and we're on a platform pod, it's likely gVisor leaking the host value.
-        if (cores < cpus().length * 0.9 || !getIsPlatform()) {
+        // and we're on a cloud pod, it's likely gVisor leaking the host value.
+        if (cores < cpus().length * 0.9 || !getIsCloud()) {
           return cores;
         }
       }
@@ -123,7 +123,7 @@ export function getContainerCpuCores(): number {
     );
     if (!isNaN(quota) && !isNaN(period) && period > 0 && quota > 0) {
       const cores = quota / period;
-      if (cores < cpus().length * 0.9 || !getIsPlatform()) {
+      if (cores < cpus().length * 0.9 || !getIsCloud()) {
         return cores;
       }
     }

package/src/util/cgroup-memory.ts

@@ -1,5 +1,5 @@
 /**
- * Container memory accounting read from cgroup files (and the platform
+ * Container memory accounting read from cgroup files (and the cloud
  * `CADET_MEMORY_LIMIT` override).
  *
  * Shared by the `/v1/health` identity handler (which reports current + max) and
@@ -36,7 +36,7 @@ function readCgroupInt(path: string): number | null {
  * by the StatefulSet template to the exact K8s memory limit (e.g. "3Gi").
  */
 export function getContainerMemoryLimitBytes(): number | null {
-  // 1. Prefer the explicit env var set by the platform StatefulSet template.
+  // 1. Prefer the explicit env var set by the cloud StatefulSet template.
   try {
     const envLimit = process.env.CADET_MEMORY_LIMIT;
     if (envLimit) {

package/src/util/container-cpu-sampler.ts

@@ -9,7 +9,7 @@
 
 import { readFileSync } from "node:fs";
 
-import { getIsPlatform } from "../config/env-registry.js";
+import { getIsCloud } from "../config/env-registry.js";
 import { getContainerCpuCores } from "./cgroup-cpu.js";
 
 /**
@@ -122,7 +122,7 @@ function runCpuSamplerTick(now: number): void {
   }
 
   // Always sample process-level CPU so the baseline stays fresh. This
-  // prevents a spike if the platform cgroup path later falls back to
+  // prevents a spike if the cloud cgroup path later falls back to
   // process.cpuUsage() after cgroup stats were previously available.
   const newProcessUsage = sampleProcessCpuUsage();
   const processDeltaUs =
@@ -135,7 +135,7 @@ function runCpuSamplerTick(now: number): void {
     _lastProcessCpuUsage = newProcessUsage;
   }
 
-  if (getIsPlatform()) {
+  if (getIsCloud()) {
     // In platform mode, prefer cgroup-level CPU usage so we see the full
     // container footprint, not just this process.
     const cgroupUs = getContainerCpuUsageUs();
@@ -155,7 +155,7 @@ function runCpuSamplerTick(now: number): void {
     }
     _lastCgroupCpuUs = cgroupUs;
   } else if (processDeltaUs !== null) {
-    // Non-platform: use process.cpuUsage() (accurate for single-process mode).
+    // Non-cloud: use process.cpuUsage() (accurate for single-process mode).
     setCachedCpuPercent(
       computeCpuPercent(processDeltaUs, elapsedMs, numCores),
       now,

package/src/util/disk-usage.ts

@@ -3,8 +3,8 @@ import { existsSync, statfsSync } from "node:fs";
 import { promisify } from "node:util";
 
 import {
+  getIsCloud,
   getIsContainerized,
-  getIsPlatform,
   getMinikubeStorageSize,
 } from "../config/env-registry.js";
 import { getWorkspaceDir } from "./platform.js";
@@ -85,7 +85,7 @@ export function __resetDiskUsageCacheForTests(): void {
  *   usage is measured with `du` and the effective capacity is current usage
  *   plus the host's remaining headroom.
  * - `none`: statfsSync already reports the volume accurately (bare metal, or
- *   a platform-managed instance on a CSI-backed PVC), so use it directly.
+ *   a cloud-managed instance on a CSI-backed PVC), so use it directly.
  */
 type WorkspaceVolumeReporting =
   | { kind: "none" }
@@ -101,7 +101,7 @@ type WorkspaceVolumeReporting =
 function classifyWorkspaceVolume(
   fsTotalBytes: number,
 ): WorkspaceVolumeReporting {
-  // Minikube mode: the platform passes the PVC storage size so we can report
+  // Minikube mode: the cloud passes the PVC storage size so we can report
   // accurate capacity. Detect the hostPath case by comparing filesystem size
   // against the PVC size — if the filesystem is larger, statfsSync is seeing
   // the host disk and we should measure the directory instead.
@@ -117,7 +117,7 @@ function classifyWorkspaceVolume(
   // Local Docker hatch: the workspace is a Docker named volume backed by the
   // host filesystem. Platform-managed remote instances run on CSI-backed PVCs
   // where statfsSync already reports the volume, so they are excluded.
-  if (getIsContainerized() && !getIsPlatform()) {
+  if (getIsContainerized() && !getIsCloud()) {
     return { kind: "host-free" };
   }
 

package/src/util/errors.ts

@@ -129,14 +129,14 @@ export type ProviderCredentialSource =
   | "byok"
   | "no-auth"
   | "oauth-subscription"
-  | "cadet-managed";
+  | "cadet-cloud";
 
 export interface ProviderRouteAttribution {
   connectionName?: string;
   profileName?: string;
-  isManagedRoute?: boolean;
+  isCloudRoute?: boolean;
   /**
-   * Credential surface used for this request. Finer than `isManagedRoute`:
+   * Credential surface used for this request. Finer than `isCloudRoute`:
    * it separates personal provider keys, keyless endpoints, and subscription
    * logins from each other so error copy can name what the user must fix.
    */

package/src/util/oom-priority.ts

@@ -13,7 +13,7 @@
  * through the desktop session's spawn wrapper, workers and Qdrant through a
  * parent-side write right after spawn. Raising a value never needs a
  * capability; lowering one below the inherited value needs CAP_SYS_RESOURCE,
- * which the platform grants and self-hosted Docker (non-root) does not. There
+ * which the cloud grants and self-hosted Docker (non-root) does not. There
  * the daemon stays at 0, which children at +1000 still lose to.
  */
 

package/src/util/platform.ts

@@ -52,7 +52,7 @@ export function getExtraToolPathDirs(): string[] {
 }
 
 /**
- * Add missing `dirs` to the PATH entry of `env` in place, using the platform
+ * Add missing `dirs` to the PATH entry of `env` in place, using the cloud
  * delimiter. Windows keys the variable as `Path`, so the existing key is
  * matched case-insensitively rather than assuming `PATH`.
  */
@@ -306,7 +306,7 @@ export function getProcDir(name: string): string {
   return join(getProcsDir(), name);
 }
 
-/** Create (if needed) and return a managed subprocess's runtime directory. */
+/** Create (if needed) and return a cloud subprocess's runtime directory. */
 export function ensureProcDir(name: string): string {
   const dir = getProcDir(name);
   mkdirSync(dir, { recursive: true });
@@ -314,7 +314,7 @@ export function ensureProcDir(name: string): string {
 }
 
 /**
- * The IPC socket a managed subprocess binds and the daemon connects to
+ * The IPC socket a cloud subprocess binds and the daemon connects to
  * (`procs/<name>/ipc.sock`). The basename is fixed — the directory already
  * carries the subprocess name. Keep it short: Unix `sun_path` is ~104–108 bytes.
  */
@@ -322,7 +322,7 @@ export function getProcSocketPath(name: string): string {
   return join(getProcDir(name), "ipc.sock");
 }
 
-/** The PID file a managed subprocess writes on readiness (`procs/<name>/<name>.pid`). */
+/** The PID file a cloud subprocess writes on readiness (`procs/<name>/<name>.pid`). */
 export function getProcPidPath(name: string): string {
   return join(getProcDir(name), `${name}.pid`);
 }
@@ -501,7 +501,7 @@ export function getWorkspaceSystemPromptDir(): string {
   return join(getWorkspaceDir(), "prompts", "system");
 }
 
-// Managed profiler runs live under <workspace>/data/profiler/. These
+// Cloud profiler runs live under <workspace>/data/profiler/. These
 // helpers enforce a single canonical layout so every runtime caller
 // resolves the same paths.